* SECURITY UPDATE: Arbitrary library load via logical decoding plugin - debian/patches/CVE-2026-6471.patch: add the output_plugin_libraries GUC (default 'pgoutput, test_decoding') and refuse to load a logical decoding output plugin that it does not list, so a REPLICATION role can no longer dlopen an arbitrary file through the plugin name - CVE-2026-6471 * SECURITY UPDATE: Integer overflow in fuzzystrmatch levenshtein() - debian/patches/CVE-2026-15742.patch: compute the Levenshtein costs in int64 and reject results outside the int range, so large cost arguments cannot wrap the distance calculation - CVE-2026-15742 * SECURITY UPDATE: Portal type confusion in EXECUTE and FETCH - debian/patches/CVE-2026-16239.patch: let the tuplestore receiver convert tuples to a target rowtype and use it to cross-check the portal's result type when EXECUTE or FETCH stores into a tuplestore, so re-creating a cursor with different column types raises an error instead of confusing the caller - CVE-2026-16239 * SECURITY UPDATE: Type confusion via functions on type internal - debian/patches/CVE-2026-14680.patch: reject SQL calls and operator invocations of functions that take or return type internal, forbid coercions to or from internal, and make the numeric aggregate combine functions return nulls instead of dummy internal values - CVE-2026-14680 * SECURITY UPDATE: Integer wraparound in pltcl and plperl allocations - debian/patches/CVE-2026-14677.patch: compute every multiplying palloc()/palloc0() size in pltcl and plperl with mul_size(), which errors on size_t overflow, so crafted function bodies cannot undersize an allocation on 32-bit builds - CVE-2026-14677