diff --git a/doc/src/sgml/release-16.sgml b/doc/src/sgml/release-16.sgml
index ed8dc6410dc..cb3fb91adca 100644
--- a/doc/src/sgml/release-16.sgml
+++ b/doc/src/sgml/release-16.sgml
@@ -1,6 +1,1050 @@
+
+ Release 16.12
+
+
+ Release date:
+ 2026-02-12
+
+
+
+ This release contains a variety of fixes from 16.11.
+ For information about new features in major release 16, see
+ .
+
+
+
+ Migration to Version 16.12
+
+
+ A dump/restore is not required for those running 16.X.
+
+
+
+ However, if you are upgrading from a version earlier than 16.10,
+ see .
+
+
+
+
+ Changes
+
+
+
+
+
+
+ Don't allow CTE references in sub-selects to determine semantic
+ levels of aggregate functions (Tom Lane)
+ §
+
+
+
+ This change undoes a change made two minor releases ago, instead
+ throwing an error if a sub-select references a CTE that's below the
+ semantic level that standard SQL rules would assign to the aggregate
+ based on contained column references and aggregates. The attempted
+ fix turned out to cause problems of its own, and it's unclear what
+ to do instead. Since sub-selects within aggregates are disallowed
+ altogether by the SQL standard, treating such cases as errors seems
+ sufficient.
+
+
+
+
+
+
+ Fix trigger transition table capture for MERGE
+ in CTE queries (Dean Rasheed)
+ §
+
+
+
+ When executing a data-modifying CTE query containing both
+ a MERGE and another DML operation on a table with
+ statement-level AFTER triggers, the transition
+ tables passed to the triggers would not include the rows affected by
+ the MERGE, only those affected by the other
+ operation(s).
+
+
+
+
+
+
+ Fix failure when all children of a partitioned target table
+ of an update or delete have been pruned (Amit Langote)
+ §
+
+
+
+ In such cases, the executor could report could not find junk
+ ctid column
errors, even though nothing needs to be done.
+
+
+
+
+
+
+ Avoid possible planner failure when a query contains duplicate
+ window function calls (Meng Zhang, David Rowley)
+ §
+
+
+
+ Confusion over de-duplication of such calls could result in errors
+ like WindowFunc with winref 2 assigned to WindowAgg with
+ winref 1
.
+
+
+
+
+
+
+ Allow indexscans on partial hash indexes even when the index's
+ predicate implies the truth of the WHERE clause (Tom Lane)
+ §
+
+
+
+ Normally we drop a WHERE clause that is implied by the predicate,
+ since it's pointless to test it; it must hold for every index
+ entry. However that can prevent creation of an indexscan plan if
+ the index is one that requires a WHERE clause on the leading index
+ key, as hash indexes do. Don't drop implied clauses when
+ considering such an index.
+
+
+
+
+
+
+ Do not emit WAL for unlogged BRIN indexes (Kirill Reshke)
+ §
+
+
+
+ One seldom-taken code path incorrectly emitted a WAL record
+ relating to a BRIN index even if the index was marked unlogged.
+ Crash recovery would then fail to replay that record, complaining
+ that the file already exists.
+
+
+
+
+
+
+ Prevent truncation of CLOG that is still needed by
+ unread NOTIFY messages (Joel Jacobson, Heikki
+ Linnakangas)
+ §
+ §
+ §
+
+
+
+ This fix prevents could not access status of
+ transaction
errors when a backend is slow to
+ absorb NOTIFY messages.
+
+
+
+
+
+
+ Escalate errors occurring during NOTIFY message
+ processing to FATAL, i.e. close the connection (Heikki Linnakangas)
+ §
+
+
+
+ Formerly, if a backend got an error while absorbing
+ a NOTIFY message, it would advance past that
+ message, report the error to the client, and move on. That behavior
+ was fraught with problems though. One big concern is that the
+ client has no good way to know that a notification was lost, and
+ certainly no way to know what was in it. Depending on the
+ application logic, missing a notification could cause the
+ application to get stuck waiting, for example. Also, any remaining
+ messages would not get processed until someone sent a
+ new NOTIFY.
