From 6a722f01fcb91c295ba7a563da3cadf8594b9111 Mon Sep 17 00:00:00 2001
From: Polina Bungina <27892524+hughcapet@users.noreply.github.com>
Date: Thu, 22 Jan 2026 13:14:08 +0100
Subject: [PATCH 01/12] Add PG18, remove PG13 (#1156)

- PG18 support
- Fix extension's build caching problem, which causes wrong pgversion symbols in extension's *.so
- Improve logic for timescaledb minor versions cleanup
- Build bg_mon from source

Not included for PG18:
- pglogical-ticker
- pgl-ddl-deploy
---
 .github/workflows/publish-ghcr-container.yaml |   8 +-
 delivery.yaml                                 |   2 +-
 postgres-appliance/Dockerfile                 |  10 +-
 .../bootstrap/maybe_pg_upgrade.py             |   4 +-
 postgres-appliance/build_scripts/base.sh      |  46 +++++--
 .../major_upgrade/inplace_upgrade.py          |  12 +-
 .../major_upgrade/pg_upgrade.py               |   9 +-
 postgres-appliance/scripts/post_init.sh       |  10 +-
 postgres-appliance/scripts/spilo_commons.py   |  10 +-
 postgres-appliance/tests/docker-compose.yml   |   2 +-
 postgres-appliance/tests/test_spilo.sh        | 122 +++++++++---------
 11 files changed, 137 insertions(+), 98 deletions(-)

diff --git a/.github/workflows/publish-ghcr-container.yaml b/.github/workflows/publish-ghcr-container.yaml
index c7f2e0203..8d28da7ab 100644
--- a/.github/workflows/publish-ghcr-container.yaml
+++ b/.github/workflows/publish-ghcr-container.yaml
@@ -3,6 +3,8 @@ on:
   push:
     tags:
       - '*'
+    branches:
+      - dev-18
 
 env:
   REGISTRY: ghcr.io
@@ -35,7 +37,11 @@ jobs:
       working-directory: postgres-appliance
       run: |
         PGVERSION=$(sed -n 's/^ARG PGVERSION=\([1-9][0-9]*\).*$/\1/p' Dockerfile)
-        IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-$PGVERSION:${GITHUB_REF/refs\/tags\//}"
+        if [[ "${{ github.ref }}" == "refs/heads/dev-18" ]]; then
+          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-$PGVERSION-dev:${GITHUB_SHA::8}"
+        else
+          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-$PGVERSION:${GITHUB_REF/refs\/tags\//}"
+        fi
         echo "NAME=$IMAGE" >> $GITHUB_OUTPUT
 
     - name: Set up QEMU
diff --git a/delivery.yaml b/delivery.yaml
index d05d19a21..281208210 100644
--- a/delivery.yaml
+++ b/delivery.yaml
@@ -3,7 +3,7 @@ allow_concurrent_steps: true
 
 build_env: &BUILD_ENV
   BASE_IMAGE: container-registry.zalando.net/library/ubuntu-22.04
-  PGVERSION: 17
+  PGVERSION: 18
   MULTI_ARCH_REGISTRY: container-registry-test.zalando.net/acid
 
 pipeline:
diff --git a/postgres-appliance/Dockerfile b/postgres-appliance/Dockerfile
index 4f8410b5b..24f148eaa 100644
--- a/postgres-appliance/Dockerfile
+++ b/postgres-appliance/Dockerfile
@@ -1,5 +1,5 @@
 ARG BASE_IMAGE=ubuntu:22.04
-ARG PGVERSION=17
+ARG PGVERSION=18
 ARG DEMO=false
 ARG COMPRESS=false
 ARG ADDITIONAL_LOCALES=
@@ -46,16 +46,16 @@ ARG PGVERSION
 ARG TIMESCALEDB_APACHE_ONLY=true
 ARG TIMESCALEDB_TOOLKIT=true
 ARG COMPRESS
-ARG PGOLDVERSIONS="13 14 15 16"
+ARG PGOLDVERSIONS="14 15 16 17"
 ARG WITH_PERL=false
 
 ARG DEB_PG_SUPPORTED_VERSIONS="$PGOLDVERSIONS $PGVERSION"
 
 # Install PostgreSQL, extensions and contribs
 ENV POSTGIS_VERSION=3.6 \
-    BG_MON_COMMIT=7f5887218790b263fe3f42f85f4ddc9c8400b154 \
+    BG_MON_COMMIT=a73c6bcd10dfdf9feaf5eabab7eb6b12d167680d \
     PG_AUTH_MON_COMMIT=fe099eef7662cbc85b0b79191f47f52f1e96b779 \
-    PG_MON_COMMIT=ead1de70794ed62ca1e34d4022f6165ff36e9a91 \
+    PG_MON_COMMIT=13c12eeb946dc2c5537139ce75432fa62b06f0eb \
     SET_USER=REL4_1_0 \
     PLPROFILER=REL4_2_5 \
     PG_PROFILE=4.10 \
@@ -71,7 +71,7 @@ COPY --from=dependencies-builder /builddeps/wal-g /usr/local/bin/
 COPY build_scripts/patroni.sh build_scripts/compress_build.sh /builddeps/
 
 # Install patroni
-ENV PATRONIVERSION=4.0.6
+ENV PATRONIVERSION=4.1.0
 
 WORKDIR /
 
diff --git a/postgres-appliance/bootstrap/maybe_pg_upgrade.py b/postgres-appliance/bootstrap/maybe_pg_upgrade.py
index 4f36e6953..9252d7899 100644
--- a/postgres-appliance/bootstrap/maybe_pg_upgrade.py
+++ b/postgres-appliance/bootstrap/maybe_pg_upgrade.py
@@ -40,7 +40,7 @@ def perform_pitr(postgresql, cluster_version, bin_version, config):
     except Exception:
         logs = tail_postgres_logs()
         # Spilo has no other locales except en_EN.UTF-8, therefore we are safe here.
-        if int(cluster_version) >= 13 and 'recovery ended before configured recovery target was reached' in logs:
+        if 'recovery ended before configured recovery target was reached' in logs:
             # Starting from version 13 Postgres stopped promoting when recovery target wasn't reached.
             # In order to improve the user experience we reset all possible recovery targets and retry.
             recovery_conf = config[config['method']].get('recovery_conf', {})
@@ -103,7 +103,7 @@ def main():
     except Exception as e:
         logger.error('Failed to update extensions: %r', e)
 
-    upgrade.analyze()
+    upgrade.analyze(bin_version)
 
 
 def call_maybe_pg_upgrade():
diff --git a/postgres-appliance/build_scripts/base.sh b/postgres-appliance/build_scripts/base.sh
index ff885c5e9..3b469fd6f 100644
--- a/postgres-appliance/build_scripts/base.sh
+++ b/postgres-appliance/build_scripts/base.sh
@@ -51,7 +51,7 @@ if [ "$WITH_PERL" != "true" ]; then
     equivs-build perl
 fi
 
