MIME-Version: 1.0
From: Ashesh Vashi <ashesh.vashi@enterprisedb.com>
Date: Thu, 18 Jun 2026 20:21:17 +0530
Message-ID: 
 <CAG7mmozoW5rR6uqKb8-Ds53RMZa0mVwkUp81q6q0hn4=8mSr3A@mail.gmail.com>
Subject: pgAdmin 4 v9.16 Released
To: pgadmin-support <pgadmin-support@postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000c0e7780654884fbd"
Archived-At: 
 <https://www.postgresql.org/message-id/CAG7mmozoW5rR6uqKb8-Ds53RMZa0mVwkUp81q6q0hn4%3D8mSr3A%40mail.gmail.com>
Precedence: bulk

--000000000000c0e7780654884fbd
Content-Type: text/plain; charset="UTF-8"

The pgAdmin Development Team is pleased to announce pgAdmin 4 version 9.16.

This release of pgAdmin 4 includes 64 bug fixes and new features. For more
details please see the release notes at:

https://www.pgadmin.org/docs/pgadmin4/9.16/release_notes_9_16.html

pgAdmin is the leading Open Source graphical management tool for
PostgreSQL. For more information, please see:

https://www.pgadmin.org/

Notable changes in this release include:

*Features:*

* Add an option to colourize panel and tab headers based on the connected
server's colour, making it easier to tell which server a tab is connected
to at a glance.
* Add a "Back to login" link to the Forgot Password and Reset Password
pages.
* Add support for the TOAST tuple target storage parameter in the
Materialized View dialog.
* Make the init container security context in the Helm chart configurable
via containerSecurityContext, consistent with the main container.
* Add support for closing a tab with a middle-click on its title.
* Allow the OAuth2 login button icon to use any Font Awesome style (e.g.
fas fa-key), not only brand icons.

*Bugs/Housekeeping:*

* Fix SQL injection across sixteen dialog templates that rendered COMMENT
ON ... IS '<description>' and the related pgstattuple/pgstatindex stats
sinks; switches the affected templates to qtLiteral and rewrites the stats
calls to pass the relation OID via a ::oid::regclass cast (CVE-2026-12044).
* Fix the AI Assistant read-only transaction bypass that allowed
prompt-injected multi-statement payloads to commit out of the READ ONLY
wrapper and execute arbitrary SQL, chaining to RCE via COPY ... TO PROGRAM
on a superuser connection (CVE-2026-12045).
* Fix two SQL Editor endpoints (close and update_connection) missing the
@pga_login_required decorator, making them reachable without authentication
in server mode and exposing a pickle deserialization sink (CVE-2026-12046).
* Fix HTML injection in the cloud deployment module (RDS, Azure, Google)
where SDK exception text was forwarded to the browser unsanitised and
rendered through html-react-parser in the Cloud Wizard (CVE-2026-12047).
* Fix critical stored cross-site scripting where PostgreSQL server error
text and Explain plan-node content passed through html-react-parser across
notifier toasts, form errors, modal alerts, and the Explain visualiser;
under pgAdmin's default Content-Security-Policy, injected script ran
same-origin to the victim's session and could exfiltrate saved server
credentials and issue SQL against every connected server (CVE-2026-12048).
* Fix the open redirect in the multi-factor authentication flow via an
unvalidated next parameter (CVE-2026-12049).
* Fix SQL injection in the named restore point endpoint where the
user-supplied restore point name was interpolated into SQL via str.format()
instead of being passed as a bound parameter (CVE-2026-12050).
* Remove the administrator-role bypass from the server-access helpers so
the access-control checks added in 9.15 (CVE-2026-7813) are enforced
uniformly. The Administrator role manages pgAdmin itself, not other users'
database connections.
* Remove the EDB BigAnimal cloud deployment support, which was deprecated
in 9.15.
* Preserve jsonb number representation in the JSON editor so trailing
fractional zeros and large integers are no longer rewritten when saving
unmodified rows.
* Fix a View/Edit Data crash when the session contains a transaction object
that is not filter-capable (e.g. left by the Query Tool or persisted by an
older version), which could prevent the desktop application from loading
after an upgrade.
* Rebase the version-specific SQL templates so the default targets
PostgreSQL 14, the oldest supported server version, dropping the obsolete
sub-14 template buckets.
* Strip the foreign-architecture slice from the macOS bundle so single-arch
builds no longer ship the universal2 Python framework's unused arm64/x86_64
code.
* Bump Electron in the desktop runtime to 42.3.3 and pin the packaged
Electron version, bump cryptography to 49.0 and other Python and JavaScript
dependencies via the dependabot batch.
* Update the Italian translation.

Builds for Windows and macOS are available now, along with a Python Wheel,
Docker Container, RPM, DEB Package, and source code tarball from:
https://www.pgadmin.org/download/

*Deprecation Notice: pgAgent*

pgAgent has been deprecated and will be discontinued. The pgAgent will be
removed from the website within one month. Support for pgAgent within
pgAdmin will be removed in a future release approximately six months from
now.
Users are encouraged to migrate to an alternative job scheduling solution
before support is removed.

