DocumentationVersion comparison
POSTGRESQL · VERSION COMPARE
All features, fixes, and compatibility notes in this release, with related records from other versions.
Includes changes after the source version through the target. A major version name means its initial release.
From PostgreSQL 9.0 onward: 17 major branches and 352 release notes. Updated 2026-09-26.
Complete release changes
2021-05-13
9.6.22 HistoricalSupport ends 2021-11-11
| CVE / issue | Severity | Fixed version |
|---|---|---|
| CVE-2021-32028 Fix mishandling of "junk" columns in INSERT ... ON CONFLICT ... UPDATE target lists | 6.5 | 9.6.22 |
| CVE-2021-32027 Prevent integer overflows in array subscripting calculations | 6.5 | 9.6.22 |
A dump/restore is not required for those running 9.6.X.
However, if you are upgrading from a version earlier than 9.6.21, see Section E.4.
Changes
Prevent integer overflows in array subscripting calculations (Tom Lane)
The array code previously did not complain about cases where an array's lower bound plus length overflows an integer. This resulted in later entries in the array becoming inaccessible (since their subscripts could not be written as integers), but more importantly it confused subsequent assignment operations. This could lead to memory overwrites, with ensuing crashes or unwanted data modifications. (CVE-2021-32027)
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix mishandling of "junk" columns in INSERT ... ON CONFLICT ... UPDATE target lists (Tom Lane)
If the UPDATE list contains any multi-column sub-selects (which give rise to junk columns in addition to the results proper), the UPDATE path would end up storing tuples that include the values of the extra junk columns. That's fairly harmless in the short run, but if new columns are added to the table then the values would become accessible, possibly leading to malfunctions if they don't match the datatypes of the added columns.
In addition, in versions supporting cross-partition updates, a cross-partition update triggered by such a case had the reverse problem: the junk columns were removed from the target list, typically causing an immediate crash due to malfunction of the multi-column sub-select mechanism. (CVE-2021-32028)
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Allow ALTER ROLE/DATABASE ... SET to set the role, session_authorization, and temp_buffers parameters (Tom Lane)
Previously, over-eager validity checks might reject these commands, even if the values would have worked when used later. This created a command ordering hazard for dump/reload and upgrade scenarios.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix bug with coercing the result of a COLLATE expression to a non-collatable type (Tom Lane)
This led to a parse tree in which the COLLATE appears to be applied to a non-collatable value. While that normally has no real impact (since COLLATE has no effect at runtime), it was possible to construct views that would be rejected during dump/reload.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Disallow calling window functions and procedures via the "fast path" wire protocol message (Tom Lane)
Only plain functions are supported here. While trying to call an aggregate function failed already, calling a window function would crash, and calling a procedure would work only if the procedure did no transaction control.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Extend pg_identify_object_as_address() to support event triggers (Joel Jacobson)
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix to_char()'s handling of Roman-numeral month format codes with negative intervals (Julien Rouhaud)
Previously, such cases would usually cause a crash.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix use of uninitialized value while parsing an \{m,n\} quantifier in a BRE-mode regular expression (Tom Lane)
This error could cause the quantifier to act non-greedy, that is behave like an {m,n}? quantifier would do in full regular expressions.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Avoid divide-by-zero when estimating selectivity of a regular expression with a very long fixed prefix (Tom Lane)
This typically led to a NaN selectivity value, causing assertion failures or strange planner behavior.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix access-off-the-end-of-the-table error in BRIN index bitmap scans (Tomas Vondra)
If the page range size used by a BRIN index isn't a power of two, there were corner cases in which a bitmap scan could try to fetch pages past the actual end of the table, leading to "could not open file" errors.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Ensure that locks are released while shutting down a standby server's startup process (Fujii Masao)
When a standby server is shut down while still in recovery, some locks might be left held. This causes assertion failures in debug builds; it's unclear whether any serious consequence could occur in production builds.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Ensure we default to wal_sync_method = fdatasync on recent FreeBSD (Thomas Munro)
FreeBSD 13 supports open_datasync, which would normally become the default choice. However, it's unclear whether that is actually an improvement for Postgres, so preserve the existing default for now.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Ensure we finish cleaning up when interrupted while detaching a DSM segment (Thomas Munro)
This error could result in temporary files not being cleaned up promptly after a parallel query.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix assorted minor memory leaks in the server (Tom Lane, Andres Freund)
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Prevent infinite loop in libpq if a ParameterDescription message with a corrupt length is received (Tom Lane)
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix psql to restore the previous behavior of \connect service=something (Tom Lane)
A previous bug fix caused environment variables (such as PGPORT) to override entries in the service file in this context. Restore the previous behavior, in which the priority is the other way around.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix race condition in detection of file modification by psql's \e and related commands (Laurenz Albe)
A very fast typist could fool the code's file-timestamp-based detection of whether the temporary edit file was changed.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix missed file version check in pg_restore (Tom Lane)
When reading a custom-format archive from a non-seekable source, pg_restore neglected to check the archive version. If it was fed a newer archive version than it can support, it would fail messily later on.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Add some more checks to pg_upgrade for user tables containing non-upgradable data types (Tom Lane)
Fix detection of some cases where a non-upgradable data type is embedded within a container type (such as an array or range). Also disallow upgrading when user tables contain columns of system-defined composite types, since those types' OIDs are not stable across versions.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix pg_waldump to count XACT records correctly when generating per-record statistics (Kyotaro Horiguchi)
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix contrib/amcheck to not complain about the tuple flags HEAP_XMAX_LOCK_ONLY and HEAP_KEYS_UPDATED both being set (Julien Rouhaud)
This is a valid state after SELECT FOR UPDATE.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Adjust VPATH build rules to support recent Oracle Developer Studio compiler versions (Noah Misch)
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix testing of PL/Python for Python 3 on Solaris (Noah Misch)
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Try another search, or .
The comparison follows PostgreSQL release notes from just after the source through the target version. For a major upgrade, maintenance releases from each older branch are included only up to the next major release date, and never after the target date. A major version such as 18 means its initial release, 18.0. Previews and development snapshots are labeled separately.
Entries come from the original English manuals. Release coverage and commit evidence are verified against upstream sources. Every entry retains its complete explanation and source link. Categories aid browsing; read the full notes for impact, conditions, and migration steps.
Fixes can be backported to several branches. Confirmed duplicates are merged conservatively, with every branch explanation retained. A note describing several independent fixes is excluded only when all are already present in the source. Major-release features remain distinct from related maintenance patches unless their complete original descriptions match. Uncertain matches are retained. This is a release-note history, not an exhaustive comparison of compiled binaries.
CVE results are calculated independently from the PostgreSQL security registry and vulnerability records. A CVE counts as gained protection only when the source is affected and the target is fixed or unaffected. Remaining vulnerabilities are listed separately. Security entries and distinct CVEs are counted separately.
Interaction inspired by pgversions.com and pgversionreport. Content comes from PostgreSQL release notes. See the release notes archive.