EDB Postgres Distributed 6.4.0 release notes v6.4.0

PGD now provides a configurable policy for handling replication apply failures. When a transaction fails to apply, PGD can capture the failed changes and expose them for review and resolution via new SQL functions. Configure the policy per node group using bdr.alter_node_group_option. For more information, see Handling replication apply errors.

PGD now provides its own implementation of large objects as a drop-in replacement for the built-in Postgres large objects. PGD large objects are logically replicated across all nodes in the cluster. The feature is available via bdr.lo_ functions directly, or transparently via bdr.override_large_objects. For more information, see Replicated large objects and the large object functions reference.

New pgd raft sync-snapshot command that synchronizes the Raft state across all nodes by disabling Raft, exporting state from the leader node, importing it on all nodes, and re-enabling Raft. Use --group to specify a target group; defaults to global group.

Transfers write and Raft leadership away from the local node across all groups, useful for draining a node before maintenance.

Unlike Group Commit, Quorum Commit is compatible with parallel apply. Quorum Commit improves on legacy Group Commit, which was only supported with num_writers = 1.

pgd raft show now displays three sections by default to provide deeper visibility into the Raft consensus layer: State (consensus state), Followers (follower status as seen from the leader), and Journal (global journal details).

Previously, IntervalStyle was only supported via the options connection parameter. Connection Manager now correctly applies IntervalStyle when specified directly as a startup parameter.

Connection Manager now closes outdated idle connections proactively on topology or configuration changes, and reports server connection errors directly to the client.

A new node_group_dsn column in bdr.node_config lets nodes within the same subgroup use a dedicated connection string, useful in Kubernetes and cloud environments to reduce egress costs. Set it via bdr.alter_node_option.

bdr.routing_leadership_transfer now accepts NULL for leader_name, triggering automatic selection of the best candidate based on write leader progress. Automatic selection is the recommended approach when using Quorum Commit as the commit scope kind. Requires PGD 6.4 with Raft protocol version 6004 or above.

Previously, configuration parameters were only loaded on Connection Manager process start. Connection Manager now reloads them on SIGHUP without requiring a restart.

Database users can no longer create or modify database objects in the bdr schema, or set the namespace of an object to the bdr schema. This restriction prevents catalog corruption and extension upgrade issues that such operations could cause. For more information, see bdr.allow_bdr_schema_changes.

Attempting to join a data node to a group where existing nodes are configured as CAMO partners, or to part a data node when the group's default_commit_scope or the local node's bdr.commit_scope is set to a CAMO commit scope, now raises an error. To perform these operations, drop the CAMO commit scope first.

The bdr.enable_auto_sync_reconcile configuration parameter is now exposed in the pg_settings view, making it visible to monitoring tools.

The emitted log message now makes it clear that the issue is transient and that processing resumes following an automatic restart of the writer.

bdr_tablespace_upsert() wasn't setting the OID when inserting a new tablespace, causing a duplicate key violation when multiple user tablespaces were synced during logical join.

The pgd assess command was failing with ERROR: schema "bdr" does not exist. The command now gracefully handles instances without BDR installed by checking for the BDR schema first, and performs the full assessment with compatibility suggestions for both PGD Essential and Expanded editions.

Fixed a memory leak in bdr_copy_to_repl_dest_receiver_receive, where per-row allocations in the walsender for the temporary replication slot used by joining nodes were not freed correctly.

Stale node_peer_progress_mapping entries left behind by cancelled forwarding subscriptions were pinning the group replication slot and preventing WAL cleanup. The maintenance path now removes entries that have been superseded by direct subscription progress.

The part and sync state machines could deadlock or stall when end-of-recovery markers were delivered through FORWARD or CATCHUP subscriptions. Multiple fixes restrict confirmation waits to NORMAL subscriptions, ensure atomic origin advancement during PART_CATCHUP, and prevent a double-delete error on node_peer_progress_mapping rows.

Enabling a NORMAL subscription while a sync_node request was in progress for the same origin caused a second writer to crash with a SIGSEGV. PGD now blocks enabling a NORMAL subscription in this case, and the origin-acquisition path returns a recoverable error instead of crashing.

When upgrading the last node in a cluster from BDR 5 to PGD 6, the pgd manager process crashed with a SIGSEGV during subscription reconfiguration when replication slots had been renamed. The pgd manager now handles missing or renamed slots gracefully.

pgd node setup was creating BDR objects with system-range OIDs, causing pgd node upgrade to fail with schema "bdr" does not exist. The setup command now assigns user-range OIDs correctly, and the upgrade command detects the issue early on existing affected clusters.

When pgaudit followed bdr in shared_preload_libraries, upgrades from PGD 6.2 failed with ERROR: pgaudit not loaded before call to pgaudit_ddl_command_end(). Hook deinitialization was resetting hooks to NULL, crashing pgaudit in the manager process. The fix adds bypass macros so hooks defer to the next handler instead of deinitializing.

Handling updates to the bdr_connection.client_addr configuration parameter, used by Connection Manager in session pooling mode, was leaking memory in the Postgres worker.

Concurrent statistics readers observed partially-initialized or freed Dynamic Shared Area (DSA) pointers when a stat entry was being created or dropped, causing bdr_stat_write_file to dereference NULL or freed memory. The initialization path now marks entries invalid until allocation succeeds, the drop path holds an exclusive lock, and all dshash scan paths guard against invalid DSA pointers.

When multiple writers concurrently changed sequence kinds, two writers could attempt to upgrade ShareRowExclusiveLock to AccessExclusiveLock on the same sequence relation simultaneously, deadlocking outside the deadlock detector's view. The lock is now acquired at AccessExclusiveLock upfront to eliminate the lock-upgrade window.

Reaching the end of WAL while loading commit decisions tripped an assertion (buf.len > 0) on debug builds. The loop now terminates normally when no more data is available.

The standby reply hook could fire before BDR catalogs were fully initialized, causing a crash. The hook now checks catalog availability and exits early when catalogs are not yet ready.

If the receiver role was reset between writer launch and writer initialization, the writer tripped an assertion. The writer now exits cleanly so it can be restarted by the supervisor without producing a core file.

The pgd raft set-leader command didn't properly wait for leadership change in asynchronous mode, allowed invalid cross-group transfers, and produced an unclear error message when the target group didn't exist. All three issues are now corrected.

routing_leadership_transfer returned immediately when consensus reported no leader, instead of retrying like other transient consensus errors. BDR_CONSENSUS_NO_LEADER is now part of the retryable error set, so leadership transfers complete after a brief leader election rather than failing.

Transient lease renewal failures in the analytics (Seafowl) replicator caused the worker to crash and restart. Because these failures are self-recovering on the next renewal cycle, they are now logged at LOG level and the worker continues running.

The AutoPartition task manager's exponential backoff wasn't reset after processing work items, causing unnecessary iteration delays. autopartition_wait_for_partitions_on_all_nodes was also hardened with better signalling, a statement_timeout = 0 override on remote connections, and fixes for PGresult/PGconn leaks.

Connection Manager was incorrectly interpreting log_min_messages, causing inconsistent log filtering compared to Postgres.

Previously the value was displayed as true, which has the same meaning but exists only as a backwards-compatibility alias. This change requires no configuration changes.

When the pglogical manager process died with an error and tried to terminate other PGD workers, it hung if those workers had died uncleanly or were stuck and unable to receive signals. The process now exits correctly in all such cases.