+
+
+
+ Also, if the connection is idle at the time of receiving
+ a NOTIFY signal, any ERROR would be escalated to
+ FATAL anyway, due to unrelated concerns. Therefore, we've chosen to
+ make that happen in all cases, for consistency and to provide a
+ clear signal to the application that it might have missed some
+ notifications.
+
+
+
+
+
+
+ Fix bug in following update chain when locking a tuple (Jasper
+ Smit)
+ §
+
+
+
+ This code path neglected to check the xmin of the first new tuple in
+ the update chain, making it possible to lock an unrelated tuple if
+ the original updater aborted and the space was immediately reclaimed
+ by VACUUM and then re-used.
+ That could cause unexpected transaction delays or deadlocks.
+ Errors associated with having identified the wrong tuple have also
+ been observed.
+
+
+
+
+
+
+ Fix issues around in-place catalog updates (Noah Misch)
+ §
+ §
+ §
+
+
+
+ Send a nontransactional invalidation message for an in-place update,
+ since such an update will survive transaction rollback. Also ensure
+ that the update is WAL-logged before other sessions can see it.
+ These fixes primarily prevent scenarios in which relations'
+ frozen-XID attributes become inconsistent, possibly allowing
+ premature CLOG truncation and subsequent could not access
+ status of transaction
errors.
+
+
+
+
+
+
+ Fix potential backend process crash at process exit due to trying to
+ release a lock in an already-unmapped shared memory segment
+ (Rahila Syed)
+ §
+
+
+
+
+
+
+ Guard against incorrect truncation of the multixact log after a
+ crash (Heikki Linnakangas)
+ §
+
+
+
+
+
+
+ Fix possibly mis-encoded result
+ of pg_stat_get_backend_activity() (Chao Li)
+ §
+
+
+
+ The shared-memory buffer holding a session's activity string can
+ end with an incomplete multibyte character. Readers are supposed
+ to truncate off any such incomplete character, but this function
+ failed to do so.
+
+
+
+
+
+
+ Guard against recursive memory context logging (Fujii Masao)
+ §
+
+
+
+ A constant flow of signals requesting memory context logging could
+ cause recursive execution of the logging code, which in theory could
+ lead to stack overflow.
+
+
+
+
+
+
+ Fix memory context usage when reinitializing a parallel execution
+ context (Jakub Wartak, Jeevan Chalke)
+ §
+
+
+
+ This error could result in a crash due to a subsidiary data
+ structure having a shorter lifespan than the parallel context.
+ The problem is not known to be reachable using only
+ core PostgreSQL, but we have reports of
+ trouble in extensions.
+
+
+
+
+
+
+ Set next multixid's offset when creating a new multixid, to remove
+ the wait loop that was needed in corner cases (Andrey Borodin)
+ §
+ §
+
+
+
+ The previous logic could get stuck waiting for an update that would
+ never occur.
+
+
+
+
+
+
+ Avoid rewriting data-modifying CTEs more than once (Bernice Southey,
+ Dean Rasheed)
+ §
+
+
+
+ Formerly, when updating an auto-updatable view or a relation with
+ rules, if the original query had any data-modifying CTEs, the rewriter
+ would rewrite those CTEs multiple times due to recursion. This was
+ inefficient and could produce false errors if a CTE included an
+ update of an always-generated column.
+
+
+
+
+
+
+ Fail recovery if WAL does not exist back to the redo point indicated
+ by the checkpoint record (Nitin Jadhav)
+ §
+
+
+
+ Add an explicit check for this before starting recovery, so that no
+ harm is done and a useful error message is provided. Previously,
+ recovery might crash or corrupt the database in this situation.
+
+
+
+
+
+
+ Avoid scribbling on the source query tree during ALTER
+ PUBLICATION (Sunil S)
+ §
+
+
+
+ This error had the visible effect that an event trigger fired for
+ the query would see only the first publish
+ option, even if several had been specified. If such a query were
+ set up as a prepared statement, re-executions would misbehave too.
