PostgreSQL 14.3, 13.7, 12.11, 11.16, and 10.21 Released!

The PostgreSQL Global Development Group has released an update to all supported
versions of PostgreSQL, including 14.3, 13.7, 12.11, 11.16, and 10.21. This
release fixes over 50 bugs reported over the last three months. This release
closes one security vulnerability and fixes over 50 bugs reported over the last
three months.

We encourage you to install this update at your earliest possible convenience.

If you have any GiST indexes on columns using the
[`ltree`](https://www.postgresql.org/docs/current/ltree.html) data type,
you will need to [reindex](https://www.postgresql.org/docs/current/sql-reindex.html)
them after upgrading.

For the full list of changes, please review the
[release notes](https://www.postgresql.org/docs/release/).

PostgreSQL 10 EOL Notice
------------------------

PostgreSQL 10 will stop receiving fixes on November 10, 2022. If you are
running PostgreSQL 10 in a production environment, we suggest that you make
plans to upgrade to a newer, supported version of PostgreSQL. Please see our
[versioning policy](https://www.postgresql.org/support/versioning/) for more
information.

Security Issues
---------------

### [CVE-2022-1552](https://www.postgresql.org/support/security/CVE-2022-1552/): Autovacuum, REINDEX, and others omit "security restricted operation" sandbox.

Versions Affected: 10 - 14. The security team typically does not test
unsupported versions, but this problem is quite old.

Autovacuum, `REINDEX`, `CREATE INDEX`, `REFRESH MATERIALIZED VIEW`, `CLUSTER`,
and `pg_amcheck` made incomplete efforts to operate safely when a privileged
user is maintaining another user's objects. Those commands activated relevant
protections too late or not at all. An attacker having permission to create
non-temp objects in at least one schema could execute arbitrary SQL functions
under a superuser identity.

While promptly updating PostgreSQL is the best remediation for most users, a
user unable to do that can work around the vulnerability by disabling
autovacuum, not manually running the above commands, and not restoring from
output of the `pg_dump` command. Performance may degrade quickly under this
workaround. `VACUUM` is safe, and all commands are fine when a trusted user
owns the target object.

The PostgreSQL project thanks Alexander Lakhin for reporting this problem.

Bug Fixes and Improvements
--------------------------

This update fixes over 50 bugs that were reported in the last several months.
The issues listed below affect PostgreSQL 14. Some of these issues may also
affect other supported versions of PostgreSQL.

Included in this release:

* Fix issue that could lead to corruption of GiST indexes on
[`ltree`](https://www.postgresql.org/docs/current/ltree.html) columns. After
upgrading, you will need to [reindex](https://www.postgresql.org/docs/current/sql-reindex.html)
any GiST indexes on [`ltree`](https://www.postgresql.org/docs/current/ltree.html)
columns.
* Column names in tuples produced by a whole-row variable (e.g. `tbl.*`) outside
of a top-level of a `SELECT` list are now always associated with those of the
associated named composite type, if there is one. The
[release notes](https://www.postgresql.org/docs/release/) detail a workaround if
you depend on the previous behavior.
* Fix incorrect rounding when extracting epoch values from `interval` types.
* Prevent issues with calling `pg_stat_get_replication_slot(NULL)`.
* Fix incorrect output for types `timestamptz` and `timetz` in
`table_to_xmlschema()`.
* Fix errors related to a planner issue that affected asynchronous remote
queries.
* Fix planner failure if a query using `SEARCH` or `CYCLE` features contains a
duplicate common-table expression (`WITH`) name.
* Fix `ALTER FUNCTION` to support changing a function's parallelism property and
its `SET`-variable list in the same command.
* Fix incorrect sorting of table rows when using `CLUSTER` on an index whose
leading key is an expression.
* Prevent data loss if a system crash occurs shortly after a sorted GiST index
build.
* Fix risk of deadlock failures while dropping a partitioned index.
* Fix race condition between `DROP TABLESPACE` and checkpointing that could fail
to remove all dead files from the tablespace directory.
* Fix potential issue in crash recovery after a `TRUNCATE` command that overlaps
with a checkpoint.
* Re-allow `_` as the first character in a custom configuration parameter name.
* Fix `PANIC: xlog flush request is not satisfied` failure during standby
promotion when there is a missing WAL continuation record.
* Fix possibility of self-deadlock in hot standby conflict handling.
* Ensure that logical replication apply workers can be restarted when the server
is near the `max_sync_workers_per_subscription` limit.
* Disallow execution of SPI functions during PL/Perl function compilation.
* libpq now accepts root-owned SSL private key files, which matches the rules
the server has used since the 9.6 release.
* Re-allow `database.schema.table` patterns in
[`psql`](https://www.postgresql.org/docs/current/app-psql.html),
[`pg_dump`](https://www.postgresql.org/docs/current/app-pgdump.html), and
[`pg_amcheck`](https://www.postgresql.org/docs/current/app-pgamcheck.html).
* Several fixes for [`pageinspect`](https://www.postgresql.org/docs/current/pageinspect.html)
to improve overall stability.
* Disable batch insertion in [`postgres_fdw`](https://www.postgresql.org/docs/current/postgres-fdw.html)
when `BEFORE INSERT ... FOR EACH ROW` triggers exist on the foreign table.
* Update JIT code to work with LLVM 14.

This update also contains the tzdata release 2022a for DST law changes in
Palestine, plus historical corrections for Chile and Ukraine.

For the full list of changes available, please review the
[release notes](https://www.postgresql.org/docs/release/).

Updating
--------

All PostgreSQL update releases are cumulative. As with other minor releases,
users are not required to dump and reload their database or use `pg_upgrade` in
order to apply this update release; you may simply shutdown PostgreSQL and
update its binaries.

However, if you have any GiST indexes on columns using the
[`ltree`](https://www.postgresql.org/docs/current/ltree.html) data type,
you will need to [reindex](https://www.postgresql.org/docs/current/sql-reindex.html)
them after upgrading.

Users who have skipped one or more update releases may need to run additional,
post-update steps; please see the release notes for earlier versions for
details.

For more details, please see the
[release notes](https://www.postgresql.org/docs/release/).

Links
-----
* [Download](https://www.postgresql.org/download/)
* [Release Notes](https://www.postgresql.org/docs/release/)
* [Security](https://www.postgresql.org/support/security/)
* [Versioning Policy](https://www.postgresql.org/support/versioning/)
* [Follow @postgresql on Twitter](https://twitter.com/postgresql)