Fix CVE-2026-111497 and CVE-2026-114406

postgres-appliance/Dockerfile

@@ -18,7 +18,8 @@ FROM $BASE_IMAGE as dependencies-builder
 
 ARG DEMO
 
-ENV WALG_REF=22eee6b2e0a4ca9e5dcb5e73d8e6aca98262db73
+# 67cb69a4 moves the bundled brotli to v1.2.1 (CVE-2026-111497).
+ENV WALG_REF=67cb69a43286dbad521206f02b8e0055d31e32f2
 
 COPY build_scripts/dependencies.sh /builddeps/
 
@@ -52,7 +53,7 @@ ARG WITH_PERL=false
 ARG DEB_PG_SUPPORTED_VERSIONS="$PGOLDVERSIONS $PGVERSION"
 
 # Install PostgreSQL, extensions and contribs
-ENV POSTGIS_VERSION=3.6 \
+ENV POSTGIS_VERSION=3.7 \
     BG_MON_COMMIT=7f5887218790b263fe3f42f85f4ddc9c8400b154 \
     PG_AUTH_MON_COMMIT=fe099eef7662cbc85b0b79191f47f52f1e96b779 \
     PG_MON_COMMIT=ead1de70794ed62ca1e34d4022f6165ff36e9a91 \
@@ -65,6 +66,17 @@ ENV POSTGIS_VERSION=3.6 \
 WORKDIR /builddeps
 RUN bash base.sh
 
+# CVE-2026-111497: base.sh does not upgrade packages that are already installed
+RUN apt-get update && \
+    apt-get install -y --only-upgrade libbrotli1 brotli && \
+    dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libbrotli1)" ge 1.0.9-2ubuntu0.1 && \
+    rm -rf /var/lib/apt/lists/*
+
+# CVE-2026-114406: the fixed ca-certificates drops emSign ECC Root CA - G3 and Comodo AAA
+RUN apt-get update && \
+    apt-get install -y --only-upgrade ca-certificates && \
+    rm -rf /var/lib/apt/lists/*
+
 # Install wal-g
 COPY --from=dependencies-builder /builddeps/wal-g /usr/local/bin/
 

postgres-appliance/build_scripts/base.sh

@@ -126,10 +126,32 @@ for version in $DEB_PG_SUPPORTED_VERSIONS; do
         "postgresql-${version}-pg-stat-kcache" \
         "${EXTRAS[@]}"
 
-    # Clean up timescaledb versions except the last 5 minor versions
+    # Clean up timescaledb versions - keep at least 5 minor versions, but ensure compatibility with the lowest/oldest PG version (where possible)
+
     exclude_patterns=()
     versions=$(find "/usr/lib/postgresql/$version/lib/" -name 'timescaledb-2.*.so' | sed -rn 's/.*timescaledb-([1-9]+\.[0-9]+\.[0-9]+)\.so$/\1/p' | sort -rV)
-    latest_minor_versions=$(echo "$versions" | awk -F. '{print $1"."$2}' | uniq | head -n 5)
+
+    # Calculate the number of versions dynamically based on the lowest PG version's latest minor
+    num_versions=5
+    if [ -n "$first_latest_minor" ]; then
+        minor_versions=$(echo "$versions" | awk -F. '{print $1"."$2}' | uniq)
+        position=0
+        found=0
+        while IFS= read -r minor; do
+            position=$((position + 1))
+            if [ "$minor" = "$first_latest_minor" ]; then
+                found=1
+                break
+            fi
+        done <<< "$minor_versions"
+
+        # if found, keep max(5, position) versions (so all versions have at least 1 version in common with lowest PG version)
+        if [ $found -eq 1 ] && [ $position -gt $num_versions ]; then
+            num_versions=$position
+        fi
+    fi
+
+    latest_minor_versions=$(echo "$versions" | awk -F. '{print $1"."$2}' | uniq | head -n "$num_versions")
     for minor in $latest_minor_versions; do
         for full_version in $(echo "$versions" | grep "^$minor"); do
             exclude_patterns+=(! -name timescaledb-"${full_version}".so)
@@ -138,6 +160,11 @@ for version in $DEB_PG_SUPPORTED_VERSIONS; do
     done
     find "/usr/lib/postgresql/$version/lib/" \( -name 'timescaledb-2.*.so' -o -name 'timescaledb-tsl-2.*.so' \) "${exclude_patterns[@]}" -delete
 
