Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wWuay-002wDN-30 for pgsql-announce@arkaria.postgresql.org; Tue, 09 Jun 2026 11:26:13 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1wWuax-006dB1-29 for pgsql-announce@arkaria.postgresql.org; Tue, 09 Jun 2026 11:26:11 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wWuaw-006dAU-1p for pgsql-announce@lists.postgresql.org; Tue, 09 Jun 2026 11:26:10 +0000 Received: from mahout.postgresql.org ([2001:4800:3e1:1::227]) by makus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wWuas-00000001qH3-0wEU for pgsql-announce@lists.postgresql.org; Tue, 09 Jun 2026 11:26:09 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=postgresql.org; s=20171124; h=Message-ID:Date:Reply-To:From:To:Subject: MIME-Version:Content-Type:Sender:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:In-Reply-To:References; bh=DIT9tkUOuC/ndkwSTmrcJiLJ0Rwao7zBohFPx8mKe00=; b=vHpxQhQTbeZcbyYdfO689tWkkG BNIA4qiCmWVtTTfra2V+xoyopuZyWZF4+z+MCWTMASHxUJ7RirXgy2J8Gt9DjkiQdEao7rgjp8KAw tRY5jP3vjFPjEQgG2JbBXsxDENVy2hGqVv1y5ifUY2BtKx5enncdR8L88S/XiSr7TKN43W9pP+8sT 2hxpxN0kM7UKVKouQosBQrAyYdbt6fWbZjPaIuclmJm0SnbNvhZmQplYrGYc5kKCZ2fnRW/ROG7ED NdDyepxXb4Wolr7S6P+SSTeY865uB9R9W9M2f/Xx9wipM8cK9kt5gYHbMCVJTtIiQdp7A8oeceYeF bprisogw==; Received: from wrigleys.postgresql.org ([2a02:16a8:dc51::60]) by mahout.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wWuar-005z5b-0h for pgsql-announce@lists.postgresql.org; Tue, 09 Jun 2026 11:26:05 +0000 Received: from localhost ([127.0.0.1] helo=wrigleys.postgresql.org) by wrigleys.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1wWuap-00DWrs-2a for pgsql-announce@lists.postgresql.org; Tue, 09 Jun 2026 11:26:03 +0000 Content-Type: multipart/alternative; boundary="===============8741379719084010287==" MIME-Version: 1.0 Subject: PostgreSQL Anonymizer 3.1 : Introducing Local Differential Privacy To: PostgreSQL Announce From: Dalibo via PostgreSQL Announce Reply-To: damien.clochard@dalibo.com Date: Tue, 09 Jun 2026 11:25:24 +0000 Message-ID: <178100432407.1285956.14391588410993267145@wrigleys.postgresql.org> X-Auto-Response-Suppress: All Auto-Submitted: auto-generated X-pglister-tags: related,security X-pglister-tagsig: e352481478366b422e768c22dd91d5a5f67b8b4fd92724722fa2fe471e289bc1 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --===============8741379719084010287== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable _Eymoutiers, France, May 27th, 2026_ Dalibo is pleased to announce `PostgreSQL Anonymizer 3.1` introducing innov= ative data masking techniques to protect your data ! Enhanced Privacy Protection for Your Data ---------------------------------------------------------------------------= ----- `PostgreSQL Anonymizer` is an extension that hides or replaces personally identifiable information (PII) or commercially sensitive data from a Postgr= eSQL database. The extension offers 6 different masking strategies: * [Dynamic Masking] - Real-time data protection * [Static Masking] - Permanent data transformation * [Replica Masking] - Anonymized logical replication * [Backup Masking] - Privacy-protected database exports * [Masking Views] - Controlled data visibility * [Masking Data Wrappers] - Extended protection across systems Each strategy is complemented by an enhanced suite of Masking Functions, in= cluding advanced techniques such as: Substitution, Randomization, Faking, Pseudonym= ization, Partial Scrambling, Shuffling, Noise Addition and Generalization. The extension can be installed with Debian and RPM packages, an Ansible rol= e, a Docker image, etc. You can use it on most major DBaaS providers including : Alibab= a Cloud, Crunchy Bridge, Google Cloud SQL, IBM Cloud, Microsoft Azure Database, Neon= , Yandex It is also available on some Postgres forks such as EDB Advanced Postgres, = Greenplum and Yugabyte. See the [INSTALL] section of the documentation for more details! [Masking Functions]: https://postgresql-anonymizer.readthedocs.io/en/latest= /masking_functions/ [Backup Masking]: