postgresql18-18.6-160000.1.1

- Let llvmjit-devel require the llc and clang binaries to fix
  build of extensions on SLE-16 and newer.
- Use LLVM 15 on SLE-15 up to SP5 and LLVM 17 on SP6 and SP7.

- Update to version 18.6:
  https://www.postgresql.org/docs/18/release-18-6.html
  https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/
  Security Fixes:
  - bsc#1275046, CVE-2026-6464: psql COPY FROM STDIN early failure
    processes data lines as psql commands (CVSS v3.1: 8.1)
  - bsc#1275044, CVE-2026-6469: ALTER TABLE ALTER TYPE resets
    extended statistics ownership (CVSS v3.1: 3.8)
  - bsc#1275043, CVE-2026-6470: Fails to check type USAGE privilege
    (CVSS v3.1: 4.3)
  - bsc#1275042, CVE-2026-6471: Logical decoding can dlopen
    arbitrary file (CVSS v3.1: 7.2)
  - bsc#1275001, CVE-2026-14662: tsvector and tsquery undersize
    allocations, via integer wraparound (CVSS v3.1: 8.8)
  - bsc#1275002, CVE-2026-14663: pgcrypto, for OpenSSL-disabled
    ciphers, silently encrypts to and decrypts from cleartext (CVSS
    v3.1: 6.5)
  - bsc#1275068, CVE-2026-14664: Regexp heap buffer overflow
    executes arbitrary code (CVSS v3.1: 8.8)
  - bsc#1275067, CVE-2026-14666: Row security caching disregards
    role modifications (CVSS v3.1: 4.2)
  - bsc#1275066, CVE-2026-14668: ctid type confusion in selectivity
    estimator discloses derivative of arbitrary read (CVSS v3.1:
    8.1)
  - bsc#1275065, CVE-2026-14669: to_char heap buffer overflow
    executes arbitrary code (CVSS v3.1: 8.8)
  - bsc#1275064, CVE-2026-14670: plperl tied object heap buffer
    overflow executes arbitrary code (CVSS v3.1: 8.8)
  - bsc#1275063, CVE-2026-14671: refint plan cache type confusion
    executes arbitrary code (CVSS v3.1: 8.8)
  - bsc#1275062, CVE-2026-14672: Observable response discrepancy
    with non-default scram_iterations provides user existence
    oracle (CVSS v3.1: 5.3)
  - bsc#1275061, CVE-2026-14673: amcheck does not clear untrusted
    search path (CVSS v3.1: 3.8)
  - bsc#1275060, CVE-2026-14676: pg_stat_statements heap buffer
    overflow executes arbitrary code (CVSS v3.1: 8.8)
  - bsc#1275059, CVE-2026-14677: 32-bit pltcl and plperl undersize
    allocations, via integer wraparound (CVSS v3.1: 8.8)
  - bsc#1275058, CVE-2026-14678: pg_trgm picksplit reads past end
    of buffer (CVSS v3.1: 4.3)
  - bsc#1275057, CVE-2026-14679: Stack buffer overflow in argument
    match writes 0x0 and 0x1 to server memory (CVSS v3.1: 8.2)
  - bsc#1275056, CVE-2026-14680: Type confusion via "internal"
    arguments (CVSS v3.1: 8.8)
  - bsc#1275055, CVE-2026-14681: Improper enforcement of GSSAPI
    encryption when coupled with SSL (CVSS v3.1: 4.2)
  - bsc#1275054, CVE-2026-15741: Expression deparse allows SQL
    injection via EXTRACT argument (CVSS v3.1: 8.8)
  - bsc#1275053, CVE-2026-15742: fuzzystrmatch writes
    effectively-arbitrary addresses, via integer wraparound (CVSS
    v3.1: 8.8)
  - bsc#1275052, CVE-2026-16238: Type confusion in
    pg_restore_attribute_stats() executes arbitrary code (CVSS
    v3.1: 8.8)
  - bsc#1275051, CVE-2026-16239: Type confusion in cursor CLOSE +
    DECLARE executes arbitrary code (CVSS v3.1: 8.8)
  - bsc#1275050, CVE-2026-16241: ECPG integer underflow can crash
    the client (CVSS v3.1: 3.8)
  - bsc#1275049, CVE-2026-18024: ascii() function reads past end of
    buffer (CVSS v3.1: 4.3)
  - bsc#1275048, CVE-2026-18408: psql \unrestrict lets superuser of
    pg_dump origin server execute arbitrary code in psql client
    (CVSS v3.1: 8.8)
  - bsc#1275047, CVE-2026-19385: pg_dump heap buffer overflow
    executes arbitrary code (CVSS v3.1: 8.8)

