EDB Postgres Distributed 5.9.4 release notes v5.9.4

Database users can no longer create or modify database objects in the bdr schema, or set the namespace of an object to the bdr schema. This restriction prevents catalog corruption and extension upgrade issues that such operations could cause.

Attempting to join a data node to a group where existing nodes are configured as CAMO partners, or to part a data node when the group's default_commit_scope or the local node's bdr.commit_scope is set to a CAMO commit scope, now raises an error. To perform these operations, drop the CAMO commit scope first.

The bdr.enable_auto_sync_reconcile configuration parameter is now exposed in the pg_settings view, making it visible to monitoring tools.

The emitted log message now makes it clear that the issue is transient and that processing resumes following an automatic restart of the writer.

bdr_tablespace_upsert() was not setting the OID when inserting a new tablespace, causing a duplicate key violation when multiple user tablespaces were synced during logical join.

Fixed a memory leak in bdr_copy_to_repl_dest_receiver_receive, where per-row allocations in the walsender for the temporary replication slot used by joining nodes were not freed correctly.

Enabling a NORMAL subscription while a sync_node request was in progress for the same origin caused a second writer to crash with a SIGSEGV. PGD now blocks enabling a NORMAL subscription in this case, and the origin-acquisition path returns a recoverable error instead of crashing.

Upgrading from EDB Postgres Extended (PGE) 17 with PGD 5 to PGE 18 with PGD 6 using pgd node upgrade was failing because pg_upgrade detected BDR replication slots as invalid. The fix backports the logic to hide BDR-managed slots from pg_upgrade during the upgrade process, allowing the upgrade to proceed successfully.

During pgd node upgrade, configured commit scopes are now reset to local to prevent the upgrade from hanging. The reset is applied via DSN parameter before the upgrade proceeds.

Handling updates to the bdr_connection.client_addr configuration parameter, used by Connection Manager in session pooling mode, was leaking memory in the Postgres worker.

Concurrent statistics readers observed partially-initialized or freed Dynamic Shared Area (DSA) pointers when a stat entry was being created or dropped, causing bdr_stat_write_file to dereference NULL or freed memory. The initialization path now marks entries invalid until allocation succeeds, the drop path holds an exclusive lock, and all dshash scan paths guard against invalid DSA pointers.

When the pglogical manager process died with an error and tried to terminate other PGD workers, it hung if those workers had died uncleanly or were stuck and unable to receive signals. The process now exits correctly in all such cases.

Connection Manager was incorrectly interpreting log_min_messages, causing inconsistent log filtering compared to Postgres.

The local state of an AutoPartition table is now logged correctly by the task manager.

In some cases, a Postgres restart on the joining node during a physical join caused the join to attempt a logical sync, resulting in errors. The fix prevents the physical join from falling back to logical join logic when a restart occurs mid-join.