Version 4.6 - July 19 2026

This is a maintenance release ro fix several security and triggers or foreign
keys related issues.

  - Copy on the temporary table the triggers defined on the "template"
    table of a global temporary table.
    
    CREATE TABLE ... (LIKE ...) has no INCLUDING TRIGGERS option in
    PostgreSQL, so the triggers must be replicated by hand once the
    temporary table has been created. The definition of each trigger is
    obtained through pg_get_triggerdef(), parsed back, and the relation
    of the resulting CreateTrigStmt is changed to point to the temporary
    table before being executed.

  - Fix duplicate key violation when trigger populates pgtt table. Thanks
    to Adrian Billington for the report.

  - Security hardening: lock down PUBLIC grants, fix possible SQL injection,
    close FK/DROP gaps. Thanks to Devrim Gunduz for the patch.
    * pg_global_temp_tables catalog table: no longer grants ALL to
      PUBLIC (every install script since 2.0.0 did). Any authenticated
      role could previously INSERT/UPDATE/DELETE/TRUNCATE another
      user's GTT registration directly, bypassing every ownership check
      the extension performs on CREATE/DROP/RENAME TABLE, and could
      enumerate every GTT's full DDL across the whole database. PUBLIC
      now gets SELECT only; roles that create/rename/drop GTTs need an
      additional explicit GRANT on this table (documented in the new
      install/upgrade scripts).
    * gtt_create_table_statement(): per-GTT "template" tables are now
      granted SELECT to PUBLIC instead of ALL, removing the ability for
      arbitrary roles to write to, truncate, or attach triggers to a
      table they do not own.
    * Fixed SQL injection (CWE-89): six internally generated SPI
      queries interpolated the user-supplied table name directly into
      single-quoted string literals without escaping, while adjacent
      code in the same functions correctly used quote_literal_cstr()
      for other values. A table name containing an embedded quote
      (e.g. a double-quoted identifier) could break out of the literal
      and inject additional SQL, executed with the caller's privileges
      -- or with a SECURITY DEFINER function's elevated privileges, if
      such a function builds a GTT name dynamically from caller input.
      All six call sites now consistently use quote_literal_cstr().
    * Fixed missing-authorization check (CWE-862) in the DROP TABLE
      path: when a dropped table isn't in the current backend's local
      GTT cache, pgtt now checks pg_class ownership of the underlying
      relation before deleting its pg_global_temp_tables row, instead
      of deleting it unconditionally and relying on the *subsequent*
      DROP TABLE's own permission check (and transaction abort) to
      undo the side effect after the fact.
    * Replaced the regex-based foreign-key rejection with inspection
      of the parsed statement: the previous check searched the raw
      query text for the literal substring "FOREIGN KEY", which missed
      the equally valid column-level "col type REFERENCES ..." syntax
      entirely (it contains no such substring). The new
      gtt_tableelts_has_foreign_key() walks the parsed CreateStmt's
      columns/constraints directly, matching the approach already used
      by the ALTER TABLE handler.
    * Replaced five unchecked strcpy() calls into fixed NAMEDATALEN
      buffers (gtt.relname, pgtt_namespace_name) and one inside the
      GttHashTableInsert macro with bounds-checked strlcpy(). Not
      currently reachable as an overflow (PostgreSQL truncates
      identifiers before they reach this code), but removes reliance
      on that as the only safety net.

  - Build failure on PostgreSQL 16 and later: pg_class_ownercheck()
    was removed in PG16, which replaced the entire family of
    per-catalog pg_*_ownercheck() functions with a single generic
    object_ownercheck(classid, objectid, roleid) (both declared in
    utils/acl.h). Thanks to Devrim Gunduz for the patch.

