Skip to content

feat(container): update image ghcr.io/cloudnative-pg/postgresql (18.6 ➔ 18.7) #12129

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat(container): update image ghcr.io/cloudnative-pg/postgresql (18.6 ➔ 18.7) #12129

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion kubernetes/apps/kritika-system/kritika/database/cluster.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ metadata:
name: kritika-postgres
spec:
instances: 2
imageName: ghcr.io/cloudnative-pg/postgresql:18.6-standard-bookworm
imageName: ghcr.io/cloudnative-pg/postgresql:18.7-standard-bookworm

@bot-vila bot-vila Bot Nov 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Rebuild the native extensions alongside PostgreSQL 18.7 · security

With the existing native extension image, this upgrades the server without rebuilding its extensions for the new security checks. PostgreSQL 18.7's release notes explicitly say the composite-datum versioning fix (CVE-2026-6460) requires rebuilding C-language extensions for full protection, with source changes needed for some extensions. This Cluster mounts ghcr.io/tensorchord/vchord-scratch:pg18-v1.1.1 at line 14, and database.yaml:12–15 enables vector and vchord; the extension image's creation timestamp is February 28, 2026, before this November 12 release. Pair the server update with a rebuilt extension image rather than leaving the pre-fix native binaries in service.

Suggested fix

Rebuild the native extension image against PostgreSQL 18.7, apply any required composite-datum compatibility changes, and update the extension image reference alongside this server bump; verify vector/vchord loading and application queries. Do not disable the new checks.

Prompt for a coding agent 
In kubernetes/apps/kritika-system/kritika/database/cluster.yaml, coordinate the PostgreSQL 18.7 image update with a rebuilt extension image. The currently referenced ghcr.io/tensorchord/vchord-scratch:pg18-v1.1.1 image predates PostgreSQL 18.7. Rebuild its native extensions against PostgreSQL 18.7 headers, incorporating any source changes required by the composite-datum versioning change, publish that image, and update spec.postgresql.extensions[0].image.reference to the rebuilt immutable reference. Verify both vector and vchord from database.yaml load and their application queries work before rolling out. Do not disable composite_type_mismatch as a workaround.

postgresql:
extensions:
- name: vchord
Expand Down