+    # Save the latest minor version from the first PG version
+    if [ -z "$first_latest_minor" ]; then
+        first_latest_minor=$(echo "$latest_minor_versions" | head -n 1)
+    fi
+
     # Install 3rd party stuff
 
     if [ "${TIMESCALEDB_APACHE_ONLY}" != "true" ] && [ "${TIMESCALEDB_TOOLKIT}" = "true" ]; then

postgres-appliance/build_scripts/dependencies.sh

@@ -32,7 +32,7 @@ mkdir /builddeps/wal-g
 # Released wal-g binaries (<= v3.0.8) ship stale Go deps with critical CVEs
 # (x/crypto, grpc, Go stdlib); building from current source clears them.
 # `make deps` must stay serial (no -j) or the brotli/cmake step races and fails.
-GO_VERSION=1.25.11
+GO_VERSION=1.27.3
 apt-get install -y --no-install-recommends git build-essential cmake liblzo2-dev
 curl -sL "https://go.dev/dl/go${GO_VERSION}.linux-${ARCH}.tar.gz" | tar -C /usr/local -xz
 export PATH="/usr/local/go/bin:$PATH"
@@ -43,7 +43,7 @@ git checkout "$WALG_REF"
 git submodule update --init --recursive
 # MAKEFLAGS is exported with -j above; clear it here so the brotli/cmake step
 # in `make deps` builds serially (parallel build races and fails under emulation).
-MAKEFLAGS= USE_BROTLI=1 make deps
-MAKEFLAGS= USE_BROTLI=1 make pg_build
+MAKEFLAGS='' USE_BROTLI=1 USE_LZO=1 make deps
+MAKEFLAGS='' USE_BROTLI=1 USE_LZO=1 make pg_build
 cp main/pg/wal-g /builddeps/wal-g/wal-g
 cd /

postgres-appliance/build_scripts/patroni_wale.sh

@@ -50,6 +50,8 @@ else
 fi
 
 pip3 install "patroni[kubernetes$EXTRAS]==$PATRONIVERSION"
+# CVE-2026-114406: 2026.10.23 is the first certifi without the compromised eMudhra roots
+pip3 install --upgrade 'certifi>=2026.10.23'
 
 for d in /usr/local/lib/python3.10 /usr/lib/python3; do
     cd $d/dist-packages

postgres-appliance/tests/docker-compose.yml

@@ -4,16 +4,16 @@ networks:
     demo:
 
 services:
-    minio:
-        image: minio/minio:RELEASE.2021-09-03T03-56-13Z
+    seaweedfs:
+        image: chrislusf/seaweedfs:4.48
         networks: [ demo ]
         environment:
-            MINIO_ACCESS_KEY: &access_key Eeghei0uVej1Wea8mato
-            MINIO_SECRET_KEY: &secret_key lecheidohbah7aThohziezah3iev7ima4eeXu9gu
-        hostname: minio
-        container_name: demo-minio
-        entrypoint: sh
-        command: -c 'mkdir -p /export/testbucket && /usr/bin/minio server /export'
+            AWS_ACCESS_KEY_ID: &access_key Eeghei0uVej1Wea8mato
+            AWS_SECRET_ACCESS_KEY: &secret_key lecheidohbah7aThohziezah3iev7ima4eeXu9gu
+            S3_BUCKET: &bucket testbucket
+        hostname: seaweedfs
+        container_name: demo-seaweedfs
+        command: mini -dir=/data -s3.port=9000
 
     etcd:
         image: ${SPILO_TEST_IMAGE:-spilo}
@@ -23,16 +23,16 @@ services:
         command: "sh -c 'export ETCD_UNSUPPORTED_ARCH=$$(dpkg --print-architecture) && exec etcd -name etcd1 -listen-client-urls http://0.0.0.0:2379 -advertise-client-urls http://$$(hostname --ip-address):2379'"
 
     spilo1: &spilo
-        depends_on: [ minio ]
+        depends_on: [ seaweedfs ]
         image: ${SPILO_TEST_IMAGE:-spilo}
         networks: [ demo ]
         environment:
             SPILO_PROVIDER: 'local'
             AWS_ACCESS_KEY_ID: *access_key
             AWS_SECRET_ACCESS_KEY: *secret_key
-            AWS_ENDPOINT: &aws_endpoint 'http://minio:9000'
+            AWS_ENDPOINT: &aws_endpoint 'http://seaweedfs:9000'
             AWS_S3_FORCE_PATH_STYLE: &aws_s3_force_path_style 'true'
-            WAL_S3_BUCKET: &bucket testbucket
+            WAL_S3_BUCKET: *bucket
 #            USE_WALG: 'true'  # wal-e is used and tested by default, wal-g is used automatically for restore in case of S3
             WALE_DISABLE_S3_SSE: &wale_disable_s3_sse 'true'
             ETCDCTL_ENDPOINTS: http://etcd:2379