PostgreSQL 10.6.1

* Before exiting walreceiver, ensure all the received WAL is fsync'd to disk
Otherwise the standby server could replay some un-synced WAL, conceivably leading to data corruption if the system crashes just at that point.
* Avoid excess fsync activity in walreceiver
* Make ALTER TABLE revalidate uniqueness and exclusion constraints when needed
This was broken in 9.0 by a change that was intended to suppress revalidation during VACUUM FULL and CLUSTER, but unintentionally affected ALTER TABLE as well.
* Fix EvalPlanQual for UPDATE of an inheritance tree in which the tables are not all alike
Any variation in the table row types (including dropped columns present in only some child tables) would confuse the EvalPlanQual code, leading to misbehavior or even crashes. Since EvalPlanQual is only executed during concurrent updates to the same row, the problem was only seen intermittently.
* Avoid failures when EXPLAIN tries to display a simple-form CASE expression
If the CASE's test expression was a constant, the planner could simplify the CASE into a form that confused the expression-display code, resulting in "unexpected CASE WHEN clause" errors.
* Fix assignment to an array slice that is before the existing range of subscripts
If there was a gap between the newly added subscripts and the first pre-existing subscript, the code miscalculated how many entries needed to be copied from the old array's null bitmap, potentially leading to data corruption or crash.
* Avoid unexpected conversion overflow in planner for very distant date values
The date type supports a wider range of dates than can be represented by the timestamp types, but the planner assumed it could always convert a date to timestamp with impunity.
* Fix PL/Python crash when an array contains null entries
* Remove ecpg's fixed length limit for constants defining an array dimension
* Fix erroneous parsing of tsquery values containing ... & !(subexpression) | ...
Queries containing this combination of operators were not executed correctly. The same error existed in contrib/intarray's query_int type and contrib/ltree's ltxtquery type.
* Fix buffer overrun in contrib/intarray's input function for the query_int type (Apple)
This bug is a security risk since the function's return address could be overwritten. Thanks to Apple Inc's security team for reporting this issue and supplying the fix.
* Fix bug in contrib/seg's GiST picksplit algorithm

# Changes

* Force the default wal_sync_method to be fdatasync on Linux The default on Linux has actually been fdatasync for many years, but recent kernel changes caused PostgreSQL to choose open_datasync instead. This choice did not result in any performance improvement, and caused outright failures on certain filesystems, notably ext4 with the data=journal mount option.
* Fix "too many KnownAssignedXids" error during Hot Standby replay
* Fix race condition in lock acquisition during Hot Standby
* Avoid unnecessary conflicts during Hot Standby This fixes some cases where replay was considered to conflict with standby queries (causing delay of replay or possibly cancellation of the queries), but there was no real conflict.
* Fix assorted bugs in WAL replay logic for GIN indexes This could result in "bad buffer id: 0" failures or corruption of index contents during replication.
* Fix recovery from base backup when the starting checkpoint WAL record is not in the same WAL segment as its redo point
* Fix corner-case bug when streaming replication is enabled immediately after creating the master database cluster
* Fix persistent slowdown of autovacuum workers when multiple workers remain active for a long time The effective vacuum_cost_limit for an autovacuum worker could drop to nearly zero if it processed enough tables, causing it to run extremely slowly.
* Fix long-term memory leak in autovacuum launcher
* Avoid failure when trying to report an impending transaction wraparound condition from outside a transaction This oversight prevented recovery after transaction wraparound got too close, because database startup processing would fail.
* Add support for detecting register-stack overrun on IA64 The IA64 architecture has two hardware stacks. Full prevention of stack-overrun failures requires checking both.
* Add a check for stack overflow in copyObject() Certain code paths could crash due to stack overflow given a sufficiently complex query.
* Fix detection of page splits in temporary GiST indexes It is possible to have a "concurrent" page split in a temporary index, if for example there is an open cursor scanning the index when an insertion is done. GiST failed to detect this case and hence could deliver wrong results when execution of the cursor continued.
* Fix error checking during early connection processing The check for too many child processes was skipped in some cases, possibly leading to postmaster crash when attempting to add the new child process to fixed-size arrays.
* Improve efficiency of window functions Certain cases where a large number of tuples needed to be read in advance, but work_mem was large enough to allow them all to be held in memory, were unexpectedly slow. percent_rank(), cume_dist() and ntile() in particular were subject to this problem.
* Avoid memory leakage while ANALYZE'ing complex index expressions
* Ensure an index that uses a whole-row Var still depends on its table An index declared like create index i on t (foo(t.*)) would not automatically get dropped when its table was dropped.