---
Ashesh Vashi

pgAdmin Project

--000000000000c0e7780654884fbd
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div>The pgAdmin Development Team is plea=
sed to announce pgAdmin 4 version 9.16.<br><br>This release of pgAdmin 4 in=
cludes 64 bug fixes and new features. For more details please see the relea=
se notes at:<br><br><a href=3D"https://www.pgadmin.org/docs/pgadmin4/9.16/r=
elease_notes_9_16.html" target=3D"_blank">https://www.pgadmin.org/docs/pgad=
min4/9.16/release_notes_9_16.html</a><br><br>pgAdmin is the leading Open So=
urce graphical management tool for PostgreSQL. For more information, please=
 see:<br><br><a href=3D"https://www.pgadmin.org/" target=3D"_blank">https:/=
/www.pgadmin.org/</a><br><br>Notable changes in this release include:<br><b=
r><b>Features:</b><br><br>* Add an option to colourize panel and tab header=
s based on the connected server&#39;s colour, making it easier to tell whic=
h server a tab is connected to at a glance.<br>* Add a &quot;Back to login&=
quot; link to the Forgot Password and Reset Password pages.<br>* Add suppor=
t for the TOAST tuple target storage parameter in the Materialized View dia=
log.<br>* Make the init container security context in the Helm chart config=
urable via containerSecurityContext, consistent with the main container.<br=
>* Add support for closing a tab with a middle-click on its title.<br>* All=
ow the OAuth2 login button icon to use any Font Awesome style (e.g. fas fa-=
key), not only brand icons.<br><br><b>Bugs/Housekeeping:</b><br><br>* Fix S=
QL injection across sixteen dialog templates that rendered COMMENT ON ... I=
S &#39;&lt;description&gt;&#39; and the related pgstattuple/pgstatindex sta=
ts sinks; switches the affected templates to qtLiteral and rewrites the sta=
ts calls to pass the relation OID via a ::oid::regclass cast (CVE-2026-1204=
4).<br>* Fix the AI Assistant read-only transaction bypass that allowed pro=
mpt-injected multi-statement payloads to commit out of the READ ONLY wrappe=
r and execute arbitrary SQL, chaining to RCE via COPY ... TO PROGRAM on a s=
uperuser connection (CVE-2026-12045).<br>* Fix two SQL Editor endpoints (cl=
ose and update_connection) missing the @pga_login_required decorator, makin=
g them reachable without authentication in server mode and exposing a pickl=
e deserialization sink (CVE-2026-12046).<br>* Fix HTML injection in the clo=
ud deployment module (RDS, Azure, Google) where SDK exception text was forw=
arded to the browser unsanitised and rendered through html-react-parser in =
the Cloud Wizard (CVE-2026-12047).<br>* Fix critical stored cross-site scri=
pting where PostgreSQL server error text and Explain plan-node content pass=
ed through html-react-parser across notifier toasts, form errors, modal ale=
rts, and the Explain visualiser; under pgAdmin&#39;s default Content-Securi=
ty-Policy, injected script ran same-origin to the victim&#39;s session and =
could exfiltrate saved server credentials and issue SQL against every conne=
cted server (CVE-2026-12048).<br>* Fix the open redirect in the multi-facto=
r authentication flow via an unvalidated next parameter (CVE-2026-12049).<b=
r>* Fix SQL injection in the named restore point endpoint where the user-su=
pplied restore point name was interpolated into SQL via str.format() instea=
d of being passed as a bound parameter (CVE-2026-12050).<br>* Remove the ad=
ministrator-role bypass from the server-access helpers so the access-contro=
l checks added in 9.15 (CVE-2026-7813) are enforced uniformly. The Administ=
rator role manages pgAdmin itself, not other users&#39; database connection=
s.<br>* Remove the EDB BigAnimal cloud deployment support, which was deprec=
ated in 9.15.<br>* Preserve jsonb number representation in the JSON editor =
so trailing fractional zeros and large integers are no longer rewritten whe=
n saving unmodified rows.<br>* Fix a View/Edit Data crash when the session =
contains a transaction object that is not filter-capable (e.g. left by the =
Query Tool or persisted by an older version), which could prevent the deskt=
op application from loading after an upgrade.<br>* Rebase the version-speci=
fic SQL templates so the default targets PostgreSQL 14, the oldest supporte=
d server version, dropping the obsolete sub-14 template buckets.<br>* Strip=
 the foreign-architecture slice from the macOS bundle so single-arch builds=
 no longer ship the universal2 Python framework&#39;s unused arm64/x86_64 c=
ode.<br>* Bump Electron in the desktop runtime to 42.3.3 and pin the packag=
ed Electron version, bump cryptography to 49.0 and other Python and JavaScr=
ipt dependencies via the dependabot batch.<br>* Update the Italian translat=
ion.<br><br>Builds for Windows and macOS are available now, along with a Py=
thon Wheel, Docker Container, RPM, DEB Package, and source code tarball fro=
m:<br><a href=3D"https://www.pgadmin.org/download/" target=3D"_blank">https=
://www.pgadmin.org/download/</a><br><br><b>Deprecation Notice: pgAgent</b><=
br><br>pgAgent has been deprecated and will be discontinued. The pgAgent wi=
ll be removed from the website within one month. Support for pgAgent within=
 pgAdmin will be removed in a future release approximately six months from =
now.<br>Users are encouraged to migrate to an alternative job scheduling so=
lution before support is removed.<br><br>---<br>Ashesh Vashi<br><br></div><=
div>pgAdmin Project<br></div><div><div dir=3D"ltr" class=3D"gmail_signature=
" data-smartmail=3D"gmail_signature"><div dir=3D"ltr"><div><div dir=3D"ltr"=
><div style=3D"margin:0pt 0pt 8px"></div></div></div></div></div></div></di=
v>
</div>

--000000000000c0e7780654884fbd--