New uNmINeD development snapshot is available for download!

Changes:

• Added support for Hytale (experimental)
• Added support for Minecraft 26.1-snapshot-6 worlds
• Added support for multiple asterixes in block name patterns
• Fixed broken textured rendering for Java Edition

uNmINeD now can read Hytale worlds. This is an experimental feature under development. Map colors are far from finished, the code is slow, and there may be bugs and crashes.

!!! WARNING !!!

It has not yet been tested whether uNmINeD can be used safely while Hytale is running. Always close Hytale before using uNmINeD to prevent data corruption!

Check your Hytale world in uNmINeD and have fun!

The PostgreSQL Global Development Group has released an update to all supported versions of PostgreSQL, including 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23. This release fixes 2 security vulnerabilities and over 50 bugs reported over the last several months.

For the full list of changes, please review the release notes.

PostgreSQL 13 EOL Notice

This is the final release of PostgreSQL 13. PostgreSQL 13 is now end-of-life and will no longer receive security and bug fixes. If you are running PostgreSQL 13 in a production environment, we suggest that you make plans to upgrade to a newer, supported version of PostgreSQL. Please see our versioning policy for more information.

Security Issues

CVE-2025-12817: PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege

CVSS v3.1 Base Score: 3.1

Supported, Vulnerable Versions: 13 - 18.

Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.

The PostgreSQL project thanks Jelte Fennema-Nio for reporting this problem.

CVE-2025-12818: PostgreSQL libpq undersizes allocations, via integer wraparound

CVSS v3.1 Base Score: 5.9

Supported, Vulnerable Versions: 13 - 18.

Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.

The PostgreSQL project thanks Aleksey Solovev (Positive Technologies) for reporting this problem.

Bug Fixes and Improvements

This update fixes over 50 bugs that were reported in the last several months. The issues listed below affect PostgreSQL 18. Some of these issues may also affect other supported versions of PostgreSQL.

• Avoid returning duplicate rows from hash right semi-joins.
• Avoid possible out-of-memory failures during parallel GIN index build.
• Several fixes for BRIN indexes.
• Fixes for crashes related to partitioned tables, including one occurring during a recheck.
• Avoid duplicating hash partition constraints during DETACH CONCURRENTLY, which previously caused issues during dump/restore or if a parent table is dropped after the DETACH.
• Disallow generated columns in partition keys and in COPY ... FROM ... WHERE clauses.
• Fix incorrect reporting of replication lag in pg_stat_replication view.
• Avoid failures when synchronized_standby_slots references nonexistent replication slots.
• Avoid unwanted WAL receiver shutdown when switching from streaming to archive WAL source.
• Avoid unnecessary invalidation of logical replication slots.
• Correctly handle GROUP BY DISTINCT in PL/pgSQL assignment statements.
• Avoid leaking memory when handling a SQL error within PL/Python.
• Fix how libpq handles socket-related errors on Windows within its GSSAPI logic.
• Fix dumping of non-inherited NOT NULL constraints on inherited table columns.
• Ensure consistent ordering of foreign key constraints in the output of pg_dump.
• Several fixes for pgbench error handling and reporting.
• Fix memory leak in pg_combinebackup.
• Allow nonsuperusers with SELECT privileges on a table to use pg_prewarm to prewarm indexes on that table.

Updating

All PostgreSQL update releases are cumulative. As with other minor releases, users are not required to dump and reload their database or use pg_upgrade in order to apply this update release; you may simply shutdown PostgreSQL and update its binaries.

Users who have skipped one or more update releases may need to run additional post-update steps; please see the release notes from earlier versions for details.

For more details, please see the release notes.

Links

• Download
• Release Notes
• Security
• Versioning Policy
• Submit a Bug
• Donate

If you have corrections or suggestions for this release announcement, please send them to the pgsql-www@lists.postgresql.org public mailing list.

The PostgreSQL Global Development Group today announced the release of PostgreSQL 18, the latest version of the world's most advanced open source database. Translations of this press release are available in the PostgreSQL 18 press kit.

PostgreSQL 18 improves performance for workloads of all sizes through a new I/O subsystem that has demonstrated up to 3× performance improvements when reading from storage, and also increases the number of queries that can use indexes. This release makes major-version upgrades less disruptive, accelerating upgrade times and reducing the time required to reach expected performance after an upgrade completes. Developers also benefit from PostgreSQL 18 features, including virtual generated columns that compute values at query time, and the database-friendly uuidv7() function that provides better indexing and read performance for UUIDs. PostgreSQL 18 makes it easier to integrate with single-sign on (SSO) systems with support for OAuth 2.0 authentication.

"The efforts of the global open source community shape every PostgreSQL release and help deliver features that meet users where their data resides," said Jonathan Katz, a member of the PostgreSQL core team. "PostgreSQL 18 builds on the project's long, rich history of delivering a reliable and robust data management experience, while continuing to expand the workloads it can support."

PostgreSQL, an innovative data management system known for its reliability, robustness, and extensibility, benefits from nearly 30 years of open source development from a global developer community and has become the preferred open source relational database for organizations of all sizes.

Introducing asynchronous I/O

PostgreSQL previously relied on operating system readahead mechanisms to accelerate data retrieval. However, because operating systems lack insight into database-specific access patterns, they cannot always anticipate what data will be required, leading to suboptimal performance in many workloads.

PostgreSQL 18 introduces a new asynchronous I/O (AIO) subsystem designed to address this limitation. AIO lets PostgreSQL issue multiple I/O requests concurrently instead of waiting for each to finish in sequence. This expands existing readahead and improves overall throughput. AIO operations supported in PostgreSQL 18 include sequential scans, bitmap heap scans, and vacuum. Benchmarking has demonstrated performance gains of up to 3x in certain scenarios.

The new io_method setting lets you toggle between the AIO methods, including worker and io_uring, or you can choose to maintain the current PostgreSQL behavior with the sync setting. There are now more parameters to consider tuning with AIO, which you can learn more about in the documentation.

Faster upgrades, better post-upgrade performance

A key PostgreSQL feature is the generation and storage of statistics that help PostgreSQL select the most efficient query plan. Before PostgreSQL 18, these statistics didn't carry over on a major version upgrade, which could cause significant query performance degradations on busy systems until the ANALYZE finished running. PostgreSQL 18 introduces the ability to keep planner statistics through a major version upgrade, which helps an upgraded cluster reach expected performance more quickly after the upgrade.

Additionally, pg_upgrade, a utility that performs major version upgrades, includes several enhancements in PostgreSQL 18, such as faster upgrades when a database contains many objects like tables and sequences. This release also lets pg_upgrade process its checks in parallel based on the settings of the --jobs flag, and adds the --swap flag that swaps upgrade directories instead of copying, cloning, or linking files.

Query and general performance enhancements

PostgreSQL 18 further accelerates query performance with features that automatically make your workloads faster. This release introduces "skip scan" lookups on multicolumn B-tree indexes that improve execution time for queries that omit an = condition on one or more prefix index columns. It can also optimize queries that use OR conditions in a WHERE to use an index, leading to significantly faster execution. There are also numerous improvements for how PostgreSQL plans and executes table joins, from boosting the performance of hash joins to allowing merge joins to use incremental sorts. PostgreSQL 18 also supports parallel builds for GIN indexes, joining B-tree and BRIN indexes in supporting this capability.

This release also builds on PostgreSQL support for hardware acceleration, including support for ARM NEON and SVE CPU intrinsics for the popcount function, which is used by the bit_count and other internal capabilities.

Enhancing the developer experience

PostgreSQL 18 introduces virtual generated columns that compute values at query time instead of storing them. This is now the default option for generated columns. Additionally, stored generated columns can now be logically replicated.

This release adds the capability to access both the previous (OLD) and current (NEW) values in the RETURNING clause for INSERT, UPDATE, DELETE and MERGE commands. PostgreSQL 18 also adds UUIDv7 generation through the uuidv7() function, letting you generate random UUIDs that are timestamp-ordered to support better caching strategies. PostgreSQL 18 includes uuidv4() as an alias for gen_random_uuid().

PostgreSQL 18 adds temporal constraints -- constraints over ranges -- for both PRIMARY KEY and UNIQUE constraints using the WITHOUT OVERLAPS clause, and on FOREIGN KEY constraints using the PERIOD clause.

Finally, PostgreSQL 18 makes it easier to create the schema definition of a foreign table using the definition of a local table with the CREATE FOREIGN TABLE ... LIKE command.

Improved text processing

PostgreSQL 18 makes text processing easier and faster with several new enhancements. This release adds the PG_UNICODE_FAST collation, which provides full Unicode semantics for case transformations while helping to accelerate many comparisons. This includes the upper and lower string comparison functions and the new casefold function for case-insensitive comparisons. Additionally, PostgreSQL 18 now supports making LIKE comparisons over text that uses a nondeterministic collation, simplifying how you can perform more complex pattern matching. This release also changes full text search to use the default collation provider of a cluster instead of always using libc, which may require you to reindex all full text search and pg_trgm indexes after running pg_upgrade.

Authentication and security features

PostgreSQL 18 introduces oauth authentication, which lets users authenticate using OAuth 2.0 mechanisms supported through PostgreSQL extensions. Additionally, PostgreSQL 18 includes validation for FIPS mode, and adds the ssl_tls13_ciphers parameter for configuring server-side TLS v1.3 cipher suites.

This release deprecates md5 password authentication, which will be removed in a future release. If you require PostgreSQL password-based authentication, use SCRAM authentication. PostgreSQL 18 also supports SCRAM passthrough authentication with both postgres_fdw and dblink for authenticating to remote PostgreSQL instances. Additionally, pgcrypto now supports SHA-2 encryption for password hashing.

Replication

PostgreSQL 18 supports reporting logical replication write conflicts in logs and in the pg_stat_subscription_stats view. Additionally, CREATE SUBSCRIPTION now defaults to using parallel streaming for applying transactions, which can help improve performance. The pg_createsubscriber utility now has an --all flag so you can create logical replicas for all databases in an instance with a single command. PostgreSQL 18 also lets you automatically drop idle replication slots to help prevent storing too many write-ahead log files on a publisher.

Maintenance and observability

PostgreSQL 18 improves its vacuum strategy by proactively freezing more pages during regular vacuums, reducing overhead and helping in situations that require aggressive vacuums.

PostgreSQL 18 adds more details to EXPLAIN, which provides information about query plan execution, and as of this release now automatically shows how many buffers (the fundamental unit of data storage) are accessed when executing EXPLAIN ANALYZE. Additionally, EXPLAIN ANALYZE now shows how many index lookups occur during an index scan, and EXPLAIN ANALYZE VERBOSE includes CPU, WAL, and average read statistics. PostgreSQL 18 includes more info in pg_stat_all_tables on time spent on vacuum and related operations, as well as per-connection statistics on I/O and WAL utilization.

Other notable changes

Databases initialized with PostgreSQL 18 initdb now have page checksums enabled by default. This can affect upgrades from non-checksum enabled clusters, which would require you to create a new PostgreSQL 18 cluster with the --no-data-checksums option when using pg_upgrade.

PostgreSQL 18 also introduces a new version (3.2) of the PostgreSQL wire protocol, the first new protocol version since PostgreSQL 7.4 (2003). libpq still uses version 3.0 by default while clients (e.g., drivers, poolers, proxies) add support for the new protocol version.

Additional Features

Many other new features and improvements have been added to PostgreSQL 18 that may also be helpful for your use cases. Please see the release notes for a complete list of new and changed features.

