[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/cloudnative-pg/postgresql	minor	18.6-standard-bookworm → 18.7-standard-bookworm

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[bot-vila]

Confidence Score: 3/5

[High risk] The reported P1 about the un-rebuilt vchord/vector native extensions caps the score. It looks like advice for full CVE protection, not a blocker, since PostgreSQL minor releases keep ABI compatibility and the extension image was not shown to break. The risk rests on a minor step of the PostgreSQL server for the database the kritika service depends on, with a rolling switchover update and the unverified live REINDEX guidance for the application's indexes.

Not approved: confidence 3/5 is below the threshold of 5

Findings

• kubernetes/apps/kritika-system/kritika/database/cluster.yaml:9 Rebuild the native extensions alongside PostgreSQL 18.7 · security

Summary

Updates Kritika’s PostgreSQL image from 18.6 to 18.7.

• Flux reconciliation applies the database image update; cluster.yaml specifies two instances and primary updates by switchover.
• PostgreSQL’s 18.7 migration notes require no dump/restore for the declared 18.6 base.
• Check live indexes against upstream REINDEX guidance; repository manifests do not expose the application’s index definitions.

Review context · 6 sources · 1/1 skills · 3/6 commands

• Sources:
  • https://redirect.github.com/cloudnative-pg/postgres-containers/releases
  • https://www.postgresql.org/docs/18/release-18-7.html
  • https://redirect.github.com/cloudnative-pg/postgres-containers/compare/995cdbf40a88523d80e121d246363ec942a70cd2...e1279c43bd11570edc864d220468c28e611df5dd
  • oci://ghcr.io/cloudnative-pg/postgresql:18.7-standard-bookworm
  • oci://ghcr.io/cloudnative-pg/postgresql:18.6-standard-bookworm
  • oci://ghcr.io/tensorchord/vchord-scratch:pg18-v1.1.1
• Skills read: reviewing-pull-requests
• Commands run: curl gh grep

_{Reviews (1) · Last reviewed commit: "feat(container): update image ghcr.io/cl..." · gpt-6.1-sol}

[bot-vila]

Rebuild the native extensions alongside PostgreSQL 18.7 · security

With the existing native extension image, this upgrades the server without rebuilding its extensions for the new security checks. PostgreSQL 18.7's release notes explicitly say the composite-datum versioning fix (CVE-2026-6460) requires rebuilding C-language extensions for full protection, with source changes needed for some extensions. This Cluster mounts ghcr.io/tensorchord/vchord-scratch:pg18-v1.1.1 at line 14, and database.yaml:12–15 enables vector and vchord; the extension image's creation timestamp is February 28, 2026, before this November 12 release. Pair the server update with a rebuilt extension image rather than leaving the pre-fix native binaries in service.

Suggested fix

Rebuild the native extension image against PostgreSQL 18.7, apply any required composite-datum compatibility changes, and update the extension image reference alongside this server bump; verify vector/vchord loading and application queries. Do not disable the new checks.

Prompt for a coding agent

In kubernetes/apps/kritika-system/kritika/database/cluster.yaml, coordinate the PostgreSQL 18.7 image update with a rebuilt extension image. The currently referenced ghcr.io/tensorchord/vchord-scratch:pg18-v1.1.1 image predates PostgreSQL 18.7. Rebuild its native extensions against PostgreSQL 18.7 headers, incorporating any source changes required by the composite-datum versioning change, publish that image, and update spec.postgresql.extensions[0].image.reference to the rebuilt immutable reference. Verify both vector and vchord from database.yaml load and their application queries work before rolling out. Do not disable composite_type_mismatch as a workaround.