* Document running the container with rootless Podman, and the PUID and PGID environment variables. #9524
* Note that the U volume option is recursive and does not relabel for SELinux.
* Document that config_local.py is lost on upgrade on macOS. #5369
* Retitle the config_py docs page to 'Configuration Files', as it covers all four configuration files. #5369
Tags are copied to a user's shared server entry, whilst passfile is
treated like passwords, SSH keys and SSL client files and is never
copied from or overlaid with the owner's value.
Views with a single base table, all of its primary key columns exposed,
no INSTEAD OF triggers and no rules other than _RETURN can be edited in
View/Edit Data. Updates and deletes are checked row by row, and adding
rows is disabled because inserts through views are not supported.
In server mode, users choose a password exec command by name from
SERVER_PASSEXEC_COMMANDS rather than entering a command line. Existing
commands are converted on upgrade once the allowlist is configured; if
it is empty the conversion is postponed and a warning is logged.
Results can now be saved as JSON or XML as well as CSV, with preferences
for the output file encoding, prepending a byte order mark to CSV/TXT
files, and the default state of the grid's copy-with-headers toggle.
Tab switching now works when focus is inside a tool and defaults to
Ctrl+Alt+PageUp/PageDown, Ctrl/Cmd+Shift+D duplicates the current line or
selection in the SQL editor, and dialogs handle Enter and Escape
consistently.
Add --statistics-only, --no-policies, --no-data, --no-schema,
--no-statistics, --statistics and --sequence-data where the utilities
support them, gated on server version 18, and suppress combinations that
pg_dump, pg_dumpall and pg_restore would reject. The pg_dumpall --format
and pg_restore --exclude-database/--globals-only options were reverted
before PostgreSQL 18.0 and so are not included.
* Add a pgEdge Starfleet API client for cloud deployment.
* Add a pgacloud provider for pgEdge Starfleet.
* Add the pgEdge Starfleet cloud deployment blueprint.
* Return the generated pgEdge Starfleet password once on deployment and allow saving it.
* Add pgEdge Starfleet to the Deploy Cloud Instance wizard.
* Test the Starfleet password is fetched once and validate the save request body.
* Show the generated pgEdge Starfleet password once after deployment.
* Document pgEdge Starfleet cloud deployment.
* Show the Starfleet password dialog at most once per job and handle copy failures.
* Wait for the Starfleet instance schema before rendering its form.
The schema is built after an asynchronous client IP lookup, but SchemaView
takes its initial data from the first schema it receives, so mounting it
early left the deployment type unset and hid the managed-only fields.
* Keep the Starfleet token for each deployment job until it completes.
The wizard clears its cloud session as soon as the deployment starts, so
the token was gone by the time the job finished and the generated
password could never be fetched. Copy the token for the job when it is
started, read the password with that copy, and discard it on completion.
* Show the reason a cloud deployment failed.
pgacloud prints the provider's error as JSON before it exits, but the
failure path ignored it, so the user saw only a generic process failure
whilst the server quietly vanished from the tree. Pass the message
through update_server and show it once per job as a plain-text error.
* Keep the cloud deployment failure message until it is dismissed.
* Explain an empty Starfleet BYOC cluster list.
* Wait for Starfleet connection details before finishing a deployment.
* Handle malformed Starfleet responses without a server error.
* Clear the Starfleet PostgreSQL version when the deployment type changes.
* Show the Starfleet size label in the deployment summary.
* Stop logging the values of a background process's environment.
* Use the official pgEdge logo for the Starfleet provider.
* Only mount the selected provider's credentials form in the cloud wizard.
* Require HTTPS and handle malformed pgEdge Starfleet responses.
Addresses CodeRabbit review on #10499: the API client refuses a non-HTTPS
URL before sending credentials, a 2xx body that is not JSON or lacks an
access token raises StarfleetError, and the provider and credential check
report an unexpected response shape instead of failing with a traceback.
* Reject an empty or non-string pgEdge Starfleet access token.
* Note that the pgEdge Starfleet API URL must use HTTPS.
* Add screenshots to the pgEdge Starfleet deployment documentation.