About PostgreSQL

PostgreSQL is the world's most advanced open source database, with a global community of thousands of users, contributors, companies and organizations. Since its beginnings at the University of California, Berkeley over 40 years ago, PostgreSQL has continued with an unmatched pace of development. PostgreSQL's mature feature set not only matches top proprietary database systems, but exceeds them in advanced database features, extensibility, security, and stability.

Links

• Download
• Release Notes
• Press Kit
• Security Page
• Versioning Policy
• Contact
• Donate

The PostgreSQL Global Development Group announces that the first release candidate of PostgreSQL 18 is now available for download. As a release candidate, PostgreSQL 18 RC 1 will be mostly identical to the initial release of PostgreSQL 18, though some more fixes may be applied prior to the general availability of PostgreSQL 18.

The planned date for the general availability of PostgreSQL 18 is September 25, 2025. Please see the "Release Schedule" section for more details.

Upgrading to PostgreSQL 18 RC 1

To upgrade to PostgreSQL 18 RC 1 from earlier versions of PostgreSQL, you will need to use a major version upgrade strategy, e.g. pg_upgrade or pg_dump / pg_restore. For more information, please visit the documentation section on upgrading:

https://www.postgresql.org/docs/18/upgrading.html

Changes Since 18 Beta 3

Several bug fixes were applied for PostgreSQL 18 during the Beta 3 period. These include:

• Skip vacuuming virtual generated columns when using vacuumdb --missing-stats-only.
• Added recommendation on when to reindex full-text search and pg_trgm indexes after using pg_upgrade.

For a detailed list of fixes, please visit the open items page.

Release Schedule

This is the first release candidate for PostgreSQL 18. Unless an issue is discovered that warrants a delay or to produce an additional release candidate, PostgreSQL 18 should be made generally available on September 25, 2025.

For further information please see the Beta Testing page.

Links

• Download
• Beta Testing Information
• PostgreSQL 18 Beta Release Notes
• PostgreSQL 18 Open Issues
• Submit a Bug
• Donate

The PostgreSQL Global Development Group has released an update to all supported versions of PostgreSQL, including 17.6, 16.10, 15.14, 14.19, and 13.22, as well as the third beta release of PostgreSQL 18. This release fixes 3 security vulnerabilities and over 55 bugs reported over the last several months.

If you previously created a BRIN index using the numeric_minmax_multi_ops operator class, please see the "Updating" section for additional instructions after upgrading your instance.

For the full list of changes, please review the release notes.

PostgreSQL 13 EOL Notice

PostgreSQL 13 will stop receiving fixes on November 13, 2025. If you are running PostgreSQL 13 in a production environment, we suggest that you make plans to upgrade to a newer, supported version of PostgreSQL. Please see our versioning policy for more information.

Security Issues

CVE-2025-8713: PostgreSQL optimizer statistics can expose sampled data within a view, partition, or child table

CVSS v3.1 Base Score: 3.1

Supported, Vulnerable Versions: 13 - 17.

PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this data is consulted during the query planning process. Prior to this release, a user could craft a leaky operator that bypassed view access control lists (ACLs) and bypassed row security policies in partitioning or table inheritance hierarchies. Reachable statistics data notably included histograms and most- common-values lists. CVE-2017-7484 and CVE-2019-10130 intended to close this class of vulnerability, but this gap remained. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.

The PostgreSQL project thanks Dean Rasheed for reporting this problem.

CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin server execute arbitrary code in psql client

CVSS v3.1 Base Score: 8.8

Supported, Vulnerable Versions: 13 - 17.

Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. This is similar to MySQL CVE-2024-21096. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.

The PostgreSQL project thanks Martin Rakhmanov, Matthieu Denais, and RyotaK for reporting this problem.

CVE-2025-8715: PostgreSQL pg_dump newline in object name executes arbitrary code in psql client and in restore target server

CVSS v3.1 Base Score: 8.8

Supported, Vulnerable Versions: 13 - 17.

Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name. The same attacks can achieve SQL injection as a superuser of the restore target server. pg_dumpall, pg_restore, and pg_upgrade are also affected. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected. Versions before 11.20 are unaffected. CVE-2012-0868 had fixed this class of problem, but version 11.20 reintroduced it.

The PostgreSQL project thanks Noah Misch for reporting this problem.

Bug Fixes and Improvements

This update fixes over 55 bugs that were reported in the last several months. The issues listed below affect PostgreSQL 17. Some of these issues may also affect other supported versions of PostgreSQL.

• Fix for BRIN indexes using the numeric_minmax_multi_ops operator class that could cause them to become bloated and inefficient. Please see the "Updating" section for instructions on how to fix these indexes.
• Several fixes for logical replication, including fixes for memory allocation failure, duplicate transaction replay, infinite wait, unexpected shutdown, and a standby unable to shutdown.
• Fix premature removal of old WAL during a checkpoint, which could impact recovery when using replication slots.
• Revert a change that could reject XML documents over 10MB in size.
• Fix how nested character classes (e.g. [[:alpha:]%_]) are handled in SIMILAR TO expressions.
• Restore the ability for PL/pgSQL expressions to use parallel execution.
• Avoid a rare scenario where a B-tree index could modify the wrong entry.
• Several fixes for MERGE, including incorrect query results with concurrency and when targeting a table that is a parent in an inheritance hierarchy.
• Fix LZ4 decompression failure that could occur on data that is not very compressible.
• Prevent an infinite loop in checkpoints on systems with very large shared_buffers settings.
• Fix issues with GSSAPI authentication when using Active Directory accounts with many group memberships. This release also fixes timing-dependent connection failures when using SSL or GSSAPI encryption in non-blocking mode.
• Fix a crash in libpq function PQcancelCreate().
• Fix several resource leaks.

Updating

All PostgreSQL update releases are cumulative. As with other minor releases, users are not required to dump and reload their database or use pg_upgrade in order to apply this update release; you may simply shutdown PostgreSQL and update its binaries.

If you have any BRIN indexes that use the numeric_minmax_multi_ops operator class, it is advisable to REINDEX them after updating to fix any potential bloating and inefficiency.

Users who have skipped one or more update releases may need to run additional post-update steps; please see the release notes from earlier versions for details.

For more details, please see the release notes.

A Note on the PostgreSQL 18 Beta

This release marks the third beta release of PostgreSQL 18 and puts the community one step closer to general availability tentatively around September/October 2025.

In the spirit of the open source PostgreSQL community, we strongly encourage you to test the new features of PostgreSQL 18 on your systems to help us eliminate bugs and other issues. While we do not advise you to run PostgreSQL 18 Beta 3 in production environments, we encourage you to find ways to run your typical application workloads against this beta release.

Your testing and feedback helps the community ensure that PostgreSQL 18 upholds our standards of delivering a stable, reliable release of the world's most advanced open source relational database. Please read more about our beta testing process and how you can contribute:

https://www.postgresql.org/developer/beta/

Upgrading to PostgreSQL 18 Beta 3

To upgrade to PostgreSQL 18 Beta 3 from an earlier version of PostgreSQL, you will need to use a strategy similar to upgrading between major versions of PostgreSQL (e.g. pg_upgrade or pg_dump / pg_restore). For more information, please visit the documentation section on upgrading.

Changes Since Beta 2

Fixes and changes in PostgreSQL 18 Beta 3 include:

• Fix for performance regression in trivial queries.
• Fix can't get cancellation key error observed with some additional software.
• Fix for background workers failing to restart after crashes.
• Fix a rare asynchronous I/O failure.
• Stop dumping excess objects in pg_dumpall --statistics-only and --no-schema.
• Remove pg_dumpall non-text output file formats.
• Fix date_trunc(..., 'infinity'::timestamptz) on 32-bit systems.

Please see the release notes for a complete list of new and changed features:

https://www.postgresql.org/docs/18/release-18.html

Testing for Bugs & Compatibility

The stability of each PostgreSQL release greatly depends on you, the community, to test the upcoming version with your workloads and testing tools to find bugs and regressions before the general availability of PostgreSQL 18. As this is a Beta, minor changes to database behaviors, feature details, and APIs are still possible. Your feedback and testing will help determine the final tweaks on the new features, so please test in the near future. The quality of user testing helps determine when we can make a final release.

A list of open issues is publicly available in the PostgreSQL wiki. You can report bugs using this form on the PostgreSQL website:

https://www.postgresql.org/account/submitbug/

Beta Schedule

This is the third beta release of version 18. The PostgreSQL Project will release one or more release candidates, before the final release around September/October 2025. For further information please see the Beta Testing page.

Links

• Download
• Release Notes
• Security
• Versioning Policy
• Beta Testing Information
• PostgreSQL 18 Beta Release Notes
• PostgreSQL 18 Open Issues
• Submit a Bug
• Donate

If you have corrections or suggestions for this release announcement, please send them to the pgsql-www@lists.postgresql.org public mailing list.

The PostgreSQL Global Development Group announces that the second beta release of PostgreSQL 18 is now available for download. This release contains previews of all features when PostgreSQL 18 is made generally available, though some details of the release can change during the beta period.

You can find information about all of the PostgreSQL 18 features and changes in the release notes:

https://www.postgresql.org/docs/18/release-18.html

In the spirit of the open source PostgreSQL community, we strongly encourage you to test the new features of PostgreSQL 18 on your systems to help us eliminate bugs and other issues. While we do not advise you to run PostgreSQL 18 Beta 2 in production environments, we encourage you to find ways to run your typical application workloads against this beta release.

Your testing and feedback helps the community ensure that PostgreSQL 18 upholds our standards of delivering a stable, reliable release of the world's most advanced open source relational database. Please read more about our beta testing process and how you can contribute:

https://www.postgresql.org/developer/beta/

Upgrading to PostgreSQL 18 Beta 2

To upgrade to PostgreSQL 18 Beta 2 from an earlier version of PostgreSQL, you will need to use a strategy similar to upgrading between major versions of PostgreSQL (e.g. pg_upgrade or pg_dump / pg_restore). For more information, please visit the documentation section on upgrading.

Changes Since Beta 1

Fixes and changes in PostgreSQL 18 Beta 2 include:

• Add support for prepared statements in squashing lists in query jumbling.
• Fix for foreign key validation on partitioned tables.
• Remove pg_get_process_memory_contexts() function.
• Several fixes for injection point testing to support testing AIO.
• Fix pg_dump for tables with complex names.
• Fix for statement location calculation for nested statements.
• Fix for upgrades from PostgreSQL 14 when the number of rows in a table is unknown.
• Fix stack overflow for OAuth parsers.
• Set pg_dump and pg_dumpall default behavior to use --no-statistics. Leave the default for pg_restore and pg_upgrade to be --with-statistics.
• Ensure LOAD $libdir/ works.
• Improvements for GIN amcheck.
• Remove PQservice() from libpq.

Please see the release notes for a complete list of new and changed features:

https://www.postgresql.org/docs/18/release-18.html

Testing for Bugs & Compatibility

The stability of each PostgreSQL release greatly depends on you, the community, to test the upcoming version with your workloads and testing tools to find bugs and regressions before the general availability of PostgreSQL 18. As this is a Beta, minor changes to database behaviors, feature details, and APIs are still possible. Your feedback and testing will help determine the final tweaks on the new features, so please test in the near future. The quality of user testing helps determine when we can make a final release.

A list of open issues is publicly available in the PostgreSQL wiki. You can report bugs using this form on the PostgreSQL website:

https://www.postgresql.org/account/submitbug/

Beta Schedule

This is the second beta release of version 18. The PostgreSQL Project will release additional betas as required for testing, followed by one or more release candidates, until the final release around September/October 2025. For further information please see the Beta Testing page.