-curl -sL "https://github.com/zalando-pg/bg_mon/archive/$BG_MON_COMMIT.tar.gz" | tar xz
+curl -sL "https://github.com/CyberDem0n/bg_mon/archive/$BG_MON_COMMIT.tar.gz" | tar xz
 curl -sL "https://github.com/zalando-pg/pg_auth_mon/archive/$PG_AUTH_MON_COMMIT.tar.gz" | tar xz
 curl -sL "https://github.com/cybertec-postgresql/pg_permissions/archive/$PG_PERMISSIONS_COMMIT.tar.gz" | tar xz
 curl -sL "https://github.com/zubkov-andrei/pg_profile/archive/$PG_PROFILE.tar.gz" | tar xz
@@ -85,10 +85,8 @@ for version in $DEB_PG_SUPPORTED_VERSIONS; do
                 "postgresql-${version}-pgaudit"
                 "postgresql-${version}-pldebugger"
                 "postgresql-${version}-pglogical"
-                "postgresql-${version}-pglogical-ticker"
                 "postgresql-${version}-plpgsql-check"
                 "postgresql-${version}-pg-checksums"
-                "postgresql-${version}-pgl-ddl-deploy"
                 "postgresql-${version}-pgq-node"
                 "postgresql-${version}-postgis-${POSTGIS_VERSION%.*}"
                 "postgresql-${version}-postgis-${POSTGIS_VERSION%.*}-scripts"
@@ -97,10 +95,12 @@ for version in $DEB_PG_SUPPORTED_VERSIONS; do
                 "postgresql-${version}-decoderbufs"
                 "postgresql-${version}-pllua"
                 "postgresql-${version}-pgvector"
-                "postgresql-${version}-roaringbitmap")
+                "postgresql-${version}-roaringbitmap"
+                "postgresql-${version}-pgfaceting")
 
-        if [ "$version" -ge 14 ]; then
-            EXTRAS+=("postgresql-${version}-pgfaceting")
+        if [ "$version" != "18" ]; then
+            EXTRAS+=("postgresql-${version}-pgl-ddl-deploy"
+                    "postgresql-${version}-pglogical-ticker")
         fi
 
         if [ "$WITH_PERL" = "true" ]; then
@@ -126,10 +126,32 @@ for version in $DEB_PG_SUPPORTED_VERSIONS; do
         "postgresql-${version}-pg-stat-kcache" \
         "${EXTRAS[@]}"
 
-    # Clean up timescaledb versions except the last 5 minor versions
+    # Clean up timescaledb versions - keep at least 5 minor versions, but ensure compatibility with the lowest/oldest PG version (where possible)
+
     exclude_patterns=()
     versions=$(find "/usr/lib/postgresql/$version/lib/" -name 'timescaledb-2.*.so' | sed -rn 's/.*timescaledb-([1-9]+\.[0-9]+\.[0-9]+)\.so$/\1/p' | sort -rV)
-    latest_minor_versions=$(echo "$versions" | awk -F. '{print $1"."$2}' | uniq | head -n 5)
+    
+    # Calculate the number of versions dynamically based on the lowest PG version's latest minor
+    num_versions=5
+    if [ -n "$first_latest_minor" ]; then
+        minor_versions=$(echo "$versions" | awk -F. '{print $1"."$2}' | uniq)
+        position=0
+        found=0
+        while IFS= read -r minor; do
+            position=$((position + 1))
+            if [ "$minor" = "$first_latest_minor" ]; then
+                found=1
+                break
+            fi
+        done <<< "$minor_versions"
+        
+        # if found, keep max(5, position) versions (so all versions have at least 1 version in common with lowest PG version)
+        if [ $found -eq 1 ] && [ $position -gt $num_versions ]; then
+            num_versions=$position
+        fi
+    fi
+    
+    latest_minor_versions=$(echo "$versions" | awk -F. '{print $1"."$2}' | uniq | head -n "$num_versions")
     for minor in $latest_minor_versions; do
         for full_version in $(echo "$versions" | grep "^$minor"); do
             exclude_patterns+=(! -name timescaledb-"${full_version}".so)
@@ -138,6 +160,11 @@ for version in $DEB_PG_SUPPORTED_VERSIONS; do
     done
     find "/usr/lib/postgresql/$version/lib/" \( -name 'timescaledb-2.*.so' -o -name 'timescaledb-tsl-2.*.so' \) "${exclude_patterns[@]}" -delete
 
+    # Save the latest minor version from the first PG version
+    if [ -z "$first_latest_minor" ]; then
+        first_latest_minor=$(echo "$latest_minor_versions" | head -n 1)
+    fi
+
     # Install 3rd party stuff
 
     if [ "${TIMESCALEDB_APACHE_ONLY}" != "true" ] && [ "${TIMESCALEDB_TOOLKIT}" = "true" ]; then
@@ -160,7 +187,8 @@ for version in $DEB_PG_SUPPORTED_VERSIONS; do
             pg_permissions-${PG_PERMISSIONS_COMMIT} \
             pg_profile-${PG_PROFILE} \
             "${EXTRA_EXTENSIONS[@]}"; do
-        make -C "$n" USE_PGXS=1 clean install-strip
+        PATH="/usr/lib/postgresql/$version/bin:$PATH" make -C "$n" USE_PGXS=1 clean
+        PATH="/usr/lib/postgresql/$version/bin:$PATH" make -C "$n" USE_PGXS=1 install-strip
     done
 done
 
diff --git a/postgres-appliance/major_upgrade/inplace_upgrade.py b/postgres-appliance/major_upgrade/inplace_upgrade.py
index d8c722ffc..772d3d184 100644
--- a/postgres-appliance/major_upgrade/inplace_upgrade.py
+++ b/postgres-appliance/major_upgrade/inplace_upgrade.py
@@ -451,7 +451,7 @@ def restore_custom_statistics_target(self):
                         except Exception:
                             logger.error("Failed to execute '%s'", query)
 
-    def reanalyze(self):
+    def custom_stats_target_reanalyze(self):
         from patroni.postgresql.connection import get_connection_cursor
 
         if not self._statistics:
@@ -470,12 +470,15 @@ def reanalyze(self):
                     except Exception:
                         logger.error("Failed to execute '%s'", query)
 
+    def full_reanalyze(self):
+        self.postgresql.analyze(self.desired_version)
+
     def analyze(self):
         try:
             self.reset_custom_statistics_target()
         except Exception as e:
             logger.error('Failed to reset custom statistics targets: %r', e)
-        self.postgresql.analyze(True)
+        self.postgresql.analyze(self.desired_version, in_stages=True)
         try:
             self.restore_custom_statistics_target()
         except Exception as e:
@@ -634,7 +637,10 @@ def do_upgrade(self):
 
         analyze_thread.join()
 
