postgresql_17: 17.6 -> 17.7

Release Notes:
https://github.com/postgres/postgres/blob/fbb530a3dff569222bea7098ad4de3d8bde97740/doc/src/sgml/release-17.sgml

Fixes:
CVE-2025-12817
CVE-2025-12818

pkgs/servers/sql/postgresql/17.nix

@@ -1,7 +1,9 @@
 import ./generic.nix {
-  version = "17.6";
-  rev = "refs/tags/REL_17_6";
-  hash = "sha256-/7C+bjmiJ0/CvoAc8vzTC50vP7OsrM6o0w+lmmHvKvU=";
+  version = "17.7";
+  # TODO: Move back to tag, when they appear upstream:
+  # rev = "refs/tags/REL_17_7";
+  rev = "fbb530a3dff569222bea7098ad4de3d8bde97740";
+  hash = "sha256-W+505LAeiO5ln7wBhxZLv/p3GxiJp8MFfCGVDyvHREg=";
   muslPatches = {
     dont-use-locale-a = {
       url = "https://git.alpinelinux.org/aports/plain/main/postgresql17/dont-use-locale-a-on-musl.patch?id=d69ead2c87230118ae7f72cef7d761e761e1f37e";

pkgs/servers/sql/postgresql/generic.nix

@@ -163,11 +163,12 @@ let
 
       dlSuffix = if olderThan "16" then ".so" else stdenv.hostPlatform.extensions.sharedLibrary;
 
-      # Pin LLVM 20 until upstream has resolved:
+      # Pin LLVM 20 until upstream has fully resolved:
       # https://www.postgresql.org/message-id/flat/d25e6e4a-d1b4-84d3-2f8a-6c45b975f53d%40applied-asynchrony.com
+      # Currently still a problem on aarch64.
       # TODO: Remove with next minor releases
       llvmPackages = lib.warnIf (
-        version == "17.7"
+        version == "17.8"
       ) "PostgreSQL: Is the pin for LLVM 20 still needed?" llvmPackages_20;
 
       stdenv' =
@@ -426,7 +427,7 @@ let
       ++ lib.optionals (stdenv'.hostPlatform.isDarwin && olderThan "16") [
         ./patches/export-dynamic-darwin-15-.patch
       ]
-      ++ lib.optionals (atLeast "17") [
+      ++ lib.optionals (atLeast "18") [
         (fetchpatch2 {
           url = "https://github.com/postgres/postgres/commit/a48d1ef58652229521ba4b5070e19f857608b22e.patch";
           hash = "sha256-3FKQS1Vpu+p6z6c1GWs6GlrLl2Bgm9paEU/z81LrEus=";