diff --git a/doc/src/sgml/release-17.sgml b/doc/src/sgml/release-17.sgml
index 207d42713c6..1d8ecbe156e 100644
--- a/doc/src/sgml/release-17.sgml
+++ b/doc/src/sgml/release-17.sgml
@@ -1,6 +1,1956 @@
+
+ Release 17.11
+
+
+ Release date:
+ 2026-08-13
+
+
+
+ This release contains a variety of fixes from 17.10.
+ For information about new features in major release 17, see
+ .
+
+
+
+ Migration to Version 17.11
+
+
+ A dump/restore is not required for those running 17.X.
+
+
+
+ However, if you are upgrading from a version earlier than 17.6,
+ see .
+
+
+
+
+ Changes
+
+
+
+
+
+
+ Fix mis-handling of asynchronous reads when rescanning an
+ asynchronous Append plan node (Alexander Korotkov, Gleb Kashkin,
+ Etsuro Fujita)
+ §
+
+
+
+ When an upper plan node rescans an Append before having read the
+ entire Append output, we need to discard any in-flight requests sent
+ to external servers (by postgres_fdw for
+ example). This was not done correctly in cases where a subplan has
+ parameter changes or is discarded by partition pruning in the next
+ scan. The outcome could be incorrect query results, an infinite
+ loop, or an assertion failure.
+
+
+
+
+
+
+ Fix error in partition pruning for RANGE-partitioned tables
+ (David Rowley)
+ §
+
+
+
+ In some cases the DEFAULT partition would be skipped when it should
+ not be, which could lead to rows missing from query results.
+
+
+
+
+
+
+ Fix planner's nullability and strictness checks
+ for value IN
+ (array) expressions
+ (Ayush Tiwari)
+ §
+
+
+
+ These checks should only succeed if the array operand is known to be
+ non-empty, but that consideration was missed, allowing optimizations
+ to be applied that should not be. This could result in wrong query
+ answers if the array actually was empty.
+
+
+
+
+
+
+ Fix incorrect join removal logic (Matheus Alcantara, Richard Guo)
+ §
+ §
+
+
+
+ In edge cases, it was possible for a constant output value coming
+ from within the nullable side of an outer join to not be replaced by
+ NULL when it should be.
+
+
+
+
+
+
+ Add missed checks for hashability of equality comparisons on
+ container datatypes (arrays, composites, ranges) (Andrei Lepikhov,
+ Tom Lane)
+ §
+
+
+
+ The planner must verify hashability of the container's component
+ type(s) before deciding it can use a hash-based plan type. This
+ step was missed in some places, leading to could not identify
+ a hash function failures at execution.
+
+
+
+
+
+
+ Fix mis-optimization of COUNT window functions
+ that have an EXCLUDE clause or
+ lack ORDER BY (Chengpeng Yan, David Rowley)
+ §
+
+
+
+ These window functions were treated as monotonic when they should
+ not be, allowing wrong answers to be computed.
+
+
+
+
+
+
+ Fix ALTER COLUMN ... DROP EXPRESSION to work when
+ there are multiple levels of partitions (Alberto Piai)
+ §
+
+
+
+
+
+
+ Fix attaching partitions of indexes that are exclusion constraints
+ (Japin Li)
+ §
+
+
+
+ Notably, this oversight broke dump/restore of partitioned exclusion
+ constraints.
+
+
+
+
+
+
+ Disallow renaming a rule to _RETURN (Tom Lane)
+ §
+
+
+
+ That name is reserved for a view's ON SELECT
+ rule, but ALTER RULE allowed renaming other rules
+ to _RETURN, causing trouble later.
+
+
+
+
+
+
+ Fix missing lock release for role membership grants in DROP
+ OWNED BY (Jeff Davis)
+ §
+
+
+
+ This oversight resulted in a warning message, followed by retaining
+ a lock on the membership grant until the end of the transaction.
+
+
+
+
+
+
+ Fix failure of EXPLAIN when
+ deparsing SQL/JSON aggregates (Richard Guo)
+ §
+
+
+
+ Some plan structures resulted in invalid
+ JsonConstructorExpr underlying node type errors.