https://postgresql-anonymizer.readthedocs.io/en/latest/an= onymous_dumps/ [Static Masking]: https://postgresql-anonymizer.readthedocs.io/en/latest/st= atic_masking/ [Dynamic Masking]: https://postgresql-anonymizer.readthedocs.io/en/latest/d= ynamic_masking/ [Replica Masking]: https://postgresql-anonymizer.readthedocs.io/en/latest/r= eplica_masking/ [Masking Views]: https://postgresql-anonymizer.readthedocs.io/en/stable/mas= king_views/ [Masking Data Wrappers]: https://postgresql-anonymizer.readthedocs.io/en/st= able/masking_data_wrappers/ [INSTALL]: https://postgresql-anonymizer.readthedocs.io/en/latest/INSTALL/ Local Differential Privacy (LDP) ---------------------------------------------------------------------------= ----- **Local Differential Privacy** is a stronger approach to adding noise. Unli= ke the regular noise functions, LDP provides a formal mathematical guarantee: given the output, an observer cannot determine the original value with high confidence, no matter what auxiliary information they have. The strength of this guarantee is controlled by a parameter called **epsilon** -- a smaller epsilon means stronger privacy but less accuracy. This is particularly useful for **survey data** and **categorical values** (e.g. ratings, age brackets, answer choices) where you want to collect aggregate statistics while protecting individual responses. Currently LDP is achieved using the Generalized Randomized Response Mechani= sm (GRRM). Additional mechanisms may be introduced in the near future. Important Security Update ---------------------------------------------------------------------------= ----- Version 3.1 includes fixes for a critical vulnerability allowing users to gain superuser privileges under certains circumstances. The risk is very hi= gh on PostgreSQL 14 and on instances upgrades from PostgreSQL 14 and earlier. **All users should upgrade the extension to version 3.1 as soon as possible= .** If a quick upgrade is not possible, the workaround below can mitigate the r= isk: CREATE OR REPLACE FUNCTION anon.k_anonymity(relid regclass) RETURNS INTEGER AS $$ SELECT NULL::INTEGER $$ LANGUAGE SQL; For more details see [issue 640] (CVE-2026-9617). [issue 640]: https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/640 Acknowledgments ---------------------------------------------------------------------------= ----- This release includes code, bugfixes, documentation, code reviews and ideas from Adem Bencheikh Lehocine, Benoit Lobr=C3=A9au, Buut, and other [contrib= utors]. The Local Differential Privacy features are part of a larger research proje= ct named [DIFPRIPOS] aiming at integrating differential privacy mechanisms into PostgreSQL. This project is financed by ANR, the French National Resea= rch Agency. Many thanks to Jean-Fran=C3=A7ois Couchot and Cedric Eichler for co= ordination and oversight. [DIFPRIPOS]: https://anr.fr/Project-ANR-23-CE23-0032 We would also like to thanks the people at [Efluid] who helped us with their ideas, comments and testing. [Efluid]: https://www.efluid.com/ And also special thanks to the [PGRX] team for their amazing work! [contributors]: https://gitlab.com/dalibo/postgresql_anonymizer/-/blob/mast= er/AUTHORS.md [PGRX]: https://github.com/pgcentralfoundation/pgrx Join our community to improve data privacy! ---------------------------------------------------------------------------= ----- PostgreSQL Anonymizer is part of the [Dalibo Labs] initiative. It is mainly developed by [Damien Clochard]. This is an open project, contributions are welcome. We need your feedback a= nd ideas! Let us know what you think of this tool, how it fits your needs and what features are missing. If you want to help, you can find a list of [Junior Jobs]. [Junior Jobs]: https://gitlab.com/dalibo/postgresql_anonymizer/issues?label= _name%5B%5D=3DJunior+Jobs --===============8741379719084010287== Content-Type: text/html; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable PostgreSQL Anonymizer 3.1 : Introducing Local Differential Priva= cy
 