Links

• Download
• Beta Testing Information
• PostgreSQL 18 Beta Release Notes
• PostgreSQL 18 Open Issues
• Submit a Bug
• Donate

The PostgreSQL Global Development Group has released an update to all supported versions of PostgreSQL, including 17.5, 16.9, 15.13, 14.18, and 13.21. This release fixes 1 security vulnerability and over 60 bugs reported over the last several months.

For the full list of changes, please review the release notes.

PostgreSQL 13 EOL Notice

PostgreSQL 13 will stop receiving fixes on November 13, 2025. If you are running PostgreSQL 13 in a production environment, we suggest that you make plans to upgrade to a newer, supported version of PostgreSQL. Please see our versioning policy for more information.

Security Issues

CVE-2025-4207: PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation

CVSS v3.1 Base Score: 5.9

Supported, Vulnerable Versions: 13 - 17.

A buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to achieve temporary denial of service on platforms where a 1-byte over-read can elicit process termination. This affects the database server and also libpq. Versions before PostgreSQL 17.5, 16.9, 15.13, 14.18, and 13.21 are affected.

Bug Fixes and Improvements

This update fixes over 60 bugs that were reported in the last several months. The issues listed below affect PostgreSQL 17. Some of these issues may also affect other supported versions of PostgreSQL.

• Handle self-referential foreign keys on partitioned tables correctly. Creating or attaching partitions failed to make the required catalog entries for a foreign-key constraint if the table referenced by the constraint was the same partitioned table. This resulted in failure to enforce the constraint fully. To fix this, please see the instructions in the "Updating" section.
• Fix for potential data loss issue when using BRIN bloom indexes (e.g. using the date_bloom_ops operator class).
• Fix MERGE into a partitioned table with DO NOTHING actions.
• Prevent failure in INSERT commands when the table has a GENERATED column of a domain type and the domain's constraints disallow NULL values.
• Fix ALTER TABLE .. ADD COLUMN to correctly handle the case of a domain type that has its own default value and the DEFAULT for the column is not set.
• Fix issues when performing casts within the keys of JSON constructor expressions.
• Fix XMLSERIALIZE() so that the INDENT option is correctly dumped out when it's present in views or rules. This was noticeable on restores.
• Several query planner fixes, including avoiding a premature evaluation of arguments in an aggregate function that has both FILTER and either ORDER BY or DISTINCT clauses that could lead to unnecessary failures.
• Fix for potentially returning incorrect results when a bitmap scan without output columns is executed while vacuum is also running on the same table.
• Fix performance issues in GIN index search startup when there are many search keys, for example, jsonbcol ?| array[...] with tens of thousands of array elements.
• Ensure that I/O statistics of active WAL senders are reported within at most one second.
• Fix race condition in handling of synchronous_standby_names immediately after startup, where a backend might fail to wait for a synchronous commit.
• Avoid infinite loop if scram_iterations is set to INT_MAX.
• Several fixes for logical replication, including handling of vacuum around deleted rows that are still required for logical decoding.
• Prevent potential data loss when schema modification operations (DDL) that don't take a strong lock affect tables that are being logically replicated.
• Prevent issues in logical replication that could allow duplicate data to be applied due to apply worker error handling.
• Improve how reindexdb handles scheduling parallel reindex operations to achieve the expected amount of parallelism.

This release also updates time zone data files to tzdata release 2025b for DST law changes in Chile, plus historical corrections for Iran. Additionally, there is a new time zone America/Coyhaique for Chile's Aysén Region, to account for it changing to UTC-03 year-round, which diverges from America/Santiago.

Updating

All PostgreSQL update releases are cumulative. As with other minor releases, users are not required to dump and reload their database or use pg_upgrade in order to apply this update release; you may simply shutdown PostgreSQL and update its binaries.

If you created a self-referential foreign key on a partitioned table, after updating, you should drop and recreate any of these self-referential foreign keys if partitions have been created or attached since the constraint was created. There may be rows in the partition that violate this constraint, in which case recreating the constraint will fail, and you'll need to correct those rows before trying again.

Users who have skipped one or more update releases may need to run additional post-update steps; please see the release notes from earlier versions for details.

For more details, please see the release notes.

Links

• Download
• Release Notes
• Security
• Versioning Policy
• Donate

If you have corrections or suggestions for this release announcement, please send them to the pgsql-www@lists.postgresql.org public mailing list.

The PostgreSQL Global Development Group announces that the first beta release of PostgreSQL 18 is now available for download. This release contains previews of all features when PostgreSQL 18 is made generally available, though some details of the release can change during the beta period.

You can find information about all of the PostgreSQL 18 features and changes in the release notes:

https://www.postgresql.org/docs/18/release-18.html

In the spirit of the open source PostgreSQL community, we strongly encourage you to test the new features of PostgreSQL 18 on your systems to help us eliminate bugs and other issues. While we do not advise you to run PostgreSQL 18 Beta 1 in production environments, we encourage you to find ways to run your typical application workloads against this beta release.

Your testing and feedback helps the community ensure that PostgreSQL 18 upholds our standards of delivering a stable, reliable release of the world's most advanced open source relational database. Please read more about our beta testing process and how you can contribute:

https://www.postgresql.org/developer/beta/

PostgreSQL 18 Feature Highlights

Below are some of the feature highlights that are planned for PostgreSQL 18. This list is not exhaustive; for the full list of planned features, please see the release notes.

Performance

PostgreSQL 18 introduces an asynchronous I/O (AIO) subsystem. This new subsystem allows to increase I/O throughput and to hide I/O latency. On Linux io_uring can be used for AIO, a worker based implementation is available on all platforms. This initial release supporting file system reads such as sequential scans, bitmap heap scans, and vacuums, with tests showing up to a 2-3x performance improvements.

These performance gains extend to query optimizations and new indexing features. PostgreSQL 18 adds support for using "skip scan" lookups on multicolumn B-tree indexes, which can result in faster execution times for queries that omit a "=" condition on one or more prefix index columns. This release also includes optimizations for WHERE clauses that contain OR and IN (...) statements to better utilize recent indexing improvements which can also result in better query performance. There are also numerous performance improvements for how PostgreSQL plans and executes table joins, from improving the overall performance of hash joins to allowing merge joins to use incremental sorts.

There are a variety of other PostgreSQL 18 features that improve performance for other query and maintenance operations. PostgreSQL 18 now supports parallel builds for GIN indexes, which are commonly used for search over JSON and full-text data. This release also allows you to define partition keys and materialized views with unique indexes which aren't B-trees. PostgreSQL 18 also improves overall locking performance for queries that access many relations, and adds several improvements to queries over partitioned tables, including improved pruning and join support. PostgreSQL 18 also has performance improvements in text processing, including general speedups to the upper/lower functions and a new built-in collation PG_UNICODE_FAST.

Major version upgrade experience

Before PostgreSQL 18, an important step after performing a major version upgrade was to run the ANALYZE to generate statistics, which is a critical component of helping PostgreSQL to select the most efficient query plan. Based on the size and overall activity of a PostgreSQL cluster, this could be a time consuming process, and potentially impact query performance until the process completed. PostgreSQL 18 introduces the ability to keep planner statistics through a major version upgrade, which helps an upgraded cluster to get to its expected performance state sooner once it's available.

Additionally, pg_upgrade, the utility used to facilitate a major version upgrade, added several performance enhancements to help accelerate upgrades with many objects, such as tables and sequences. This release also allows pg_upgrade to process its checks in parallel based on the settings of the --jobs flag, and also adds the --swap flag, which swaps upgrade directories instead of copying, cloning, or linking files.

Developer Experience

PostgreSQL 18 introduces virtual generated columns that compute the column values just-in-time during query execution, instead of having to store them. This is now the default option for generated columns. Additionally, stored generated columns can now be logically replicated.

This release adds the capability to access both the previous (OLD) and current (NEW) values in the RETURNING clause for INSERT, UPDATE, DELETE and MERGE commands. Additionally, PostgreSQL 18 adds support for UUIDv7 generation through the uuidv7() function, letting you generate random UUIDs that are timestamp-ordered to support better caching strategies (this release also adds uuidv4() as an alias for gen_rand_uuid).

Now in PostgreSQL 18, you can make LIKE comparisons over text that uses a nondeterministic collation, making it simpler to do more complex pattern matching. Additionally, this release introduces the CASEFOLD to help with case-insensitive matches.

This release also adds temporal constraints, or constraints over ranges, for both PRIMARY KEY and UNIQUE constraints using the WITHOUT OVERLAPS clause, and on FOREIGN KEY constraints using the PERIOD clause.

Security Features

PostgreSQL 18 introduces oauth authentication, which lets users authenticate using OAuth 2.0 mechanisms supported through PostgreSQL extensions. Additionally, PostgreSQL 18 adds several features to validate and enforce FIPS mode behavior, and also adds the ssl_tls13_ciphers to let users configure which TLS v1.3 cipher suites the server can use.

This release deprecates md5 password authentication in favor of using SCRAM authentication that was first added in PostgreSQL 10. md5 authentication will be fully removed in a future major version release. Additionally, PostgreSQL 18 adds support for SCRAM passthrough authentication with both postgres_fdw and dblink when authenticating to remote PostgreSQL instances.

Monitoring and Observability

PostgreSQL 18 adds more details to the EXPLAIN utility, which provides information about query plan execution, and as of this release now automatically shows how many buffers (the fundamental unit of data storage) are accessed when executing EXPLAIN ANALYZE. Additionally, EXPLAIN ANALYZE now shows how many index lookups occur during an index scan, and EXPLAIN ANALYZE VERBOSE includes CPU, WAL, and average read statistics. This release also includes information about the total amount of time spent vacuuming and analyzing a table in pg_stat_all_tables, and now shows per-connection statistics on I/O and WAL utilization.

PostgreSQL 18 also provides more insights into write conflicts that occur during logical replication, and surfaces this information both in logs and in the pg_stat_subscription_stats view.

Other Highlights

Starting with PostgreSQL 18, data checksums, which are used to validate the integrity of stored data, are now enabled by default on new PostgreSQL clusters. You can choose to disable this behavior using the initdb --no-data-checksums command. Note that this may require changes to your upgrade scripts.

Additionally, there are new behaviors available in several constraint features. First, both foreign key and check constraints can be set as NOT ENFORCED and conversely, made enforceable. Additionally, NOT NULL constraints now preserve their names as required by the SQL standard, support the NOT VALID and NO INHERIT clauses, and now behave more consistently with inheritance.

pg_createsubscriber now supports an --all flag so you can create logical replicas for all databases in an instance with a single command. Additionally, PostgreSQL 18 lets you create the schema definition of a foreign table using the definition of a local table using the CREATE FOREIGN TABLE ... LIKE command.

PostgreSQL 18 also introduces a new version (3.2) of the PostgreSQL wire protocol, which is the first new protocol version since PostgreSQL 7.4 (2003). libpq still uses version 3.0 by default while clients (e.g., drivers, poolers, proxies) add support for the new protocol version.

Additional Features

Many other new features and improvements have been added to PostgreSQL 18. Many of these may also be helpful for your use cases. Please see the release notes for a complete list of new and changed features:

https://www.postgresql.org/docs/18/release-18.html

Testing for Bugs & Compatibility

The stability of each PostgreSQL release greatly depends on you, the community, to test the upcoming version with your workloads and testing tools to find bugs and regressions before the general availability of PostgreSQL 18. As this is a Beta, minor changes to database behaviors, feature details, and APIs are still possible. Your feedback and testing will help determine the final tweaks on the new features, so please test in the near future. The quality of user testing helps determine when we can make a final release.

