Update PG15 to 15.16

.abi-compliance-history

@@ -18,6 +18,33 @@
 # Be sure to replace "<ADD JUSTIFICATION HERE>" with details of your change and
 # why it is deemed acceptable.
 
+c5824536e7ca3c5ef5a9db59bd36c4e6beb23f51
+#
+# Fix trigger transition table capture for MERGE in CTE queries.
+# 2026-01-24 11:30:51 +0000
+#
+# This commit changed the TransitionCaptureState structure, replacing
+# the "tcs_private" field with 3 separate fields. This structure can
+# only be built using MakeTransitionCaptureState(), and PGXN contained
+# no calls to MakeTransitionCaptureState() or uses of the
+# TransitionCaptureState structure.
+
+05d605b6c69f0276ae091ced1ed9082963052550
+#
+# For inplace update, send nontransactional invalidations.
+# 2025-12-16 16:13:55 -0800
+#
+# This changed PrepareToInvalidateCacheTuple() parameters.  PGXN contained no
+# calls to that function.
+
+2393d374ae9c0bc8327adc80fe4490edb05be167
+#
+# Check for CREATE privilege on the schema in CREATE STATISTICS.
+# 2025-11-10 09:00:00 -0600
+#
+# This commit added a parameter to CreateStatistics().  We are unaware of any
+# impacted third-party code.
+
 fc0fb77c550fe8289d718c33c7aacf16023d9941
 #
 # Fix re-distributing previously distributed invalidation messages during logical decoding.

.cirrus.tasks.yml

@@ -216,7 +216,7 @@ task:
   env:
     CPUS: 4 # always get that much for cirrusci macOS instances
     BUILD_JOBS: $CPUS
-    # Test performance regresses noticably when using all cores. 8 seems to
+    # Test performance regresses noticeably when using all cores. 8 seems to
     # work OK. See
     # https://postgr.es/m/20220927040208.l3shfcidovpzqxfh%40awork3.anarazel.de
     TEST_JOBS: 8

COPYRIGHT

@@ -1,7 +1,7 @@
 PostgreSQL Database Management System
 (also known as Postgres, formerly known as Postgres95)
 
-Portions Copyright (c) 1996-2025, PostgreSQL Global Development Group
+Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
 
 Portions Copyright (c) 1994, The Regents of the University of California
 

configure

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for PostgreSQL 15.15.
+# Generated by GNU Autoconf 2.69 for PostgreSQL 15.16.
 #
 # Report bugs to <pgsql-bugs@lists.postgresql.org>.
 #
@@ -582,8 +582,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='PostgreSQL'
 PACKAGE_TARNAME='postgresql'
-PACKAGE_VERSION='15.15'
-PACKAGE_STRING='PostgreSQL 15.15'
+PACKAGE_VERSION='15.16'
+PACKAGE_STRING='PostgreSQL 15.16'
 PACKAGE_BUGREPORT='pgsql-bugs@lists.postgresql.org'
 PACKAGE_URL='https://www.postgresql.org/'
 
@@ -1454,7 +1454,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures PostgreSQL 15.15 to adapt to many kinds of systems.
+\`configure' configures PostgreSQL 15.16 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1519,7 +1519,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of PostgreSQL 15.15:";;
+     short | recursive ) echo "Configuration of PostgreSQL 15.16:";;
    esac
   cat <<\_ACEOF
 
@@ -1694,7 +1694,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-PostgreSQL configure 15.15
+PostgreSQL configure 15.16
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2447,7 +2447,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by PostgreSQL $as_me 15.15, which was
+It was created by PostgreSQL $as_me 15.16, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -21018,7 +21018,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by PostgreSQL $as_me 15.15, which was
+This file was extended by PostgreSQL $as_me 15.16, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -21089,7 +21089,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-PostgreSQL config.status 15.15
+PostgreSQL config.status 15.16
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 

configure.ac

@@ -17,7 +17,7 @@ dnl Read the Autoconf manual for details.
 dnl
 m4_pattern_forbid(^PGAC_)dnl to catch undefined macros
 
