v0.19.4

Welcome to pgrx v0.19.4! This is a security release for the CVE-2026-6460 fix that Postgres shipped today. It is also the last release in the v0.19.x series.

As always, please install cargo-pgrx with cargo install cargo-pgrx --version 0.19.4 --locked.

Run cargo pgrx init

After installing, run a plain cargo pgrx init, with no arguments. It downloads and builds every patched Postgres release: 14.25, 15.20, 16.16, 17.12, 18.7, and 19rc2.

Moving On

The v0.19.x branch will stay around, but we don't plan any more 0.19 releases. Please move to pgrx v0.20.0, which is coming next as a full release with no further betas.

CVE-2026-6460

• 0.19: Check composite datum versions when reading attributes (CVE-2026-6460), and bump PG19 to rc2 by @eeeebbbbrrrr in #2503

The patched Postgres releases record a version in each composite datum. Postgres checks that version before reading an attribute, so it raises an ERROR instead of misreading a row formed under an incompatible definition of its type. pgrx reads composite attributes with its own code, which skipped that check until now. PgHeapTuple and the htup functions now perform it.

To get the fix, rebuild your extension with pgrx 0.19.4 against a patched Postgres. The check is compiled in only when the Postgres headers you build against include the fix. An extension built against the fixed headers will not load on an earlier minor release.

Postgres 19rc2

cargo pgrx init --pg19=download now downloads 19rc2 instead of 19beta4. The bindings for all supported versions have been regenerated against the new minor releases.

Full Changelog: v0.19.3...v0.19.4