- Require clang/llvm-devel metapackages instead of directly
  requiring the latest version. With clang migrating away from
  update-alternatives, the versioned packages no longer provide the
  /usr/bin/clang symlink, which will now be contained in the
  metapackage only. If older LLVM versions are required, the
  compiler binary has to be provided via CLANG=clang-<N>.

- Update to version 18.4:
  * bsc#1265172, CVE-2026-6472: ensure the user has CREATE
    privilege on the schema specified
  * bsc#1265173, CVE-2026-6473: integer overflows in
    memory-allocation calculations
  * bsc#1265174, CVE-2026-6474: Guard against malicious time zone
    names
  * bsc#1265175, CVE-2026-6475: Prevent path traversal in
    pg_basebackup and pg_rewind
  * bsc#1265176, CVE-2026-6476: Properly quote subscription names
    in pg_createsubscriber
  * bsc#1265177, CVE-2026-6477: Mark PQfn() as unsafe, and avoid
    using it within libpq
  * bsc#1265178, CVE-2026-6478: Use timing-safe string comparisons
    in authentication code
  * bsc#1265179, CVE-2026-6479: Prevent unbounded recursion while
    processing startup packets
  * bsc#1265180, CVE-2026-6575: Detect faulty input when restoring
    attribute MCV statistics
  * bsc#1265181, CVE-2026-6637: Prevent SQL injection and buffer
    overruns in contrib/spi
  * bsc#1265182, CVE-2026-6638: Properly quote object names in
    logical replication origin checks
  * https://www.postgresql.org/docs/release/18.4/

- bsc#1263804: After dropping update-alternatives we have to
  package /usr/bin/pg_config as an actual symlink, not %ghost.
- Fix spelling of build conditionals.

- Get rid of update-alternatives for openSUSE/SLE 16.0 and newer
  to support immutable systems and transactional updates.
  (jsc#PED-14820)

- bsc#1258754: Update to 18.3 to fix two regressions in 18.2:
  * https://www.postgresql.org/docs/release/18.3/
  * The substring() function raises an error "invalid byte sequence
    for encoding" on non-ASCII text values if the source of
    that value is a database column.
  * A standby may halt and return an error "could not access status
    of transaction".

- Update to 18.2:
  * https://www.postgresql.org/about/news/p-3235/
  * https://www.postgresql.org/docs/release/18.2/
  * bsc#1258008, CVE-2026-2003: Guard against unexpected
    dimensions of oidvector/int2vector
  * bsc#1258009, CVE-2026-2004: Harden selectivity estimators
    against being attached to operators that accept unexpected
    data types.
  * bsc#1258010, CVE-2026-2005: Fix buffer overrun in
    contrib/pgcrypto's PGP decryption functions.
  * bsc#1258011, CVE-2026-2006: Fix inadequate validation of
    multibyte character lengths.
  * bsc#1258012, CVE-2026-2007: Harden contrib/pg_trgm against
    changes in string lowercasing behavior.
  * obsoletes llvm-21-aarch64.patch
- Disown /var/lib/pgsql to support transactional updates.

- Fix build on aarch64 with upstream commit 0dceba2:
  * llvm-21-aarch64.patch

- Fix build with uring for post SLE15 code streams.

- Use %product_libs_llvm_ver to determine the LLVM version.
- Remove conditionals for obsolete PostgreSQL releases.

- Update to 18.1:
  * https://www.postgresql.org/about/news/p-3171/
  * https://www.postgresql.org/docs/release/18.1/
  * bsc#1253332, CVE-2025-12817: Missing check for CREATE
    privileges on the schema in CREATE STATISTICS allowed table
    owners to create statistics in any schema, potentially leading
    to unexpected naming conflicts.
  * bsc#1253333, CVE-2025-12818: Several places in libpq were not
    sufficiently careful about computing the required size of a
    memory allocation. Sufficiently large inputs could cause
    integer overflow, resulting in an undersized buffer, which
    would then lead to writing past the end of the buffer.