-AC_INIT([PostgreSQL], [15.15], [pgsql-bugs@lists.postgresql.org], [], [https://www.postgresql.org/])
+AC_INIT([PostgreSQL], [15.16], [pgsql-bugs@lists.postgresql.org], [], [https://www.postgresql.org/])
 
 m4_if(m4_defn([m4_PACKAGE_VERSION]), [2.69], [], [m4_fatal([Autoconf version 2.69 is required.
 Untested combinations of 'autoconf' and PostgreSQL versions are not

contrib/adminpack/expected/adminpack.out

@@ -36,10 +36,10 @@ SELECT pg_read_file('test_file1');
 
 -- disallowed file paths for non-superusers and users who are
 -- not members of pg_write_server_files
-CREATE ROLE regress_user1;
-GRANT pg_read_all_settings TO regress_user1;
-GRANT EXECUTE ON FUNCTION pg_file_write(text,text,bool) TO regress_user1;
-SET ROLE regress_user1;
+CREATE ROLE regress_adminpack_user1;
+GRANT pg_read_all_settings TO regress_adminpack_user1;
+GRANT EXECUTE ON FUNCTION pg_file_write(text,text,bool) TO regress_adminpack_user1;
+SET ROLE regress_adminpack_user1;
 SELECT pg_file_write('../test_file0', 'test0', false);
 ERROR:  path must be in or below the current directory
 SELECT pg_file_write('/tmp/test_file0', 'test0', false);
@@ -53,9 +53,9 @@ SELECT pg_file_write(current_setting('data_directory') || '/test_file4', 'test4'
 SELECT pg_file_write(current_setting('data_directory') || '/../test_file4', 'test4', false);
 ERROR:  absolute path not allowed
 RESET ROLE;
-REVOKE EXECUTE ON FUNCTION pg_file_write(text,text,bool) FROM regress_user1;
-REVOKE pg_read_all_settings FROM regress_user1;
-DROP ROLE regress_user1;
+REVOKE EXECUTE ON FUNCTION pg_file_write(text,text,bool) FROM regress_adminpack_user1;
+REVOKE pg_read_all_settings FROM regress_adminpack_user1;
+DROP ROLE regress_adminpack_user1;
 -- sync
 SELECT pg_file_sync('test_file1'); -- sync file
  pg_file_sync 
@@ -153,8 +153,8 @@ SELECT pg_file_unlink('test_file4');
 (1 row)
 
 -- superuser checks
-CREATE USER regress_user1;
-SET ROLE regress_user1;
+CREATE USER regress_adminpack_user1;
+SET ROLE regress_adminpack_user1;
 SELECT pg_file_write('test_file0', 'test0', false);
 ERROR:  permission denied for function pg_file_write
 SELECT pg_file_sync('test_file0');
@@ -167,6 +167,6 @@ ERROR:  permission denied for function pg_file_unlink
 SELECT pg_logdir_ls();
 ERROR:  permission denied for function pg_logdir_ls
 RESET ROLE;
-DROP USER regress_user1;
+DROP USER regress_adminpack_user1;
 -- no further tests for pg_logdir_ls() because it depends on the
 -- server's logging setup

contrib/adminpack/sql/adminpack.sql

@@ -14,20 +14,20 @@ SELECT pg_read_file('test_file1');
 
 -- disallowed file paths for non-superusers and users who are
 -- not members of pg_write_server_files
-CREATE ROLE regress_user1;
+CREATE ROLE regress_adminpack_user1;
 
-GRANT pg_read_all_settings TO regress_user1;
-GRANT EXECUTE ON FUNCTION pg_file_write(text,text,bool) TO regress_user1;
+GRANT pg_read_all_settings TO regress_adminpack_user1;
+GRANT EXECUTE ON FUNCTION pg_file_write(text,text,bool) TO regress_adminpack_user1;
 
-SET ROLE regress_user1;
+SET ROLE regress_adminpack_user1;
 SELECT pg_file_write('../test_file0', 'test0', false);
 SELECT pg_file_write('/tmp/test_file0', 'test0', false);
 SELECT pg_file_write(current_setting('data_directory') || '/test_file4', 'test4', false);
 SELECT pg_file_write(current_setting('data_directory') || '/../test_file4', 'test4', false);
 RESET ROLE;
-REVOKE EXECUTE ON FUNCTION pg_file_write(text,text,bool) FROM regress_user1;
-REVOKE pg_read_all_settings FROM regress_user1;
-DROP ROLE regress_user1;
+REVOKE EXECUTE ON FUNCTION pg_file_write(text,text,bool) FROM regress_adminpack_user1;
+REVOKE pg_read_all_settings FROM regress_adminpack_user1;
+DROP ROLE regress_adminpack_user1;
 
