pg_dump dumps security labels on databases. Which makes sense. The problem is that they're dumped including the database name.
Which means that if you dump a database and restore it into a differently named one you'll either get a failure because the database does not exist, or worse you'll update the label of the wrong database.
So I think we need CURRENT_DATABASE (or similar) support for security labels on databases.
I won't have time to do anything about this anytime soon, but I think we should fix that at some point. Shall I put this on the todo? Or do we want to create an 'open items' page that's not major version specific?