+
+
+
+
+
+
+ Fix use of REINDEX CONCURRENTLY with
+ a deferred uniqueness constraint (Nitin Motiani)
+ §
+
+
+
+ The transient index copy created during REINDEX
+ CONCURRENTLY was incorrectly marked as enforcing immediate
+ uniqueness, causing spurious reports of constraint violation.
+
+
+
+
+
+
+ Fix matching of localized month/day names
+ in to_date() (Heikki Linnakangas)
+ §
+
+
+
+ The matching logic misbehaved in cases where case-folding changes
+ the byte length of the string.
+
+
+
+
+
+
+ Fix incorrect NFC recomposition for Hangul U+11A7 (TBASE)
+ (Diego Frias, Michael Paquier)
+ §
+
+
+
+ This character was treated as a valid T syllable, which it is not,
+ and hence silently swallowed during normalization.
+
+
+
+
+
+
+ Avoid possible truncation of output lexemes in case-insensitive
+ synonym dictionaries (Jeff Davis)
+ §
+
+
+
+ If folding to lower case increased the byte length of a lexeme, it
+ was incorrectly truncated to its original byte length when emitted.
+
+
+
+
+
+
+ Defend against truncated UTF-8 characters in case-conversion logic
+ (Jeff Davis)
+ §
+
+
+
+
+
+
+ Fix typo in hash_record_extended() (Man Zeng)
+ §
+
+
+
+ The code failed to initialize the second isnull argument passed to
+ FunctionCallInvoke(). This is harmless for existing in-core
+ extended hash support functions, which will not examine that value.
+ However, extension-provided hash functions could be affected if they
+ inspect PG_ARGISNULL(1).
+
+
+
+
+
+
+ Fix pg_get_publication_tables() to not fail if
+ a publishable table is dropped concurrently (Bharath Rupireddy)
+ §
+
+
+
+
+
+
+ Prevent satisfies_hash_partition() from
+ crashing with VARIADIC NULL (Robert Haas)
+ §
+
+
+
+
+
+
+ Report invalid-weight errors more cleanly and consistently
+ in tsvector_filter() and allied functions
+ (Ewan Young)
+ §
+
+
+
+ In particular, report weight characters that are not printable ASCII
+ in octal form (\nnn),
+ as charout() would render them. This avoids
+ possibly producing an invalidly-encoded error message.
+
+
+
+
+
+
+ Fix mishandling of namespace nodes in xpath()
+ (Michael Paquier)
+ §
+ §
+
+
+
+ This fix avoids an unexpected could not copy node
+ error.
+
+
+
+
+
+
+ Fix jsonpath's .decimal method to
+ not throw a hard error for incorrect precision or scale (Ewan Young)
+ §
+ §
+
+
+
+ Silent mode should suppress these errors, but failed to.
+
+
+
+
+
+
+ Fix NULL-pointer crash when IS JSON or similar
+ constructs have an argument that is of string category but lacks a
+ cast to type text (Ayush Tiwari)
+ §
+
+
+
+ There are no such data types in
+ core PostgreSQL, but the problem is
+ reachable with some extension types.
+
+
+
+
+
+
+ Ensure that SQL/JSONON EMPTY / ON ERROR
+ DEFAULT values are coerced to the correct typmod (Ewan Young)
+ §
+
+
+
+ For example, the declared precision and scale of
+ a numeric target column were not applied to the default
+ value.
+
+
+
+
+
+
+ Avoid machine-dependent behavior when dividing the smallest
+ possible money value by -1 (Andrey Rachitskiy)
+ §
+
+
+
+
+
+
+ Fix crash after out-of-memory failure partway through creation of a
+ cache entry for a text search dictionary (Tom Lane)
+ §
+
+
+
+
+
+
+ Fix memory-safety bugs in processing of incorrect ispell/hunspell
+ dictionary files (Andrey Rachitskiy)
+ §
+
+
+
+
+
+
+ Prevent access to other sessions' temporary tables (Jim Jones,
+ Daniil Davydov, Alexander Korotkov)
+ §
+ §
+
+
+
+ Some code paths failed to prevent this, leading to silently wrong
+ (inconsistent) results.
+
+
+
+
+
+
+ Fix the order in which autovacuum processes databases
+ (Rustam Khamidullin)
+ §
+
+
+
+ It was unintentionally processing databases from lowest to highest
+ score, when it should be doing the reverse.