  - Add security regression tests. Thanks to Devrim Gunduz for the patch.
    * test/sql/15_security_grants.sql -- proves PUBLIC now has SELECT
      only (not ALL) on pgtt_schema.pg_global_temp_tables and on a
      GTT's template table: an unprivileged role can still read both,
      but every INSERT/UPDATE/DELETE/TRUNCATE against them is rejected.
      Also proves a role provisioned per the documented non-superuser
      setup (schema CREATE + the new required table-level grant) can
      still fully create, use, and drop a GTT end to end.
    * test/sql/16_sql_injection.sql -- creates, renames, and uses a GTT
      whose name is a double-quoted identifier containing an embedded
      single quote and a complete extra SQL statement.
    * test/sql/17_drop_authorization.sql -- has a non-owner role whose
      backend cache predates a GTT's creation attempt to DROP TABLE it;
      the drop must be rejected and the registration must survive
      intact. This specifically exercises the "not cached" lookup path
      in the DROP TABLE handler, where the missing ownership check
      lived.
    * test/sql/10_foreignkey.sql -- adds the column-level
      "c1 integer REFERENCES other(id)" form alongside the existing
      table-level "FOREIGN KEY (c1) REFERENCES other(id)" cases, both
      directly in CREATE and added later via ALTER TABLE, and confirms
      it is still allowed on an ordinary (non-GTT) table.

Version 4.5 - June 18 2026

This is a maintenance release to add support to PG v19 and fix issues reported
by users since last release.

  - Add support to PG v19.
  - Fix -Wmissing-variable-declarations warnings by making globals static.
    Thanks to Japin Li for the patch.
  - Fix CI workflow.
  - Add support to CREATE INDEX CONCURRENTLY ... Thanks to Haibo Yan
    for the patch.
  - Remove use of the registered relid of the relation. When restoring
    pgtt_schema.pg_global_temp_tables from a dump it contains invalid Oid
    for the relation. Thanks to sibowu-aws for the report.

Version 4.4 - July 02 2025

This is a maintenance release to fix a search_path error when using pg_dump.


  - Fix pg_dump error with invalid search_path. pg_dump set search_path to
    empty string, appending the pgtt schema in this case make it fail.
  - Update regression test expected output file related to search_path test.

Version 4.3 - June 09 2025

This is a quick maintenance release to fix an issue introduced in latest
release.

  - Drop extension before running tests on search_path.
  - Fix invalid search_path error. When pgtt isn't preloaded and pg_catalog
    is the last element in search_path, results in error message "invalid
    value for parameter 'search_path'" due to invalid list syntax. Thanks
    to Japin Li for the patch.

Version 4.2 - June 08 2025

This is a maintenance release to fix issues reported by users since latest
release and especially a search_path modification issue.

  - Preserve pg_catalog at end of search path if it is the case to allow
    pg_catalog overloaded function to be executed.
  - Add regression test on search_path forcing.
  - Preserve $user and other elements in search_path. Thanks to Japin Li
    for the patch.
  - Remove the LOAD command from documentation. Thanks to Li Jianping for the
    patch.
  - Fix session_preload_libraries documentation for non-superusers. Thanks
    to Japin Li for the patch.
  - Resolve a warning regarding incompatible pointer types. Thanks to Li
    Jianping for the patch.

Version 4.1 - March 18 2025

This is a maintenance release to fix issues reported by users since latest
release.

  - Use query instead of \d to list indexes in regression tests.
  - Fix wrong complain about temporary table created and active when a
    regular temporary table is created with (LIKE ... INCLUDING INDEXES).
    Thanks to Benjamin Wirth for the report.
  - Remove documentation for non-superuser configuration. Thanks to Julien
    Rouhaud for the patch.
  - Fix config in README. The concrete path to the shared library is not
    needed in postgresql.conf. Thanks to Simon Martin for the patch.
  - Install docs to a non-generic name, add a symlink to README.md that is
    referenced in DOCS. Thanks to Christoph Berg for the patch.
  - Add vaccum pg_class + pg_sleep(1) after each drop table in regression
    tests to wait that the temporary table is really removed.
  - Add missing PGDLLEXPORT tags on callback functions, those are needed on
    windows. Thanks to Julien Rouhaud for the patch.

Version 4.0 - May 31 2024

This major release allow preloading pgtt in session_preload_libraries
and adds support to Windows operating system. Here is the complete list
of changes.

