runner-images
runner-images copied to clipboard
[windows] PostgreSQL pinned to vulnerable version on Windows
Description
In #10014, the Windows images were pinned to a 14.12-forked version of PostgreSQL. v14.13 is available, contains security fixes, and the version in the agents should be updated. The PR suggested the pinning was temporary, but it was never revisited. Can it be unpinned now?
~Also, why do the Windows agents use some Enterprise-y distribution of PostgreSQL, instead of the official one?~
Platforms affected
- [X] Azure DevOps
- [X] GitHub Actions - Standard Runners
- [X] GitHub Actions - Larger Runners
Runner images affected
- [ ] Ubuntu 20.04
- [ ] Ubuntu 22.04
- [ ] Ubuntu 24.04
- [ ] macOS 12
- [ ] macOS 13
- [ ] macOS 13 Arm64
- [ ] macOS 14
- [ ] macOS 14 Arm64
- [ ] macOS 15
- [ ] macOS 15 Arm64
- [X] Windows Server 2019
- [X] Windows Server 2022
Image version and build link
Latest Windows 2019/2022 images
Is it regression?
No
Expected behavior
Latest secure version of PostgreSQL available is included in the image
Actual behavior
A vulnerable version of PostgreSQL is included in the image
Repro steps
- Open image readme, scroll to PostgreSQL section