* Update the cloud provider screenshot to include pgEdge Starfleet.
* Remove pgEdge Starfleet BYOC support from the cloud deployment wizard.
Only Managed databases are now offered, so the Deployment type selector,
the cluster list, the BYOC PostgreSQL version list and the BYOC capability
probe are gone, along with the --kind and --cluster-id options of
pgacloud's starfleet create-instance command.
* Regenerate the Starfleet instance and review screenshots without the deployment type.
* Retry transient pgEdge Starfleet polling errors and write job tokens through.
A network error, rate limit or server error whilst waiting for a new
database no longer ends the deployment, leaving the database running in
Starfleet but removed from pgAdmin; polling now retries until its
deadline, failing at once only on other client errors.
The job's copy of the access token is now written to the session store
immediately, so a status poll handled by another worker can still fetch
the generated password.
* Write the pgEdge Starfleet wizard token through, and warn that a failed deployment may leave the database behind.
Adds browser support for PostgreSQL 14+ extended statistics objects
(CREATE STATISTICS), with the create/edit dialog, reverse engineered SQL,
the computed values ANALYZE collected where the role may see them, and
schema diff support. Completes Murtuza Zabuawala's #9748.
Co-authored-by: Dave Page <dpage@pgadmin.org>
Adds OAUTH2_SERVER_GROUP_CLAIM and OAUTH2_SERVER_GROUP_CLAIM_MAPPING. When
the claim is configured for a provider, shared servers owned by other users
are only visible and accessible if their server group's name appears in the
(optionally mapped) claim values; if the claim is missing, none are. The
user's own servers, and users of other authentication methods, are
unaffected. The claim is resolved at login and only stored once the login
has been authorised.
Co-authored-by: Dave Page <dpage@pgadmin.org>
YAML consumes the quotes around a Compose scalar, so a value such as
PGADMIN_CONFIG_MAIL_SERVER: "mail.example.com" reaches config_distro.py
as a bare name and fails with NameError at startup. Document the nested
quoting needed in map syntax and env_file, how the list form differs,
escaping $ as $$, when config_distro.py is regenerated, and add a Compose
example.
Adds a pgTimeTable Chains node under Servers when pg_timetable is
installed in the maintenance database, with Tasks beneath each chain.
Chains and tasks can be created, edited and deleted, a chain can be
triggered with Run Now, and both have statistics tabs. Includes
regression tests, CI installation of pg_timetable, and documentation.
The 'Change Password...' option on a server node was ambiguous, because it
changes the password of the PostgreSQL role that pgAdmin connects with, yet
read as though it might change the pgAdmin login password instead. The menu
option and its dialog are now called 'Change Server Password', with the
connected role name in the dialog title, and the equivalent option in the
user menu becomes 'Change pgAdmin Password', so that the two can no longer
be confused with one another.
The dialog's own 'User' field was always blank, since the userName prop that
showChangeServerPassword passes was never accepted by ChangePasswordContent;
it is now wired through, which also makes the existing documentation of that
field accurate. The documentation for both dialogs has been updated to match
the new names, along with a couple of button names that had drifted.
Fixes#9230.
Adds Caddy examples alongside the existing NGINX ones for hosting pgAdmin with
Gunicorn or uWSGI, both at the root of a server and under a sub-directory,
mirroring the structure of the NGINX sections. Caddy does not speak the native
uwsgi protocol, so its uWSGI examples run uWSGI in HTTP mode instead.
Documents the two things that must line up for a sub-directory deployment
behind any reverse proxy: the proxy forwarding the request path unmodified
with an X-Script-Name header, and a SCRIPT_NAME environment variable on the
pgAdmin process itself, which is read at startup to set APPLICATION_ROOT and
SESSION_COOKIE_PATH. The missing environment variable is what caused the
"login succeeds then bounces back to the login page" report in #10334.
Also notes that pgAdmin trusts X-Script-Name and X-Scheme unconditionally,
unlike the X-Forwarded-* headers, so every example now either overwrites or
clears both rather than passing on whatever the client sent; warns that the
systemd unit shipped with Caddy sets PrivateTmp=true, which hides a socket
created in the system /tmp; and refreshes the stale python3.7 paths.