A list of open issues is publicly available in the PostgreSQL wiki. You can report bugs using this form on the PostgreSQL website:

https://www.postgresql.org/account/submitbug/

Beta Schedule

This is the first beta release of version 18. The PostgreSQL Project will release additional betas as required for testing, followed by one or more release candidates, until the final release around September/October 2025. For further information please see the Beta Testing page.

Links

• Download
• Beta Testing Information
• PostgreSQL 18 Beta Release Notes
• PostgreSQL 18 Open Issues
• Submit a Bug
• Donate

The PostgreSQL Global Development Group has released an update to all supported versions of PostgreSQL, including 17.4, 16.8, 15.12, 14.17, and 13.20.

For the full list of changes, please review the release notes.

Bug Fixes and Improvements

The issues listed below affect PostgreSQL 17. Some of these issues may also affect other supported versions of PostgreSQL.

• Improve behavior of quoting functions in libpq. The fix for CVE-2025-1094 caused the quoting functions to not honor their string length parameters and, in some cases, cause crashes. This problem could be noticeable from a PostgreSQL client library, based on how it is integrated with libpq.
• Fix small memory leak in pg_createsubscriber.

Updating

All PostgreSQL update releases are cumulative. As with other minor releases, users are not required to dump and reload their database or use pg_upgrade in order to apply this update release; you may simply shutdown PostgreSQL and update its binaries.

Users who have skipped one or more update releases may need to run additional post-update steps; please see the release notes from earlier versions for details.

For more details, please see the release notes.

Links

• Download
• Release Notes
• Security
• Versioning Policy
• Donate

If you have corrections or suggestions for this release announcement, please send them to the pgsql-www@lists.postgresql.org public mailing list.

The PostgreSQL Global Development Group is planning for an out-of-cycle release on February 20, 2025 to address a regression that was released as part of the February 13, 2025 update release, which included release 17.3, 16.7, 15.11, 14.16, and 13.19. As part of this release, we will issue fixes for all supported versions (17.4, 16.8, 15.12, 14.17, 13.20). While these fixes may not impact all PostgreSQL users, PostgreSQL Global Development Group determined that it would be better to address these sooner than the next scheduled release on May 8, 2025.

The fix for CVE-2025-1094, which closed a vulnerability in the libpq PostgreSQL client library, introduced a regression related to string handling for non-null terminated strings. The error would be visible based on how a PostgreSQL client implemented this behavior, and may not impact all PostgreSQL drivers. As a precaution, the PostgreSQL Global Development Group opted for a follow up release.

If you are impacted by this issue, we advise to consider waiting for the availability of 17.4, 16.8, 15.12, 14.17, and 13.20 before upgrading.

The PostgreSQL Global Development Group has released an update to all supported versions of PostgreSQL, including 17.3, 16.7, 15.11, 14.16, and 13.19. This release fixes 1 security vulnerability and over 70 bugs reported over the last several months.

For the full list of changes, please review the release notes.

Security Issues

CVE-2025-1094: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation

CVSS v3.1 Base Score: 8.1

Supported, Vulnerable Versions: 13 - 17.

Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command line arguments to achieve SQL injection when client_encoding is BIG5 and server_encoding is one of EUC_TW or MULE_INTERNAL. Versions before PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19 are affected.

The PostgreSQL project thanks Stephen Fewer, Principal Security Researcher, Rapid7 for reporting this problem.

Bug Fixes and Improvements

This update fixes over 70 bugs that were reported in the last several months. The issues listed below affect PostgreSQL 17. Some of these issues may also affect other supported versions of PostgreSQL.

• Restore pre-v17 truncation behavior for >63-byte database names and usernames in connection requests.
• Don't perform connection privilege checks and limits on parallel workers, and instead inherit these from the leader process.
• Remove Lock suffix from LWLock wait event names.
• Fix possible re-use of stale results in window aggregates, which could lead to incorrect results.
• Several race condition fixes for vacuum that in the worst case could cause corruption to a system catalog.
• Several fixes for truncating tables and indexes that prevent potential corruption.
• Fix for detaching a partition where its own foreign-key constraint references a partitioned table.
• Fix for the FFn (e.g., FF1) format codes for to_timestamp, where an integer format code before the FFn would consume all available digits.
• Fixes for SQL/JSON and XMLTABLE() to double-quote specific entries when necessary.
• Include the ldapscheme option in pg_hba_file_rules().
• Several fixes for UNION, including not merging columns with non-compatible collations.
• Several fixes that could impact availability or speed of starting a connection to PostgreSQL.
• Fix multiple memory leaks in logical decoding output.
• Fix several memory leaks in PL/Python.
• Add psql tab completion for COPY (MERGE INTO).
• Make pg_controldata more resilient when displaying info from corruptedpg_control files.
• Fix for a memory leak in pg_restore with zstd-compressed data.
• Fix pg_basebackup to correctly handle pg_wal.tar files exceeding 2GB on Windows.
• Modify earthdistance to use SQL-standard function bodies, which fixes possible issues with major version upgrades to v17 when databases use this extension.
• Fix crash in pageinspect in instances where the brin_page_items() function definition is not updated to the latest version.
• Fix race condition when trying to cancel a postgres_fdw remote query.

This release also updates time zone data files to tzdata release 2025a for DST law changes in Paraguay, plus historical corrections for the Philippines.

Updating

All PostgreSQL update releases are cumulative. As with other minor releases, users are not required to dump and reload their database or use pg_upgrade in order to apply this update release; you may simply shutdown PostgreSQL and update its binaries.

Users who have skipped one or more update releases may need to run additional post-update steps; please see the release notes from earlier versions for details.

For more details, please see the release notes.

Links

• Download
• Release Notes
• Security
• Versioning Policy
• Donate

If you have corrections or suggestions for this release announcement, please send them to the pgsql-www@lists.postgresql.org public mailing list.

Postfix stable release 3.10.7 and legacy releases 3.9.8, 3.8.14, 3.7.19

[An on-line version of this announcement will be available at https://www.postfix.org/announcements/postfix-3.10.7.html]

Fixes for all Postfix 3.* releases:

• This patch addresses build errors on recent Linux distributions. With the patch, Postfix builds will run the compiler with a backwards compatibility option that is supported by Gcc and Clang. For other compilers, an error message provides hints.

  Background: the build errors are caused by C compilers that by default define a 'bool' type (size=1) that conflicts with Postfix's 'bool' type (an alias for 'int', typically size=4). Postfix 3.11 will support the new bool type, but that change is too large for stable Postfix releases (too many lines in too many files).

  This patch will also apply to Postfix 3.6 all the way back to Postfix 3.0 with a simple change: remove the Prereq: line, and remove the part that updates the HISTORY file.

You can find the updated Postfix source code at the mirrors listed at https://www.postfix.org/.

Postfix stable release 3.10.6 and legacy releases 3.9.7, 3.8.13, 3.7.18

[An on-line version of this announcement will be available at https://www.postfix.org/announcements/postfix-3.10.6.html]

Fixes for Postfix 3.10 only:

• Bugfix (defect introduced: Postfix 3.10, date: 20250117). Symptom: warning messages that smtp_tls_wrappermode requires "smtp_tls_security_level = encrypt".
  Root cause: Support for "TLS-Required: no" broke client-side TLS wrappermode support, by downgrading a connection to TLS security level 'may'.
  The fix changes the downgrade level for wrappermode connections to 'encrypt'. Rationale: by design, TLS can be optional only for connections that use STARTTLS. The downgrade to unauthenticated 'encrypt' allows a sender to avoid an email delivery problem. Problem reported by Joshua Tyler Cochran.

• New logging: the Postfix SMTP client will log a warning when an MX hostname does not match STS policy MX patterns, with "smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with TLSRPT support enabled in a TLS policy plugin. It will log a successful match only when verbose logging is enabled.

• Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP client null pointer crash when an STS policy plugin sends no policy_string or no mx_pattern attributes. This can happen only during tests with a fake STS plugin.

Fixes for Postfix 3.10, 3.9, 3.8, 3.7:

• Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault when a duplicate parameter name is given to "postconf -X" or "postconf -#'.

• Documentation: removed incorrect text from the parameter description for smtp_cname_overrides_servername. File: proto/postconf.proto.

You can find the updated Postfix source code at the mirrors listed at https://www.postfix.org/.

Postfix stable release 3.10.5 and legacy releases 3.9.6, 3.8.12, 3.7.17

[An on-line version of this announcement will be available at https://www.postfix.org/announcements/postfix-3.10.5.html]

Fixes for Postfix 3.10 only:

• Workaround for an interface mis-match between the Postfix SMTP client and MTA-STS policy plugins.

  • The existing behavior is to connect to any MX host listed in DNS, and to match the server certificate against any STS policy MX host pattern.

  • The corrected behavior is to connect to an MX host only if its name matches any STS policy MX host pattern, and to match the server certificate against the MX hostname.

  The corrected behavior must be enabled in two places: in Postfix with a new parameter "smtp_tls_enforce_sts_mx_patterns" (default: "yes") and in an MTA-STS plugin by enabling TLSRPT support, so that the plugin forwards STS policy attributes to Postfix. This works even if Postfix TLSRPT support is disabled at build time or at runtime.

• TLSRPT Workaround: when a TLSRPT policy-type value is "no-policy-found", pretend that the TLSRPT policy domain value is equal to the recipient domain. This ignores that different policy types (TLSA, STS) use different policy domains. But this is what Microsoft does, and therefore, what other tools expect.

Fixes for Postfix 3.10, 3.9, 3.8, 3.7:

• Bugfix (defect introduced: Postfix 3.0): the Postfix SMTP client's connection reuse logic did not distinguish between sessions that require SMTPUTF8 support, and sessions that do not. The solution is 1) to store sessions with different SMTPUTF8 requirements under distinct connection cache storage keys, and 2) to not cache a connection when SMTPUTF8 is required but the server does not support that feature.

• Bugfix (defect introduced: Postfix 3.0, date 20140731): the smtpd 'disconnect' command statistics did not count commands with "bad syntax" and "bad UTF-8 syntax" errors.

• Bugfix: the August 2025 patch broke DBM library support which is still needed on Solaris; and the same change could result in warnings with "database X is older than source file Y".

• Postfix 3.11 forward compatibility: to avoid ugly warnings when Postfix 3.11 is rolled back to an older version, allow a preliminary 'size' record in maildrop queue files created with Postfix 3.11 or later.

• Bugfix (defect introduced: Postfix 3.8, date 20220128): non-reproducible build, because the 'postconf -e' output order for new main.cf entries was no longer deterministic. Problem reported by Oleksandr Natalenko, diagnosis by Eray Aslan.

• To make builds predictable, add missing meta_directory and shlib_directory settings to the stock main.cf file. Problem diagnosed by Eray Aslan.

Fixes for Postfix 3.10, 3.9, 3.8:

• Bugfix (defect introduced: Postfix 3.9, date 20230517): posttls-finger(1) logged an incorrectly-formatted port number. Viktor Dukhovni.

You can find the updated Postfix source code at the mirrors listed at https://www.postfix.org/.

