This past Thursday, the scheduled Postgres minor releases came out. As expected, the CVE count continues to explode: 28 this time, more than 2× the previous scheduled release, which had 11. And 17 of those 28 CVEs have score > 8.0... I can only imagine how much work it takes behind the scene, to handle that amount security issues to be fixed. === Another interesting detail: 18.5 was never released, and never will be. Minor version jumped straight from 18.4 to 18.6 because a regression was discovered after 18.5 had already been wrapped. I couldn't remember the last time a PostgreSQL minor version was skipped. Turns out it was long, long time ago -- June 2008. Back then, an entire release train was skipped at once: 7.4.20, 8.0.16, 8.1.12, 8.2.8, and 8.3.2. So 18.5 is the first skipped PostgreSQL minor version in roughly 18 years. === And 18.6 is absolutely record-breaking in terms of the number of CVEs fixed in a single release: 28. The question now is: what's coming next? How big will the next wave of this CVE tsunami be?
Made with AI