+
+
+
+
+
+
+ Fix memory leak in parallel vacuum worker processes (Baji Shaik)
+ §
+
+
+
+ Progress reports from a parallel worker leaked about 1kB per report,
+ with the waste accumulating for the life of the worker process.
+
+
+
+
+
+
+ Honor query cancel and vacuum delay during GIN index posting-tree
+ cleanup (Paul Kim, Alexander Korotkov)
+ §
+
+
+
+ The posting tree for a common value can be large, so that this
+ missed check could allow vacuum to run for a long time before
+ noticing an interrupt.
+
+
+
+
+
+
+ Fix possible mis-decoding of index tuples during GiST and SP-GiST
+ index-only scans (Peter Geoghegan)
+ §
+
+
+
+ This error could lead to emitting corrupted data from an index-only
+ scan plan. The only affected core opclass is GiST's range_ops, and
+ it could only fail if the range column were not the first index
+ column.
+
+
+
+
+
+
+ Ensure that the new last block of a bulk-extended table is added to
+ its free space map promptly (Jingtang Zhang)
+ §
+
+
+
+ An off-by-one error caused the last block of a multi-block table
+ extension to not be marked as free in the map. This would
+ eventually get corrected by vacuum, but meanwhile the space wouldn't
+ be used.
+
+
+
+
+
+
+ Avoid possible double-free or infinite error recovery loop in
+ resource cleanup during transaction abort (Tom Lane)
+ §
+
+
+
+
+
+
+ When creating directories, tolerate concurrent creation of the same
+ directory (Andrew Dunstan, Tom Lane)
+ §
+
+
+
+
+
+
+ Prevent creation of dangling object dependencies by acquiring a
+ shared lock on any object being depended on (Bertrand Drouvot)
+ §
+ §
+
+
+
+ The shared lock will conflict with any attempt to drop the
+ depended-on object, eliminating the race condition that formerly
+ existed. For example, if one session drops a schema (that appears
+ empty to it) concurrently with some other session creating a
+ function in that schema, previously both transactions could commit,
+ leaving an invalid function definition behind. Now, one transaction
+ or the other will fail.
+
+
+
+
+
+
+ Fix race condition in conflict detection
+ for SERIALIZABLE isolation mode
+ (Peter Geoghegan)
+ §
+
+
+
+ A conflict could be missed when examining an initially-empty btree
+ index, allowing failure of serializability due to improperly
+ allowing conflicting transactions to commit.
+
+
+
+
+
+
+ Fix race condition in ProcSignalBarrier code (Masahiko Sawada)
+ §
+
+
+
+ This error could result in processes getting stuck, typically after
+ reporting still waiting for backend with
+ PID nnnn to accept
+ ProcSignalBarrier.
+
+
+
+
+
+
+ Fix race conditions when a set of processes that belong to the same
+ lock group exit at the same time (Vlad Lesin)
+ §
+ §
+
+
+
+ These errors could lead to PANIC aborts, with messages such
+ as latch already owned. The issue does not normally
+ arise in regular parallel query, since the leader won't exit before
+ seeing its workers finish; but some extensions reach the problem.
+
+
+
+
+
+
+ Fix WAL logging of operations that clear bits in tables' visibility
+ maps (Melanie Plageman, Andres Freund)
+ §
+ §
+ §
+
+
+
+ Such VM changes were missed by the WAL summarizer, potentially
+ leading to incorrect incremental backups. We also failed to log
+ full-page images of such VM pages when needed, potentially allowing
+ torn page writes to go uncorrected. This could lead to misbehavior
+ later, such as wrong results from index-only scans.
+
+
+
+
+
+
+ Prevent WAL summarizer process from getting stuck at a timeline
+ switch (Robert Haas)
+ §
+ §
+
+
+
+
+
+
+ Fix race with timeline selection in logical decoding during standby
+ promotion (Bertrand Drouvot)
+ §
+ §
+
+
+
+ Logical decoding being performed on the standby could fail with
+ a requested WAL segment has already been removed
+ error. A repeat attempt would succeed, so there was no permanent
+ problem but there was an availability hazard.