Postfix stable release 3.10.4 and legacy releases 3.9.5, 3.8.11, 3.7.16

[An on-line version of this announcement will be available at https://www.postfix.org/announcements/postfix-3.10.4.html]

Fixes for Postfix 3.10, 3.9, 3.8, 3.7:

• Fixes for postscreen(8):

  • Bugfix (defect introduced: postfix-2.2, date 20050203): after detecting a lookup table change, and after starting a new postscreen process, the old postscreen process logged an ENOTSOCK error while attempting to accept a connection on a socket that it was no longer listening on. This error was introduced first in the multi_server skeleton code, and was five years later duplicated in the event_server skeleton that was created for postscreen. Problem reported by Florian Piekert.

  • Bugfix (defect introduced: Postfix 2.8, date 20101230): after detecting a cache table change and before starting a new postscreen process, the old postscreen process did not close the postscreen_cache_map, and therefore kept an exclusive lock that could prevent a new postscreen process from starting. Problem reported by Florian Piekert.

• Fixes for tlsproxy(8):

  • Bugfix (defect introduced: Postfix 3.7): incorrect backwards compatible support for the legacy configuration parameters tlsproxy_client_level and tlsproxy_client_policy. This disabled the tlsproxy TLS client role when a legacy parameter was set (instead of the newer tlsproxy_client_security_level or tlsproxy_client_policy_maps). Reported by John Doe, diagnosed by Viktor Dukhovni.

  • Bugfix (defect introduced: Postfix 3.4): with the TLS client role disabled by configuration, the tlsproxy daemon dereferenced a null pointer while handling a tlsproxy client request. Reported by John Doe.

• Reducing process churn: Postfix daemons no longer automatically restart after a btree:, dbm:, hash:, lmdb:, or sdbm: table file modification time change, when they opened that table for writing.

• Portability: deleted an <openssl/engine.h> build dependency, because the feature is being removed from OpenSSL, and Postfix no longer needs it.

Fixes for Postfix 3.10 only:

• Cleanup: with "tls_required_enable = yes", the Postfix SMTP client will no longer maintain TLSRPT statistics for messages that contain a "TLS-Required: no" header. This can prevent TLSRPT notifications for TLSRPT notifications.

• Bugfix (defect introduced: Postfix 3.6, date 20200710): Postfix TLS client code logged "Untrusted TLS connection" (wrong) instead of "Trusted TLS connection" (right), for a new or resumed TLS session, when a server offered a trusted (valid PKI trust chain) certificate that did not match the expected server name pattern. Fix by Viktor Dukhovni.

You can find the updated Postfix source code at the mirrors listed at https://www.postfix.org/.

Postfix stable release 3.10.3

[An on-line version of this announcement will be available at https://www.postfix.org/announcements/postfix-3.10.3.html]

This release fixes defects that were introduced in Postfix 3.10. These were fixed first in the Postfix 3.11 unstable release.

The defects exist only with the default configuration "tls_required_enable = yes".

• Bugfix (defect introduced: Postfix-3.10, date 20250117): include the current TLS security level in the SMTP connection cache lookup key for lookups by next-hop destination, to avoid reusing the same SMTP connection when sending messages with and without a "TLS-Required: no" header. Likewise, include the current TLS security level in the TLS session lookup key, to avoid reusing the same TLS session info when sending messages with and without a "TLS-Required: no" header.

• Bugfix (defect introduced: Postfix-3.10, date 20250117): the Postfix SMTP client attempted to look up TLSA records even with "TLS-Required: no". This could result in unnecessary failures. Fix by Viktor Dukhovni & Wietse.

You can find the updated Postfix source code at the mirrors listed at https://www.postfix.org/.

Postfix stable release 3.10.2 and legacy releases 3.9.4, 3.8.10, 3.7.15

[An on-line version of this announcement will be available at https://www.postfix.org/announcements/postfix-3.10.2.html]

Fixes for Postfix 3.10, 3.9, 3.8, 3.7:

• Bugfix (defect introduced: date 19991116): when appending a setting to a main.cf or master.cf file that did not end in a newline character, the "postconf -e" command did not add an extra newline character before appending the new setting, causing information to become garbled. Fix by Michael Tokarev.

• Bugfix (defect introduced: Postfix 2.3, date 20051222): the Dovecot auth client did not attempt to create a new connection after an I/O error on an existing connection. Reported by Oleksandr Kozmenko.

• Improved and corrected error messages when converting (host or service) information to (symbolic text, numerical text, or binary) form.

• Documentation: updated link to Dovecot documentation.

You can find the updated Postfix source code at the mirrors listed at https://www.postfix.org/.

Postfix stable release 3.10.1 and legacy releases 3.9.3, 3.8.9, 3.7.14, 3.6.18

[An on-line version of this announcement will be available at https://www.postfix.org/announcements/postfix-3.10.1.html]

Fix for Postfix 3.10, 3.9, 3.8, 3.7, 3.6:

• Bugfix (defect introduced: 20250210): a recent 'fix' for the default smtp_tls_dane_insecure_mx_policy setting resulted in unnecessary 'dnssec_probe' warnings, on systems that disable DNSSEC lookups (which is the default).

You can find the updated Postfix source code at the mirrors listed at https://www.postfix.org/.

Postfix stable release 3.10.0

[An updated version of this announcement will be available at https://www.postfix.org/announcements/postfix-3.10.0.html]

Postfix stable release 3.10.0 is available. Postfix 3.6 - 3.9 were updated earlier this week; after that, Postfix 3.6 will no longer be updated.

The main changes are below. See the RELEASE_NOTES file for further details.

Changes that need a restart:

• Internal protocol change: Postfix needs "postfix reload" (or "postfix stop" and "postfix start") after upgrade, because of a change in the delivery agent protocol. If this step is skipped, Postfix delivery agents will log a warning:

  unexpected attribute smtputf8 from xxx socket (expecting: sendopts)

  where xxx is the delivery agent service name.

Changes in TLS support:

• Forward compatibility: Support for OpenSSL 3.5 post-quantum cryptography. To manage algorithm selection, OpenSSL introduces new TLS group syntax that Postfix will not attempt to imitate. Instead, Postfix now allows the tls_eecdh_auto_curves and tls_ffdhe_auto_groups parameter values to have an empty value. When both are set empty, the algorithm selection can be managed through OpenSSL configuration. For more, look for "Post-quantum" in the postconf(5) manpage.

• Support for the RFC 8689 "TLS-Required: no" message header to request delivery of messages (such as TLSRPT summaries) even if the preferred TLS security policy cannot be enforced. This limits the Postfix SMTP client to "smtp_tls_security_level = may" which does not authenticate server certificates and which allows falling back to plaintext.

  Support for the REQUIRETLS SMTP service extension will evolve in Postfix 3.11.

• Support for the TLSRPT protocol (defined in RFC 8460). With this, a domain can publish a policy in DNS that requests daily summary reports for successful and failed SMTP-over-TLS connections to that domain's MX hosts. This supports both DANE (built-in) and MTA-STS (via an smtp_tls_policy_maps plugin). The implementation uses a TLSRPT library and reporting infrastructure that are maintained by sys4. For details, see TLSRPT_README.

Miscellaneous changes:

• Privacy: With "smtpd_hide_client_session = yes", the Postfix SMTP server generates a Received: header without client session info. This setting may be used with the MUA submission services (port 465 and 587).

• Support for RFC 2047 encoding of non-ASCII "full name" information in Postfix-generated From: message headers. Encoding non-ASCII full names can avoid the need to use SMTPUTF8, and therefore can avoid incompatibility with sites that do not support SMTPUTF8. See the full_name_encoding_charset parameter description for details.

• Database performance: When mysql: or pgsql: configuration specifies a single host, assume that it is a load balancer and reconnect immediately after a single failure, instead of failing all requests for 60s.

Changes in logging:

• The Postfix Milter implementation now logs the reason for a 'quarantine' action, instead of "milter triggers HOLD action".

• The SMTP server now logs the queue ID (or "NOQUEUE") when a connection ends abnormally (timeout, lost connection, or too many errors), and the cleanup server now logs "queueid: canceled" when a message transaction is started but not completed. These changes simplify logfile analysis.

• Dovecot SASL client logging for "Invalid authentication mechanism" now includes the name of that mechanism.

• Postfix SMTP server 'reject' logging now shows the sasl_method, sasl_username, and sasl_sender if available.

You can find the Postfix source code at the mirrors listed at https://www.postfix.org/.

Postfix legacy releases 3.9.2, 3.8.8, 3.7.13, 3.6.17

[An on-line version of this announcement will be available at https://www.postfix.org/announcements/postfix-3.9.2.html]

These releases add forward compatibility with upcoming Postfix and OpenSSL versions, improve PostgreSQL and MySQL performance, and fix minor bugs. This will be the last update for Postfix 3.6.

Fixes for Postfix 3.9.2, 3.8.8, 3.7.13, 3.6.17:

• Forward compatibility: Support for OpenSSL 3.5 post-quantum cryptography. To manage algorithm selection, OpenSSL introduces new TLS group syntax that Postfix will not attempt to imitate. Instead, Postfix now allows the tls_eecdh_auto_curves and tls_ffdhe_auto_groups parameter values to have an empty value. When both are set empty, the algorithm selection can be managed through OpenSSL configuration. Viktor Dukhovni.

• Forward compatibility: ignore new queue file flag bits that may be used with Postfix 3.10 and later. This is a safety in case a Postfix 3.10 upgrade needs to be rolled back, after the new TLS-Required feature has been used.

• Performance: when a mysql: or pgsql: configuration specifies a single host, assume that it is a load balancer and reconnect immediately after a single failure, instead of failing all requests for 60s.

• Bugfix (defect introduced: Postfix 3.4, date 20181113): a server with multiple TLS certificates could report, for a resumed TLS session, the wrong server-signature and server-digest names in logging and Received: message headers. Viktor Dukhovni.

• Bugfix (defect introduced: Postfix 3.3, date 20180107) small memory leak in the cleanup daemon when generating a "From: full-name &quot; message header. The impact is limited because the number of requests is bounded by the &quot;max_use&quot; configuration parameter. Found during code maintenance.

• Bugfix (defect introduced: Postfix 3.0): the bounce daemon mangled a non-ASCII address localpart in the "X-Postfix-Sender:" field of a delivery status notification. It backslash-escaped each byte in a multi-byte character. This behavior was implemented in Postfix 2.1 (no support for UTF8 local-parts), but it became incorrect after SMTPUTF8 support was implemented in Postfix 3.0.

• Bugfix (defect introduced: Postfix 3.6): Reverted the default smtp_tls_dane_insecure_mx_policy setting to "dane" as of Postfix 3.6.17, 3.7.13, 3.8.8, 3.9.2, and 3.10.0. By mistake the default was dependent on the smtp_tls_security_level setting. Problem reported by Ömer Güven.

• Portability: added "include <sys_socket.h>" for a SUNOS5 workaround. Gary R. Schmidt.

You can find the updated Postfix source code at the mirrors listed at https://www.postfix.org/.

Postfix stable release 3.9.1, and legacy releases 3.8.7, 3.7.12, 3.6.16

[An on-line version of this announcement will be available at https://www.postfix.org/announcements/postfix-3.9.1.html]

Fixed with Postfix 3.9.1:

• The mail_version configuration parameter did not have a three-number value (3.9 instead of 3.9.0; it still had the two-number version from the development releases postfix-3.9-yyyymmdd). This broke pathnames derived from the mail_version value, such as shlib_directory. Problem reported by Michael Orlitzky.