The file mixed issue-backed entries with commit-id ones. Make every
entry issue-backed:
- The LLM API redirect hardening had no issue, and its entry was the
only record of Ziya Abdullayev's report outside the commit message.
It gets #10420, written up with the mechanism, the affected range
(>= 9.15, since ALLOWED_LLM_API_URLS did not exist before then) and
the fix commit, and noting that it is hardening rather than an
exploitable flaw, so no CVE was requested.
- The Table dialog fix closed two issues, #10179 and #10180, so it
becomes two entries. That also covers the Definition-tab type
restriction, which the single commit-id entry had omitted.
- The remaining commit-id entries are dropped.
Fill in the identifiers allocated by the PostgreSQL CNA for the three
security entries that carried a placeholder:
#10383 webserver Remote-User auth bypass CVE-2026-86863
#10384 backup argument/conninfo injection CVE-2026-86864
#10385 File Manager save_file symlink follow CVE-2026-86861
Add the missing entry for #10388, connection-string injection in the
Restore and Maintenance tools (CVE-2026-86862). The fix was written but
never got a release-note line.
Move the release date out to 2026-09-17.
Covers the ten commits merged from master: the CSP per-request nonce,
the Object Explorer keyboard shortcut (folded into the existing #9631
entry, since it is the same feature reached another way), the Schema
Diff dependency ordering, function-body whitespace, foreign table and
sequence fixes surfaced by the now-asserting regression test, the
server-cursor prepare TypeError, the partitioned index TABLESPACE
clause, the UDF argument grid, the Helm existingSecret path and the
Validate binary path dialog.
Entries within each section are now ordered by issue number, with the
SHA-keyed ones last.
#10254 made the Object Explorer collapsible by clicking the current
workspace icon, but left that as the only way to do it. This adds a
shortcut, Ctrl+Alt+B by default, registered as its own
toggle_object_explorer preference so anyone can change it.
Ctrl+Alt+B rather than anything in the Shift+Alt family, which is full: b,
f, o, l, h, q, v, s, n, e, d and g are all taken, b by the existing Object
Explorer shortcut, which keeps its meaning of focusing the tree. Ctrl+Alt+B
is close enough to VS Code's Ctrl+B for the side bar to be guessable, and
keeps a family resemblance to the bracket keys used for tab navigation.
Ctrl+Shift+B would have been the other obvious candidate, but Chrome and
Firefox both use it for the bookmarks bar.
Worth noting for anyone reviewing: on keyboard layouts where AltGr is
Ctrl+Alt, this combination can be swallowed by the layout and produce a
character instead. That is true of any Ctrl+Alt binding, the preference is
user-configurable, and Shift+Ctrl+Alt+B is available if the default turns
out to annoy people.
The shortcut itself only fires an event, since the workspace provider owns
the visibility state, and the provider ignores it in classic layout where
there is no workspace toolbar and the Object Explorer is always shown.
Tested in a browser as well as in the unit tests: from the workspace layout
the key collapses and restores the panel, and the preference is registered
alongside the existing shortcuts.
Update APP_REVISION/APP_VERSION_INT in web/version.py and the Helm
chart's version/appVersion, and add docs/en_US/release_notes_9_18.rst
with a toctree entry.
The notes cover everything merged since REL-9_17 (ee7109d40..bd7cde585)
plus the three CVE fixes on this branch: the Webserver auth header
bypass (#10383), Backup argument and connection-string injection
(#10384) and the File Manager save_file symlink TOCTOU (#10385). The
CVE identifiers are still placeholders (CVE-2026-XXXXX) pending
assignment, and #10388 has no entry because its fix is not on this
branch yet.
Changes with no associated issue are listed under Housekeeping and Bug
fixes keyed by commit SHA, following the 9.15 convention, so the
"Additional changes" wrapper is dropped and Dependencies becomes a
top-level section.