-        self.reanalyze()
+        if int(self.desired_version) < 18:
+            self.custom_stats_target_reanalyze()
+        else:
+            self.full_reanalyze()
 
         logger.info('Total upgrade time (with analyze): %s', time.time() - downtime_start)
         self.postgresql.bootstrap.call_post_bootstrap(self.config['bootstrap'])
diff --git a/postgres-appliance/major_upgrade/pg_upgrade.py b/postgres-appliance/major_upgrade/pg_upgrade.py
index ad1563e80..bb7ff42f9 100644
--- a/postgres-appliance/major_upgrade/pg_upgrade.py
+++ b/postgres-appliance/major_upgrade/pg_upgrade.py
@@ -268,9 +268,12 @@ def do_upgrade(self):
         return self.pg_upgrade() and self.restore_shared_preload_libraries()\
                  and self.switch_pgdata() and self.cleanup_old_pgdata()
 
-    def analyze(self, in_stages=False):
-        vacuumdb_args = ['--analyze-in-stages'] if in_stages else []
-        logger.info('Rebuilding statistics (vacuumdb%s)', (' ' + vacuumdb_args[0] if in_stages else ''))
+    def analyze(self, version, in_stages=False):
+        vacuumdb_args = []
+        if in_stages:
+            vacuumdb_args = ['--analyze-in-stages'] if int(version) < 18 else ['--analyze-in-stages',
+                                                                               '--missing-stats-only']
+        logger.info('Rebuilding statistics (vacuumdb%s)', (' ' + ' '.join(vacuumdb_args) if in_stages else ''))
         if 'username' in self.config.superuser:
             vacuumdb_args += ['-U', self.config.superuser['username']]
         vacuumdb_args += ['-Z', '-j']
diff --git a/postgres-appliance/scripts/post_init.sh b/postgres-appliance/scripts/post_init.sh
index c12e9c83b..b1f8f325a 100755
--- a/postgres-appliance/scripts/post_init.sh
+++ b/postgres-appliance/scripts/post_init.sh
@@ -139,16 +139,12 @@ CREATE TABLE IF NOT EXISTS public.postgres_log (
     query_pos integer,
     location text,
     application_name text,
+    backend_type text,
+    leader_pid integer,
+    query_id bigint,
     CONSTRAINT postgres_log_check CHECK (false) NO INHERIT
 );
 GRANT SELECT ON public.postgres_log TO admin;"
-if [ "$PGVER" -ge 13 ]; then
-    echo "ALTER TABLE public.postgres_log ADD COLUMN IF NOT EXISTS backend_type text;"
-fi
-if [ "$PGVER" -ge 14 ]; then
-    echo "ALTER TABLE public.postgres_log ADD COLUMN IF NOT EXISTS leader_pid integer;"
-    echo "ALTER TABLE public.postgres_log ADD COLUMN IF NOT EXISTS query_id bigint;"
-fi
 
 # Sunday could be 0 or 7 depending on the format, we just create both
 LOG_SHIP_HOURLY=$(echo "SELECT text(current_setting('log_rotation_age') = '1h')" | psql -tAX -d postgres 2> /dev/null | tail -n 1)
diff --git a/postgres-appliance/scripts/spilo_commons.py b/postgres-appliance/scripts/spilo_commons.py
index 0543bf771..981c9caa8 100644
--- a/postgres-appliance/scripts/spilo_commons.py
+++ b/postgres-appliance/scripts/spilo_commons.py
@@ -12,13 +12,13 @@
 
 # (min_version, max_version, shared_preload_libraries, extwlist.extensions)
 extensions = {
-    'timescaledb':    (9.6, 17, True,  True),
-    'pg_cron':        (9.5, 17, True,  False),
-    'pg_stat_kcache': (9.4, 17, True,  False),
-    'pg_partman':     (9.4, 17, False, True)
+    'timescaledb':    (9.6, 18, True,  True),
+    'pg_cron':        (9.5, 18, True,  False),
+    'pg_stat_kcache': (9.4, 18, True,  False),
+    'pg_partman':     (9.4, 18, False, True)
 }
 if os.environ.get('ENABLE_PG_MON') == 'true':
-    extensions['pg_mon'] = (11,  17, True,  False)
+    extensions['pg_mon'] = (11,  18, True,  False)
 
 
 def adjust_extensions(old, version, extwlist=False):
diff --git a/postgres-appliance/tests/docker-compose.yml b/postgres-appliance/tests/docker-compose.yml
index e8e7952e9..3358f61a9 100644
--- a/postgres-appliance/tests/docker-compose.yml
+++ b/postgres-appliance/tests/docker-compose.yml
@@ -50,7 +50,7 @@ services:
               postgresql:
                 parameters:
                   shared_buffers: 32MB
-            PGVERSION: '13'
+            PGVERSION: '14'
             # Just to test upgrade with clone. Without CLONE_SCOPE they don't work
             CLONE_WAL_S3_BUCKET: *bucket
             CLONE_AWS_ACCESS_KEY_ID: *access_key
diff --git a/postgres-appliance/tests/test_spilo.sh b/postgres-appliance/tests/test_spilo.sh
index 66100cbe9..a68c86a7f 100755
--- a/postgres-appliance/tests/test_spilo.sh
+++ b/postgres-appliance/tests/test_spilo.sh
@@ -124,15 +124,15 @@ function drop_timescaledb() {
 }
 
 function test_inplace_upgrade_wrong_version() {
-    docker_exec "$1" "PGVERSION=13 $UPGRADE_SCRIPT 3" 2>&1 | grep 'Upgrade is not required'
+    docker_exec "$1" "PGVERSION=14 $UPGRADE_SCRIPT 3" 2>&1 | grep 'Upgrade is not required'
 }
 
 function test_inplace_upgrade_wrong_capacity() {
-    docker_exec "$1" "PGVERSION=14 $UPGRADE_SCRIPT 4" 2>&1 | grep 'number of replicas does not match'
+    docker_exec "$1" "PGVERSION=15 $UPGRADE_SCRIPT 4" 2>&1 | grep 'number of replicas does not match'
 }
 
-function test_successful_inplace_upgrade_to_14() {
-    docker_exec "$1" "PGVERSION=14 $UPGRADE_SCRIPT 3"
+function test_successful_inplace_upgrade_to_15() {
+    docker_exec "$1" "PGVERSION=15 $UPGRADE_SCRIPT 3"
 }
 
 function test_envdir_suffix() {
@@ -146,11 +146,7 @@ function test_envdir_updated_to_x() {
 }
 
 function test_failed_inplace_upgrade_big_replication_lag() {
-    ! test_successful_inplace_upgrade_to_14 "$1"
-}
-
-function test_successful_inplace_upgrade_to_15() {
-    docker_exec "$1" "PGVERSION=15 $UPGRADE_SCRIPT 3"
+    ! test_successful_inplace_upgrade_to_15 "$1"
 }
 
 function test_successful_inplace_upgrade_to_16() {
@@ -161,8 +157,12 @@ function test_successful_inplace_upgrade_to_17() {
     docker_exec "$1" "PGVERSION=17 $UPGRADE_SCRIPT 3"
 }
 