PostgreSQL Anonymizer 3.1 : Introducing Local Differential Privacy

Eymoutiers, France, May 27th, 2026=

Dalibo is pleased to announce Postgre= SQL Anonymizer 3.1 introducing innovative data masking techniques to protect your data !

Enhanced Privacy Protection for= Your Data

PostgreSQL Anonymizer is an ex= tension that hides or replaces personally identifiable information (PII) or commercially sensitive data from a Postgr= eSQL database.

The extension offers 6 different masking st= rategies:

Each strategy is complemented by an enhance= d suite of Masking Functions, including advanced techniques such as: Substitution, Randomization, Faking, Pseudonym= ization, Partial Scrambling, Shuffling, Noise Addition and Generalization.

The extension can be installed with Debian = and RPM packages, an Ansible role, a Docker image, etc. You can use it on most major DBaaS providers including : Alibab= a Cloud, Crunchy Bridge, Google Cloud SQL, IBM Cloud, Microsoft Azure Database, Neon= , Yandex It is also available on some Postgres forks such as EDB Advanced Postgres, = Greenplum and Yugabyte.

See the INSTALL section of the documentation for more detail= s!

Local Differential Privacy (LDP= )

Local Differential Privacy= is a stronger approach to adding noise. Unlike the regular noise functions, LDP provides a formal mathematical guarantee: given the output, an observer cannot determine the original value with high confidence, no matter what auxiliary information they have. The strength of this guarantee is controlled by a parameter called epsilon= -- a smaller epsilon means stronger privacy but less accuracy.

This is particularly useful for sur= vey data and categorical values (e.g. ratings, age brackets, answer choices) where you want to collect aggregate statistics while protecting individual responses.

Currently LDP is achieved using the General= ized Randomized Response Mechanism (GRRM). Additional mechanisms may be introduced in the near future.

Important Security Update

Version 3.1 includes fixes for a critical v= ulnerability allowing users to gain superuser privileges under certains circumstances. The risk is very hi= gh on PostgreSQL 14 and on instances upgrades from PostgreSQL 14 and earlier.<= /p>

All users should upgrade the extens= ion to version 3.1 as soon as possible.

If a quick upgrade is not possible, the wor= karound below can mitigate the risk:

CREATE OR REPLACE FUNCTION anon.k_anonymity(relid regclass)
RETURNS INTEGER AS $$ SELECT NULL::INTEGER $$ LANGUAGE SQL;

For more details see issue 640 (CVE-2026-9617).

Acknowledgments

This release includes code, bugfixes, docum= entation, code reviews and ideas from Adem Bencheikh Lehocine, Benoit Lobr=C3=A9au, Buut, and other contributors.

The Local Differential Privacy features are= part of a larger research project named DIFPRIPOS aiming at integrating dif= ferential privacy mechanisms into PostgreSQL. This project is financed by ANR, the French National Resea= rch Agency. Many thanks to Jean-Fran=C3=A7ois Couchot and Cedric Eichler for co= ordination and oversight.

We would also like to thanks the people at = Efluid who helped us with their ideas, comments and testing.

And also special thanks to the PGRX team for their amazing work!

Join our community to improve d= ata privacy!

PostgreSQL Anonymizer is part of the [Dalib= o Labs] initiative. It is mainly developed by [Damien Clochard].

This is an open project, contributions are = welcome. We need your feedback and ideas! Let us know what you think of this tool, how it fits your needs and what features are missing.

If you want to help, you can find a list of=
This email was sent to you from Dalibo. It was delivered on their behalf by the PostgreSQL project. Any questions about the content of the message shou= ld be sent to Dalibo.

You were sent this email as a subscriber of the pgsql-announce mai= linglist, for for one of the content tags Related Open Source or Security. To unsubscribe from further emails, or change which emails you want to receive, please click th= e personal unsubscribe link that you can find in the headers of this email, or visit https://lists.postgresql.org/unsubscribe/.

 
--===============8741379719084010287==--