  - Add port to Windows operating system. Note that, for some unknown reasons
    it doesn't work at all with PostgreSQL 13. Thanks to Julien Rouhaud for
    the patch
  - Allow preloading pgtt in session_preload_libraries. The module is now lazily
    loaded when it might be needed (after parse analysis, before executor
    startup and before utility statements execution), and all the code is simply
    bypassed if the underlying extension has not been created. Thanks to Julien
    Rouhaud for the patch.
  - Fix first query execution after a LOAD command. If the extension is loaded
    with a plain LOAD command, the search_path will only be set during the next
    query execution.  It means that the very first query executed after such a
    LOAD wouldn't see the global temporary tables. Thanks to Julien Rouhaud for
    the patch.
  - Remove the relocation test, the extension is not relocatable anymore.
  - Fix crash with RESET ALL. RESET ALL has a NULL "name" field, so we can't use
    strcmp in that case.  Since the existing code is only interested in SET
    commands, just move up the check that the command is a VAR_SET_VALUE to
    ensure that we will have a GUC name. Thanks to Julien Rouhaud for the patch.
  - Fix various minor whitespace and indent issues. Thanks to Julien Rouhaud for
    the patch.
  - Add Julen Rouhaud in the authors and maintainers list.

Version 3.2 - Apr 12 2024

This is a maintenance release to fix issues reported by users since latest
release and compatibility with future PG 17.

  - Add information about privilege on the pgtt schema.
  - Make test on lock compatible with version <= 14
  - The temporary table needs to be locked. Thanks to Leo X.M. Zeng for the patch.
  - Replace MyBackendId with MyProcNumber for PG > 16
  - Check extension when loading pgtt. Thanks to Japin Li for the patch.
  - Release lock on global template temporary table. Thanks to Japin Li for the patch.

Version 3.1 - Dec 26 2023

This is a maintenance release to fix issues reported by users since latest
release.

  - Fix ERROR:  attempt to redefine parameter "pgtt.enabled". Thanks to
    Japin Li for the report.
  - Forget acquiring lock for temporary table. Thanks to Japin Li for the patch.
  - Add temporisation after vacuum in 08_plplgsql test.
  - Update main.yml to remove PG versions prior 12.

Version 3.0 - Sep 17 2023

This major release fix several issues related to PostgreSQL v16 port
and remove support to PostgreSQL version prior 12. Here is the complete
list of changes.

  - Remove support to PostgreSQL prior v12.
  - Fix compilation error: static declaration of get_extension_schema follows
    non-static declaration. Thanks to Devrim Gunduz for the report.
  - Remove grouping set in regexp.
  - Add -Wno-ignored-attributes to CPPFLAGS to avoid compilation warning on
    pg_vsnprintf call.
  - Replace GetOverrideSearchPath() call by GetSearchPathMatcher() with
    PG > 16
  - Fix debug information print on Windows. Thanks to Lanlan for the patch.
  - Replace reg* regexp function with the pg_reg* function. Thanks to Lanlan
    for the report.
  - Fix port to PostgreSQL v16. Thanks to Julien Rouhaud for the patch.

Version 2.10 - Feb 23 2023

This is a maintenance release to fix a lock issue in multi parallel process
environment, many locks were generated. Here is the complete list of changes.

  - Delegate locks on per session temporary tables to PostgreSQL when the table
    will be used.
  - Release lock on parent table after temporary table creation based on this
    relation. Thanks to jayhsiang and liyaojinli for the report.
  - Use vacuum in test 08 to not look at pg_class too early before the temporary
    table is remove.
  - Fix setting default value of the parent table's persistence that can be
    misleading in future development. Thanks to songjinzhou for the patch.
  - Fix documentation. Thanks to Luca Ferrari for the patch.

Version 2.9 - Aug 16 2022

This is a maintenance release per CVE-2022-2625 and new PostgreSQL minor
versions updates.

  - Remove creation of the pgtt_schema if it not exists from extension
    files per CVE-2022-2625. Thanks to Dmitry Ukolov for the report.
  - Add regression test for regular table drop.

Version 2.8 - Jun 02 2022

This is a maintenance release to add support to PostgreSQL 15
and fix an error when trying to drop a regular table.

  - Add support to PostgreSQL 15.
  - Fix impossibility to drop a regular table when the extension is loaded.
    Thanks to basildba for the report.

Version 2.7 - Nov 23 2021

This is a maintenance release to fix an issue with parallelism
and improve performances.

  - Prevent code to be executed in parallel processes. Thanks to
    Dmitry Ukolov for the report.
  - Improve performances by not looking for an existing GTT table
    if the table is a temporary table or part of the pg_catalog.
  - Update ChangeLog to acknowledge patch on PG14 support to Dmitry Ukolov.
  - Update copyright year.