* Add missing support in DROP OWNED BY for removing foreign data wrapper/server privileges belonging to a user
* Do not "inline" a SQL function with multiple OUT parameters This avoids a possible crash due to loss of information about the expected result rowtype.
* Fix crash when inline-ing a set-returning function whose argument list contains a reference to an inline-able user function
* Behave correctly if ORDER BY, LIMIT, FOR UPDATE, or WITH is attached to the VALUES part of INSERT ... VALUES
* Make the OFF keyword unreserved (Heikki Linnakangas) This prevents problems with using off as a variable name in PL/pgSQL. That worked before 9.0, but was now broken because PL/pgSQL now treats all core reserved words as reserved.
* Fix constant-folding of COALESCE() expressions The planner would sometimes attempt to evaluate sub-expressions that in fact could never be reached, possibly leading to unexpected errors.
* Fix "could not find pathkey item to sort" planner failure with comparison of whole-row Vars
* Fix postmaster crash when connection acceptance (accept() or one of the calls made immediately after it) fails, and the postmaster was compiled with GSSAPI support
* Retry after receiving an invalid response packet from a RADIUS authentication server This fixes a low-risk potential denial of service condition.
* Fix missed unlink of temporary files when log_temp_files is active If an error occurred while attempting to emit the log message, the unlink was not done, resulting in accumulation of temp files.
* Add print functionality for InhRelation nodes This avoids a failure when debug_print_parse is enabled and certain types of query are executed.
* Fix incorrect calculation of distance from a point to a horizontal line segment This bug affected several different geometric distance-measurement operators.
* Fix incorrect calculation of transaction status in ecpg
* Fix errors in psql's Unicode-escape support
* Speed up parallel pg_restore when the archive contains many large objects (blobs)
* Fix PL/pgSQL's handling of "simple" expressions to not fail in recursion or error-recovery cases
* Fix PL/pgSQL's error reporting for no-such-column cases As of 9.0, it would sometimes report "missing FROM-clause entry for table foo" when "record foo has no field bar" would be more appropriate.
* Fix PL/Python to honor typmod (i.e., length or precision restrictions) when assigning to tuple fields This fixes a regression from 8.4.
* Fix PL/Python's handling of set-returning functions Attempts to call SPI functions within the iterator generating a set result would fail.
* Fix bug in contrib/cube's GiST picksplit algorithm This could result in considerable inefficiency, though not actually incorrect answers, in a GiST index on a cube column. If you have such an index, consider REINDEXing it after installing this update.
* Don't emit "identifier will be truncated" notices in contrib/dblink except when creating new connections
* Fix potential coredump on missing public key in contrib/pgcrypto
* Fix buffer overrun in contrib/pg_upgrade
* Fix memory leak in contrib/xml2's XPath query functions
* Update time zone data files to tzdata release 2010o for DST law changes in Fiji and Samoa; also historical corrections for Hong Kong.

# Major enhancements include:
* Built-in replication based on log shipping. This advance consists of two features: Streaming Replication, allowing continuous archive (WAL) files to be streamed over a network connection to a standby server, and Hot Standby, allowing continuous archive standby servers to execute read-only queries. The net effect is to support a single master with multiple read-only slave servers.
* Easier database object permissions management. GRANT/REVOKE IN SCHEMA supports mass permissions changes on existing objects, while ALTER DEFAULT PRIVILEGES allows control of privileges for objects created in the future. Large objects (BLOBs) now support permissions management as well.
* Broadly enhanced stored procedure support. The DO statement supports ad-hoc or "anonymous" code blocks. Functions can now be called using named parameters. PL/pgSQL is now installed by default, and PL/Perl and PL/Python have been enhanced in several ways, including support for Python3.
* Full support for 64-bit Windows.
* More advanced reporting queries, including additional windowing options (PRECEDING and FOLLOWING) and the ability to control the order in which values are fed to aggregate functions.
* New trigger features, including SQL-standard-compliant per-column triggers and conditional trigger execution.
* Deferrable unique constraints. Mass updates to unique keys are now possible without trickery
* Exclusion constraints. These provide a generalized version of unique constraints, allowing enforcement of complex conditions.
* New and enhanced security features, including RADIUS authentication, LDAP authentication improvements, and a new contrib module passwordcheck for testing password strength.
* New high-performance implementation of the LISTEN/NOTIFY feature. Pending events are now stored in a memory-based queue rather than a table. Also, a "payload" string can be sent with each event, rather than transmitting just an event name as before.
