Skip to content

Commit bf37dce

Browse files
oliriceolirice
committed
lint for checking that extension versions == default
1 parent 82f1f09 commit bf37dce

7 files changed

+227
-3
lines changed

‎docs/0022_extension_versions_outdated.md‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
Level: WARN
2+
3+
### Rationale
4+
5+
Keeping PostgreSQL extensions up to date is important for maintaining database security and stability. Extension developers regularly release updates that include:
6+
7+
- **Security patches** that fix known vulnerabilities
8+
- **Bug fixes** that resolve functional issues
9+
- **Performance improvements** that optimize database operations
10+
11+
Using outdated extension versions can expose your database to security risks and prevent you from benefiting from the latest improvements. Additionally, Supabase's Service Level Agreement (SLA) for issues resulting from extensions only applies to the default (recommended) version of each extension.
12+
13+
### Why Keep Extensions Updated?
14+
15+
**Security**: Outdated extensions may contain known security vulnerabilities that have been patched in newer versions. These vulnerabilities could potentially be exploited by malicious actors.
16+
17+
**Support**: Supabase provides support and SLA coverage only for the default (recommended) versions of extensions. Running outdated versions may result in limited support options if issues arise.
18+
19+
**Consistency**: Maintaining consistent extension versions across all projects helps ensure predictable behavior and reduces compatibility issues.
20+
21+
**Performance**: Newer versions frequently include performance optimizations and improvements that can benefit your database operations.
22+
23+
### Warning
24+
25+
- Always test extension updates in a development environment before applying them to production
26+
- Some extension updates may include breaking changes, so review the extension's changelog before updating
27+
- Back up your database before performing extension updates
28+
29+
### How to Resolve
30+
31+
To update an extension to its default (recommended) version, use the `ALTER EXTENSION` command:
32+
33+
```sql
34+
ALTER EXTENSION extension_name UPDATE;
35+
```
36+
37+
For example, to update the `uuid-ossp` extension:
38+
39+
First, check the version of the extension taht is installed:
40+
41+
```sql
42+
-- Check current extension version
43+
SELECT name, installed_version, default_version
44+
FROM pg_available_extensions
45+
WHERE name = 'uuid-ossp';
46+
```
47+
48+
This could return:
49+
```
50+
name | installed_version | default_version
51+
-------------+-------------------+-----------------
52+
uuid-ossp | 1.0 | 1.1
53+
```
54+
55+
To update to the installed version:
56+
57+
```sql
58+
ALTER EXTENSION "uuid-ossp" UPDATE;
59+
```
60+
61+
After updating, verify the installed version matches default:
62+
63+
```sql
64+
SELECT name, installed_version, default_version
65+
FROM pg_available_extensions
66+
WHERE name = 'uuid-ossp';
67+
```
68+
69+
Should now return:
70+
```
71+
name | installed_version | default_version
72+
-------------+-------------------+-----------------
73+
uuid-ossp | 1.1 | 1.1
74+
```

‎lints/0022_extension_versions_outdated.sql‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
create view lint."0022_extension_versions_outdated" as
2+
3+
select
4+
'extension_versions_outdated' as name,
5+
'Extension Versions Outdated' as title,
6+
'WARN' as level,
7+
'EXTERNAL' as facing,
8+
array['SECURITY'] as categories,
9+
'Detects extensions that are not using the default (recommended) version.' as description,
10+
format(
11+
'Extension `%s` is using version `%s` but version `%s` is available. Using outdated extension versions may expose the database to security vulnerabilities.',
12+
ext.name,
13+
ext.installed_version,
14+
ext.default_version
15+
) as detail,
16+
'https://supabase.com/docs/guides/database/database-linter?lint=0022_extension_versions_outdated' as remediation,
17+
jsonb_build_object(
18+
'extension_name', ext.name,
19+
'installed_version', ext.installed_version,
20+
'default_version', ext.default_version
21+
) as metadata,
22+
format(
23+
'extension_versions_outdated_%s_%s',
24+
ext.name,
25+
ext.installed_version
26+
) as cache_key
27+
from
28+
pg_catalog.pg_available_extensions ext
29+
where
30+
ext.installed_version is not null
31+
and ext.default_version is not null
32+
and ext.installed_version != ext.default_version
33+
order by
34+
ext.name;

