PG Exporter v1.5.0 improves connection safety, replication metric accuracy, database discovery, and health reporting. It is built with Go 1.27.3 and refreshed dependencies.
Highlights
- Reject malformed connection URLs and invalid query parameters before connecting, report errors without exposing credentials, and reject empty URL key files. Explicit TLS settings are no longer silently discarded after a query-decoding error.
- Resolve database identity through
lib/pq, includingdbname/databaseoverrides. Auto-discovery now replaces conflicting database parameters correctly and preserves special database names, preventing duplicate series and failed scrapes. - Read one atomic health state per HTTP response, keeping status codes and response bodies consistent during concurrent role or connectivity changes.
- Replan collectors when the connected user, schemas, or extension set changes; preserve cached results when those sets are unchanged.
- Reject non-finite and overflowing collector/predicate TTLs and query timeouts during configuration parsing. Existing zero-value and finite negative-timeout semantics remain.
- Validate the actual metrics route against the active Go HTTP mux, including escaped paths, so accepted telemetry paths reach the metrics handler.
- Correct replication monitoring: add the owning database label to
pg_sub_*, map WAL receiver states accurately, and clarify publication table counts, subscription relation states, and replication-origin privileges.
Security and dependencies
The Go toolchain moves from Go 1.26.5 to 1.27.3. This includes CVE-2026-111943, which rejects certificate chains containing a small set of untrusted intermediates, plus the cumulative HTTP, TLS, template, parser, and build-tool fixes in Go 1.26.6 and Go 1.27.2.
The independent golang.org/x/net dependency moves 0.57.0 → 0.61.0, incorporating the HTTP/2 fixes released in 0.60.0:
- CVE-2026-78659: excessive memory use with trailer headers.
- CVE-2026-78669: excessive CPU consumption handling window updates.
- CVE-2026-78663: incorrect flow-control credit accounting.
- CVE-2026-97032: HPACK encoder race/panic.
- CVE-2026-78660: malformed HTTP/2 framing response headers.
x/crypto 0.54.0 → 0.58.0 also incorporates SSH fixes CVE-2026-56854, CVE-2026-56855, and CVE-2026-78662; x/text 0.40.0 → 0.43.0 incorporates the precis fix CVE-2026-56851. PG Exporter does not import those SSH/precis packages. These are dependency-version fixes, not evidence that those vulnerabilities were exploitable through this exporter.
Other maintenance updates include Prometheus client_golang 1.25.0, client_model 0.6.3, common 0.72.1, exporter-toolkit 0.20.0, klauspost/compress 1.20.3, and the maintained YAML v3 module go.yaml.in/yaml/v3 3.0.5. The database driver remains lib/pq 1.12.3.
Source scans on Linux amd64, Darwin arm64, and Windows amd64 found no known symbol-level or imported-package findings in this release candidate as of 2026-10-23. An unimported OpenPGP module advisory (GO-2026-5932) remains. Static symbol matches in older versions are not proof of exploitation. Upgrading the host's Go installation alone does not update an existing exporter binary: install the rebuilt v1.5.0 artifact.
The bilingual release articles provide the full CVE/version table and scope: English · 简体中文.
Upgrade notes
-
Upgrade the binary and the collector configuration to obtain the replication fixes. Package managers preserve locally modified configuration; merge the updated definitions deliberately.
-
pg_sub_*now carries adatnamelabel. Review recording rules and dashboards that assume the previous label set, especially where subscription names repeat across databases. -
On PostgreSQL 10–13, grant the monitoring role access to the subscription OID in the exporter's main connection database:
GRANT SELECT (oid) ON pg_catalog.pg_subscription TO monitor;
-
pg_recv_stateretains 0=streaming, 4=stopping, and 5=connecting (PG19+); it adds 6=starting, 7=waiting, 8=restarting, and 9=stopped. Values 1–3 remain reserved, and -1 means unknown. -
Keep
pg_origindisabled unless the documented privileges have been provisioned. On PostgreSQL 13 and older, granting function execution alone does not remove its internal superuser check. -
Fix malformed URLs and non-finite/overflowing durations before upgrading; these inputs now fail explicitly. TLS remains opt-in when
sslmodeis omitted, so setsslmode=verify-fulland the appropriate CA for remote targets. -
Existing behavior is retained: an empty YAML configuration successfully installs zero collectors; SIGTERM does not drain active HTTP requests.
Configuration and validation
The regular bundle contains 58 YAML files including the schema reference, 96 query branches, 59 namespaces, and 460 distinct metric definitions. This replaces the imprecise “600+ metrics” wording; it is not a reduction in collectors. Actual time-series counts vary with versions, configuration, objects, and labels.
Validation covered PostgreSQL 9.1–9.6, 10–18, and 19 RC1, plus PgBouncer 1.26.1, using non-superuser monitoring accounts. It also covered real standby promotion, disconnection/recovery, metadata and cache changes, failed reloads, concurrent requests, race tests, both HTTP mux modes, and approximately 600,000 fuzz executions.
Release targets: Linux amd64/arm64/ppc64le, macOS amd64/arm64, and Windows amd64. Docker images use pgsty/pg_exporter:1.5.0 for amd64 and arm64. PostgreSQL 9.1–9.6 requires the legacy configuration.
Full diff: v1.4.1...v1.5.0