* New implementation of VACUUM FULL. This command now rewrites the entire table and indexes, rather than moving individual rows to compact space. It is substantially faster in most cases, and no longer results in index bloat.
* New contrib module pg_upgrade to support in-place upgrades from 8.3 or 8.4 to 9.0.
* Multiple performance enhancements for specific types of queries, including elimination of unnecessary joins. This helps optimize some automatically-generated queries, such as those produced by object-relational mappers (ORMs).
* EXPLAIN enhancements. The output is now available in JSON, XML, or YAML format, and includes buffer utilization and other data not previously available.
* hstore improvements, including new functions and greater data capacity.

* Enforce restrictions in plperl using an opmask applied to the whole interpreter, instead of using Safe.pm (Tim Bunce, Andrew Dunstan)
- Recent developments have convinced us that Safe.pm is too insecure to rely on for making plperl trustable. This change removes use of Safe.pm altogether, in favor of using a separate interpreter with an opcode mask that is always applied. Pleasant side effects of the change include that it is now possible to use Perl's strict pragma in a natural way in plperl, and that Perl's $a and $b variables work as expected in sort routines, and that function compilation is significantly faster. (CVE-2010-1169)
* Prevent PL/Tcl from executing untrustworthy code from pltcl_modules (Tom)
- PL/Tcl's feature for autoloading Tcl code from a database table could be exploited for trojan-horse attacks, because there was no restriction on who could create or insert into that table. This change disables the feature unless pltcl_modules is owned by a superuser. (However, the permissions on the table are not checked, so installations that really need a less-than-secure modules table can still grant suitable privileges to trusted non-superusers.) Also, prevent loading code into the unrestricted "normal" Tcl interpreter unless we are really going to execute a pltclu function. (CVE-2010-1170)
* Fix data corruption during WAL replay of ALTER ... SET TABLESPACE (Tom)
- When archive_mode is on, ALTER ... SET TABLESPACE generates a WAL record whose replay logic was incorrect. It could write the data to the wrong place, leading to possibly-unrecoverable data corruption. Data corruption would be observed on standby slaves, and could occur on the master as well if a database crash and recovery occurred after committing the ALTER and before the next checkpoint.
* Fix possible crash if a cache reset message is received during rebuild of a relcache entry (Heikki)
- This error was introduced in 8.4.3 while fixing a related failure.
* Apply per-function GUC settings while running the language validator for the function (Itagaki Takahiro)
- This avoids failures if the function's code is invalid without the setting; an example is that SQL functions may not parse if the search_path is not correct.
* Do constraint exclusion for inherited UPDATE and DELETE target tables when constraint_exclusion = partition (Tom)
- Due to an oversight, this setting previously only caused constraint exclusion to be checked in SELECT commands.
* Do not allow an unprivileged user to reset superuser-only parameter settings (Alvaro)
- Previously, if an unprivileged user ran ALTER USER ... RESET ALL for himself, or ALTER DATABASE ... RESET ALL for a database he owns, this would remove all special parameter settings for the user or database, even ones that are only supposed to be changeable by a superuser. Now, the ALTER will only remove the parameters that the user has permission to change.
* Avoid possible crash during backend shutdown if shutdown occurs when a CONTEXT addition would be made to log entries (Tom)
- In some cases the context-printing function would fail because the current transaction had already been rolled back when it came time to print a log message.
* Fix erroneous handling of %r parameter in recovery_end_command (Heikki)
- The value always came out zero.
* Ensure the archiver process responds to changes in archive_command as soon as possible (Tom)
* Fix pl/pgsql's CASE statement to not fail when the case expression is a query that returns no rows (Tom)
* Update pl/perl's ppport.h for modern Perl versions (Andrew)
* Fix assorted memory leaks in pl/python (Andreas Freund, Tom)
* Handle empty-string connect parameters properly in ecpg (Michael)
* Prevent infinite recursion in psql when expanding a variable that refers to itself (Tom)
* Fix psql's copy to not add spaces around a dot within copy (select ...) (Tom)
- Addition of spaces around the decimal point in a numeric literal would result in a syntax error.
* Avoid formatting failure in psql when running in a locale context that doesn't match the client_encoding (Tom)
* Fix unnecessary "GIN indexes do not support whole-index scans" errors for unsatisfiable queries using contrib/intarray operators (Tom)
* Ensure that contrib/pgstattuple functions respond to cancel interrupts promptly (Tatsuhito Kasahara)
* Make server startup deal properly with the case that shmget() returns EINVAL for an existing shared memory segment (Tom)
- This behavior has been observed on BSD-derived kernels including OS X. It resulted in an entirely-misleading startup failure complaining that the shared memory request size was too large.