‎splinter.sql‎

Lines changed: 35 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1108,4 +1108,38 @@ from
11081108
where c.contype = 'f'
11091109
and cn.nspname = 'auth'
11101110
and i.indisunique
1111-
and not i.indisprimary)
1111+
and not i.indisprimary)
1112+
union all
1113+
(
1114+
select
1115+
'extension_versions_outdated' as name,
1116+
'Extension Versions Outdated' as title,
1117+
'WARN' as level,
1118+
'EXTERNAL' as facing,
1119+
array['SECURITY'] as categories,
1120+
'Detects extensions that are not using the default (recommended) version.' as description,
1121+
format(
1122+
'Extension `%s` is using version `%s` but version `%s` is available. Using outdated extension versions may expose the database to security vulnerabilities.',
1123+
ext.name,
1124+
ext.installed_version,
1125+
ext.default_version
1126+
) as detail,
1127+
'https://supabase.com/docs/guides/database/database-linter?lint=0022_extension_versions_outdated' as remediation,
1128+
jsonb_build_object(
1129+
'extension_name', ext.name,
1130+
'installed_version', ext.installed_version,
1131+
'default_version', ext.default_version
1132+
) as metadata,
1133+
format(
1134+
'extension_versions_outdated_%s_%s',
1135+
ext.name,
1136+
ext.installed_version
1137+
) as cache_key
1138+
from
1139+
pg_catalog.pg_available_extensions ext
1140+
where
1141+
ext.installed_version is not null
1142+
and ext.default_version is not null
1143+
and ext.installed_version != ext.default_version
1144+
order by
1145+
ext.name)

‎test/expected/0022_extension_versions_outdated.out‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
begin;
2+
-- 0 issues initially (all extensions should be up to date)
3+
select * from lint."0022_extension_versions_outdated";
4+
name | title | level | facing | categories | description | detail | remediation | metadata | cache_key
5+
------+-------+-------+--------+------------+-------------+--------+-------------+----------+-----------
6+
(0 rows)
7+
8+
-- Note: We cannot easily create a test that shows outdated extensions
9+
-- because we cannot install older versions of extensions in a test environment.
10+
-- Our test image doesn't have multiple extension versions available.
11+
-- The test will primarily verify that the query executes without error
12+
-- and returns the expected column structure.
13+
-- This lint was tested manually with real outdated extensions.
14+
-- Verify the query structure and column names
15+
select
16+
count(*) as total_outdated_extensions
17+
from lint."0022_extension_versions_outdated";
18+
total_outdated_extensions
19+
---------------------------
20+
0
21+
(1 row)
22+
23+
-- Test that the query returns proper column structure
24+
-- This will help ensure the lint is properly formed
25+
select
26+
name,
27+
title,
28+
level,
29+
facing,
30+
categories,
31+
description,
32+
detail,
33+
remediation,
34+
metadata,
35+
cache_key
36+
from lint."0022_extension_versions_outdated";
37+
name | title | level | facing | categories | description | detail | remediation | metadata | cache_key
38+
------+-------+-------+--------+------------+-------------+--------+-------------+----------+-----------
39+
(0 rows)
40+
41+
rollback;

‎test/expected/queries_are_unionable.out‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,11 @@ begin;
3636
union all
3737
select * from lint."0019_insecure_queue_exposed_in_api"
3838
union all
39-
select * from lint."0020_table_bloat";
39+
select * from lint."0020_table_bloat"
40+
union all
41+
select * from lint."0021_fkey_to_auth_unique"
42+
union all
43+
select * from lint."0022_extension_versions_outdated";
4044
name | title | level | facing | categories | description | detail | remediation | metadata | cache_key
4145
------+-------+-------+--------+------------+-------------+--------+-------------+----------+-----------
4246
(0 rows)

‎test/sql/0022_extension_versions_outdated.sql‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
begin;
2+
3+
-- 0 issues initially (all extensions should be up to date)
4+
select * from lint."0022_extension_versions_outdated";
5+
6+
-- Note: We cannot easily create a test that shows outdated extensions
7+
-- because we cannot install older versions of extensions in a test environment.
8+
-- Our test image doesn't have multiple extension versions available.
9+
-- The test will primarily verify that the query executes without error
10+
-- and returns the expected column structure.
11+
-- This lint was tested manually with real outdated extensions.
12+
13+
-- Verify the query structure and column names
14+
select
15+
count(*) as total_outdated_extensions
16+
from lint."0022_extension_versions_outdated";
17+
18+
-- Test that the query returns proper column structure
19+
-- This will help ensure the lint is properly formed
20+
select
21+
name,
22+
title,
23+
level,
24+
facing,
25+
categories,
26+
description,
27+
detail,
28+
remediation,
29+
metadata,
30+
cache_key
31+
from lint."0022_extension_versions_outdated";
32+
33+
rollback;

‎test/sql/queries_are_unionable.sql‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,10 @@ begin;
3838
union all
3939
select * from lint."0019_insecure_queue_exposed_in_api"
4040
union all
41-
select * from lint."0020_table_bloat";
41+
select * from lint."0020_table_bloat"
42+
union all
43+
select * from lint."0021_fkey_to_auth_unique"
44+
union all
45+
select * from lint."0022_extension_versions_outdated";
4246

4347
rollback;

0 commit comments

Comments
 (0)