+
+
+
+
+
+
+ Avoid exposing a WAL receiver's full connection string during timeline
+ jumps (Chao Li)
+ §
+
+
+
+ The pg_stat_wal_receiver view should show a
+ sanitized version of the connection string, without sensitive data.
+ But it transiently showed the full string when we re-use an existing
+ WAL receiver.
+
+
+
+
+
+
+ Use run-time checks, not just Asserts, to verify the correct number
+ of columns in tuples received during logical replication (Varik
+ Matevosyan)
+ §
+
+
+
+ A malicious or buggy publisher could send inconsistent numbers of
+ columns. While we could not find a scenario in which this would
+ have serious ill effects, extra caution seems warranted.
+
+
+
+
+
+
+ Clean up quoting of string parameters within constructed replication
+ commands (Tom Lane)
+ §
+
+
+
+ Various places that generate replication commands were not being
+ adequately careful about quoting replication slot names and other
+ parameters that need to be inserted into those commands. This could
+ result in unexpected syntax errors in those commands. In principle,
+ a crafted replication slot name could result in SQL injection; but
+ such a scenario seems very unlikely to occur in practice, since
+ replication operations can only be invoked by highly-privileged
+ users and there is no reason for them to use a slot name coming from
+ an untrustworthy source.
+
+
+
+
+
+
+ Fix logical decoding of empty prepared transactions (Masahiko Sawada)
+ §
+
+
+
+ A prepared transaction that did not cause any decodable updates could
+ result in sending COMMIT/ROLLBACK PREPARED to the
+ output plugin with no preceding PREPARE. For the
+ built-in subscriber this breaks replication, and other plugins will
+ probably not like it either.
+
+
+
+
+
+
+ Fix corruption of unlogged sequences after standby promotion
+ (Fujii Masao)
+ §
+
+
+
+ Previously, if an unlogged sequence was created on the primary and
+ replicated to a standby, accessing the sequence after promoting the
+ standby could fail with bad magic number in sequence
+ or related errors.
+
+
+
+
+
+
+ Fix cascading standby reconnect failure after archive fallback
+ (Marco Nenciarini)
+ §
+
+
+
+ A cascading standby could fail to reconnect to its upstream standby
+ with requested starting point ... is ahead of the WAL flush
+ position after falling back to archive recovery.
+
+
+
+
+
+
+ Do not try to clear
+ pg_database.dathasloginevt
+ locally on a standby server (Ayush Tiwari)
+ §
+
+
+
+ Event trigger cleanup tried to perform that action on standby
+ servers as well as the primary. That can't work on a standby,
+ and there's no need anyway since replay of the primary's database
+ change will soon fix it.
+
+
+
+
+
+
+ Avoid race condition while dropping obsolete replication slots
+ (Xuneng Zhou)
+ §
+
+
+
+ An incorrect unlock and log message could occur if another session
+ immediately re-used the dropped slot's shared-memory entry.
+
+
+
+
+
+
+ Avoid race condition while dropping ephemeral replication slots
+ (Zhijie Hou)
+ §
+
+
+
+ The slot-releasing code performed some additional updates to the
+ replication slot's shared-memory entry after releasing the slot.
+ This is unsafe since another session could immediately re-use the
+ dropped slot's shared-memory entry. Skip those updates in the case
+ of an ephemeral slot.
+
+
+
+
+
+
+ Fix stale progress reports during logical replication table
+ synchronization (Shinya Kato)
+ §
+
+
+
+ Previously, the pg_stat_progress_copy view
+ in the subscriber would continue to show the
+ initial COPY operation as active even after the
+ data copy had finished. The stale entry remained visible until
+ synchronization caught up with the publisher.
+
+
+
+
+
+
+ Clear base backup progress on backup failure (Chao Li)
+ §
+ §
+
+
+
+ Previously the pg_stat_progress_basebackup
+ view would continue to show a stale progress entry after a failure,
+ until the replication client
+ disconnected. pg_basebackup normally
+ disconnects immediately, but other clients might not.
