Skip to content

feat(container): update postgres ( 16.6 → v16.11 ) #616

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
homebot-0 wants to merge 1 commit into
base: main
Choose a base branch
from
+1 −1
Open

feat(container): update postgres ( 16.6 → v16.11 ) #616

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion kubernetes/apps/ai/litellm-postgres/app/helmrelease.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ spec:
image:
repository: postgres
# renovate: datasource=docker depName=postgres
tag: "16.6-alpine"
tag: "16.11-alpine"
Comment on lines 26 to +29
Copy link

@coderabbitai coderabbitai bot Feb 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

PostgreSQL 16.11 release notes breaking changes

💡 Result:

PostgreSQL 16.11 (released 2025-11-13) is a minor release and does not require a dump/restore for upgrades from 16.x, but it does include a few user-visible behavior changes that can be “breaking” depending on what you rely on: 1

  • Stricter permission check for CREATE STATISTICS: you now must have CREATE privilege on the target schema (previously, table owners could create stats in schemas they didn’t have CREATE on). This can break scripts that created statistics in shared schemas. 1
  • Generated columns are now reliably rejected in more places:
    • Partition keys: cases that previously slipped through (e.g., via implicit whole-row references) are now rejected. 1
    • COPY ... FROM ... WHERE clauses: referencing generated columns is now disallowed (previously produced incorrect behavior or confusing errors). 1
  • Logical replication safety enforcement (can turn previously “working” DML into errors):
    • MERGE that may UPDATE/DELETE on a table that publishes updates/deletes now requires REPLICA IDENTITY.
    • INSERT ... ON CONFLICT DO UPDATE on a table that publishes inserts/updates now requires REPLICA IDENTITY. 1
  • pg_filenode_relation() behavior change: as a side-effect of a fix, it will now ignore temporary tables, which can affect diagnostic tooling that expected temp-table mappings. 1

Source: PostgreSQL 16.11 release notes. 1

🌐 Web query:

postgres 16.11-alpine Docker Hub official image tag

💡 Result:

The Docker Official Image tag you want is:

  • postgres:16.11-alpine 1

(There are also Alpine-version-pinned variants: postgres:16.11-alpine3.23 and postgres:16.11-alpine3.22.) 1

🌐 Web query:

PostgreSQL 16 minor versions changelog 16.7 16.8 16.9 16.10 16.11

💡 Result:

PostgreSQL 16 minor release changelog (16.7 → 16.11)

Version Release date Notable changes (selected)
16.7 2025-02-13 libpq: harden PQescapeString and related quoting against invalidly-encoded input; plus multiple correctness/stability fixes (catalog/cache races, truncation/checkpoint safety, etc.). 1
16.8 2025-02-20 libpq: fix quoting functions (PQescapeLiteral, PQescapeIdentifier) to honor the length parameter (regression/oversight related to CVE-2025-1094 changes) and improve handling of invalid encodings; meson: header-detection fix. 2
16.9 2025-05-08 Fix possible crash on invalid GB18030 strings (CVE-2025-4207); fix enforcement bug for self-referential FKs on partitioned tables (may require drop/recreate); fix potential data loss in BRIN bloom union and various MERGE/planner/replication/index fixes. 3
16.10 2025-08-14 Planner security hardening around leaky functions/statistics and view/permissions/RLS edge cases (CVE-2025-8713); BRIN numeric_minmax_multi_ops correctness fix (reindex recommended); plus MERGE/partitioning/XML and other fixes. 4
16.11 2025-11-13 Security: require CREATE privilege on schema for CREATE STATISTICS (CVE-2025-12817); libpq allocation-size overflow fixes (CVE-2025-12818); plus multiple planner/index/cancellation/BRIN autosummarization and other fixes. 5

Sources (official release notes): 16.7 1, 16.8 2, 16.9 3, 16.10 4, 16.11 5.

Flag specific breaking changes in PostgreSQL 16.11 before merge.

The tag postgres:16.11-alpine exists and the upgrade from 16.x does not require dump/restore. However, 16.11 introduces behavior changes that may impact the deployment:

  • CREATE STATISTICS now requires CREATE privilege on the target schema (CVE-2025-12817) — will break if litellm creates statistics in shared schemas
  • Generated columns rejected in partition keys — verify litellm doesn't rely on partition key patterns that previously slipped through
  • Logical replication enforcement: MERGE and INSERT ... ON CONFLICT DO UPDATE now require REPLICA IDENTITY on published tables — check if replication is configured
  • pg_filenode_relation() ignores temporary tables — if diagnostics tooling depends on temp-table mapping, behavior will change

Security fixes (libpq CVE-2025-12818, planner hardening CVE-2025-8713) are worth the upgrade if none of the above apply to your schema/workload.

🤖 Prompt for AI Agents 
In `@kubernetes/apps/ai/litellm-postgres/app/helmrelease.yaml` around lines 26 -
29, The Postgres image tag was changed to "postgres:16.11-alpine" and this
upgrade has breaking behavior changes that must be flagged before merging;
update the helm/PR metadata and release notes to call out the specific checks
(CREATE STATISTICS requiring CREATE on schema, generated columns prohibited in
partition keys, MERGE/ON CONFLICT requiring REPLICA IDENTITY for published
tables, and pg_filenode_relation ignoring temp tables), run schema/workload
tests against image.repository/postgres with image.tag "16.11-alpine", and if
any of those checks fail either pin image.tag back to the previous 16.x image or
add migration steps (schema privileges, partition key fixes, replica identity
settings) to the deployment/upgrade instructions so operators are aware.

env:
POSTGRES_DB: litellm
POSTGRES_USER: litellm
Expand Down