Index | Thread | Search

From:
Renato Aguiar <renato@renatoaguiar.net>
Subject:
Re: databases/timescaledb 2.25.2 (CVE #2026-29089)
To:
Mark Patruck <mark@wrapped.cx>
Cc:
ports@openbsd.org
Date:
Thu, 05 Mar 2026 21:53:58 +0000

Download raw body.

Thread
On Thu, Mar 05 2026, Mark Patruck wrote:

> Update databases/timescaledb to 2.25.2 (+ extras) released
> two days ago. Besides performance improvements, 2.25.2 fixes
> also a security issue, see here for more info:
>
> https://github.com/timescale/timescaledb/security/advisories/GHSA-vgp2-jj5c-828m
>
> Changes since in-ports 2.23.1:
>
> https://github.com/timescale/timescaledb/releases/tag/2.24.0
> https://github.com/timescale/timescaledb/releases/tag/2.25.0
> https://github.com/timescale/timescaledb/releases/tag/2.25.1
> https://github.com/timescale/timescaledb/releases/tag/2.25.2
>
> As the only direct consumer i know (net/zabbix) works with 2.25.2
> and our in-ports version is months old, we should get this in asap.
>
> Thanks,
>
> 	-Mark
>
>
> Index: Makefile
> ===================================================================
> RCS file: /cvs/ports/databases/timescaledb/Makefile,v
> retrieving revision 1.35
> diff -u -p -r1.35 Makefile
> --- Makefile	23 Nov 2025 03:08:24 -0000	1.35
> +++ Makefile	5 Mar 2026 19:30:14 -0000
> @@ -4,10 +4,10 @@ ONLY_FOR_ARCHS = ${LP64_ARCHS}
>
>   GH_ACCOUNT =	timescale
>   GH_PROJECT =	timescaledb
> -GH_TAGNAME =	2.23.1
> +GH_TAGNAME =	2.25.2
>
>   # -extras is only used for 2.15.X-fix_hypertable_foreign_keys.sql
> -EXTRAS_COMMIT =	ba47f5dff02e8d75268cb09dd3c30101cf12dd6f
> +EXTRAS_COMMIT =	a9a9b9967a3bd37c5495f2f68f10084ad17ec05f
>   DIST_TUPLE +=	github timescale timescaledb-extras ${EXTRAS_COMMIT} _extras
>
>   CATEGORIES =	databases
> Index: distinfo
> ===================================================================
> RCS file: /cvs/ports/databases/timescaledb/distinfo,v
> retrieving revision 1.29
> diff -u -p -r1.29 distinfo
> --- distinfo	23 Nov 2025 03:08:24 -0000	1.29
> +++ distinfo	5 Mar 2026 19:30:14 -0000
> @@ -1,4 +1,4 @@
> -SHA256 (timescale-timescaledb-extras-ba47f5dff02e8d75268cb09dd3c30101cf12dd6f.tar.gz) = MFKGKubWrbok/Gqg6qo3sBn/5J9H1uHK2C9O682MCAw=
> -SHA256 (timescaledb-2.23.1.tar.gz) = JldfqeKHphB6a/Fiusq0kysN8ZvuONKMEy+aLWWR1kc=
> -SIZE (timescale-timescaledb-extras-ba47f5dff02e8d75268cb09dd3c30101cf12dd6f.tar.gz) = 17811
> -SIZE (timescaledb-2.23.1.tar.gz) = 8276671
> +SHA256 (timescale-timescaledb-extras-a9a9b9967a3bd37c5495f2f68f10084ad17ec05f.tar.gz) = ynoVAALGNMSoM9Mi6ZnRZTliWBoiyL8kmslLC3GWMM8=
> +SHA256 (timescaledb-2.25.2.tar.gz) = F50oGkl3zbKa1EFq/9wAAV0he7eUUOBz6n6OFE+dqbQ=
> +SIZE (timescale-timescaledb-extras-a9a9b9967a3bd37c5495f2f68f10084ad17ec05f.tar.gz) = 24216
> +SIZE (timescaledb-2.25.2.tar.gz) = 8308761
> Index: pkg/PLIST
> ===================================================================
> RCS file: /cvs/ports/databases/timescaledb/pkg/PLIST,v
> retrieving revision 1.30
> diff -u -p -r1.30 PLIST
> --- pkg/PLIST	23 Nov 2025 03:08:25 -0000	1.30
> +++ pkg/PLIST	5 Mar 2026 19:30:14 -0000
> @@ -1,5 +1,4 @@
>   @so lib/postgresql/timescaledb-${GH_TAGNAME}.so
> -@so lib/postgresql/timescaledb-invalidations-${GH_TAGNAME}.so
>   @so lib/postgresql/timescaledb-tsl-${GH_TAGNAME}.so
>   @so lib/postgresql/timescaledb.so
>   share/doc/pkg-readmes/${PKGSTEM}
> @@ -46,6 +45,10 @@ share/postgresql/extension/timescaledb--
>   share/postgresql/extension/timescaledb--2.22.0--${GH_TAGNAME}.sql
>   share/postgresql/extension/timescaledb--2.22.1--${GH_TAGNAME}.sql
>   share/postgresql/extension/timescaledb--2.23.0--${GH_TAGNAME}.sql
> +share/postgresql/extension/timescaledb--2.23.1--${GH_TAGNAME}.sql
> +share/postgresql/extension/timescaledb--2.24.0--${GH_TAGNAME}.sql
> +share/postgresql/extension/timescaledb--2.25.0--${GH_TAGNAME}.sql
> +share/postgresql/extension/timescaledb--2.25.1--${GH_TAGNAME}.sql
>   share/postgresql/extension/timescaledb--${GH_TAGNAME}.sql
>   share/postgresql/extension/timescaledb--2.9.0--${GH_TAGNAME}.sql
>   share/postgresql/extension/timescaledb--2.9.1--${GH_TAGNAME}.sql

Diff looks good to me.