From 01258c1162aba93cb7e7be0d10cfa495d1f97ec6 Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Tue, 11 Nov 2025 12:46:47 +0100 Subject: [PATCH 1/6] postgresql_13: 13.22 -> 13.23 Release Notes: https://github.com/postgres/postgres/blob/89df812eb890814b105d871185935b580478e660/doc/src/sgml/release-13.sgml Fixes: CVE-2025-12817 CVE-2025-12818 --- pkgs/servers/sql/postgresql/13.nix | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/pkgs/servers/sql/postgresql/13.nix b/pkgs/servers/sql/postgresql/13.nix index 53aa3ea5e44e..7be01f723e00 100644 --- a/pkgs/servers/sql/postgresql/13.nix +++ b/pkgs/servers/sql/postgresql/13.nix @@ -1,7 +1,9 @@ import ./generic.nix { - version = "13.22"; - rev = "refs/tags/REL_13_22"; - hash = "sha256-6zHA+WU1FroUbGJcTAeEbPKBVQY7SKpT5+Kxe9ZhtoM="; + version = "13.23"; + # TODO: Move back to tag, when they appear upstream: + # rev = "refs/tags/REL_13_23"; + rev = "89df812eb890814b105d871185935b580478e660"; + hash = "sha256-GSIHFSt2wzaI3HkA3yX/gZZF+LKwODHYislagdhQjmE="; muslPatches = { disable-test-collate-icu-utf8 = { url = "https://git.alpinelinux.org/aports/plain/main/postgresql13/disable-test-collate.icu.utf8.patch?id=69faa146ec9fff3b981511068f17f9e629d4688b"; From 88fd06566cd47d1d52ab86e7adecab91e06c8c56 Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Tue, 11 Nov 2025 12:47:55 +0100 Subject: [PATCH 2/6] postgresql_14: 14.19 -> 14.20 Release Notes: https://github.com/postgres/postgres/blob/9ad034be354da9af1cea76836a9e576c110d1ff3/doc/src/sgml/release-14.sgml Fixes: CVE-2025-12817 CVE-2025-12818 --- pkgs/servers/sql/postgresql/14.nix | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/pkgs/servers/sql/postgresql/14.nix b/pkgs/servers/sql/postgresql/14.nix index e0b6deadab98..09262f8be453 100644 --- a/pkgs/servers/sql/postgresql/14.nix +++ b/pkgs/servers/sql/postgresql/14.nix @@ -1,7 +1,9 @@ import ./generic.nix { - version = "14.19"; - rev = "refs/tags/REL_14_19"; - hash = "sha256-z8MEeLae4W4YqGBNcPtKnUENxnixugnv5Q6r+LW4uu8="; + version = "14.20"; + # TODO: Move back to tag, when they appear upstream: + # rev = "refs/tags/REL_14_20"; + rev = "9ad034be354da9af1cea76836a9e576c110d1ff3"; + hash = "sha256-5wWuS78yn1p+ZjlUy5jCf1mLq78D3iI7mWPBVTd1Ufk="; muslPatches = { disable-test-collate-icu-utf8 = { url = "https://git.alpinelinux.org/aports/plain/main/postgresql14/disable-test-collate.icu.utf8.patch?id=56999e6d0265ceff5c5239f85fdd33e146f06cb7"; From 534d73a49febcc48e80a8a6467024f1fd93fe140 Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Tue, 11 Nov 2025 12:48:32 +0100 Subject: [PATCH 3/6] postgresql_15: 15,14 -> 15.15 Release Notes: https://github.com/postgres/postgres/blob/32f38816779420502d4a311835d5fe939e9548a0/doc/src/sgml/release-15.sgml Fixes: CVE-2025-12817 CVE-2025-12818 --- pkgs/servers/sql/postgresql/15.nix | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/pkgs/servers/sql/postgresql/15.nix b/pkgs/servers/sql/postgresql/15.nix index 6cb49891ad0d..11e4144564e8 100644 --- a/pkgs/servers/sql/postgresql/15.nix +++ b/pkgs/servers/sql/postgresql/15.nix @@ -1,7 +1,9 @@ import ./generic.nix { - version = "15.14"; - rev = "refs/tags/REL_15_14"; - hash = "sha256-KzN0gsEY6wFLqNYMxbTj2NH+4IWO0pplWP4XO/fqRLM="; + version = "15.15"; + # TODO: Move back to tag, when they appear upstream: + # rev = "refs/tags/REL_15_15"; + rev = "32f38816779420502d4a311835d5fe939e9548a0"; + hash = "sha256-veGKXAvK+dNofBuSXsmCsPdXDJOC04+QV3HEr0XaE68="; muslPatches = { dont-use-locale-a = { url = "https://git.alpinelinux.org/aports/plain/main/postgresql15/dont-use-locale-a-on-musl.patch?id=f424e934e6d076c4ae065ce45e734aa283eecb9c"; From 1a270675e209963dcb7f0af94a727d3b82ce1438 Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Tue, 11 Nov 2025 12:49:07 +0100 Subject: [PATCH 4/6] postgresql_16: 16.10 -> 16.11 Release Notes: https://github.com/postgres/postgres/blob/d61dd817be70749d14e982a369e97fdda9d5cba6/doc/src/sgml/release-16.sgml Fixes: CVE-2025-12817 CVE-2025-12818 --- pkgs/servers/sql/postgresql/16.nix | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/pkgs/servers/sql/postgresql/16.nix b/pkgs/servers/sql/postgresql/16.nix index c0b7498da49c..478c1dc234bd 100644 --- a/pkgs/servers/sql/postgresql/16.nix +++ b/pkgs/servers/sql/postgresql/16.nix @@ -1,7 +1,9 @@ import ./generic.nix { - version = "16.10"; - rev = "refs/tags/REL_16_10"; - hash = "sha256-1zG8+G/lNA1xm0hxLVEilIaI+25d4gfpqA2aCb4+taY="; + version = "16.11"; + # TODO: Move back to tag, when they appear upstream: + # rev = "refs/tags/REL_16_11"; + rev = "d61dd817be70749d14e982a369e97fdda9d5cba6"; + hash = "sha256-hxv+N+OWqiXmFmsB+SSYGKQLBbHtNMnneHFvOtUz8z4="; muslPatches = { dont-use-locale-a = { url = "https://git.alpinelinux.org/aports/plain/main/postgresql16/dont-use-locale-a-on-musl.patch?id=08a24be262339fd093e641860680944c3590238e"; From 8e8cc8abefc4667c7576bf7748bad2c263796faa Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Tue, 11 Nov 2025 12:49:36 +0100 Subject: [PATCH 5/6] postgresql_17: 17.6 -> 17.7 Release Notes: https://github.com/postgres/postgres/blob/fbb530a3dff569222bea7098ad4de3d8bde97740/doc/src/sgml/release-17.sgml Fixes: CVE-2025-12817 CVE-2025-12818 --- pkgs/servers/sql/postgresql/17.nix | 8 +++++--- pkgs/servers/sql/postgresql/generic.nix | 7 ++++--- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/pkgs/servers/sql/postgresql/17.nix b/pkgs/servers/sql/postgresql/17.nix index faacd3b72fc5..3f6e2b3f5b22 100644 --- a/pkgs/servers/sql/postgresql/17.nix +++ b/pkgs/servers/sql/postgresql/17.nix @@ -1,7 +1,9 @@ import ./generic.nix { - version = "17.6"; - rev = "refs/tags/REL_17_6"; - hash = "sha256-/7C+bjmiJ0/CvoAc8vzTC50vP7OsrM6o0w+lmmHvKvU="; + version = "17.7"; + # TODO: Move back to tag, when they appear upstream: + # rev = "refs/tags/REL_17_7"; + rev = "fbb530a3dff569222bea7098ad4de3d8bde97740"; + hash = "sha256-W+505LAeiO5ln7wBhxZLv/p3GxiJp8MFfCGVDyvHREg="; muslPatches = { dont-use-locale-a = { url = "https://git.alpinelinux.org/aports/plain/main/postgresql17/dont-use-locale-a-on-musl.patch?id=d69ead2c87230118ae7f72cef7d761e761e1f37e"; diff --git