-function test_pg_upgrade_to_17_check_failed() {
-    ! test_successful_inplace_upgrade_to_17 "$1"
+function test_successful_inplace_upgrade_to_18() {
+    docker_exec "$1" "PGVERSION=18 $UPGRADE_SCRIPT 3"
+}
+
+function test_pg_upgrade_to_18_check_failed() {
+    ! test_successful_inplace_upgrade_to_18 "$1"
 }
 
 function start_clone_with_walg_upgrade_container() {
@@ -170,7 +170,7 @@ function start_clone_with_walg_upgrade_container() {
 
     docker-compose run \
         -e SCOPE=upgrade \
-        -e PGVERSION=14 \
+        -e PGVERSION=15 \
         -e CLONE_SCOPE=demo \
         -e CLONE_METHOD=CLONE_WITH_WALG \
         -e CLONE_TARGET_TIME="$(next_minute)" \
@@ -183,27 +183,27 @@ function start_clone_with_walg_upgrade_replica_container() {
     start_clone_with_walg_upgrade_container 2
 }
 
-function start_clone_with_walg_upgrade_to_17_container() {
+function start_clone_with_walg_upgrade_to_18_container() {
     docker-compose run \
         -e SCOPE=upgrade3 \
-        -e PGVERSION=17 \
+        -e PGVERSION=18 \
         -e CLONE_SCOPE=demo \
-        -e CLONE_PGVERSION=13 \
+        -e CLONE_PGVERSION=14 \
         -e CLONE_METHOD=CLONE_WITH_WALG \
         -e CLONE_TARGET_TIME="$(next_minute)" \
         --name "${PREFIX}upgrade4" \
         -d "spilo3"
 }
 
-function start_clone_with_walg_17_container() {
+function start_clone_with_walg_18_container() {
     docker-compose run \
-        -e SCOPE=clone16 \
-        -e PGVERSION=17 \
+        -e SCOPE=clone17 \
+        -e PGVERSION=18 \
         -e CLONE_SCOPE=upgrade3 \
-        -e CLONE_PGVERSION=17 \
+        -e CLONE_PGVERSION=18 \
         -e CLONE_METHOD=CLONE_WITH_WALG \
         -e CLONE_TARGET_TIME="$(next_hour)" \
-        --name "${PREFIX}clone16" \
+        --name "${PREFIX}clone17" \
         -d "spilo3"
 }
 
@@ -211,7 +211,7 @@ function start_clone_with_basebackup_upgrade_container() {
     local container=$1
     docker-compose run \
         -e SCOPE=upgrade2 \
-        -e PGVERSION=15 \
+        -e PGVERSION=16 \
         -e CLONE_SCOPE=upgrade \
         -e CLONE_METHOD=CLONE_WITH_BASEBACKUP \
         -e CLONE_HOST="$(docker_exec "$container" "hostname --ip-address")" \
@@ -225,10 +225,10 @@ function start_clone_with_basebackup_upgrade_container() {
 function start_clone_with_hourly_log_rotation() {
     docker-compose run \
         -e SCOPE=hourlylogs \
-        -e PGVERSION=17 \
+        -e PGVERSION=18 \
         -e LOG_SHIP_HOURLY="true" \
         -e CLONE_SCOPE=upgrade2 \
-        -e CLONE_PGVERSION=15 \
+        -e CLONE_PGVERSION=16 \
         -e CLONE_METHOD=CLONE_WITH_WALG \
         -e CLONE_TARGET_TIME="$(next_minute)" \
         --name "${PREFIX}hourlylogs" \
@@ -260,18 +260,18 @@ function verify_hourly_log_rotation() {
     [ "$log_rotation_age" = "1h" ] && [ "$log_filename" = "postgresql-%u-%H.log" ] && [ "$postgres_log_ftables" -eq 192 ] && [ "$postgres_log_views" -eq 8 ] && [ "$postgres_failed_auth_views" -eq 200 ]
 }
 
-# TEST SUITE 1 - In-place major upgrade 13->14->...->17
-# TEST SUITE 2 - Major upgrade 13->17 after wal-g clone (with CLONE_PGVERSION set)
-# TEST SUITE 3 - PITR (clone with wal-g) with unreachable target (14+)
-# TEST SUITE 4 - Major upgrade 13->14 after wal-g clone (no CLONE_PGVERSION)
+# TEST SUITE 1 - In-place major upgrade 14->15->...->18
+# TEST SUITE 2 - Major upgrade 14->18 after wal-g clone (with CLONE_PGVERSION set)
+# TEST SUITE 3 - PITR (clone with wal-g) with unreachable target (15+)
+# TEST SUITE 4 - Major upgrade 14->15 after wal-g clone (no CLONE_PGVERSION)
 # TEST SUITE 5 - Replica bootstrap with wal-g
-# TEST SUITE 6 - Major upgrade 14->15 after clone with basebackup
+# TEST SUITE 6 - Major upgrade 15->16 after clone with basebackup
 # TEST SUITE 7 - Hourly log rotation
 function test_spilo() {
     # TEST SUITE 1
     local container=$1
 
-    run_test test_envdir_suffix "$container" 13
+    run_test test_envdir_suffix "$container" 14
 
     log_info "[TS1] Testing wrong upgrade setups"
     run_test test_inplace_upgrade_wrong_version "$container"
@@ -288,66 +288,66 @@ function test_spilo() {
 
     # TEST SUITE 2
     local upgrade3_container
-    upgrade3_container=$(start_clone_with_walg_upgrade_to_17_container) # SCOPE=upgrade3 PGVERSION=17 CLONE: _SCOPE=demo _PGVERSION=13 _TARGET_TIME=<next_min>
-    log_info "[TS2] Started $upgrade3_container for testing major upgrade 13->17 after clone with wal-g"
+    upgrade3_container=$(start_clone_with_walg_upgrade_to_18_container) # SCOPE=upgrade3 PGVERSION=18 CLONE: _SCOPE=demo _PGVERSION=14 _TARGET_TIME=<next_min>
+    log_info "[TS2] Started $upgrade3_container for testing major upgrade 14->18 after clone with wal-g"
 