Version 2.6 - Sep 22 2021

This is a maintenance release to add support for upcomming PostgreSQL 14
and fixed some issues reported in the past three months.

  - Add support to PostgreSQL 14. Thanks to Devrim Gunduz for the report
    and Dmitry Ukolov for the patch.
  - Remove support to PG 9.5 which obviously was not working. Minimal PG
    version for this extension is 9.6.
  - Fix documentation menu.
  - Fix creation of GTT when there is a CHECK constraint with string
    constant.

Version 2.5 - Jun 08 2021

This is a maintenance release to hotfix port on PostgreSQL 9.6.

  - Fix port to PostgreSQL 9.6. Thanks to Devrim Gunduz for the report.


Version 2.4 - Jun 04 2021

This version allow use of the extension by non superuser and especially
the creation and maintenance of GTT. It also fixes compatibility with
PostgreSQL v14. Here is the full list of changes:

  - Fix FailedAssertion "flags & HASH_STRINGS" with PG14. Thanks to
    MigOps for the patch.
  - Check for minimum pg version in the C code instead of Makefile.
    Thanks to MigOps for the patch.
  - Fixed compiling for PostgreSQL 14. Thanks to Dmitry Ukolov for
    the patch.
  - Fix documentation about privilege to set on pgtt_schema for a
    non superuser role.
  - Allow creation and maintenance of Global Temporary Tables by non
    superuser. This require that the user can use schema pgtt_schema
    and can write to table pg_schema.pg_global_temp_tables.
  - The library can now be loaded by the user using:
	LOAD '$libdir/plugins/pgtt.so';
    Thanks to Dmitry Ukolov for the feature request.
  - Fix two crashes when --enable-cassert is used. Thanks to hanson69
    for the report.
  - Fix comment and index on PGTT table. Thanks to Dmitry Ukolov for
    the report.
  - Fix unexpected error "attempt to create referential integrity
    constraint on global temporary table" when creating a regular
    table and fix detection of FK and throw an error on create global
    temporary table statement. Thanks to Dmitry Ukolov for the report.
  - Fix impossibility to recreate GTT if it was dropped in another
    session. Thanks to Dmitry Ukolov for the report.
  - Remove useless extension's downgrade files. Thanks to MigOps
    for the patch.


Version 2.3 - Apr 02 2021

This version fix the compatibility with PostgreSQL 10 and 11.

When use on PostgreSQL 10 and 11 the following was raised
  ERROR: unrecognized node type: 375
Thanks to smallcookie086 for the report.

Add upgrade/downgrade SQL files.


Version 2.2 - Nov 08 2020

This release is a port of the extension for PostgreSQL v12 and v13.
Works now on all PostgreSQL version from v9.5 to current. It also
fixes automatic creation of the underlying temporary table after a
rollback.

Other fixes:

  - Fix regression test for all supported PG version.
  - Replace call to \d in regression tests, they do not report the
    same information following PG version.
  - Remove test about partitioning as it returns a failure for PG < 10.
  - Update regression tests to avoid failure related to temp table id.
  - Add regression test for error on rollback issue.


Version 2.1 - May 11 2020

This is a maintenance release to complete the work on the extension
and fix some issues.
 
  * Prevent use of foreign keys with GTT, not that PostgreSQL do not
    allow it but just to mimic the behavior of Oracle and other RDBMS
    like DB2, SQL Server and MySQL for example.
  * Raise an error on an attempt to partition a Global Temporary Table.
    This is not supported, again not because PostgreSQL do not allow
    partition on temporary table but because other RDBMS like Oracle,
    DB2 and MySQL do not support it.
  * Add support to comments, constraints and identity columns clauses
    when creating the GTT.

Other fixes:

  - Add regression tests on partitioning and FK.
  - Exclude regression.* files from git scope.
  - Improve documentation and add information about constraints.
  - Add documentation about unsupported FK and partition on GTT.
  - Fix missing files for expected test results.
  - Fix exclusion of .out and results directory.
  - Update regression tests about changes on CREATE TABLE ... LIKE.
  - Fix some typo in documentation and  markdown titles.


Version 2.0 - April 19 2020
	Initial release.