+
+
+
+
+
+
+ Fix possible PANIC due to concurrent drop of pgstats entries
+ when track_functions is enabled (Sami Imseih,
+ Michael Paquier)
+ §
+ §
+ §
+
+
+
+
+
+
+ Clean up broken local pgstats entry after failing to obtain space for
+ the corresponding shared hashtable entry (Niall Newman)
+ §
+
+
+
+ Failure to do this led to a null-pointer dereference the next time
+ the local entry was used.
+
+
+
+
+
+
+ In PL/Perl, avoid NULL pointer
+ dereference crash when working with an
+ invalid PostgreSQL::InServer::ARRAY object (Xing Guo)
+ §
+
+
+
+
+
+
+ In PL/Python, properly check for errors
+ when working with sequence and mapping objects (Richard Guo)
+ §
+
+
+
+ Previously, a broken object or an unhandled exception could result
+ in a NULL pointer dereference crash.
+
+
+
+
+
+
+ In libpq, always drain all pending bytes
+ from the SSL or GSS decryption buffer
+ during pqReadData() (Jacob Champion)
+ §
+ §
+ §
+ §
+
+
+
+ This avoids edge cases where libpq or its
+ calling application waits for more data to arrive on the socket, but
+ actually all the data has already arrived.
+
+
+
+
+
+
+ Allow libpq to accept
+ ParameterDescription messages exceeding 30000 bytes (Ning Sun)
+ §
+
+
+
+ Previously, this message type was not among those
+ that libpq's validity heuristics believed
+ could be long. The limit resulted in failure for prepared queries
+ having more than 7498 parameters, which is unlikely but supported.
+
+
+
+
+
+
+ Reject multiple descriptor header items
+ in ecpg's GET/SET
+ DESCRIPTOR statements (Masashi Kamura)
+ §
+
+
+
+ Previously the grammar allowed this syntax, but broken C code was
+ generated. Adjust the grammar and the documentation to allow only
+ one header item.
+
+
+
+
+
+
+ Make line widths match in psql's expanded
+ aligned output format (Pavel Stehule)
+ §
+
+
+
+ When the table's data rows are narrower than the record header lines,
+ widen the data rows to match the headers, avoiding unsightly output.
+
+
+
+
+
+
+ Fix psql's privilege check for showing
+ database size in \l+ (Christoph Berg)
+ §
+
+
+
+ The underlying server function permits users who
+ have pg_read_all_stats privileges to see the
+ sizes of all databases, even if they lack CONNECT
+ privilege. But psql was unaware of that
+ provision and would not call the function unless the user
+ has CONNECT privilege.
+
+
+
+
+
+
+ Fix psql's tab completion
+ for \df to consider procedures too
+ (Erik Wienhold)
+ §
+
+
+
+
+
+
+ Fix thread-safety bug in pgbench
+ (Fujii Masao)
+ §
+
+
+
+ When pgbench runs with multiple threads
+ and the option, different threads
+ could attempt to use the same buffer to construct error messages,
+ leading to corrupted log output.
+
+
+
+
+
+
+ In pg_combinebackup, prevent infinite
+ loop if the source file is shorter than expected (Peter Eisentraut)
+ §
+
+
+
+
+
+
+ Fix cleanup of publisher-side objects after errors
+ in pg_createsubscriber (Nisha Moond)
+ §
+
+
+
+ When pg_createsubscriber fails after
+ creating logical replication objects, it should remove the
+ publication and replication slot that it created on the publisher.
+ Some error cases failed to do so.
+
+
+
+
+
+
+ Use the source cluster's group-read file permissions
+ for pg_recvlogical output files
+ (Fujii Masao)
+ §
+
+
+
+ pg_recvlogical was documented to behave
+ this way, but it never actually enabled group-read.
+
+
+
+
+
+
+ In contrib/amcheck, handle short-header varlena
+ datums correctly (Andrey Borodin)
+ §
+
+
+
+ This error could result in doing excess work while verifying a btree
+ index, but seems not to have had any worse consequences.
+
+
+
+
+
+
+ In contrib/btree_gist,
+ fix NaN handling in the float4
+ and float8 opclasses (Bill Kim, Tom Lane)
+ §
+
+
+
+ Comparisons, as well as the GiST penalty and distance functions, did
+ not account for NaN and would give the wrong
+ answer when handed one. It is recommended to
+ reindex btree_gist indexes on float columns
+ after installing this update, if there is any possibility that there
+ are NaN entries in those columns.
