Date: Sat, 16 Nov 2024 19:37:17 +0100
From: Christoph Berg <myon@debian.org>
To: Debian Security Team <team@security.debian.org>
Cc: PostgreSQL in Debian <pgsql-pkg-debian@lists.postgresql.org>
Subject: PostgreSQL security updates are re-wrapped
Message-ID: <ZzjmXdnFvda7jt_K@msg.df7cb.de>
References: <ZrTK7iruFyVK7nIy@msg.df7cb.de>
 <ZrXWwoCWoxhAtGRl@pisco.westfalen.local>
 <Zzjl6LOGMZnB9MZu@msg.df7cb.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <Zzjl6LOGMZnB9MZu@msg.df7cb.de>
Archived-At: 
 <https://www.postgresql.org/message-id/ZzjmXdnFvda7jt_K%40msg.df7cb.de>
Precedence: bulk

(I replied to the wrong old mail, the issue is in the current minor
releases, released 2024-11-14.)

Re: To Debian Security Team
> Re: Moritz Mühlenhoff
> > DSAs have been released, thanks!
> 
> Unfortunately there is an ABI change in the last minors that has
> greater impact than originally planned.
> 
> The effect is that some extensions need recompilation against the new
> version (after which they will no longer work with the old version).
> In Debian, timescaledb and, to a lesser extend, postgresql-16-age are
> affected, but both are only part of testing, not stable.
> 
> (See https://qa.debian.org/excuses.php?package=postgresql-17 where the
> timescaledb problem shows up as regression.)
> 
> A new round of releases is planned for next week to revert that part.
> 
> Since we can't tell what 3rd-party extensions people are using with
> the Debian packages it would be prudent to release that update as a
> DSA update.
> 
> PostgreSQL is well aware that problems like that shouldn't happen and
> the already existing ABI checking will be done even stricter in the
> future, both manually and automated.
> 
> Sorry for the trouble,
> Christoph

Christoph