Fixed with Postfix 3.9.1, 3.8.7, 3.7.12, 3.6.16:

• Bugfix (defect introduced: Postfix 2.9, date 20111218): with "smtpd_sasl_auth_enable = no", the permit_sasl_authenticated feature ignored information that was received with the XCLIENT LOGIN command, so that the client was treated as unauthenticated. This was fixed by removing an unnecessary test. Problem reported by Antonin Verrier.

• Bugfix (defect introduced: postfix 3.0): the default master.cf syslog_name setting for the relay service did not preserve multi-instance information, which complicated logfile analysis. Found during a support discussion.

• Bugfix (defect introduced: Postfix 2.3, date 20051222): file descriptor leak after failure to connect to a Dovecot auth server. The impact is limited because Dovecot auth failures are rare, there are limits on the number of retries (one), on the number of errors per SMTP session (smtpd_hard_error_limit), on the number of sessions per SMTP server process (max_use), and on the number of file handles per process (managed with sysctl). Found during code maintenance.

• Bugfix (defect introduced: Postfix 3.4, date 20190121): the postsuper command failed with "open logfile '/path/to/file': Permission denied" when the maillog_file parameter specified a filename and Postfix was not running. This was fixed by opening the maillog_file before dropping root privileges. Found during code maintenance.

• Bugfix (defect introduced Postfix 3.0). No autodetection of UTF8 text when missing message headers were automatically added by Postfix (for example, a From: header with UTF8 full name information from the password file). This caused Postfix to send UTF8 in message headers without using the SMTPUTF8 protocol. Problem reported by Michael Tokarev.

You can find the updated Postfix source code at the mirrors listed at https://www.postfix.org/.

You can install pre-built binaries from https://repo.dovecot.org/

Docker images can be found at https://hub.docker.com/r/dovecot/dovecot

Please review https://doc.dovecot.org/2.4.2/installation/upgrade/2.3-to-2.4.html and https://doc.dovecot.org/2.4.2/installation/installation.html.

Important

The v2.4.2 comes with new libpcre2 dependency.

Critical bug fixes

• CVE-2025-30189: Passdb oauth2 (not oauth2 mechanism), passdb passwd,
  passdb bsdauth, and userdb passwd drivers would cause users to be
  cached with same cache key when auth cache was enabled.

Changes

• auth: Remove proxy_always field.
• config: Change settings history parsing to use python3.
• doveadm: Print table formatter - Print empty values as "-".
• imapc: Propagate remote error codes properly.
• lda: Default mail_home=$HOME environment if not using userdb lookup
• lib-dcrypt: Salt for new version 2 keys has been increased to 16 bytes.
• lib-dregex: Add libpcre2 based regular expression support to Dovecot,
  if the library is missing, disable all regular expressions. This
  adds libpcre2-32 as build dependency.
• lib-oauth2: jwt - Allow nbf and iat to point 1 second into future.
• lib: Replace libicu with our own unicode library. Removes libicu as build
  dependency.
• login-common: If proxying fails due to remote having invalid SSL cert, don't reconnect.

New features

• auth: Add ssl_client_cert_fp and ssl_client_cert_pubkey_fp fields, see
  https://doc.dovecot.org/latest/core/summaries/settings.html#ssl_peer_certificate_fingerprint_hash
  for more information.
• config: Add support for $SET:filter/path/setting.
• config: Improve @group includes to work with overwriting their settings.
• doveadm kick: Add support for kicking multiple usernames
• doveadm mailbox status: Add support for deleted status item.
• imap, imap-client: Add experimental partial IMAP4rev2 support.
• imap: Implement support for UTF8=ACCEPT for APPEND
• lib-oauth2, oauth2: Add oauth2_token_expire_grace setting.
• lmtp: lmtp-client - Support command pipelining.
• login-common: Support local/remote blocks better.
• master: accept() unix/inet connections before creating child process
  to handle it. This reduces timeouts when child processes are slow to
  spawn themselves.

Bug fixes

• SMTPUTF8 was accepted even when it wasn't enabled.
• auth, *-login: Direct logging with -L parameter was not working.
• auth: Crash occured when OAUTH token validation failed with
  oauth2_use_worker_with_mech=yes.
• auth: Invalid field handling crashes were fixed.
• auth: ldap - Potential crash could happen at deinit.
• auth: mech-gssapi - Server sending empty initial response would cause
  errors.
• auth: mech-winbind - GSS-SPNEGO mechanism was erroneously marked as
  not accepting NUL.
• config: Multiple issues with $SET handling has been fixed.
• configure: Building without LDAP didn't work.
• doveadm: If source user didn't exist, a crash would occur.
• imap, pop3, submission, imap-urlauth: USER environment usage was broken
  when running standalone.
• imap-hibernate: Statistics would get truncated on unhibernation.
• imap: "SEARCH MIMEPART FILENAME ENDS" command could have accessed
  memory outside allocated buffer, resulting in a crash.
• imapc: Fetching partial headers would cause other cached headers to
  be cached empty, breaking e.g. imap envelope responses when caching to disk.
• imapc: Shared namespace's INBOX mailbox was not always uppercased.
• imapc: imapc_features=guid-forced GUID generation was not working correctly.
• lda: USER environment was not accepted if -d hasn't been specified.
• lib-http: http-url - Significant path percent encoding through parse
  and create was not preserved. This is mainly important for Dovecot's
  Lua bindings for lib-http.
• lib-settings: Crash would occur when using %variables in SET_FILE type settings.
• lib-storage: Attachment flags were attempted to be added for
  readonly mailboxes with mail_attachment_flags=add-flags.
• lib-storage: Root directory for unusable shared namespaces was
  unnecessarily attempted to be created.
• lib: Crash would occur when config was reloaded and logging to syslog.
• login-common: Crash might have occured when login proxy was destroyed.
• sqlite: The sqlite_journal_mode=wal setting didn't actually do anything.
• Many other bugs have been fixed.

Installation

You can install pre-built binaries from https://repo.dovecot.org

Docker images can be found at https://hub.docker.com/r/dovecot/dovecot

Please review https://doc.dovecot.org/2.4.1/installation/upgrade/2.3-to-2.4.html and https://doc.dovecot.org/2.4.1/installation/installation.html.

Important

We have changed the signing key for 2.4 going forward, releases are signed with EF0882079FD4ED32BF8B23B2A1B09EF84EDC5219, which can be found at https://repo.dovecot.org/DOVECOT-REPO-GPG-2.4 and is signed with the previous key.

The old key has been renamed to https://repo.dovecot.org/DOVECOT-REPO-GPG-2.3.

We are happy to provide experimental arm64 support in the form of a Docker image. There are now three kinds of images, latest, latest-dev and latest-root.

The latest docker image is now ran rootless, with UID 1000 as vmail. Please take this into consideration when upgrading. The latest-root image still runs as root. Latest 2.3 image can be used with tag 2.3-latest still.

Changes

• auth: Change unix_listener/auth-userdb/group = $SET:default_internal_group
  This change needs dovecot_config_version=2.4.1.
• auth: lua - Remove support for single string result.
• imap: Unconditionally advertise SPECIAL-USE capability.
• lib-dcrypt: Install dcrypt_openssl.so into dovecot modules directory.
• lib-master: For glibc, default MALLOC_MMAP_THRESHOLD_=131072.
• lib-storage: Change default mail_cache_fields to:
  hdr.date hdr.subject hdr.from hdr.sender hdr.reply-to hdr.to
  hdr.cc hdr.bcc hdr.in-reply-to hdr.message-id
  date.received size.virtual imap.bodystructure mime.parts hdr.references
  hdr.importance hdr.x-priority hdr.x-open-xchange-share-url
  pop3.uidl pop3.order. This change needs dovecot_config_version=2.4.1.
• lib-var-expand: Use moduledir instead of pkglibdir for crypt.
• lmtp: Change the default lmtp_user_concurrency_limit to 10.
  This change needs dovecot_config_version=2.4.1.
• lmtp: Change the default service_restart_request_count to 1.
  This change needs dovecot_config_version=2.4.1.

New features and additions

• auth: Allow configuring passdb/userdb sql to use auth-workers.
• config: Add default group @mailbox_defaults = english.
• config: Improve "Unknown setting" error with more details and
  suggestions.
• doveconf: Add -U parameter to ignore unknown settings in config file.
• fts-flatcurve: Support lock files in VOLATILEDIR.
• imap-acl: Add support for the IMAP LIST-MYRIGHTS capability (RFC 8440).
• imap-client: Support ANONYMOUS authentication.
• imap: Implement support for the REPLACE capability.

Bug fixes

• auth: ldap - Passdb fields were ignored with
  passdb_ldap_bind_userdn=yes.
• auth: lua - Fix error result handling in lua passdb/userdb.
• auth: oauth2 - When building oauth2 failure reply, memory would leak.
• config: local_name handling would work wrong with multiple names and
  wildcards.
• fts-flatcurve: A potential crash could occur when searching virtual
  mailboxes.
  Fixes: Panic: file fts-search.c: line 87 (level_scores_add_vuids):
  assertion failed: (array_count(&vuids_arr) == array_count(&br->scores))
• fts-flatcurve: Maybe queries were done wrong.
• fts-flatcurve: Non-selectable mailboxes were not ignored when doing
  optimize/rescan.
• fts-flatcurve: Signal 11 crash could happen with fts rescan.
• fts: Fix crash caused by event object lifecycle mishandling.
• imap-hibernate: Client counters would get reset on unhibernation,
  affecting imap_logout_format variables.
• imap: Crash would occur with Maildir when trying to send INPROGRESS
  during mailbox syncing.
• ldap: Dovecot could not be compiled without LDAP.
• lib-dcrypt: Output stream encryption can cause assert crash if
  attempting to encrypt over 64 GiB of data with GCM. This is still not
  supported with GCM, but it fails better.
• lib-http: HTTP client context memory usage was increasing.
• lib-http: Pipeline corruption could happen after 100 Continue response.
• lib-settings: Variable expansion initialization could crash with
  Panic: file settings.c: line 1560 (settings_var_expand_init_add):
  assertion failed: (I_MAX(num_tables, num_provs) == num_ctx)
• lib-smtp: Pipelining initial SASL response after AUTH was broken.
• lib-var-expand: If filter failed, memory leak would occur.
• lib-var-expand: Older bison versions did not have error symbol for
  handling causing unexpected behaviour on the parser on error conditions.
• quota: Quota calculations had minor bugs causing small errors.

Installation

You can install pre-built binaries from https://repo.dovecot.org

Docker images can be found at https://hub.docker.com/r/dovecot/dovecot

Please review https://doc.dovecot.org/2.4.0/installation/upgrade/2.3-to-2.4.html and https://doc.dovecot.org/2.4.0/installation/installation.html.

Important

We have changed the signing key for 2.4 going forward, releases are signed with EF0882079FD4ED32BF8B23B2A1B09EF84EDC5219, which can be found at https://repo.dovecot.org/DOVECOT-REPO-GPG-2.4 and is signed with the previous key.

The old key has been renamed to https://repo.dovecot.org/DOVECOT-REPO-GPG-2.3.

We are happy to provide experimental arm64 support in the form of a Docker image.

Docker images are now run rootless, with UID 1000 as vmail. Please take this into consideration when upgrading. Latest 2.3 image can be used with tag 2.3-latest still.