* Avoid possible crashes in syslogger process on Windows (Heikki)
* Deal more robustly with incomplete time zone information in the Windows registry (Magnus)
* Update the set of known Windows time zone names (Magnus)
* Update time zone data files to tzdata release 2010j for DST law changes in Argentina, Australian Antarctic, Bangladesh, Mexico, Morocco, Pakistan, Palestine, Russia, Syria, Tunisia; also historical corrections for Taiwan.
- Also, add PKST (Pakistan Summer Time) to the default set of timezone abbreviations.

Changes:
Restrict visibility of pg_user_mappings.umoptions, to protect passwords stored as user mapping options.
Prevent exposure of statistical information via leaky operators.
Restore libpq's recognition of the PGREQUIRESSL environment variable .
Fix possibly-invalid initial snapshot during logical decoding .
Fix possible corruption of "init forks" of unlogged indexes.
Fix incorrect reconstruction of pg_subtrans entries when a standby server replays a prepared but uncommitted two-phase transaction.
Avoid possible crash in walsender due to failure to initialize a string buffer.
Fix possible crash when rescanning a nearest-neighbor index-only scan on a GiST index.
Prevent delays in postmaster's launching of multiple parallel worker processes.
Fix postmaster's handling of fork() failure for a background worker process .
Fix possible "no relation entry for relid 0" error when planning nested set operations.
Fix assorted minor issues in planning of parallel queries.
Avoid applying "physical targetlist" optimization to custom scans.
Use the correct sub-expression when applying a FOR ALL row-level-security policy.
Ensure parsing of queries in extension scripts sees the results of immediately-preceding DDL.
Skip tablespace privilege checks when ALTER TABLE ... ALTER COLUMN TYPE rebuilds an existing index.
Fix ALTER TABLE ... VALIDATE CONSTRAINT to not recurse to child tables when the constraint is marked NO INHERIT.
Avoid dangling pointer in COPY ... TO when row-level security is active for the source table.
Avoid accessing an already-closed relcache entry in CLUSTER and VACUUM FULL.
Fix VACUUM to account properly for pages that could not be scanned due to conflicting page pins.
Ensure that bulk-tuple-transfer loops within a hash join are interruptible by query cancel requests.
Fix incorrect support for certain box operators in SP-GiST.
Fix integer-overflow problems in interval comparison.
Fix cursor_to_xml() to produce valid output with tableforest = false.
Fix roundoff problems in float8_timestamptz() and make_interval().
Fix pg_get_object_address() to handle members of operator families correctly.
Fix cancelling of pg_stop_backup() when attempting to stop a non-exclusive backup.
Improve performance of pg_timezone_names view.
Reduce memory management overhead for contexts containing many large blocks.
Fix sloppy handling of corner-case errors from lseek() and close().
Fix incorrect check for whether postmaster is running as a Windows service.
Fix ecpg to support COMMIT PREPARED and ROLLBACK PREPARED.
Fix a double-free error when processing dollar-quoted string literals in ecpg.
Fix pgbench to handle the combination of --connect and --rate options correctly.
Fix pgbench to honor the long-form option spelling --builtin, as per its documentation.
Fix pg_dump/pg_restore to correctly handle privileges for the public schema when using --clean option.
In pg_dump, fix incorrect schema and owner marking for comments and security labels of some types of database objects.
Fix typo in pg_dump's query for initial privileges of a procedural language.
Avoid emitting an invalid list file in pg_restore -l when SQL object names contain newlines.
Fix pg_upgrade to transfer comments and security labels attached to "large objects".
Improve error handling in contrib/adminpack's pg_file_write() function.
In contrib/dblink, avoid leaking the previous unnamed connection when establishing a new unnamed connection.
Fix contrib/pg_trgm's extraction of trigrams from regular expressions.
In contrib/postgres_fdw, allow join conditions that contain shippable extension-provided functions to be pushed to the remote server.
Support Tcl 8.6 in MSVC builds.
Sync our copy of the timezone library with IANA release tzcode2017b.
Update time zone data files to tzdata release 2017b for DST law changes in Chile, Haiti, and Mongolia, plus historical corrections for Ecuador, Kazakhstan, Liberia, and Spain. Switch to numeric abbreviations for numerous time zones in South America, the Pacific and Indian oceans, and some Asian and Middle Eastern countries.
Use correct daylight-savings rules for POSIX-style time zone names in MSVC builds.