+
+
+
+
+
+
+ In contrib/btree_gist, fix searches using a
+ not-equal operator (Ayush Tiwari)
+ §
+
+
+
+ For variable-length data types, the code for scanning non-leaf index
+ pages applied the wrong comparison function, leading to wrong
+ results and potentially crashes.
+
+
+
+
+
+
+ Fix unguarded recursion and loops in
+ contrib/hstore_plperl,
+ contrib/jsonb_plperl, and
+ contrib/jsonb_plpython
+ (Aleksander Alekseev)
+ §
+ §
+
+
+
+ Prevent stack overflow when dealing with deeply
+ nested jsonb values, and allow interruption of the infinite
+ loop caused when attempting to dereference circular chains of Perl
+ object references.
+
+
+
+
+
+
+ Fix missed release of statistics catcache entry
+ in contrib/intarray (Man Zeng)
+ §
+
+
+
+ This oversight led to warnings like resource was not closed:
+ cache pg_statistic.
+
+
+
+
+
+
+ In contrib/ltree, fix integer overflow in
+ comparisons (Ayush Tiwari)
+ §
+
+
+
+ ltree values containing more than about 14,653 labels
+ resulted in wrong comparison answers due to overflow. If a btree
+ index contains such values, it is probably corrupt and should be
+ reindexed after installing this update.
+
+
+
+
+
+
+ In contrib/pgcrypto, avoid double-free crash
+ after encountering an error while using an OSSLCipher object
+ (Yuelin Wang)
+ §
+
+
+
+
+
+
+ Fix array overrun in contrib/pg_surgery's
+ heap_force_kill and
+ heap_force_freeze functions (Michael Paquier)
+ §
+
+
+
+ Attempting to change a TID whose offset number equals
+ MaxHeapTuplesPerPage wrote one byte past the end of the allocated
+ array, potentially crashing the server.
+
+
+
+
+
+
+ In contrib/pg_surgery, avoid infinite loop with
+ TID arrays having more than 64K elements (Andrey Rachitskiy)
+ §
+
+
+
+
+
+
+ Avoid NULL-pointer dereference
+ in contrib/refint's
+ check_foreign_key() (Ayush Tiwari)
+ §
+
+
+
+ In the on-update-cascade case, a null value of a referenced column
+ led to a crash. This is an oversight in the fix for CVE-2026-6637,
+ but the code that was there before that wasn't really right either.
+
+
+
+
+
+
+ Remove the plan cache in contrib/refint
+ (Ayush Tiwari)
+ §
+
+
+
+ This caching behavior has several serious bugs, notably that
+ check_foreign_key() embeds the new key values
+ in its cascade-UPDATE queries, so a cached plan reuses the
+ originally-needed values rather than the key values that should be
+ used. The simplest solution is to remove it.
+
+
+
+
+
+
+ Fix contrib/seg to print segments
+ with ~ certainty indicators correctly
+ (Ewan Young)
+ §
+
+
+
+ Due to a typo, seg_out() did not print
+ a ~ certainty indicator attached to a segment's
+ upper boundary. Worse, if the lower boundary
+ had ~ while the upper boundary had no indicator,
+ the upper boundary was not printed at all, incorrectly converting
+ the value into an open interval.
+
+
+
+
+
+
+ Fix crash with namespace nodes in contrib/xml2's
+ xpath_nodeset() function (Andrey Chernyy,
+ Michael Paquier)
+ §
+
+
+
+
+
+
+ Support building PostgreSQL with
+ OpenSSL 4 (Daniel Gustafsson)
+ §
+
+
+
+
+
+
+ Update time zone data files to tzdata
+ release 2026c (Tom Lane)
+ §
+
+
+
+ Alberta (America/Edmonton) will be on year-round UTC-06
+ (effectively, permanent DST) beginning in November 2026. This
+ release assumes that their TZ abbreviation will
+ be CST from that time forward. That seems likely
+ to change, but it's unclear what new abbreviation will be used.
+
+
+
+ Morocco (Africa/Casablanca) will move to permanent UTC+00,
+ without daylight saving time transitions, on 2026-09-20.
+
+
+
+
+
+
+
+
Release 17.10