 -- sync
 SELECT pg_file_sync('test_file1'); -- sync file
@@ -59,8 +59,8 @@ SELECT pg_file_unlink('test_file4');
 
 
 -- superuser checks
-CREATE USER regress_user1;
-SET ROLE regress_user1;
+CREATE USER regress_adminpack_user1;
+SET ROLE regress_adminpack_user1;
 
 SELECT pg_file_write('test_file0', 'test0', false);
 SELECT pg_file_sync('test_file0');
@@ -69,7 +69,7 @@ SELECT pg_file_unlink('test_file0');
 SELECT pg_logdir_ls();
 
 RESET ROLE;
-DROP USER regress_user1;
+DROP USER regress_adminpack_user1;
 
 
 -- no further tests for pg_logdir_ls() because it depends on the

contrib/amcheck/t/002_cic.pl

@@ -60,5 +60,29 @@
 		  )
 	});
 
+# Test bt_index_parent_check() with indexes created with
+# CREATE INDEX CONCURRENTLY.
+$node->safe_psql('postgres', q(CREATE TABLE quebec(i int primary key)));
+# Insert two rows into index
+$node->safe_psql('postgres',
+	q(INSERT INTO quebec SELECT i FROM generate_series(1, 2) s(i);));
+
+# start background transaction
+my $in_progress_h = $node->background_psql('postgres');
+$in_progress_h->query_safe(q(BEGIN; SELECT pg_current_xact_id();));
+
+# delete one row from table, while background transaction is in progress
+$node->safe_psql('postgres', q(DELETE FROM quebec WHERE i = 1;));
+# create index concurrently, which will skip the deleted row
+$node->safe_psql('postgres',
+	q(CREATE INDEX CONCURRENTLY oscar ON quebec(i);));
+
+# check index using bt_index_parent_check
+$result = $node->psql('postgres',
+	q(SELECT bt_index_parent_check('oscar', heapallindexed => true)));
+is($result, '0', 'bt_index_parent_check for CIC after removed row');
+
+$in_progress_h->quit;
+
 $node->stop;
 done_testing();

contrib/amcheck/verify_nbtree.c

@@ -463,11 +463,11 @@ bt_check_every_level(Relation rel, Relation heaprel, bool heapkeyspace,
 					 bool readonly, bool heapallindexed, bool rootdescend)
 {
 	BtreeCheckState *state;
+	Snapshot	snapshot = InvalidSnapshot;
 	Page		metapage;
 	BTMetaPageData *metad;
 	uint32		previouslevel;
 	BtreeLevel	current;
-	Snapshot	snapshot = SnapshotAny;
 
 	if (!readonly)
 		elog(DEBUG1, "verifying consistency of tree structure for index \"%s\"",
@@ -516,37 +516,33 @@ bt_check_every_level(Relation rel, Relation heaprel, bool heapkeyspace,
 		state->heaptuplespresent = 0;
 
 		/*
-		 * Register our own snapshot in !readonly case, rather than asking
+		 * Register our own snapshot for heapallindexed, rather than asking
 		 * table_index_build_scan() to do this for us later.  This needs to
 		 * happen before index fingerprinting begins, so we can later be
 		 * certain that index fingerprinting should have reached all tuples
 		 * returned by table_index_build_scan().
 		 */
-		if (!state->readonly)
-		{
-			snapshot = RegisterSnapshot(GetTransactionSnapshot());
+		snapshot = RegisterSnapshot(GetTransactionSnapshot());
 