a/pkgs/servers/sql/postgresql/generic.nix b/pkgs/servers/sql/postgresql/generic.nix index 836b48664aa5..1ab79b168039 100644 --- a/pkgs/servers/sql/postgresql/generic.nix +++ b/pkgs/servers/sql/postgresql/generic.nix @@ -163,11 +163,12 @@ let dlSuffix = if olderThan "16" then ".so" else stdenv.hostPlatform.extensions.sharedLibrary; - # Pin LLVM 20 until upstream has resolved: + # Pin LLVM 20 until upstream has fully resolved: # https://www.postgresql.org/message-id/flat/d25e6e4a-d1b4-84d3-2f8a-6c45b975f53d%40applied-asynchrony.com + # Currently still a problem on aarch64. # TODO: Remove with next minor releases llvmPackages = lib.warnIf ( - version == "17.7" + version == "17.8" ) "PostgreSQL: Is the pin for LLVM 20 still needed?" llvmPackages_20; stdenv' = @@ -426,7 +427,7 @@ let ++ lib.optionals (stdenv'.hostPlatform.isDarwin && olderThan "16") [ ./patches/export-dynamic-darwin-15-.patch ] - ++ lib.optionals (atLeast "17") [ + ++ lib.optionals (atLeast "18") [ (fetchpatch2 { url = "https://github.com/postgres/postgres/commit/a48d1ef58652229521ba4b5070e19f857608b22e.patch"; hash = "sha256-3FKQS1Vpu+p6z6c1GWs6GlrLl2Bgm9paEU/z81LrEus="; From 07885bcfa1021fc2e7e4cac4812c27d5be9e2eb9 Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Tue, 11 Nov 2025 12:50:19 +0100 Subject: [PATCH 6/6] postgresql_18: 18.0 -> 18.1 Release Notes: https://github.com/postgres/postgres/blob/4b324845ba5d24682b9b3708a769f00d160afbd7/doc/src/sgml/release-18.sgml Fixes: CVE-2025-12817 CVE-2025-12818 --- pkgs/servers/sql/postgresql/18.nix | 8 +++++--- pkgs/servers/sql/postgresql/generic.nix | 6 ------ 2 files changed, 5 insertions(+), 9 deletions(-) diff --git a/pkgs/servers/sql/postgresql/18.nix b/pkgs/servers/sql/postgresql/18.nix index 401471cde9a7..ab7a401d8b98 100644 --- a/pkgs/servers/sql/postgresql/18.nix +++ b/pkgs/servers/sql/postgresql/18.nix @@ -1,7 +1,9 @@ import ./generic.nix { - version = "18.0"; - rev = "refs/tags/REL_18_0"; - hash = "sha256-xA6gbJe4tIV9bYRFrdI4Rfy20ZwTkvyyjt7ZxvCFEec="; + version = "18.1"; + # TODO: Move back to tag, when they appear upstream: + # rev = "refs/tags/REL_18_1"; + rev = "4b324845ba5d24682b9b3708a769f00d160afbd7"; + hash = "sha256-cZA2hWtr5RwsUrRWkvl/yvUzFPSfdtpyAKGXfrVUr0g="; muslPatches = { dont-use-locale-a = { url = "https://git.alpinelinux.org/aports/plain/main/postgresql17/dont-use-locale-a-on-musl.patch?id=d69ead2c87230118ae7f72cef7d761e761e1f37e"; diff --git a/pkgs/servers/sql/postgresql/generic.nix b/pkgs/servers/sql/postgresql/generic.nix index 1ab79b168039..5cc4f21ea8db 100644 --- a/pkgs/servers/sql/postgresql/generic.nix +++ b/pkgs/servers/sql/postgresql/generic.nix @@ -426,12 +426,6 @@ let ] ++ lib.optionals (stdenv'.hostPlatform.isDarwin && olderThan "16") [ ./patches/export-dynamic-darwin-15-.patch - ] - ++ lib.optionals (atLeast "18") [ - (fetchpatch2 { - url = "https://github.com/postgres/postgres/commit/a48d1ef58652229521ba4b5070e19f857608b22e.patch"; - hash = "sha256-3FKQS1Vpu+p6z6c1GWs6GlrLl2Bgm9paEU/z81LrEus="; - }) ]; installTargets = [ "install-world" ];