Two non-blocking items from asheshv/pgAdmin4-cve#66's approval review:
- The auth_source lockout remedy was circular for the deployments most
likely to hit it: telling a locked-out admin to "sign in through
another authentication source" doesn't help when
AUTHENTICATION_SOURCES = ['webserver'] and there is no other source.
Documented the actual way out - temporarily add 'internal' back,
fix the affected users, remove it again.
- A malformed WEBSERVER_REMOTE_USER (not a non-empty string) was
demoted to info logging along with the client-triggered rejections
in the previous round, but it's a static operator misconfiguration,
not something a client varies per request - at info it would go
unnoticed while every header-based login silently fails. Moved back
to warning, consistent with the other config-error checks.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Round 2 of asheshv/pgAdmin4-cve#66's review:
- test_webserver_remote_user_trust.py bound WebserverAuthentication at
module-import time. test_auth_gating.py (which sorts and runs first)
evicts pgadmin.authenticate.webserver from sys.modules to observe its
re-import and never restores it, so the trust test held a discarded
copy of the module while patch('...webserver.User') patched the fresh
one - the patch silently missed and hit a real, unconfigured database.
Reproduced the reviewer's "27 passed, 3 failed" package-level run, then
fixed it by importing WebserverAuthentication inside each runTest()
instead, matching this repo's existing deferred-import convention.
Full authenticate package now passes 30/30.
- Documented the auth_source lockout: login() refusing any non-webserver
auth_source protects existing accounts, but a site with pre-existing
internal-auth users (including the default admin) will find nobody can
log in after enabling this. Added a warning to webserver.rst with the
fix (change Authentication source in User Management).
- login()'s user-is-None branch called logger.exception() with no active
exception, writing a useless NoneType traceback and never naming the
failed username. Now a plain warning naming it.
- Demoted per-request rejection logging (untrusted peer, secret mismatch,
misconfigured name) from warning to info, since an unauthenticated
client can trigger any of them on every request; kept genuine config
errors (a malformed WEBSERVER_TRUSTED_PROXIES entry, or the whole
setting not being a list/tuple) at warning.
- Guarded against WEBSERVER_TRUSTED_PROXIES being set to a plain string,
which iterated character-by-character and logged one warning per
character while still safely rejecting the request.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
WebserverAuthentication.get_user() fell back to request.headers when the
WSGI environ lookup missed, letting any client set Remote-User (or an
equivalent HTTP_-prefixed/hyphenated name) and log in as an arbitrary
existing user, including an Administrator, with no credential check.
Gate the header fallback behind an explicit opt-in
(WEBSERVER_REMOTE_USER_FROM_HEADER), a trusted-proxy IP/CIDR allow-list
(WEBSERVER_TRUSTED_PROXIES, checked against the raw pre-ProxyFix peer so
X-Forwarded-For can't spoof it), and an optional shared secret
(WEBSERVER_SHARED_SECRET). Also refuse to log a header-asserted identity
into any account whose auth_source isn't webserver, so a forged header
can never take over an internal-auth admin even if the gate above is
misconfigured.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Importing a servers.json definition insisted on a Username attribute for
every server, so a shared server that carried only SharedUsername was
rejected with "'Username' attribute not found for server ...", even though
the dialog treats SharedUsername as the default username for a shared
server. Validation now accepts either attribute when the server is shared,
whilst non-shared servers still require Username.
The loader derives the username it stores in the same way. Username wins
when both are present, since it is the owner's own login and the per-user
override, and SharedUsername is used when Username is absent. That matches
what creating a shared server through the dialog produces, so an imported
shared server prompts for a password on the first connection rather than
sitting on a loading spinner with no username to connect with.
SharedUsername itself does not inherit a legacy Username, because it means
"the default username for the other users of this server" rather than a
fallback for the owner.
Folded in during review:
Validation now looks at the values rather than merely at the keys. Checking
for the presence of a key alone let {"Shared": true, "SharedUsername": null}
and its empty-string equivalent through, and the loader would then store
that as the server's username: on a schema created from the model that is an
integrity error surfaced as a raw "Error creating server" string, whilst on
a database migrated over the years, where the column carries no NOT NULL, it
imports silently and leaves behind a server that cannot connect. The
equivalent pre-existing hole on the non-shared path, where {"Username": ""}
is still accepted, is left for a separate change covering empty usernames in
general.