-			/*
-			 * GetTransactionSnapshot() always acquires a new MVCC snapshot in
-			 * READ COMMITTED mode.  A new snapshot is guaranteed to have all
-			 * the entries it requires in the index.
-			 *
-			 * We must defend against the possibility that an old xact
-			 * snapshot was returned at higher isolation levels when that
-			 * snapshot is not safe for index scans of the target index.  This
-			 * is possible when the snapshot sees tuples that are before the
-			 * index's indcheckxmin horizon.  Throwing an error here should be
-			 * very rare.  It doesn't seem worth using a secondary snapshot to
-			 * avoid this.
-			 */
-			if (IsolationUsesXactSnapshot() && rel->rd_index->indcheckxmin &&
-				!TransactionIdPrecedes(HeapTupleHeaderGetXmin(rel->rd_indextuple->t_data),
-									   snapshot->xmin))
-				ereport(ERROR,
-						(errcode(ERRCODE_T_R_SERIALIZATION_FAILURE),
-						 errmsg("index \"%s\" cannot be verified using transaction snapshot",
-								RelationGetRelationName(rel))));
-		}
+		/*
+		 * GetTransactionSnapshot() always acquires a new MVCC snapshot in
+		 * READ COMMITTED mode.  A new snapshot is guaranteed to have all the
+		 * entries it requires in the index.
+		 *
+		 * We must defend against the possibility that an old xact snapshot
+		 * was returned at higher isolation levels when that snapshot is not
+		 * safe for index scans of the target index.  This is possible when
+		 * the snapshot sees tuples that are before the index's indcheckxmin
+		 * horizon.  Throwing an error here should be very rare.  It doesn't
+		 * seem worth using a secondary snapshot to avoid this.
+		 */
+		if (IsolationUsesXactSnapshot() && rel->rd_index->indcheckxmin &&
+			!TransactionIdPrecedes(HeapTupleHeaderGetXmin(rel->rd_indextuple->t_data),
+								   snapshot->xmin))
+			ereport(ERROR,
+					errcode(ERRCODE_T_R_SERIALIZATION_FAILURE),
+					errmsg("index \"%s\" cannot be verified using transaction snapshot",
+						   RelationGetRelationName(rel)));
 	}
 
 	Assert(!state->rootdescend || state->readonly);
@@ -621,8 +617,7 @@ bt_check_every_level(Relation rel, Relation heaprel, bool heapkeyspace,
 		/*
 		 * Create our own scan for table_index_build_scan(), rather than
 		 * getting it to do so for us.  This is required so that we can
-		 * actually use the MVCC snapshot registered earlier in !readonly
-		 * case.
+		 * actually use the MVCC snapshot registered earlier.
 		 *
 		 * Note that table_index_build_scan() calls heap_endscan() for us.
 		 */
@@ -635,16 +630,15 @@ bt_check_every_level(Relation rel, Relation heaprel, bool heapkeyspace,
 
 		/*
 		 * Scan will behave as the first scan of a CREATE INDEX CONCURRENTLY
-		 * behaves in !readonly case.
+		 * behaves.
 		 *
 		 * It's okay that we don't actually use the same lock strength for the
-		 * heap relation as any other ii_Concurrent caller would in !readonly
-		 * case.  We have no reason to care about a concurrent VACUUM
-		 * operation, since there isn't going to be a second scan of the heap
-		 * that needs to be sure that there was no concurrent recycling of
-		 * TIDs.
+		 * heap relation as any other ii_Concurrent caller would.  We have no
+		 * reason to care about a concurrent VACUUM operation, since there
+		 * isn't going to be a second scan of the heap that needs to be sure
+		 * that there was no concurrent recycling of TIDs.
 		 */
-		indexinfo->ii_Concurrent = !state->readonly;
+		indexinfo->ii_Concurrent = true;
 
 		/*
 		 * Don't wait for uncommitted tuple xact commit/abort when index is a
@@ -668,13 +662,12 @@ bt_check_every_level(Relation rel, Relation heaprel, bool heapkeyspace,
 								 state->heaptuplespresent, RelationGetRelationName(heaprel),
 								 100.0 * bloom_prop_bits_set(state->filter))));
 
-		if (snapshot != SnapshotAny)
-			UnregisterSnapshot(snapshot);
-
 		bloom_free(state->filter);
 	}
 
 	/* Be tidy: */
+	if (snapshot != InvalidSnapshot)
+		UnregisterSnapshot(snapshot);
 	MemoryContextDelete(state->targetcontext);
 }