- pg_config --libs returns -lnuma so we need to require it.

- Update to 18.0.
  * https://www.postgresql.org/about/news/p-3142/
  * https://www.postgresql.org/docs/18/release-18.html

- Update to 18 RC1.
  * https://www.postgresql.org/about/news/p-3130/

- move libpq-oauth into the libpq5  package. it is a plugin that
  will be loaded via dlopen() if libpq encounters an oauth workflow
  during a connection.

- In the symlinking loop for *.so files only handle symlinks and
  not also files.
  This allows us to enable oauth support

- enable liburing and libnuma support
- prepare oauth support. but it creates broken symlinks at the
  moment

- Update to 18~beta3
  * https://www.postgresql.org/about/news/p-3118/
  Security Issues
  * CVE-2025-8713: PostgreSQL optimizer statistics can expose
    sampled data within a view, partition, or child table
    (boo#1248120)
  * CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin
    server execute arbitrary code in psql client (boo#1248122)
  * CVE-2025-8715: PostgreSQL pg_dump newline in object name
    executes arbitrary code in psql client and in restore target
    server (boo#1248119)

- Update to 18~beta2
  https://www.postgresql.org/about/news/p-3103/

- Fork package for postgresql 18
  https://www.postgresql.org/about/news/p-3070/

- Upgrade to 17.5:
  * bsc#1242931, CVE-2025-4207: postgresql: PostgreSQL GB18030
    encoding validation can read one byte past end of allocation
    for text that fails validation.
  * https://www.postgresql.org/docs/release/17.5/
  * https://www.postgresql.org/about/news/p-3072/
- Add postresql-pg_config_paths.patch to Fix a race condition
  while generating pg_config_paths.h.

- Upgrade to 17.4:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/17.4/
  * https://www.postgresql.org/about/news/p-3018/

- Upgrade to 17.3:
  * bsc#1237093, CVE-2025-1094: Harden PQescapeString and allied
    functions against invalidly-encoded input strings.
  * obsoletes postgresql-tzdata2025a.patch
  * https://www.postgresql.org/docs/release/17.3/
  * https://www.postgresql.org/about/news/-3015/

- Apply postgresql-tzdata2025a.patch regardless of
  whether LLVM JIT is enabled

- Fix build, add postgresql-tzdata2025a.patch

- Disable LLVM JIT on loongarch64

- Upgrade to 17.2:
  * Repair ABI break for extensions that work with struct
    ResultRelInfo.
  * Restore functionality of ALTER {ROLE|DATABASE} SET role.
  * Fix cases where a logical replication slot's restart_lsn could
    go backwards.
  * Avoid deleting still-needed WAL files during pg_rewind.
  * Fix race conditions associated with dropping shared statistics
    entries.
  * Count index scans in contrib/bloom indexes in the statistics
    views, such as the pg_stat_user_indexes.idx_scan counter.
  * Fix crash when checking to see if an index's opclass options
    have changed.
  * Avoid assertion failure caused by disconnected NFA sub-graphs
    in regular expression parsing.
  * https://www.postgresql.org/about/news/p-2965/
  * https://www.postgresql.org/docs/release/17.2/

- Upgrade to 17.1:
  * CVE-2024-10976, bsc#1233323: Ensure cached plans are marked as
    dependent on the calling role when RLS applies to a
    non-top-level table reference.
  * CVE-2024-10977, bsc#1233325: Make libpq discard error messages
    received during SSL or GSS protocol negotiation.
  * CVE-2024-10978, bsc#1233326: Fix unintended interactions
    between SET SESSION AUTHORIZATION and SET ROLE
  * CVE-2024-10979, bsc#1233327: Prevent trusted PL/Perl code from
    changing environment variables.
  * obsoletes postgresql17-jsonb_jsonpath.patch
  * https://www.postgresql.org/about/news/p-2955/
  * https://www.postgresql.org/docs/release/17.1/