It’s a pleasure to announce hpgsql, a PostgreSQL driver written in pure Haskell (no libpq), with an API largely inspired by the great postgresql-simple library, but featuring: Usage of PostgreSQL’s ...

Everything in the Postgres world has common abbreviation pg, and it seems more logical to call Postgres' c-library libpg, rather than libpq. Why is it called libpq? Is libpg already taken by anothe...

On January 18th, 2000, non-blocking mode support was added to libpq

PostgreSQL client for node.js. Contribute to brianc/node-postgres development by creating an account on GitHub.

Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) st

Jelte Fennema-Nio discovered that the PostgreSQL CREATE STATISTICS command did not correctly check for schema CREATE privileges. An authenticated attacker could possibly use this issue to create a denial of service against other CREATE STATISTICS users. (CVE-2025-12817) Aleksey Solovev discovered that the PostgreSQL libpq client library incorrectly handled certain memory operations. A remote attacker could possibly use this issue to cause libpq to crash, resulting in a denial of service. (CVE-2025-12818)

2024年12月30日、「中国政府が支援する高度で持続的な脅威攻撃者」がアメリカ財務省の機密データを管理するシステムを侵害しました。この侵入にはPostgreSQLに9年以上存在していたのに誰も気付いていなかったSQLインジェクションの脆弱(ぜいじゃく)性が使用されたことが判明しており、ソフトウェアエンジニアのニック・アグリアーノ氏が記事にまとめています。

The PostgreSQL Global Development Group has released an update to all supported versions of PostgreSQL, including 18.1, 17.7, 16.11, 15.15, …

Posted by Solar Designer on Nov 16 Hi, As announced in: https://www.postgresql.org/about/news/postgresql-171-165-159-1414-1317-and-1221-released-2955/ https://www.postgresql.org/message-id/173159332163.1547975.13346191756810493274%40wrigleys.postgresql.org new PostgreSQL updates to all supported versions fix 4 CVEs and 35 non-security bugs. CVE-2024-10976 PostgreSQL row security below e.g. subqueries disregards user ID changes (CVSS 4.2) CVE-2024-10977 PostgreSQL libpq retains...

AFAICT (and quoting the docs a bit) `pqi` reproduces the API surface of the `postgresql-libpq` package without any ties to libpq or any particular implementation of that API itself. hpgsql provides a much higher-level API than anything trying to replace postgresql-libpq - it’s more of a cousin to `postgresql-simple` and `hasql`. hpgsql has its own internal and lower-level APIs, of course, that I evolved while developing hpgsql to have the things I wanted, including for example interruption safety, thread safety and streams. They are very different from postgresql-libpq’s, and I honest don’t know how easily it could be retrofitted to a libpq-style API, though I think it should be possible (maybe with minor tradeoffs). My (biased and actually not that well informed about libpq) opinion, however, has been that the PostgreSQL ecosystem in Haskell would benefit from moving away from libpq-style APIs. We have wonderful abstractions and luxuries - from Streams to interruption safety and just plain pure code -, and though I didn’t look too deeply, while I was developing hpgsql it felt like not having the libpq-style APIs forced on me gave me a lot of freedom to achieve those goals, not to mention a lot of performance work (and there’s still a lot more of that coming!). I of course understand that asking other library authors to reimplement their libraries is a huge effort and risk, and that there’s a long way towards native postgres implementations to support all the auth methods and TLS encryption, so I applaud Nikita’s effort to make a call towards a common interface. And if I ever expose one from hpgsql, I’ll make sure to adapt it to `pqi`.