Tests in web/pgadmin/utils/tests/test_validate_json_data.py cover the
username requirements for shared and non-shared servers, the Service escape
hatch, the integer port check, and shared servers being skipped rather than
rejected for a non-admin user. The JSON format documentation notes that
SharedUsername may stand in for Username.
Fixes#9226
The AI documentation covered how to configure each provider but said
nothing about what actually leaves the server once one is configured,
which is the first question anyone working under data residency or
procurement constraints will ask.
This adds a provider-neutral section to the AI Reports documentation
setting out what may be transmitted, which is schema definitions,
configuration settings read from pg_settings, query text, EXPLAIN plan
output and, because the Query Tool assistant can run read-only queries,
row data where the assistant judges it necessary; when nothing is
transmitted at all, which is the default, since no provider is
configured out of the box; and the fact that each provider processes
that data under its own terms and in locations of its own choosing, so
the reader knows to check both those terms and their own organisation's
policies before enabling a cloud provider.
It also makes explicit that the list of providers reflects the APIs
pgAdmin can speak to rather than a recommendation, and cross-references
the new section from the AI Assistant notes in the Query Tool
documentation.
Follow-up to #10142. Geometry Viewer's custom tile provider was only
configurable per-user (Preferences), with no way for an administrator
to set an organization-wide default (e.g. an internal tile server)
that applies out of the box for every user.
config.DEFAULT_GEOMETRY_VIEWER_PROVIDER is a plain dict; the five
custom_tile_* preference defaults (url, name, crs, attribution,
max_zoom) are sourced from it instead of hardcoded literals.
Preference.get() only reads a per-user DB row if the user has
explicitly saved one, otherwise it falls back to this default --
override semantics, one active provider, no naming-conflict surface.
config_local.py/config_distro.py/PGADMIN_CONFIG_* replace this config
variable wholesale, not merged key-by-key, so a naive
DEFAULT_GEOMETRY_VIEWER_PROVIDER['name'] lookup would KeyError-crash
preference registration (and app startup) on any partial admin
override, or AttributeError on a wrong-typed value.
resolve_geometry_viewer_provider_defaults() guards against this:
falls back per-field on missing/wrong-type values, validates crs
against the 3 supported choices, validates max_zoom is a non-bool int
in [0, 25], degrading to the original hardcoded defaults instead of
crashing.
No new attacker-reachable surface: DEFAULT_GEOMETRY_VIEWER_PROVIDER is
filesystem/deployment-level admin config, same trust boundary as
DEFAULT_BINARY_PATHS/OAUTH2_CONFIG. Existing DOMPurify sanitization on
name/attribution and the http(s):// + {x}/{y}/{z} URL validation in
GeometryViewerUtils.js (from #10142) apply uniformly to config-sourced
and per-user values alike.
Adds test_geometry_viewer_provider_defaults.py (9 scenarios: fully
valid, partial override, non-dict, invalid CRS, out-of-range/non-int/
bool max_zoom, non-string fields, empty dict).
Geometry Viewer's base-layer choices were hardcoded (Empty, Street,
Topography, Gray Style, Light Color/Dark Matter), with no way to
point at a private/internal tile server or a provider not in that
built-in list.
Add a geometry_viewer preferences category (custom_tile_url, _name,
_crs, _attribution, _max_zoom) under sqleditor. When a valid custom
tile provider URL is configured (must be http(s) and contain {x},
{y}, {z}), it's used as the default base layer; built-in tiled
layers are hidden unless the custom provider's CRS is also
EPSG:3857 (Web Mercator), since they can't be reprojected together.
Non-mercator custom providers (e.g. EPSG:4326) only apply to SRID
4326 geometry data; other SRIDs still render on the existing blank
Cartesian plane.
Custom name/attribution are DOMPurify-sanitized before being passed
to Leaflet (both are innerHTML sinks). URL is not sanitized but is
gated by the http(s):// prefix check, so javascript:/data: URLs are
rejected; it's consumed as a tile-image src template, not an HTML
sink.
