ops(security): patch PostgreSQL 16.12 -> 16.14 (11 CVEs) #668

New issue

Closed

opened 2026-06-01 15:05:36 +02:00 by claude · 0 comments

claude commented

2026-06-01 15:05:36 +02:00

Collaborator

Finding

Dependency audit (2026-06-01, live rs2000 docker ps): 2× postgres:16.12-alpine running. Latest 16.x minor = 16.14 (released 2026-05-14), which fixes 11 security vulnerabilities + ~60 bugs. Notable CVEs in the gap:

Missing authorization in CREATE TYPE — an object creator can hijack other queries that use search_path to resolve user-defined types.
Uncontrolled recursion in SSL/GSS negotiation — DoS via an AF_UNIX (or TCP, if SSL+GSS disabled) socket connection.

Risk calibration

These DBs are internal — not in the public exposure-manifest, behind the edge/Tailnet. So this is not "drop everything", but the CVE vectors require connection/socket access, so the patch is warranted. (Separately: the Honcho DB runs pgvector/pgvector:pg15 — a different major; track in a future upgrade-wave, not here.)

Why this is separate from Renovate

Once Renovate is live it would raise this PR automatically — but (a) it's a security + data-layer change we want to do deliberately and now, not wait for the automation's first run, and (b) it needs the operator gate + careful smoke. So it's tracked explicitly.

Update is low-risk

PostgreSQL minor updates: "stop the server, swap binaries, restart — no dump/reload required." Both instances on the same 16.x line → straightforward.

Path

Runtime mutation → operator-gated platformctl apply (PR → CI → approve). Good candidate for the first upgrade-wave after M06 apply-pipeline hardening lands. The DR (M02) + metadata (M05) gates that previously blocked upgrades are now CLOSED, so upgrade-waves (M09 pattern) can legitimately resume.

Scope + acceptance

Bump the postgres image pin 16.12-alpine → 16.14-alpine for both instances (env var / compose).
platformctl plan shows only the image change.
Apply via the gated pipeline; smoke green; no data migration needed.
Both postgres instances report 16.14.

Authored by claude (audit/capture); execution = Codex lane (gated apply).

## Finding Dependency audit (2026-06-01, live rs2000 `docker ps`): **2× `postgres:16.12-alpine`** running. Latest 16.x minor = **`16.14`** (released 2026-05-14), which fixes **11 security vulnerabilities** + ~60 bugs. Notable CVEs in the gap: - Missing authorization in `CREATE TYPE` — an object creator can hijack other queries that use `search_path` to resolve user-defined types. - Uncontrolled recursion in SSL/GSS negotiation — DoS via an AF_UNIX (or TCP, if SSL+GSS disabled) socket connection. ## Risk calibration These DBs are **internal** — not in the public exposure-manifest, behind the edge/Tailnet. So this is **not "drop everything"**, but the CVE vectors require connection/socket access, so the patch is warranted. (Separately: the Honcho DB runs `pgvector/pgvector:pg15` — a different major; track in a future upgrade-wave, not here.) ## Why this is separate from Renovate Once Renovate is live it *would* raise this PR automatically — but (a) it's a security + data-layer change we want to do deliberately and now, not wait for the automation's first run, and (b) it needs the operator gate + careful smoke. So it's tracked explicitly. ## Update is low-risk PostgreSQL minor updates: "stop the server, swap binaries, restart — **no dump/reload required**." Both instances on the same `16.x` line → straightforward. ## Path Runtime mutation → operator-gated `platformctl apply` (PR → CI → approve). Good candidate for the **first upgrade-wave after M06 apply-pipeline hardening lands**. The DR (M02) + metadata (M05) gates that previously blocked upgrades are now **CLOSED**, so upgrade-waves (M09 pattern) can legitimately resume. ## Scope + acceptance - [ ] Bump the postgres image pin `16.12-alpine` → `16.14-alpine` for both instances (env var / compose). - [ ] `platformctl plan` shows only the image change. - [ ] Apply via the gated pipeline; smoke green; no data migration needed. - [ ] Both postgres instances report 16.14. Authored by claude (audit/capture); execution = Codex lane (gated apply).

claude added this to the 10 - Improvements milestone

2026-06-01 15:05:36 +02:00

claude added the

agent/codex

priority:p1

labels

2026-06-01 15:05:36 +02:00

claude referenced this issue

2026-06-01 17:19:15 +02:00

docs(strategy): platform security & maturity roadmap v1 (audit-grounded) #674

claude added the

status:codex-ready