Changes

• config: dovecot_config_version must be the first non-comment
  line in configuration file.
• config: dovecot_storage_version must be in the configuration
  file.
• config: Many configuration options have changed so old configuration
  files do not work without rewrite. See
  https://doc.dovecot.org/latest/installation/upgrade/2.3-to-2.4.html
• config: New variable expansion syntax has been introduced, see
  https://doc.dovecot.org/latest/core/settings/variables.html
• config: Some default settings have changed.
• config: plugin {} section has been removed.
• *-login: With ssl=required, connections from login_trusted_networks
  are now also required to be SSL/TLS encrypted.
• acl: Use ACL settings instead of Global ACL Directories.
• auth-worker: auth_worker_max_count is replaced with
  service auth-worker { process_limit }.
• auth: Weak password schemes are disabled by default, use
  auth_allow_weak_schemes to enable them.
• auth_debug, mail_debug: Use log_debug filter instead.
• config: All sections require a name, for example passdb/userdb:

  passdb static {
    password=secret
  }
  

• db2: Remove Berkeley DB support.
• dict-memcached: This is removed, use Redis instead.
• director: Feature has been removed. Unsupported small-scale replacement:
  https://github.com/dovecot/tools/blob/main/director.lua
• doveadm: USER environment variable is only supported with
  --no-userdb-lookup. One of -u, -F or -A must be used
  otherwise.
• doveconf: Option -n is now default when running doveconf.
• dsync: Use doveadm sync instead, legacy symlink has been removed.
• fs-sis: Feature is now deprecated and has been made read-only.
  It will be removed in future release.
• fts-lucene, fts-squat: These have been removed, use fts-flatcurve or
  fts-solr instead.
• imap-login: IMAP compression is now handled in proxies.
• imap_quota: SETQUOTA / quota_set has been removed.
• imap_zlib: This plugin is no longer needed, it's always enabled.
• imapc: All features are enabled by default, imapc_features can be used
  to explicitly disable features that are not wanted.
• lib-storage: mbox driver is now frozen.
• mail_compress: XZ and LZMA algorithm support has been removed.
• mailbox-alias: Plugin has been removed.
• old_stats, auth_stats: These have been removed.
• openssl: Minimum supported version of OpenSSL is now 1.1.1.
• openssl: Add support for OpenSSL 3.x
• quota-dict, quota-dirsize: These have been removed, use quota-count
  instead. You can use quota-clone to copy quota usage to some database.
• replicator: Feature has been removed. Use NFS or some other shared
  filesystem instead, or run doveadm sync in crontab.
• stats: The bytes_in and bytes_out field in several events have been
  renamed as net_in_bytes and net_out_bytes.
• zlib: Renamed to mail_compress plugin.

New features and additions

• Experimental SMTPUTF8 and IMAP UTF8=ACCEPT support has been added.
  Needs --enable-experimental-mail-utf8 configure option and
  mail_utf8_extensions=yes setting.
• Long running mail commands can be aborted with Ctrl-C / doveadm kick.
• auth: LDAP driver now supports multi-value attributes.
• auth: Add support for SCRAM-SHA-1-PLUS and SCRAM-SHA-256-PLUS.
• auth: Add support for TLS channel binding.
• auth: Support sending JA3 hash to policy server.
• configure: Detect latest Lua version.
• *-login: Support for TLS Server Name has been improved to allow pre-login
  settings. For example capabilities to be changed based on TLS Server Name.
• *-login: Support for TLS ALPN has been added, connections with mismatching
  application are now refused. Missing ALPN is accepted.
• fts-flatcurve: New Xapian based FTS plugin has been added.
• imap: Support for INPROGRESS untagged messages as per RFC 9585.
• lib-lua: Expose Dovecot DNS client.
• lib-lua: Expose Dovecot HTTP client.
• lib-sasl: Support SCRAM-SHA mechanisms.
• lmtp: SNI support has been added which allows settings to be applied
  based on TLS Server Name.
• sqlite: Support WAL mode.
• stats: Submetric name size has been increased.
• submission: Add submission_add_received_header setting to protect
  sender identity by suppressing the Received: header.

Bug fixes

• Many bugs have been fixed.

• CVE-2024-23184: A large number of address headers in email resulted
  in excessive CPU usage.
• CVE-2024-23185: Abnormally large email headers are now truncated or
  discarded, with a limit of 10MB on a single header and 50MB for all
  the headers of all the parts of an email.
• oauth2: Dovecot would send client_id and client_secret as POST parameters
  to introspection server. These need to be optionally in Basic auth
  instead as required by OIDC specification.
• oauth2: JWT key type check was too strict.
• oauth2: JWT token audience was not validated against client_id as
  required by OIDC specification.
• oauth2: XOAUTH2 and OAUTHBEARER mechanisms were not giving out
  protocol specific error message on all errors. This broke OIDC discovery.
• oauth2: JWT aud validation was not performed if aud was missing
  from token, but was configured on Dovecot.

• lib-oauth2: Allow JWT tokens to be validated with missing typ field.
  The typ field is left out by some key issuers to conserve space,
  notably kubernetes. Now missing typ is tolerated, but if present, it
  still must be "jwt".

• auth: Auth passdb and userdb reply can contain "event_=value"
  which will be added to login event and mail user event respectively.
• lib-master: Set process title during various initialization stages to
  clearly describe what the process is waiting on.
• lib-storage: The mail_temp_scan_interval is now fuzzed incrementing it
  by 0..30% based on username's hash to reduce the chance of load spikes
  .
• lib-storage: The temp file scan has been moved from the open of the
  mailbox to the close, to reduce the latency perceived by users.
• stats: If metric has fields specified, all these fields are
  exported as counters to prometheus exposition.
  See https://doc.dovecot.org/configuration_manual/stats/openmetrics/.

• *-login: Processes might have crashed when a SSL connection disconnect
  s
  uncleanly.
• acl: When plugin was loaded \HasChildren and \HasNoChildren flags
  were calculated incorrectly for mailboxes containing '*' and '%'
  in their names.
• auth: Crash occured if a connection to PostgreSQL database server
  failed during startup.
• auth: Logins with invalid passwords (e.g. unknown scheme) in passdb
  were failing with "password mismatch" instead of "internal error".
• auth: XOAUTH2 and OAUTHBEARER mechanisms were not giving out protocol
  specific error message on all errors. This especially broke OIDC
  discovery.
• dbox: When last_temp_file_scan header wasn't set (especially after
  dsync migration), the next mailbox open always triggers the temp file
  scan. This could have caused a load spike after migrations. Fixed by
  using the mailbox directory's atime when the header isn't set, which
  usually moves the scan time into the future.
• dict-redis: A crash would occur on transaction rollback.
• dsync: Infinite loop causing out of memory would occur when handling
  mailbox deletion from remote end and hierarchy separators would differ.
• dsync: Incremental dsync failed for folder names ending with '%',
  unless BROKENCHAR was set. Also folder names with '%' elsewhere in
  them caused each incremental dsync to unnecessarily rename the folder
  to a temporary name and back. v2.3.19 regression.
• imap-hibernate: If an IMAP client unhibernation timed out with
  "(version received)", the unhibernation could still have successfully
  finished later on and continued working normally. This was rather
  confusing, because imap-hibernate already logged that the client got
  disconnected. Avoid this by forcing the connection to shutdown on
  unhibernation timeout.
• imapc: Crashed when a folder mapped through the virtual plugin
  disappears from the storage.
• imapc: EXPUNGE, EXISTS or FETCH replies from a server for a previously
  selected mailbox could have been processed as if they belonged to the
  new mailbox currently being selected. This could have caused warnings.
• lib-http: Dovecot HTTP server (doveadm, stats/openmetrics) may have
  disconnected HTTP clients before the response is fully sent. This
  happened only on busy servers where kernel's socket buffers were
  rather full.
• lib-http: Fixed a potential crash on http-server if a client
  disconnected early. v2.3.18 regression.
• lib-index: Index file corruption could have caused a crash. Fixes:
  Panic: file mail-transaction-log-view.c: line 165 (mail_transaction_log_view_set):
  assertion failed: (min_file_seq <= max_file_seq).
• lib-index: Purging an existing >1GB cache file can crash. Now cache
  files still above 1GB after purging are removed. Fixes:
  Panic: file mail-index-util.c: line 10 (mail_index_uint32_to_offset):
  assertion failed: (offset < 0x40000000)
• lib-lua: A HTTP client could not resolve DNS names in mail processes,
  because it expected "the dns-client" socket to exist in the current
  directory.
• lib-oauth2: Dovecot would send client_id and client_secret as POST
  parameters to the introspection server. These need to be optionally in
  Basic auth instead.
• lib-oauth2: JWT aud validation was not performed if aud was missing
  from a token, but was configured on Dovecot.
• lib-oauth2: JWT key type check was too strict.
• lib-oauth2: JWT token audience was not validated against client_id as
  required by the specification.
• lib-ssl-iostream: Using the ssl_require_crl=yes setting may have caused
  CRL check failures for outgoing SSL/TLS connections, although it was
  supposed to affect checking CRLs only for client-side SSL
  certificates. v2.3.17 regression.
• lib-sql: MySQL driver leaked memory when connection failed.
• lib-storage: Various fixes when running into out of disk space.
• master: Service idle_kill setting didn't work properly on busy
  servers. It was very unlikely that any process was idling long enough
  to become killed. Also the idle_kill handling code was using quite a
  lot of CPU on the master process when there were a lot of processes
  (e.g. imap). The new behavior is to track the lowest number of idling
  processes every idle_kill time interval and then kill that many idling
  processes.
• mdbox: Temp file scan was done for always empty directories.
• mdbox: The fdatasync() call was done in wrong parent directory when
  writing mails. Also on a failure it crashed instead of logging an error.
• notify_status: The plugin crashes if any user initialization fails.
• pop3: Sending command with the ':' character caused an assert-crash.
  v2.3.18 regression. Fixes: Panic: event_reason_code_prefix(): name has ':'
• stats: Fix panic when a nonexistent event exporter was referenced while
  adding a new metric dynamically via doveadm stats add. This produces
  a proper error now.
• stats: If process exported a lot of events and then exited, some of
  the last events may have become lost.
• stats: Invalid Prometheus label names were created with specific
  histogram group_by configurations. Prometheus rejected these labels.
• welcome: The plugin didn't execute in some situations that created
  INBOX but didn't open it, e.g. if GETMETADATA was used before the
  INBOX was opened.

• Add dsync_features=no-header-hashes. When this setting is enabled and
  one dsync side doesn't support mail GUIDs (i.e. imapc), there is no
  fallback to using header hashes. Instead, dsync assumes that all mails
  with identical IMAP UIDs contains the same mail contents. This can
  significantly improve dsync performance with some IMAP servers that
  don't support caching Date/Message-ID headers.
• lua: HTTP client has more settings now, see
  https://doc.dovecot.org/admin_manual/lua/#dovecot.http.client
• replicator: "doveadm replicator status" command now outputs when the
  next sync is expected for the user.