Adds GeometryViewerUtils.spec.js covering URL validation, defaults,
sanitization, CRS resolution/fallback, and base-layer composition.
OAuth2 provider settings are only read from the OAUTH2_CONFIG list;
bare top-level keys like OAUTH2_CLIENT_ID or
OAUTH2_SSL_CERT_VERIFICATION are silently ignored. This is an easy
trap in container deployments where every other option is set via
an individual PGADMIN_CONFIG_<KEY> env var.
Add warn_on_misplaced_oauth2_config(), called once at OAuth2 module
startup, that logs when per-provider OAUTH2_* keys exist at the top
level with no provider configured in OAUTH2_CONFIG. No behavior
change for correctly configured or unconfigured deployments.
Documents the supported container approach in oauth2.rst.
Closes#10053
The PDF docs build in the Check documentation builds workflow began
failing after the 9.16 release notes added "Mai Phạm Hiền" as the
reporter for CVE-2026-12049. pdflatex's default utf8 inputenc maps
Latin-1 and Latin-Extended-A but rejects the precomposed Vietnamese
code points U+1EA1 (a with dot below) and U+1EC1 (e with circumflex
and grave) with:
! LaTeX Error: Unicode character ạ (U+1EA1)
not set up for use with LaTeX.
Declare the two characters in the LaTeX preamble via
\DeclareUnicodeCharacter so they typeset correctly:
ạ -> \d{a} (a with combining dot below)
ề -> \`{\^e} (e with circumflex + grave)
Picked this over switching to xelatex because it is a single-file
change, keeps the existing pdflatex toolchain, and the CI workflow
already has the apt packages it needs (no .github/workflows change).
Verified by running make docs-pdf in an ubuntu:22.04 container that
mirrors check-doc-builds.yml (same apt packages, locale-gen
en_US.UTF-8, sphinx + sphinxcontrib-youtube): 682-page pgadmin4.pdf
produced cleanly, zero Unicode-character errors in the log.
The login page hardcoded the 'fab' (brands) Font Awesome style for the
OAuth2 button icon, so non-brand icons could not be used. Use the
configured OAUTH2_ICON as-is when it already specifies a style class
(e.g. 'fas fa-key'), and fall back to 'fab' when only an icon name is
given, preserving backward compatibility.
The CLI set-prefs path (save_pref -> Preferences.save_cli) wrote the raw
value to the configuration database without any type validation and
always reported success, unlike the GUI path which validates via
_Preference.set(). Route save_cli through the same set() validation
(set() now accepts an explicit user_id so it works outside a request
context), and make setup.py set-prefs check the result and report
preferences whose value was invalid.
* Fix View/Edit Data crash on a stale/non-filter session transaction object
initialize_viewdata restores the filter and data-sorting from any command
object previously stored in session['gridData'] under the same trans_id. It
assumed that object was always a filter-capable (View/Edit Data) command and
accessed old_trans_obj._row_filter / ._data_sorting directly.
That assumption is wrong: the same trans_id may have been used by the Query
Tool (a QueryToolCommand, which does not inherit SQLFilter), or the session
may contain an incompatible object persisted by an older version after an
upgrade. In those cases the attribute access raised AttributeError, returning
a 500 from the endpoint and - in desktop mode, where this runs during startup
- preventing the application from loading at all.
Guard the restore with isinstance(old_trans_obj, SQLFilter) (short-circuited
before the did/obj_id checks) so a non-filter object is simply skipped. Add a
regression test that seeds a pickled QueryToolCommand under the trans_id and
asserts initialize/viewdata returns 200.
Closes#9744
* test: avoid hard-coded PK constraint name colliding across the suite
The regression test created its table with a fixed 'table_pk' primary key
constraint name, which collides with the same name used by TestViewData in
this package when the full suite runs against one database. That made the
CREATE TABLE fail in CI (table not found -> IndexError on the OID lookup).
Let PostgreSQL auto-name the primary key instead.
