Re: Policy for Abandoned Extensions

Maybe we can add "end-of-life" versions to extensions?

So if we have versions x.y.z-alpha and x.y.z-beta before x.y.z , maybe we
can also have x.y.z-abandoned and/or x.y.z-unmaintained at the other end?

So anyone installing such will habe better chance to notice.

And we could make them als sort after normal versions in
postgres_debversion and pg_debver :)

---
Hannu

On Sat, Oct 10, 2026 at 8:02 PM Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:

> Joe Conway <mail(at)joeconway(dot)com> writes:
> > It may be impractical, but given cases like the XZ Utils backdoor
> > situation (i.e where a malicious person showed up offering to "help"
> > maintain an open source project where the original maintainer was
> > stepping away), it seems like any transfer process needs a vetting step.
>
> Yeah, if the replacement maintainer is malicious or even merely
> incompetent, things could be worse than leaving the extension alone.
> But that wasn't on David's list of worries, so I imagine he thinks
> that's a soluble problem.
>
> regards, tom lane
>
>
>