Version 1.7.2 of pg_vault_tde is now available. It is a binary patch release: the extension version remains at 1.7, but operators can identify the exact build at runtime by calling pg_vault_tde_build_version(). The update concentrates on critical stability, security, and correctness fixes across storage layout, indexes, key management, and logical decoding.
- New On-Disk Tuple Layout (v5): introduces a walkable structure that fixes a critical segmentation fault on
UPDATEoperations against tables with indexed variable-length columns (PSQLE-165). - TOAST Crash Resolved: fixes a segfault triggered when values crossed the
TOAST_TUPLE_THRESHOLDonly after being encrypted, plus a bug that left a table unreadable after an all-NULLrow. - tde_btree Hardening: the
tde_btreeindex now answers equality queries only, preventing incorrect row returns under range operators,ORDER BY, or merge joins (PSQLE-173). - Key Management & Reliability: addresses data loss and corruption in
rotate_online()concurrent access (PSQLE-184), local wallet KEK rotation (PSQLE-185), and vault-to-wallet migrations (PSQLE-188). - WAL & Logical Decoding: fixes memory accounting drift in logical decoding (PSQLE-186) and moves the Custom WAL resource manager ID.
For developers running encrypted workloads, the headline items are the layout and TOAST fixes, which target crashes reachable through ordinary DML rather than exotic edge cases. The tde_btree change alters query planning expectations: workloads that previously relied on that index for range scans should verify plans and results after upgrading. Because this is a binary patch, existing 1.7 deployments can adopt it without an extension version bump, but the new v5 tuple layout makes testing on a staging copy advisable before rolling out to production.