 
     # TEST SUITE 4
     local upgrade_container
-    upgrade_container=$(start_clone_with_walg_upgrade_container) # SCOPE=upgrade PGVERSION=14 CLONE: _SCOPE=demo _TARGET_TIME=<next_min>
-    log_info "[TS4] Started $upgrade_container for testing major upgrade 13->14 after clone with wal-g"
+    upgrade_container=$(start_clone_with_walg_upgrade_container) # SCOPE=upgrade PGVERSION=15 CLONE: _SCOPE=demo _TARGET_TIME=<next_min>
+    log_info "[TS4] Started $upgrade_container for testing major upgrade 14->15 after clone with wal-g"
 
 
     # TEST SUITE 1
     # wait clone to finish and prevent timescale installation gets cloned
     find_leader "$upgrade3_container"
     find_leader "$upgrade_container"
-    create_timescaledb "$container" # we don't install it at the beginning, as we do 13->17 in a clone
+    create_timescaledb "$container" # we don't install it at the beginning, as we do 14->18 in a clone
 
-    log_info "[TS1] Testing in-place major upgrade 13->14"
+    log_info "[TS1] Testing in-place major upgrade 14->15"
     wait_zero_lag "$container"
-    run_test test_successful_inplace_upgrade_to_14 "$container"
+    run_test test_successful_inplace_upgrade_to_15 "$container"
     wait_all_streaming "$container"
-    run_test test_envdir_updated_to_x 14
+    run_test test_envdir_updated_to_x 15
 
     # TEST SUITE 2
-    log_info "[TS2] Testing in-place major upgrade 13->17 after wal-g clone"
-    run_test verify_clone_upgrade "$upgrade3_container" "wal-g" 13 17
+    log_info "[TS2] Testing in-place major upgrade 14->18 after wal-g clone"
+    run_test verify_clone_upgrade "$upgrade3_container" "wal-g" 14 18
 
     run_test verify_archive_mode_is_on "$upgrade3_container"
     wait_backup "$upgrade3_container"
 
 
     # TEST SUITE 3
-    local clone17_container
-    clone17_container=$(start_clone_with_walg_17_container) # SCOPE=clone17 CLONE: _SCOPE=upgrade3 _PGVERSION=17 _TARGET_TIME=<next_hour>
-    log_info "[TS3] Started $clone17_container for testing point-in-time recovery (clone with wal-g) with unreachable target on 14+"
+    local clone18_container
+    clone18_container=$(start_clone_with_walg_18_container) # SCOPE=clone18 CLONE: _SCOPE=upgrade3 _PGVERSION=18 _TARGET_TIME=<next_hour>
+    log_info "[TS3] Started $clone18_container for testing point-in-time recovery (clone with wal-g) with unreachable target on 15+"
 
 
     # TEST SUITE 1
-    log_info "[TS1] Testing in-place major upgrade 14->15"
-    run_test test_successful_inplace_upgrade_to_15 "$container"
+    log_info "[TS1] Testing in-place major upgrade 15->16"
+    run_test test_successful_inplace_upgrade_to_16 "$container"
     wait_all_streaming "$container"
-    run_test test_envdir_updated_to_x 15
+    run_test test_envdir_updated_to_x 16
 
 
     # TEST SUITE 3
-    find_leader "$clone17_container"
-    run_test verify_archive_mode_is_on "$clone17_container"
+    find_leader "$clone18_container"
+    run_test verify_archive_mode_is_on "$clone18_container"
 
 
     # TEST SUITE 1
     wait_backup "$container"
 
-    log_info "[TS1] Testing in-place major upgrade to 15->16"
-    run_test test_successful_inplace_upgrade_to_16 "$container"
+    log_info "[TS1] Testing in-place major upgrade to 16->17"
+    run_test test_successful_inplace_upgrade_to_17 "$container"
     wait_all_streaming "$container"
-    run_test test_envdir_updated_to_x 16
+    run_test test_envdir_updated_to_x 17
 
 
     # TEST SUITE 4
-    log_info "[TS4] Testing in-place major upgrade 13->14 after clone with wal-g"
-    run_test verify_clone_upgrade "$upgrade_container" "wal-g" 13 14
+    log_info "[TS4] Testing in-place major upgrade 14->15 after clone with wal-g"
+    run_test verify_clone_upgrade "$upgrade_container" "wal-g" 14 15
 
     run_test verify_archive_mode_is_on "$upgrade_container"
     wait_backup "$upgrade_container"
@@ -361,20 +361,20 @@ function test_spilo() {
 
     # TEST SUITE 6
     local basebackup_container
-    basebackup_container=$(start_clone_with_basebackup_upgrade_container "$upgrade_container")  # SCOPE=upgrade2 PGVERSION=15 CLONE: _SCOPE=upgrade
-    log_info "[TS6] Started $basebackup_container for testing major upgrade 14->15 after clone with basebackup"
+    basebackup_container=$(start_clone_with_basebackup_upgrade_container "$upgrade_container")  # SCOPE=upgrade2 PGVERSION=16 CLONE: _SCOPE=upgrade
+    log_info "[TS6] Started $basebackup_container for testing major upgrade 15->16 after clone with basebackup"
     wait_backup "$basebackup_container"
 
     # TEST SUITE 1
-    # run_test test_pg_upgrade_to_17_check_failed "$container"  # pg_upgrade --check complains about timescaledb
+    # run_test test_pg_upgrade_to_18_check_failed "$container"  # pg_upgrade --check complains about timescaledb
 
     wait_backup "$container"
 
-    # drop_timescaledb "$container"
-    log_info "[TS1] Testing in-place major upgrade 16->17"
-    run_test test_successful_inplace_upgrade_to_17 "$container"
+    drop_timescaledb "$container"
+    log_info "[TS1] Testing in-place major upgrade 17->18"
+    run_test test_successful_inplace_upgrade_to_18 "$container"
     wait_all_streaming "$container"
-    run_test test_envdir_updated_to_x 17
+    run_test test_envdir_updated_to_x 18
 
 
     # TEST SUITE 5
@@ -387,8 +387,8 @@ function test_spilo() {
     log_info "[TS7] Started $hourlylogs_container for testing hourly log rotation"
 
     # TEST SUITE 6
-    log_info "[TS6] Testing in-place major upgrade 14->15 after clone with basebackup"
-    run_test verify_clone_upgrade "$basebackup_container" "basebackup" 14 15
+    log_info "[TS6] Testing in-place major upgrade 15->16 after clone with basebackup"
+    run_test verify_clone_upgrade "$basebackup_container" "basebackup" 15 16
     run_test verify_archive_mode_is_on "$basebackup_container"
 
     # TEST SUITE 7

From 371a9b2b3aa2664ef89f40ebc1ddc747238a5a83 Mon Sep 17 00:00:00 2001
From: Ida Novindasari <idanovinda@gmail.com>
Date: Thu, 12 Feb 2026 08:39:20 +0100
Subject: [PATCH 02/12] Update PGOLDVERSIONS for internal pipeline build
 (#1171)

