dabla commented on code in PR #74647: URL: https://github.com/apache/airflow/pull/74647#discussion_r4314920511
########## chart/newsfragments/74647.significant.rst: ########## @@ -0,0 +1,17 @@ +Default PgBouncer image updated to PgBouncer 1.25.2 and PgBouncer exporter image to 0.21.0 + +The default PgBouncer image is now ``airflow-pgbouncer-2026.10.13-1.25.2``, previously it was +``airflow-pgbouncer-2026.04.17-1.23.1``. It fixes CVE-2026-6664, CVE-2026-6665 and CVE-2026-6666. +The default PgBouncer exporter image is now ``airflow-pgbouncer-exporter-2026.10.13-0.21.0``, +previously it was ``airflow-pgbouncer-exporter-2026.04.17-0.18.0``, built with Go 1.27.2. Exporter +0.21.0 is required to scrape PgBouncer 1.24 and later; its metric names are unchanged. + +PgBouncer 1.24 and 1.25 change some behaviour. If needed, previous values can be restored through Review Comment: **[nit]** Not every bullet below can be restored through `pgbouncer.extraIni`. The first, second and fourth bullets are defaults that `extraIni` can set back. The other three cannot: - `reserve_pool` is a per-database setting, so in this chart it goes in `pgbouncer.extraIniMetadata` / `extraIniResultBackend`, not `extraIni`. The old name is also still an alias, so nothing needs to be restored. - The `KILL_CLIENT` restriction and the `auth_query` / `VALID UNTIL` change are security fixes and cannot be turned off. Something like "The first, second and fourth can be set back through `pgbouncer.extraIni`; the others are informational" would keep users from searching for a setting that does not exist. ########## chart/newsfragments/74647.significant.rst: ########## @@ -0,0 +1,17 @@ +Default PgBouncer image updated to PgBouncer 1.25.2 and PgBouncer exporter image to 0.21.0 + +The default PgBouncer image is now ``airflow-pgbouncer-2026.10.13-1.25.2``, previously it was Review Comment: **[nit]** 1.25.2 fixes four CVEs, not three. The [1.25.2 changelog](https://github.com/pgbouncer/pgbouncer/releases/tag/pgbouncer_1_25_2) also lists CVE-2026-6667: before 1.25.2, any user with access to the admin console could run `KILL_CLIENT`, not only `admin_users`. The `KILL_CLIENT` bullet further down describes exactly this fix, so the CVE could go into this line (and the PR body) next to the other three. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
