Jeremy Schneider: Postgres 18.7 minor breaks ABI compatibility again
Postgres API and ABI stability has been a topic of discussion for a long time. To understand why this matters so much, start with Dave Stokes recent blog post [Is PostgreSQL Really Winning Part 2: The Evidence Beyond the Rankings]. It’s fundamentally about “a slow core with a fast edge is a pretty good design” and how the Postgres extension API enables an amazing ecosystem around Postgres.
The official postgres docs have [guidance on API/ABI stability], and for a bit of extra background check out [David Wheeler’s 2024 post-pgconf blog], and EnterpriseDB’s [explainer about the Postgres 17.1 ABI breakage].
The postgres community works really hard not to break ABI compatability because it means that a bunch of extensions won’t interoperate between minors. But sadly this was another of the rare cases where it was needed… this time as a result of CVE-2026-6460 (just one of many CVEs in the GIANT stack that 18.7 contains).
It’s explicit in the release notes and it’s the very first bullet point. https://www.postgresql.org/docs/release/18.7
Introduce versioning logic to permit detection of composite datums that don’t match the tuple descriptor we wish to interpret them with. For full protection, this change requires rebuilding C-language extensions, and there are some extensions that will require source-code changes. If necessary, the new composite_type_mismatch server parameter can be used to disable these checks, but doing so carries security risks.
This will be a pain for Postgres users. It means that extensions (which are packaged and distributed separately) need to be upgraded exactly in lockstep with the Postgres minor bugfix update itself.
One very unfortunate side-effect of the Postgres model: Postgres 18.7 has important CVE fixes – but people using extensions cannot upgrade to 18.7 and get those CVE fixes until their extensions are also updated and have released new extension versions.
I’m doing a lot of work around extensions for CloudNativePG on Kubernetes and I saw a lot of my own build pipelines broke today due to updates not happening in lockstep – for example postgres extensions AGE, credcheck and pg_cron have already released new versions which don’t work at all on version 18.6 of Postgres! Working on my pipelines now, to make sure things are updating in lockstep. Might take a few days for core and extension updates to flow through various build channels.
Postgres users – manage this next minor update carefully; make sure you update your extensions and database together.