PostgreSQL Schedules Emergency Out-of-Cycle Release After Regression in February Update
The PostgreSQL Global Development Group has announced an emergency out-of-cycle release for February 26, 2026 to fix two regressions introduced by the February 12 security update across all supported versions.
The PostgreSQL Global Development Group announced an unscheduled, out-of-cycle release for February 26, 2026, after discovering two significant regressions introduced in the February 12 security update that shipped versions 18.2, 17.8, 16.12, 15.16, and 14.21. The emergency release will ship fixes as versions 18.3, 17.9, 16.13, 15.17, and 14.22.
Regressions Introduced by the February Security Update
The first regression affects the substring() function. The fix for CVE-2026-2006 — which closed a server-side vulnerability — inadvertently caused substring() to return an "invalid byte sequence for encoding" error when the source of a text value is a database column containing multi-byte, non-ASCII characters. The problem only manifests when the value comes from a column rather than a string literal, making it easy to miss in testing but potentially impactful in any application serving international content.
The second regression affects standby servers. Under certain conditions, a standby may halt with a "could not access status of transaction" error, causing replication failures that require manual intervention to resolve. High-availability setups relying on streaming replication are directly affected.
What to Do Before February 26
Operators who upgraded to the February 12 release and are experiencing either issue can apply the relevant upstream commits manually using commit references published on the PostgreSQL project wiki. Each supported version has a separate commit to apply. If neither regression impacts your workload, the safest course is to wait for the scheduled release.
The next regular quarterly release after this fix is scheduled for May 14, 2026. Out-of-cycle releases are unusual for the PostgreSQL project, but its policy is to address critical regressions promptly rather than waiting for the next scheduled maintenance window.
Related Articles
Redis 8.4 Brings Hybrid Search, Atomic Multi-Key Operations, and Auto-Repair AOF
Redis 8.4 is now generally available, delivering hybrid search that combines full-text and vector queries using Reciprocal Rank Fusion, new atomic string commands like MSETEX and DELEX, and automatic repair for corrupted append-only files. Lookahead prefetching and JSON memory optimizations round out a performance-focused release.
Deno 2.7 Stabilizes Temporal API and Ships Native Windows ARM Builds
Deno 2.7 has stabilized the TC39 Temporal API, bringing immutable, timezone-aware date and time objects to replace the legacy JavaScript Date API. The release also delivers official Windows ARM builds for Surface and Snapdragon devices, npm overrides support, and global install compilation for standalone executables.
Laravel 13 Ships with PHP Attributes, Passkeys, and Zero Breaking Changes
Taylor Otwell unveiled Laravel 13 at Laracon EU, delivering PHP 8 Attributes as an alternative to class properties, built-in passkey authentication in starter kits, and a new Reverb database driver for horizontal WebSocket scaling. The release requires PHP 8.3+ and promises the smoothest upgrade path in Laravel history.