This is an automated email from the ASF dual-hosted git repository.
dabla pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new fd9298bf795 Chart: Bump PgBouncer to 1.25.2 and exporter to 0.21.0 to
fix CVEs (#74647)
fd9298bf795 is described below
commit fd9298bf79590d102ecfe1a8ce8ffd230e02abf4
Author: Mathieu Monet <[email protected]>
AuthorDate: Wed Oct 28 14:10:36 2026 +0100
Chart: Bump PgBouncer to 1.25.2 and exporter to 0.21.0 to fix CVEs (#74647)
* Chart: Bump PgBouncer to 1.25.2 and exporter to 0.21.0 to fix CVEs
Update the default PgBouncer image to PgBouncer 1.25.2, which fixes
CVE-2026-6664, CVE-2026-6665 and CVE-2026-6666. CVE-2026-6664 lets an
unauthenticated client crash PgBouncer with a malformed SCRAM packet,
and the chart uses scram-sha-256 by default.
Update the PgBouncer exporter image to 0.21.0 built with Go 1.27.2.
Exporter 0.18.0 cannot parse the SHOW STATS columns added in PgBouncer
1.24, which is why the previous 1.24 bump was rolled back.
Both images are rebuilt on the current Alpine 3.23 with apk upgrade,
and unused runtime packages (libressl, libressl-dev, openssl) are
dropped.
* Rename PgBouncer newsfragment to PR number
* Clarify which PgBouncer behaviour changes can be restored
Review feedback: 1.25.2 also fixes CVE-2026-6667, and not every behaviour
change listed can be set back through pgbouncer.extraIni. reserve_pool is a
per-database setting whose old name still works, and the KILL_CLIENT and
auth_query changes are security fixes.
---------
Co-authored-by: Mathieu Monet <[email protected]>
Co-authored-by: David Blain <[email protected]>
---
chart/dockerfiles/pgbouncer-exporter/Dockerfile | 9 ++++-----
.../dockerfiles/pgbouncer-exporter/build_and_push.sh | 8 ++++----
chart/dockerfiles/pgbouncer/Dockerfile | 8 ++++++--
chart/dockerfiles/pgbouncer/build_and_push.sh | 8 ++++----
chart/newsfragments/74647.significant.rst | 19 +++++++++++++++++++
chart/values.schema.json | 4 ++--
chart/values.yaml | 4 ++--
7 files changed, 41 insertions(+), 19 deletions(-)
diff --git a/chart/dockerfiles/pgbouncer-exporter/Dockerfile
b/chart/dockerfiles/pgbouncer-exporter/Dockerfile
index 7a290aa713a..b4abe1e7b21 100644
--- a/chart/dockerfiles/pgbouncer-exporter/Dockerfile
+++ b/chart/dockerfiles/pgbouncer-exporter/Dockerfile
@@ -16,7 +16,7 @@
# under the License.
ARG ALPINE_VERSION="3.23"
-ARG GO_VERSION="1.23.7"
+ARG GO_VERSION="1.27.2"
FROM golang:${GO_VERSION} AS builder
@@ -37,10 +37,9 @@ RUN
URL="https://github.com/jbub/pgbouncer_exporter/archive/${PGBOUNCER_EXPORTER
FROM alpine:${ALPINE_VERSION} AS final
-# We want to make sure this one includes latest security fixes.
-# "Pin versions in apk add" https://github.com/hadolint/hadolint/wiki/DL3018
-# hadolint ignore=DL3018
-RUN apk --no-cache add libressl libressl-dev openssl
+# The exporter is a static (CGO_ENABLED=0) binary, so no extra runtime
libraries are needed.
+# We only want to make sure the base image includes latest security fixes.