---
 delivery.yaml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/delivery.yaml b/delivery.yaml
index 281208210..71cc29a94 100644
--- a/delivery.yaml
+++ b/delivery.yaml
@@ -4,6 +4,7 @@ allow_concurrent_steps: true
 build_env: &BUILD_ENV
   BASE_IMAGE: container-registry.zalando.net/library/ubuntu-22.04
   PGVERSION: 18
+  PGOLDVERSIONS: "15 16 17"
   MULTI_ARCH_REGISTRY: container-registry-test.zalando.net/acid
 
 pipeline:
@@ -32,7 +33,7 @@ pipeline:
       docker buildx build --platform "linux/amd64,linux/arm64" \
                           --build-arg PGVERSION="$PGVERSION" \
                           --build-arg BASE_IMAGE="$BASE_IMAGE" \
-                          --build-arg PGOLDVERSIONS="14 15 16" \
+                          --build-arg PGOLDVERSIONS="$PGOLDVERSIONS" \
                           -t "$ECR_TEST_IMAGE" \
                           --push .
 
@@ -61,7 +62,7 @@ pipeline:
       docker buildx build --platform "linux/amd64,linux/arm64" \
                           --build-arg PGVERSION="$PGVERSION" \
                           --build-arg BASE_IMAGE="$BASE_IMAGE" \
-                          --build-arg PGOLDVERSIONS="14 15 16" \
+                          --build-arg PGOLDVERSIONS="$PGOLDVERSIONS" \
                           -t "$ECR_TEST_IMAGE" \
                           --push .
       cdp-promote-image "$ECR_TEST_IMAGE"
@@ -92,7 +93,7 @@ pipeline:
       docker buildx build --platform "linux/amd64,linux/arm64" \
                           --build-arg PGVERSION="$PGVERSION" \
                           --build-arg BASE_IMAGE="$BASE_IMAGE" \
-                          --build-arg PGOLDVERSIONS="14 15 16" \
+                          --build-arg PGOLDVERSIONS="$PGOLDVERSIONS" \
                           -t "$ECR_TEST_IMAGE" \
                           --push .
       cdp-promote-image "$ECR_TEST_IMAGE"

From 31d082e862c39617c23dd8c6e9684ad2a989984b Mon Sep 17 00:00:00 2001
From: Polina Bungina <polina.bungina@zalando.de>
Date: Thu, 12 Feb 2026 15:12:15 +0100
Subject: [PATCH 03/12] Build internal 18 image on push to dev-18

---
 delivery.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/delivery.yaml b/delivery.yaml
index 71cc29a94..930423851 100644
--- a/delivery.yaml
+++ b/delivery.yaml
@@ -44,6 +44,8 @@ pipeline:
   when:
     - event: push
       branch: trigger
+    - event: push
+      branch: dev-18  # TODO: remove once merged to master
   timeout: 10h
   vm_config:
     type: linux

From 183d32184fe99db71a1f62ba6beb4012a75fa720 Mon Sep 17 00:00:00 2001
From: Polina Bungina <27892524+hughcapet@users.noreply.github.com>
Date: Thu, 12 Feb 2026 15:50:52 +0100
Subject: [PATCH 04/12] Trigger internal 18 image (#1175)

---
 delivery.yaml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/delivery.yaml b/delivery.yaml
index 930423851..7f815df37 100644
--- a/delivery.yaml
+++ b/delivery.yaml
@@ -43,9 +43,7 @@ pipeline:
   type: script
   when:
     - event: push
-      branch: trigger
-    - event: push
-      branch: dev-18  # TODO: remove once merged to master
+      branch: dev-18  # TODO: change to master once merged
   timeout: 10h
   vm_config:
     type: linux

From ee756c9eedfcbdf6ed911ef036258d4116858642 Mon Sep 17 00:00:00 2001
From: Polina Bungina <27892524+hughcapet@users.noreply.github.com>
Date: Fri, 13 Feb 2026 14:13:31 +0100
Subject: [PATCH 05/12] No default provider, handle gh PUT IMDS request
 differently (#1177)

---
 postgres-appliance/scripts/configure_spilo.py | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/postgres-appliance/scripts/configure_spilo.py b/postgres-appliance/scripts/configure_spilo.py
index f260c1304..f073b2f60 100755
--- a/postgres-appliance/scripts/configure_spilo.py
+++ b/postgres-appliance/scripts/configure_spilo.py
@@ -396,7 +396,7 @@ def deep_update(a, b):
 
 
 def get_provider():
-    provider = os.environ.get('SPILO_PROVIDER', PROVIDER_LOCAL)
+    provider = os.environ.get('SPILO_PROVIDER')
     if provider:
         if provider in {PROVIDER_AWS, PROVIDER_GOOGLE, PROVIDER_OPENSTACK, PROVIDER_LOCAL}:
             return provider
@@ -411,18 +411,23 @@ def get_provider():
         logging.info("Figuring out my environment (Google? AWS? Openstack? Local?)")
         response = requests.put(
             url='http://169.254.169.254/latest/api/token',
-            headers={'X-aws-ec2-metadata-token-ttl-seconds': '60'}
+            headers={'X-aws-ec2-metadata-token-ttl-seconds': '60'},
+            timeout=2
         )
+        if not response.ok:
+            logging.info("Failed to get IMDS token (status %s), assuming local Docker setup", response.status_code)
+            return PROVIDER_LOCAL
         token = response.text
         r = requests.get(
             url='http://169.254.169.254',
-            headers={'X-aws-ec2-metadata-token': token}
+            headers={'X-aws-ec2-metadata-token': token},
+            timeout=2
         )
         if r.headers.get('Metadata-Flavor', '') == 'Google':
             return PROVIDER_GOOGLE
         else:
             # accessible on Openstack, will fail on AWS
-            r = requests.get('http://169.254.169.254/openstack/latest/meta_data.json')
+            r = requests.get('http://169.254.169.254/openstack/latest/meta_data.json', timeout=2)
             if r.ok:
                 # make sure the response is parsable - https://github.com/Azure/aad-pod-identity/issues/943 and
                 # https://github.com/zalando/spilo/issues/542
@@ -432,7 +437,8 @@ def get_provider():
             # is accessible from both AWS and Openstack, Possiblity of misidentification if previous try fails
             r = requests.get(
                 url='http://169.254.169.254/latest/meta-data/ami-id',
-                headers={'X-aws-ec2-metadata-token': token}
+                headers={'X-aws-ec2-metadata-token': token},
+                timeout=2
             )
             return PROVIDER_AWS if r.ok else PROVIDER_UNSUPPORTED
     except (requests.exceptions.ConnectTimeout, requests.exceptions.ConnectionError, requests.exceptions.ReadTimeout):

