public inbox for [email protected]  

help / color / mirror / Atom feed

From: Noah Misch <[email protected]>
To: Bruce Momjian <[email protected]>
Cc: PostgreSQL-development <[email protected]>
Subject: Re: PG 18 release notes draft committed
Date: Wed, 4 Jun 2025 14:29:46 -0700
Message-ID: <[email protected]> (raw)
In-Reply-To: <[email protected]>
References: <[email protected]>
	<[email protected]>
	<[email protected]>

On Wed, Jun 04, 2025 at 04:45:18PM -0400, Bruce Momjian wrote:
> On Tue, Jun  3, 2025 at 10:21:23AM -0700, Noah Misch wrote:
> > When a commit changes the user that runs a function in existing queries, I
> > think that almost always needs a release notes entry.  It would follow that
> > commit 01463e1 needs an entry.  I recommend text "Run each deferred trigger as
> > the role that caused the trigger to fire."

> There are two questions --- should it be mentioned in the release notes,
> and should it be listed in the incompatibility section.
> 
> It is called a bug fix, which I think means it is just implementing a
> behavior that users already expected.  (Yes, there is a doc addition to
> clarify this.)  I thought it was an edge case that didn't warrant
> mention in the release notes, and the rare cases would be caught in
> application testing.
> 
> Now, if we do want to mention it, it should be done in a way that makes
> it clear to readers whether they are affected by this change.  We can
> try text like:
> 
> 	Execute non-SECURITY-DEFINER AFTER triggers as the role that was
> 	active at the time the trigger was fired
> 	
> 	Previously such triggers were run as the role that was active at
> 	commit time.

I agree with David G. Johnston's feedback on this.  My draft didn't mention
SECURITY DEFINER, because I consider it redundant from a user's perspective.
If a function is SECURITY DEFINER, that always overrides other sources of user
identity.  No need to mention it each time.

That said, I'm not too picky about the exact wording.  The way you have it
wouldn't bother me.

> Seems like this would be in the incompatibility section, if we want to
> add it.

Works for me.

view thread (147+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected]
  Subject: Re: PG 18 release notes draft committed
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox