PG Exporter v1.5.0

VonngAuthor of PG Exporter and Pigsty, working on PostgreSQL infrastructure and monitoring.

PG Exporter v1.5.0 updates the Go toolchain and dependencies, fixes replication collector identity and state mappings, and closes six runtime defects around target URLs, discovery, health, collector planning, durations, and HTTP routing.

The bundle still contains 58 YAML files, 96 collector branches, 59 namespaces, and 460 distinct metric definitions. The metric count spans all version branches, including disabled collectors and two unexpanded SQL histograms; it is not a promise of 460 series in each scrape.

Changes

• Safer connection URLs: malformed URL syntax, query escaping, or unsafe decoded parameter names stop startup without exposing the original connection string. Explicit TLS options can no longer disappear silently when malformed parameters are normalized. An empty or whitespace-only selected PG_EXPORTER_URL_FILE also fails startup.
• Correct database discovery: database identity follows lib/pq, including the dbname and database aliases. Discovery removes conflicting database parameters when substituting a database path and preserves special characters. This prevents repeated collection of one database, duplicate samples, and resulting HTTP 500 responses.
• Consistent health responses: each response derives its status code and body from one atomic state snapshot. Concurrent probes, scrapes, and reloads can no longer combine HTTP 200 with a down or starting body. Health still reports cached target state.
• Collector plans follow metadata: changes to the connected user, schema set, or extension set invalidate the plan after a successful metadata precheck. New eligible collectors appear on the next scrape; removed dependencies stop selecting collectors. Unchanged sets preserve their caches.
• Bounded configuration durations: YAML TTLs, timeouts, and predicate TTLs reject NaN, infinity, and positive duration overflow. Zero/default semantics and finite negative timeouts that disable deadlines remain unchanged.
• Reachable metrics paths: startup checks the actual metrics handler selected by the active HTTP mux, including decoded paths and redirects. A path cannot pass validation while routing to the homepage or a redirect.
• Replication identity and states: every pg_sub_* sample gains a datname label, distinguishing subscriptions with the same name in different databases. pg_recv_state uses the actual receiver states, and its legacy query uses PG9.6-compatible substring().
• More precise collector descriptions: document optional replication-origin permissions, publication table counts versus subscription table/sequence counts, and pg_backend grouping by backend type. These description changes do not add metric families or enable optional collectors.

Toolchain and dependencies

The database driver remains lib/pq 1.12.3. There is no driver migration or new optional data source in this release. Prometheus client/model/procfs, YAML, compression, OAuth2, and other transitive modules are also refreshed; a version bump alone is not evidence that an application CVE was fixed.

Security updates

The upgrade incorporates upstream security fixes; it does not mean every listed CVE was exploitable through PG Exporter. The comparison below uses the v1.4.1 source and dependencies with Go 1.26.5. S means a static symbol match, P an imported-package match without an affected-symbol call, and M a module match whose affected package is not imported. Symbol matches can be conservative and are not attack reproductions.

Go standard library and build tools

Go 1.27.3 includes CVE-2026-111943, which adds an X.509 denylist for untrusted intermediate certificates, plus cumulative HTTP, TLS, template, and parser fixes. The following affected standard-library entries were present in the old baseline; the match column is from Darwin/arm64 and platform-specific preconditions still apply.

The build toolchain also includes module/toolchain download-validation fixes CVE-2026-56865, CVE-2026-56864, CVE-2026-94444, and CVE-2026-94447. These strengthen the build environment, rather than describing exporter runtime vulnerabilities. The official announcements cover Go 1.26.6, Go 1.27.2, and Go 1.27.3.

Go modules

On 2026-10-23, govulncheck found no symbol-level or imported-package vulnerabilities in the v1.5.0 candidate for Darwin/arm64, Linux/amd64, and Windows/amd64. The unimported OpenPGP package still produces the module-only advisory GO-2026-5932, which has no fixed version. This is not a claim that every dependency module is free of advisories. Upgrading Go alone while retaining the old modules leaves the five x/net matches; both the compiler and dependency changes matter.

Use the rebuilt release artifacts: installing a newer Go compiler on a host does not change an already compiled exporter binary.

Upgrade notes

1. Deploy the matching collector configuration. Upgrading only the binary does not apply SQL or label corrections. Compare local customizations before replacing /etc/pg_exporter.yml.

2. Review the pg_sub_* label change. The new datname label creates new time series. Keep database identity in PromQL joins and aggregations where needed. pg_sub_id remains a Gauge.

3. Grant the PG10–13 subscription prerequisite. As an administrator, run the following in each database used as the exporter’s main connection database, using the actual monitoring role. Granting it only in a subscription’s database is insufficient. It does not expose subconninfo; PG14+ needs no extra grant under standard catalog ACLs.

   GRANT SELECT (oid) ON pg_catalog.pg_subscription TO monitor;

4. Check receiver-state alerts. streaming=0, stopping=4, connecting=5 (PG19+), starting=6, waiting=7, restarting=8, stopped=9, and unknown/NULL =-1; codes 1–3 are reserved. A missing receiver row remains absent.

5. Correct previously tolerated invalid input. Broken URL escapes, empty selected URL files, non-finite durations, and unreachable metrics paths now fail validation. Prefer /metrics for compatibility with both HTTP mux implementations.

Omitted sslmode still defaults to disable; configure TLS explicitly for remote connections. The scratch container still requires a mounted CA for certificate verification. Empty YAML reloads still apply zero configured collectors, invalid files in a directory may be skipped, and SIGTERM does not wait for active HTTP requests. See Security, HTTP API, and Bundled Collectors for the operating contracts.

Validation scope

Pre-release validation covered the race suite, both HTTP mux modes, static analysis, module and generated-config consistency, roughly 604,000 short-run fuzz cases, and six target builds. Non-superuser default collection passed on PostgreSQL 9.1–9.6, 10–18, 19 RC1, and PgBouncer 1.26.1. Runtime checks included conflicting database aliases, special database names, schema/extension changes, failed reloads, reconnect recovery, physical standby promotion, and concurrent HTTP requests. RPM/DEB installation and Docker builds were also checked.

These checks cover the recorded versions and scenarios, not every extension combination or production workload. Composite, Patroni, pgBackRest, and PostgreSQL-log components remain development work outside v1.5.0.