From e44bdf8e6f9ebba185542ccd623d430419265564 Mon Sep 17 00:00:00 2001
From: Polina Bungina <27892524+hughcapet@users.noreply.github.com>
Date: Fri, 13 Feb 2026 14:36:33 +0100
Subject: [PATCH 06/12] Do not include pg15 into internal image (#1178)

---
 delivery.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/delivery.yaml b/delivery.yaml
index 7f815df37..d1c701b8e 100644
--- a/delivery.yaml
+++ b/delivery.yaml
@@ -4,7 +4,7 @@ allow_concurrent_steps: true
 build_env: &BUILD_ENV
   BASE_IMAGE: container-registry.zalando.net/library/ubuntu-22.04
   PGVERSION: 18
-  PGOLDVERSIONS: "15 16 17"
+  PGOLDVERSIONS: "16 17"
   MULTI_ARCH_REGISTRY: container-registry-test.zalando.net/acid
 
 pipeline:

From 6393e80e3ced3e18099bd3f2d34dcc119099f81c Mon Sep 17 00:00:00 2001
From: Polina Bungina <27892524+hughcapet@users.noreply.github.com>
Date: Mon, 16 Feb 2026 09:06:40 +0100
Subject: [PATCH 07/12] Handle checksums enabled in initdb by default (#1179)

---
 postgres-appliance/major_upgrade/pg_upgrade.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/postgres-appliance/major_upgrade/pg_upgrade.py b/postgres-appliance/major_upgrade/pg_upgrade.py
index bb7ff42f9..f3f05ea6b 100644
--- a/postgres-appliance/major_upgrade/pg_upgrade.py
+++ b/postgres-appliance/major_upgrade/pg_upgrade.py
@@ -207,8 +207,9 @@ def prepare_new_pgdata(self, version):
         locale = self.query("SELECT datcollate FROM pg_database WHERE datname='template1';")[0][0]
         encoding = self.query('SHOW server_encoding')[0][0]
         initdb_config = [{'locale': locale}, {'encoding': encoding}]
-        if self.query("SELECT current_setting('data_checksums')::bool")[0][0]:
-            initdb_config.append('data-checksums')
+        checksums_enabled = self.query("SELECT current_setting('data_checksums')::bool")[0][0]
+        if checksums_enabled == (int(version) < 18):
+            initdb_config.append('data-checksums' if checksums_enabled else 'no-data-checksums')
 
         logger.info('initdb config: %s', initdb_config)
 

From 683fe2c061e6e03fdab62f3bd8efbc63f9993e35 Mon Sep 17 00:00:00 2001
From: Polina Bungina <27892524+hughcapet@users.noreply.github.com>
Date: Mon, 16 Feb 2026 17:12:45 +0100
Subject: [PATCH 08/12] Remove build on every dev-18 push (#1180)

---
 .github/workflows/publish-ghcr-container.yaml | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/.github/workflows/publish-ghcr-container.yaml b/.github/workflows/publish-ghcr-container.yaml
index 8d28da7ab..c7f2e0203 100644
--- a/.github/workflows/publish-ghcr-container.yaml
+++ b/.github/workflows/publish-ghcr-container.yaml
@@ -3,8 +3,6 @@ on:
   push:
     tags:
       - '*'
-    branches:
-      - dev-18
 
 env:
   REGISTRY: ghcr.io
@@ -37,11 +35,7 @@ jobs:
       working-directory: postgres-appliance
       run: |
         PGVERSION=$(sed -n 's/^ARG PGVERSION=\([1-9][0-9]*\).*$/\1/p' Dockerfile)
-        if [[ "${{ github.ref }}" == "refs/heads/dev-18" ]]; then
-          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-$PGVERSION-dev:${GITHUB_SHA::8}"
-        else
-          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-$PGVERSION:${GITHUB_REF/refs\/tags\//}"
-        fi
+        IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-$PGVERSION:${GITHUB_REF/refs\/tags\//}"
         echo "NAME=$IMAGE" >> $GITHUB_OUTPUT
 
     - name: Set up QEMU

From 38a4fa07c35203cce6daef23a169a8b5fa129d03 Mon Sep 17 00:00:00 2001
From: Polina Bungina <27892524+hughcapet@users.noreply.github.com>
Date: Fri, 20 Feb 2026 18:29:35 +0100
Subject: [PATCH 09/12] Update wal-g version to 3.0.8 (#1183)

Co-authored-by: idanovinda <idanovinda@gmail.com>
---
 postgres-appliance/Dockerfile                    | 2 +-
 postgres-appliance/build_scripts/dependencies.sh | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/postgres-appliance/Dockerfile b/postgres-appliance/Dockerfile
index 24f148eaa..ec7920b7e 100644
--- a/postgres-appliance/Dockerfile
+++ b/postgres-appliance/Dockerfile
@@ -18,7 +18,7 @@ FROM $BASE_IMAGE as dependencies-builder
 
 ARG DEMO
 
-ENV WALG_VERSION=v3.0.5
+ENV WALG_VERSION=v3.0.8
 
 COPY build_scripts/dependencies.sh /builddeps/
 
diff --git a/postgres-appliance/build_scripts/dependencies.sh b/postgres-appliance/build_scripts/dependencies.sh
index 65aa28055..2f1ef68cb 100644
--- a/postgres-appliance/build_scripts/dependencies.sh
+++ b/postgres-appliance/build_scripts/dependencies.sh
@@ -29,9 +29,9 @@ apt-get install -y curl ca-certificates
 mkdir /builddeps/wal-g
 
 if [ "$ARCH" = "amd64" ]; then
-    PKG_NAME='wal-g-pg-ubuntu-20.04-amd64'
+    PKG_NAME='wal-g-pg-22.04-amd64'
 else
-    PKG_NAME='wal-g-pg-ubuntu-20.04-aarch64'
+    PKG_NAME='wal-g-pg-22.04-aarch64'
 fi
 
 curl -sL "https://github.com/wal-g/wal-g/releases/download/$WALG_VERSION/$PKG_NAME.tar.gz" \

From 5fac7f91935acea9cda4f1c682e69b902047399d Mon Sep 17 00:00:00 2001
From: Polina Bungina <27892524+hughcapet@users.noreply.github.com>
Date: Tue, 24 Feb 2026 18:47:14 +0100
Subject: [PATCH 10/12] Dev 18 sync (#1186)