• LAYOUT=index: duplicate GUIDs were not cleaned out. Also the list
  recovery was not optimal.
• auth: Assert crash would occur when iterating multiple userdb
  backends.
• director: Logging into director using master user with
  auth_master_user_separator character redirected user to a wrong
  backend, unless master_user_separator setting was also set to the same
  value. Merged these into auth_master_user_separator.
• dsync: Couldn't always fix folder GUID conflicts automatically with
  Maildir format. This resulted in replication repeatedly failing
  with "Remote lost mailbox GUID".
• dsync: Failed to migrate INBOX when using namespace prefix=INBOX/,
  resulting in "Remote lost mailbox GUID" errors.
• dsync: INBOX was created too early with namespace prefix=INBOX/,
  resulting a GUID conflict. This may have been resolved automatically,
  but not always.
• dsync: v2.3.18 regression: Wrong imapc password with dsync caused
  Panic: file lib-event.c: line 506 (event_pop_global):
  assertion failed: (event == current_global_event)
• imapc: Requesting STATUS for a mailbox with imapc and INDEXPVT
  configured did not return correct (private) unseen counts.
• lib-dict: Process would crash when committing data to redis without
  dict proxy.
• lib-mail: Corrupted cached BODYSTRUCTURE caused panic during FETCH.
  Fixes: Panic: file message-part-data.c: line 579 (message_part_is_attachment):
  assertion failed: (data != NULL). v2.3.13 regression.
• lib-storage: mail_attribute_dict with dict-sql failed when it tried to
  lookup empty dict keys.
• lib: ioloop-kqueue was missing include breaking some BSD builds.
• lua-http: Dovecot Lua HTTP client could not resolve DNS names in mail
  processes, because it expected "dns-client" socket to exist in the
  current directory.
• oauth2: Using %{oauth2:name} variables could cause useless
  introspections.
• pop3: Sending POP3 command with ':' character caused an assert-crash.
  v2.3.18 regression.
• replicator: Replication queue had various issues, potentially causing
  replication requests to become stuck.
• stats: Invalid Prometheus label names were created with specific
  histogram group_by configurations. Prometheus rejected these labels.

• doveadm deduplicate: Non-duplicate mails were deleted.
  v2.3.19 regression.
• auth: Crash would occur when iterating multiple backends.
  Fixes: Panic: file userdb-blocking.c:
  line 125 (userdb_blocking_iter_next): assertion failed: (ctx->conn != NULL)

• Added mail_user_session_finished event, which is emitted when the mail
  user session is finished (e.g. imap, pop3, lmtp). It also includes
  fields with some process statistics information.
  See https://doc.dovecot.org/admin_manual/list_of_events/ for more
  information.
• Added process_shutdown_filter setting. When an event matches the filter,
  the process will be shutdown after the current connection(s) have
  finished. This is intended to reduce memory usage of long-running imap
  processes that keep a lot of memory allocated instead of freeing it to
  the OS.
• auth: Add cache hit indicator to auth passdb/userdb finished events.
  See https://doc.dovecot.org/admin_manual/list_of_events/ for more
  information.
• doveadm deduplicate: Performance is improved significantly.
• imapc: COPY commands were sent one mail at a time to the remote IMAP
  server. Now the copying is buffered, so multiple mails can be copied
  with a single COPY command.
• lib-lua: Add a Lua interface to Dovecot's HTTP client library. See
  https://doc.dovecot.org/admin_manual/lua/ for more information.

• auth: Cache lookup would use incorrect cache key after username change.
• auth: Improve handling unexpected LDAP connection errors/hangs.
  Try to fix up these cases by reconnecting to the LDAP server and
  aborting LDAP requests earlier.
• auth: Process crashed if userdb iteration was attempted while auth-workers
  were already full handling auth requests.
• auth: db-oauth2: Using %{oauth2:name} variables caused unnecessary
  introspection requests.
• dict: Timeouts may have been leaked at deinit.
• director: Ring may have become unstable if a backend's tag was changed.
  It could also have caused director process to crash.
• doveadm kick: Numeric parameter was treated as IP address.
• doveadm: Proxying can panic when flushing print output. Fixes
  Panic: file ioloop.c: line 865 (io_loop_destroy): assertion failed:
  (ioloop == current_ioloop).
• doveadm sync: BROKENCHAR was wrongly changed to '_' character when
  migrating mailboxes. This was set by default to %, so any mailbox
  names containing % characters were modified to "_25".
• imapc: Copying or moving mails with doveadm to an imapc mailbox could
  have produced "Error: Syncing mailbox '[...]' failed" Errors. The
  operation itself succeeded but attempting to sync the destination
  mailbox failed.
• imapc: Prevent index log synchronization errors when two or more imapc
  sessions are adding messages to the same mailbox index files, i.e.
  INDEX=MEMORY is not used.
• indexer: Process was slowly leaking memory for each indexing request.
• lib-fts: fts header filters caused binary content to be sent to the
  indexer with non-default configuration.
• doveadm-server: Process could hang in some situations when printing
  output to TCP client, e.g. when printing doveadm sync state.
• lib-index: dovecot.index.log files were often read and parsed entirely,
  rather than only the parts that were actually necessary. This mainly
  increased CPU usage.
• lmtp-proxy: Session ID forwarding would cause same session IDs being
  used when delivering same mail to multiple backends.
• log: Log prefix update may have been lost if log process was busy.
  This could have caused log prefixes to be empty or in some cases
  reused between sessions, i.e. log lines could have been logged for the
  wrong user/session.
• mail_crypt: Plugin crashes if it's loaded only for some users. Fixes
  Panic: Module context mail_crypt_user_module missing.
• mail_crypt: When LMTP was delivering mails to both recipients with mail
  encryption enabled and not enabled, the non-encrypted recipients may
  have gotten mails encrypted anyway. This happened when the first
  recipient was encrypted (mail_crypt_save_version=2) and the 2nd
  recipient was not encrypted (mail_crypt_save_version=0).
• pop3: Session would crash if empty line was sent.
• stats: HTTP server leaked memory.
• submission-login: Long credentials, such as OAUTH2 tokens, were refused
  during SASL interactive due to submission server applying line length
  limits.
• submission-login: When proxying to remote host, authentication was not
  using interactive SASL when logging in using long credentials such as
  OAUTH2 tokens. This caused authentication to fail due to line length
  constraints in SMTP protocol.
• submission: Terminating the client connection with QUIT command after
  mail transaction is started with MAIL command and before it is
  finished with DATA/BDAT can cause a segfault crash.
• virtual: doveadm search queries with mailbox-guid as the only parameter
  crashes: Panic: file virtual-search.c: line 77 (virtual_search_get_records):
  assertion failed: (result != 0)

• Removed mail_cache_lookup_finished event. This event wasn't especially
  useful, but it increased CPU usage significantly.
• fts: Don't index inline base64 encoded content in FTS indexes using
  the generic tokenizer. This reduces the FTS index sizes by removing
  input that is very unlikely to be searched for. See
  https://doc.dovecot.org/configuration_manual/fts/tokenization for
  details on how base64 is detected. Only applies when using libfts.
• lmtp: Session IDs are now preserved through proxied connections, so
  LMTP sessions can be tracked. This slightly changes the LMTP session
  ID format by appending ":Tn" (transaction), ":Pn" (proxy connection)
  and ":Rn" (recipient) counters after the session ID prefix.

• Events now have "reason_code" field, which can provide a list of
  reasons why the event is happening. See
  https://doc.dovecot.org/admin_manual/event_reasons/
• New events are added. See https://doc.dovecot.org/admin_manual/list_of_events/
• fts: Added fts_header_excludes and fts_header_includes settings to
  specify which headers to index. See
  https://doc.dovecot.org/settings/plugin/fts-plugin#plugin-fts-setting-fts-header-excludes
  for configuration details.
• fts: Initialize the textcat language detection library only once per
  process. This can reduce CPU usage if fts_languages setting has multiple
  languages listed and service indexer-worker { service_count } isn't 1.
  Only applies when using libfts.
• lib-storage: Reduced CPU usage significantly for some operations that
  accessed lots of emails (e.g. fetching all flags in a folder, SORT, ...)
• lib: DOVECOT_PREREQ() - Add micro version which enables compiling
  external plugins against different versions of Dovecot.
• lmtp: Added new lmtp_verbose_replies setting that makes errors sent to
  the LMTP client much more verbose with details about why exactly
  backend proxy connections or commands are failing.
• submission: Support implicit SASL EXTERNAL with
  submission_client_workarounds=implicit-auth-external. This allows
  automatically logging in when SSL client certificate is present.

• *-login: Statistics were disabled if stats process connection was lost.
• auth: Authentication master user login fails with SCRAM-* SASL mechanisms.
• auth: With auth_cache_verify_password_with_worker=yes, passdb extra
  fields in the auth cache got lost.
• doveadm: Fixed crash if zlib_save_level setting was specified,
  but zlib_save was unset. v2.3.15 regression.
• doveadm: Proxying can panic when flushing print output. v2.3.17
  regression. Fixes:
  Panic: file ioloop.c: line 865 (io_loop_destroy): assertion failed:
  (ioloop == current_ioloop)
• doveadm: stats add --group-by parameter didn't work.
• fts: Using email-address fts tokenizer could result in excessive memory
  usage with garbage email input. This could cause the indexer-worker
  processes to fail due to reaching the VSZ memory size limit.
  Only applies when using libfts.
• imap: A SEARCH command timing out while fts returns indexes may timeout
  returning "NO [SERVERBUG]", while it should return "NO [INUSE]" instead.
• imap: LIST-EXTENDED doesn't return STATUS for all folders. Sending
  LIST .. RETURN (SUBSCRIBED STATUS (...)) did not return STATUS for
  folders that are not subscribed when they have a child folder that is
  subscribed as mandated by IMAP RFCs.
• imapc: Mailbox vsize calculation crashed with
  Panic: file index-mailbox-size.c: line 344 (index_mailbox_vsize_hdr_add_missing):
  assertion failed: (mails_left > 0)
• indexer: If indexer-worker crashes, the request it was processing gets
  stuck in the indexer process. This stops indexing for the folder until
  indexer process is restarted. v2.3.14 regression.
• indexer: Process was slowly leaking memory for each indexing request.
• lib-event: Unnamed events were wrongly filtered out for event/metric
  filters like "event=abc OR something_independent_of_event_name".
• lib-index: 64-bit big endian CPUs handle last_used field in
  dovecot.index.cache wrong.
• lib-ssl-iostream: Fix buggy OpenSSL error handling without assert-crashing.
  If there is no error available, log it as an error instead of crashing.
  The previous fix for this in v2.3.11 was incomplete. Fixes
  Panic: file istream-openssl.c: line 51 (i_stream_ssl_read_real):
  assertion failed: (errno != 0)
• lmtp: Out-of-memory issues can happen when proxying large messages to
  LMTP backend servers that accept the message data too slow.
• master: HAProxy header parsing has read buffer overflow if provided
  header size is invalid. This happens only if inet_listener
  { haproxy=yes } is configured and only if the remote IP address is in
  haproxy_trusted_networks.
• old_stats: Plugin kept increasing memory usage, which became
  noticeable with long-running imap sessions.
• stats: Dynamically adding same metric multiple times causes multiple stats.
• submission-login: Authentication does not accept OAUTH2 token (or
  other very long credentials) because it considers the line to be too long.
• submission-login: Process can crash if HELO is pipelined with an
  invalid domain.
• submission-proxy: Don't use SASL-IR if it would make the AUTH command
  line longer than 512 bytes.
• submission: Service would crash if relay server authentication failed.
• virtual: FTS search in a virtual folder could crash if there are
  duplicate mailbox GUIDs. This mainly happened when user had both INBOX
  and INBOX/INBOX folders and the namespace prefix was INBOX/. Fixes
  Panic: file hash.c: line 252 (hash_table_insert_node):
  assertion failed: (opcode == HASH_TABLE_OP_UPDATE)
• virtual: If mailbox opening fails, the backend mailbox is leaked and
  process crashes when client disconnects. Fixes
  Panic: file mail-user.c: line 232 (mail_user_deinit):
  assertion failed: ((*user)->refcount == 1)
• virtual: Searching headers in virtual folders didn't always use
  full-text search indexes, if fts_enforced=no or body.