+RUN apk --no-cache upgrade
COPY --from=builder /usr/src/myapp/pgbouncer_exporter /bin
diff --git a/chart/dockerfiles/pgbouncer-exporter/build_and_push.sh
b/chart/dockerfiles/pgbouncer-exporter/build_and_push.sh
index b5cd45becb4..a207cbd9500 100755
--- a/chart/dockerfiles/pgbouncer-exporter/build_and_push.sh
+++ b/chart/dockerfiles/pgbouncer-exporter/build_and_push.sh
@@ -21,19 +21,19 @@ readonly DOCKERHUB_USER
DOCKERHUB_REPO=${DOCKERHUB_REPO:="airflow"}
readonly DOCKERHUB_REPO
-PGBOUNCER_EXPORTER_VERSION="0.18.0"
+PGBOUNCER_EXPORTER_VERSION="0.21.0"
readonly PGBOUNCER_EXPORTER_VERSION
# The commit that PGBOUNCER_EXPORTER_VERSION's tag pointed at when it was
reviewed. The image
# is built from this commit, not from the tag: tags on the upstream repository
are mutable and
# can be moved to different content without this file changing. Update both
together, and
# re-check the diff upstream when you do.
-PGBOUNCER_EXPORTER_COMMIT_SHA="1b1faecd80fdeb0f4d8baa0d423e8b58e4ab9aa5"
+PGBOUNCER_EXPORTER_COMMIT_SHA="9e444947e9f21df7a4e120156a1e3fa5fae26b4a"
readonly PGBOUNCER_EXPORTER_COMMIT_SHA
-AIRFLOW_PGBOUNCER_EXPORTER_VERSION="2026.04.17"
+AIRFLOW_PGBOUNCER_EXPORTER_VERSION="2026.10.13"
readonly AIRFLOW_PGBOUNCER_EXPORTER_VERSION
-EXPECTED_GO_VERSION="1.23.7"
+EXPECTED_GO_VERSION="1.27.2"
readonly EXPECTED_GO_VERSION
COMMIT_SHA=$(git rev-parse HEAD)
diff --git a/chart/dockerfiles/pgbouncer/Dockerfile
b/chart/dockerfiles/pgbouncer/Dockerfile
index faa51f2e7a7..a39d4c8c792 100644
--- a/chart/dockerfiles/pgbouncer/Dockerfile
+++ b/chart/dockerfiles/pgbouncer/Dockerfile
@@ -36,7 +36,10 @@ RUN wget --progress=dot:giga
"https://github.com/pgbouncer/pgbouncer/releases/do
&& tar -xzvf pgbouncer-$PGBOUNCER_VERSION.tar.gz
WORKDIR /pgbouncer-$PGBOUNCER_VERSION
-RUN ./configure --prefix=/usr --disable-debug && make && make install \
+# Release tarballs no longer ship prebuilt man pages, and `make install` would
need pandoc to
+# generate them. Only the binary is copied to the final image, so build and
install just that.
+RUN ./configure --prefix=/usr --disable-debug && make pgbouncer \
+ && install -m 755 pgbouncer /usr/bin/pgbouncer \
&& mkdir /etc/pgbouncer \
&& cp ./etc/pgbouncer.ini /etc/pgbouncer/ \
&& touch /etc/pgbouncer/userlist.txt \
@@ -56,7 +59,8 @@ ARG COMMIT_SHA
# We want to make sure this one includes latest security fixes.
# "Pin versions in apk add" https://github.com/hadolint/hadolint/wiki/DL3018
# hadolint ignore=DL3018
-RUN apk --no-cache add libevent libressl c-ares
+RUN apk --no-cache upgrade \
+ && apk --no-cache add libevent libssl3 libcrypto3 c-ares
COPY --from=builder /etc/pgbouncer /etc/pgbouncer
COPY --from=builder /usr/bin/pgbouncer /usr/bin/pgbouncer
diff --git a/chart/dockerfiles/pgbouncer/build_and_push.sh
b/chart/dockerfiles/pgbouncer/build_and_push.sh
index a5664fb00da..26b7f2cdb12 100755
--- a/chart/dockerfiles/pgbouncer/build_and_push.sh
+++ b/chart/dockerfiles/pgbouncer/build_and_push.sh
@@ -24,16 +24,16 @@ readonly DOCKERHUB_REPO
# Sometimes the pgbouncer tag does not reliably correspond with the version
name
# For example, it may have a `-fixed` suffix
-PGBOUNCER_TAG="pgbouncer_1_23_1-fixed"
+PGBOUNCER_TAG="pgbouncer_1_25_2"
readonly PGBOUNCER_TAG
-PGBOUNCER_VERSION="1.23.1"