* Fix server version request in basebackup.sh
* Update bg_mon, pg_mon, pg_profile, pg_permissions refs
* Install set_user, pg_permissions from pgdg
---
 postgres-appliance/Dockerfile            | 8 +++-----
 postgres-appliance/build_scripts/base.sh | 6 ++----
 postgres-appliance/scripts/basebackup.sh | 6 +++++-
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/postgres-appliance/Dockerfile b/postgres-appliance/Dockerfile
index ec7920b7e..6608483ab 100644
--- a/postgres-appliance/Dockerfile
+++ b/postgres-appliance/Dockerfile
@@ -55,12 +55,10 @@ ARG DEB_PG_SUPPORTED_VERSIONS="$PGOLDVERSIONS $PGVERSION"
 ENV POSTGIS_VERSION=3.6 \
     BG_MON_COMMIT=a73c6bcd10dfdf9feaf5eabab7eb6b12d167680d \
     PG_AUTH_MON_COMMIT=fe099eef7662cbc85b0b79191f47f52f1e96b779 \
-    PG_MON_COMMIT=13c12eeb946dc2c5537139ce75432fa62b06f0eb \
-    SET_USER=REL4_1_0 \
+    PG_MON_COMMIT=88ac7b58348aa061c814982defc170644f368f39 \
     PLPROFILER=REL4_2_5 \
-    PG_PROFILE=4.10 \
-    PAM_OAUTH2=v1.0.1 \
-    PG_PERMISSIONS_COMMIT=f4b7c18676fa64236a1c8e28d34a35764e4a70e2
+    PG_PROFILE=4.11 \
+    PAM_OAUTH2=v1.0.1
 
 WORKDIR /builddeps
 RUN bash base.sh
diff --git a/postgres-appliance/build_scripts/base.sh b/postgres-appliance/build_scripts/base.sh
index 3b469fd6f..bc4633d82 100644
--- a/postgres-appliance/build_scripts/base.sh
+++ b/postgres-appliance/build_scripts/base.sh
@@ -53,9 +53,7 @@ fi
 
 curl -sL "https://github.com/CyberDem0n/bg_mon/archive/$BG_MON_COMMIT.tar.gz" | tar xz
 curl -sL "https://github.com/zalando-pg/pg_auth_mon/archive/$PG_AUTH_MON_COMMIT.tar.gz" | tar xz
-curl -sL "https://github.com/cybertec-postgresql/pg_permissions/archive/$PG_PERMISSIONS_COMMIT.tar.gz" | tar xz
 curl -sL "https://github.com/zubkov-andrei/pg_profile/archive/$PG_PROFILE.tar.gz" | tar xz
-git clone -b "$SET_USER" https://github.com/pgaudit/set_user.git
 
 apt-get install -y \
     postgresql-common \
@@ -124,6 +122,8 @@ for version in $DEB_PG_SUPPORTED_VERSIONS; do
         "postgresql-server-dev-${version}" \
         "postgresql-${version}-pgq3" \
         "postgresql-${version}-pg-stat-kcache" \
+        "postgresql-${version}-pg-permissions" \
+        "postgresql-${version}-set-user" \
         "${EXTRAS[@]}"
 
     # Clean up timescaledb versions - keep at least 5 minor versions, but ensure compatibility with the lowest/oldest PG version (where possible)
@@ -183,8 +183,6 @@ for version in $DEB_PG_SUPPORTED_VERSIONS; do
 
     for n in bg_mon-${BG_MON_COMMIT} \
             pg_auth_mon-${PG_AUTH_MON_COMMIT} \
-            set_user \
-            pg_permissions-${PG_PERMISSIONS_COMMIT} \
             pg_profile-${PG_PROFILE} \
             "${EXTRA_EXTENSIONS[@]}"; do
         PATH="/usr/lib/postgresql/$version/bin:$PATH" make -C "$n" USE_PGXS=1 clean
diff --git a/postgres-appliance/scripts/basebackup.sh b/postgres-appliance/scripts/basebackup.sh
index 6e1622eea..d47cd2923 100755
--- a/postgres-appliance/scripts/basebackup.sh
+++ b/postgres-appliance/scripts/basebackup.sh
@@ -19,6 +19,10 @@ done
 
 [[ -z $DATA_DIR || -z "$CONNSTR" || ! $RETRIES =~ ^[1-9]$ ]] && exit 1
 
+if [[ ! $CONNSTR =~ dbname= ]]; then
+    CONNSTR="${CONNSTR} dbname=postgres"
+fi
+
 if which pg_receivewal &> /dev/null; then
     PG_RECEIVEWAL=pg_receivewal
     PG_BASEBACKUP_OPTS=(-X none)
@@ -95,7 +99,7 @@ else
     receivewal_pid=$(cat "$WAL_FAST/receivewal.pid")
 fi
 
-PGVER=$(psql -d "$CONNSTR" -tAc "SELECT pg_catalog.current_setting('server_version_num')::int/10000" || echo 0)
+PGVER=$(psql "$CONNSTR" -tAc "SELECT pg_catalog.current_setting('server_version_num')::int/10000" || echo 0)
 if [[ $PGVER -ge 15 ]]; then
     PG_BASEBACKUP_OPTS+=("--compress=server-lz4")
 fi

From 6b073fd1b11c8166f4428bc1d6a1bf8011647e0e Mon Sep 17 00:00:00 2001
From: Polina Bungina <27892524+hughcapet@users.noreply.github.com>
Date: Fri, 27 Feb 2026 21:34:52 +0100
Subject: [PATCH 11/12] Properly format ipv6 address for rsync (#1187) (#1189)

---
 postgres-appliance/major_upgrade/inplace_upgrade.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/postgres-appliance/major_upgrade/inplace_upgrade.py b/postgres-appliance/major_upgrade/inplace_upgrade.py
index 772d3d184..51c193bb6 100644
--- a/postgres-appliance/major_upgrade/inplace_upgrade.py
+++ b/postgres-appliance/major_upgrade/inplace_upgrade.py
@@ -717,6 +717,7 @@ def rsync_replica(config, desired_version, primary_ip, pid):
 
     env = os.environ.copy()
     env['RSYNC_PASSWORD'] = postgresql.config.replication['password']
+    primary_ip = f'[{primary_ip}]' if ':' in primary_ip else primary_ip
     if subprocess.call(['rsync', '--archive', '--delete', '--hard-links', '--size-only', '--omit-dir-times',
                         '--no-inc-recursive', '--include=/data/***', '--include=/data_old/***',
                         '--exclude=/data/pg_xlog/*', '--exclude=/data_old/pg_xlog/*',

From 22e802a40c39d9c9ac710c0b5d4484539dc26d1e Mon Sep 17 00:00:00 2001
From: Polina Bungina <polina.bungina@zalando.de>
Date: Thu, 19 Mar 2026 14:04:44 +0100
Subject: [PATCH 12/12] Do not build on push to dev-18

---
 delivery.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/delivery.yaml b/delivery.yaml
index d1c701b8e..12ea76a70 100644
--- a/delivery.yaml
+++ b/delivery.yaml
@@ -43,7 +43,7 @@ pipeline:
   type: script
   when:
     - event: push
-      branch: dev-18  # TODO: change to master once merged
+      branch: trigger
   timeout: 10h
   vm_config:
     type: linux