---------
Co-authored-by: Ashesh Vashi <ashesh.vashi@enterprisedb.com>
Add 14 release-note entries that were merged on master but not yet
captured in the 9.16 notes: 1 new feature (#2431), 6 housekeeping
(#9817, #9866, #9917, #9959, #10014, #10023) and 7 bug fixes (#9701,
#9782, #9933, #9952, #9985, #10013, #10030). Entries inserted in
numeric order within each section.
Also add an "Additional changes (no associated issue) -> Dependencies"
section mirroring the 9.15 format, listing net direct dep bumps
between REL-9_15 and HEAD across Python (requirements.txt,
tools/requirements.txt, web/regression/requirements.txt), web/
package.json, and runtime/package.json. Transitive yarn resolutions
and the setuptools pin (covered by bug fix#9829) are excluded.
The Forgot Password and Reset Password pages had no way to navigate back
to the login page. Added a "Back to login" link (using the login URL
already used by the login form) to both pages.
Webpack 5 asset modules include the leading dot in the [ext] token, so
the 'img/[name].[ext]' and 'fonts/[name].[ext]' templates produced
filenames with a double dot (e.g. Roboto-Bold..ttf). Use '[name][ext]'
so the emitted filenames are correct.
The base (default) SQL templates previously targeted PostgreSQL < 12.
Re-base them so the default target is 14 - the oldest supported server
version - by collapsing every version bucket <= 14 (11_plus, 12_plus,
13_plus, 14_plus and the old default) into a single `default`, keeping
per file the content a v14 server resolves today. Buckets for newer
versions (15_plus, 16_plus, 17_plus, 18_plus) are retained as overrides.
The transformation is behaviour-preserving for every server version >= 14:
template (and test-fixture) resolution is byte-identical before and after
for all supported versions, verified programmatically across every bucket
container and confirmed by the resql, ERD and Schema Diff suites against
PostgreSQL 18.
Also drop PostgreSQL/EDB Advanced Server 13 from the 9.16 supported-server
list and repoint the sqleditor explain_plan tests (which referenced the
removed 12_plus/13_plus buckets) at the new default template.
Closes#10050
* Propagate column renames to FK and unique constraints. #9060
In the new-table dialog, the primary key already updated its column
references when a column was renamed, but foreign key and unique
constraint definitions did not, leaving them pointing at the old name.
Mirror the PK rename-propagation in the foreign_key and unique_constraint
depChange handlers (and add 'columns' to the unique constraint deps so it
fires on column changes).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Address review feedback for column rename propagation (#9060)
- Remap unique constraint INCLUDE columns on rename. The INCLUDE list
holds bare name strings (not {column} objects), so renaming an
included column previously emitted stale DDL. Now mirrors the
primary key INCLUDE handling.
- Add regression tests covering rename propagation in depChange for
foreign_key and unique_constraint, including the unique constraint
INCLUDE case.
- Correct the release note wording from "Create/Edit Table" to
"Create Table"; the propagation only runs on the new-table path
(state.oid === undefined).
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Ashesh Vashi <ashesh.vashi@enterprisedb.com>
setuptools 82 stops shipping pkg_resources, which passlib (via
Flask-Security-Too on Python 3.9) imports, so a clean install on Python
3.9 failed with "No module named 'pkg_resources'". Python 3.9 is still a
supported target (RHEL/Rocky/AlmaLinux 8 and 9 build with system Python
3.9). Split the pin by Python version, mirroring the existing
Flask-Security-Too split.
The fix for #9570 (stop Alt+F5 showing a crosshair cursor) changed the
rectangular-selection eventFilter to require Alt+Ctrl and moved the
crosshair cue to Control. That broke the long-standing Alt+drag block
(column) selection and left an inconsistent Ctrl crosshair cue.
Restore the default rectangularSelection() (Alt+drag) and drop
crosshairCursor entirely - the crosshair-on-Alt was exactly the artifact
#9570 wanted gone, and CodeMirror's crosshair cannot be limited to an
active drag. This brings back block selection (#9864, #10029) while
keeping #9570's intent (no crosshair on the Alt+F5 shortcut).