+PGBOUNCER_VERSION="1.25.2"
readonly PGBOUNCER_VERSION
-PGBOUNCER_SHA256="1963b497231d9a560a62d266e4a2eae6881ab401853d93e5d292c3740eec5084"
+PGBOUNCER_SHA256="924ad35113fd0a71c8e2dbe85b5d03445532e2b7b37a9f8a48983beea238b332"
readonly PGBOUNCER_SHA256
-AIRFLOW_PGBOUNCER_VERSION="2026.04.17"
+AIRFLOW_PGBOUNCER_VERSION="2026.10.13"
readonly AIRFLOW_PGBOUNCER_VERSION
COMMIT_SHA=$(git rev-parse HEAD)
diff --git a/chart/newsfragments/74647.significant.rst
b/chart/newsfragments/74647.significant.rst
new file mode 100644
index 00000000000..7b6ba42952f
--- /dev/null
+++ b/chart/newsfragments/74647.significant.rst
@@ -0,0 +1,19 @@
+Default PgBouncer image updated to PgBouncer 1.25.2 and PgBouncer exporter
image to 0.21.0
+
+The default PgBouncer image is now ``airflow-pgbouncer-2026.10.13-1.25.2``,
previously it was
+``airflow-pgbouncer-2026.04.17-1.23.1``. It fixes CVE-2026-6664,
CVE-2026-6665, CVE-2026-6666 and
+CVE-2026-6667. The default PgBouncer exporter image is now
``airflow-pgbouncer-exporter-2026.10.13-0.21.0``,
+previously it was ``airflow-pgbouncer-exporter-2026.04.17-0.18.0``, built with
Go 1.27.2. Exporter
+0.21.0 is required to scrape PgBouncer 1.24 and later; its metric names are
unchanged.
+
+PgBouncer 1.24 and 1.25 change some behaviour:
+
+* Prepared statement support is enabled by default (``max_prepared_statements
= 200``).
+* ``default_pool_size = 0`` now means an unlimited pool size.
+* The default ``server_check_query`` is now empty instead of ``select 1``.
+* ``reserve_pool`` is renamed to ``reserve_pool_size``. The old name remains
an alias.
+* ``KILL_CLIENT`` is restricted to users listed in ``admin_users``
(CVE-2026-6667).
+* A custom ``auth_query`` must take the password's ``VALID UNTIL`` into
account (CVE-2025-2291).
+
+The first three are defaults, and the previous values can be restored through
``pgbouncer.extraIni``.
+The last three need no action: the old name still works, and the two security
fixes cannot be turned off.
diff --git a/chart/values.schema.json b/chart/values.schema.json
index 49251ffa3d2..9e5b1782b1e 100644
--- a/chart/values.schema.json
+++ b/chart/values.schema.json
@@ -927,7 +927,7 @@
"tag": {
"description": "The PgBouncer image tag.",
"type": "string",
- "default": "airflow-pgbouncer-2026.04.17-1.23.1"
+ "default": "airflow-pgbouncer-2026.10.13-1.25.2"
},
"pullPolicy": {
"description": "The PgBouncer image pull policy.",
@@ -954,7 +954,7 @@
"tag": {
"description": "The PgBouncer exporter image tag.",
"type": "string",
- "default":
"airflow-pgbouncer-exporter-2026.04.17-0.18.0"
+ "default":
"airflow-pgbouncer-exporter-2026.10.13-0.21.0"
},
"pullPolicy": {
"description": "The PgBouncer exporter image pull
policy.",
diff --git a/chart/values.yaml b/chart/values.yaml
index 3edbbf55c58..6f301412cdf 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -113,11 +113,11 @@ images:
pullPolicy: IfNotPresent
pgbouncer:
repository: apache/airflow
- tag: airflow-pgbouncer-2026.04.17-1.23.1
+ tag: airflow-pgbouncer-2026.10.13-1.25.2
pullPolicy: IfNotPresent
pgbouncerExporter:
repository: apache/airflow
- tag: airflow-pgbouncer-exporter-2026.04.17-0.18.0
+ tag: airflow-pgbouncer-exporter-2026.10.13-0.21.0
pullPolicy: IfNotPresent
gitSync:
repository: registry.k8s.io/git-sync/git-sync