+
+
+
+
+
+
+ Pass connection options specified in CREATE SUBSCRIPTION
+ ... CONNECTION to the publisher's walsender (Fujii Masao)
+ §
+
+
+
+ Before this fix, the options connection option
+ (if any) was ignored, thus for example preventing setting custom
+ server parameter values in the walsender session. It was intended
+ for that to work, and it did work before refactoring
+ in PostgreSQL version 15 broke it, so
+ restore the previous behavior.
+
+
+
+
+
+
+ Prevent invalidation of newly created or newly synced replication
+ slots (Zhijie Hou)
+ §
+
+
+
+ A race condition with a concurrent checkpoint could allow WAL to be
+ removed that is needed by the replication slot, causing the slot to
+ immediately get marked invalid.
+
+
+
+
+
+
+ Fix race condition in computing a replication slot's required xmin
+ (Zhijie Hou)
+ §
+
+
+
+ This could lead to the error cannot build an initial slot
+ snapshot as oldest safe xid follows snapshot's xmin
.
+
+
+
+
+
+
+ During initial synchronization of a logical replication
+ subscription, commit the addition of
+ a pg_replication_origin entry before
+ starting to copy data (Zhijie Hou)
+ §
+
+
+
+ Previously, if the copy step failed, the
+ new pg_replication_origin entry would be
+ lost due to transaction rollback. This led to inconsistent state in
+ shared memory.
+
+
+
+
+
+
+ Don't advance logical replication progress after a parallel worker
+ apply failure (Zhijie Hou)
+ §
+
+
+
+ The previous behavior allowed transactions to be lost by a
+ subscriber.
+
+
+
+
+
+
+ Fix possible failure with unexpected data beyond EOF
+ during restart of a streaming replica server (Anthonin Bonnefoy)
+ §
+
+
+
+
+
+
+ Fix erroneous tracking of column position when parsing partition
+ range bounds (myzhen)
+ §
+
+
+
+ This could, for example, lead to the wrong column name being cited
+ in error messages about casting partition bound values to the
+ column's data type.
+
+
+
+
+
+
+ Fix assorted minor errors in error messages (Man Zeng, Tianchen Zhang)
+ §
+ §
+ §
+
+
+
+ For example, an error report about mismatched timeline number in a
+ backup manifest showed the starting timeline number where it meant
+ to show the ending timeline number.
+
+
+
+
+
+
+ Fix failure to perform function inlining when doing JIT compilation
+ with LLVM version 17 or later (Anthonin Bonnefoy)
+ §
+
+
+
+
+
+
+ Adjust our JIT code to work with LLVM 21 (Holger Hoffstätte)
+ §
+
+
+
+ The previous coding failed to compile on aarch64 machines.
+
+
+
+
+
+
+ Add new server parameter to
+ control use of posix_fallocate() (Thomas Munro)
+ §
+
+
+
+ PostgreSQL version 16 and later will
+ use posix_fallocate(), if the platform provides
+ it, to extend relation files. However, this has been reported to
+ interact poorly with some file systems: BTRFS compression is
+ disabled by the use of posix_fallocate(), and
+ XFS could produce spurious ENOSPC errors in older
+ Linux kernel versions. To provide a workaround, introduce this new
+ server parameter. Setting file_extend_method
+ to write_zeros will cause the server to return to
+ the old method of extending files by writing blocks of zeroes.
+
+
+
+
+
+
+ Honor open()'s O_CLOEXEC
+ flag on Windows (Bryan Green, Thomas Munro)
+ §
+ §
+ §
+
+
+
+ Make this flag work like it does on POSIX platforms, so that we
+ don't leak file handles into child processes such as COPY
+ TO/FROM PROGRAM. While that leakage hasn't caused many
+ problems, it seems undesirable.
+
+
+
+
+
+
+ Fix failure to parse long options on the server command line in
+ Solaris executables built with meson (Tom Lane)
+ §
+
+
+
+
+
+
+ Support process title changes on GNU/Hurd (Michael Banck)
+ §
+
+
+
+
+
+
+ Make pg_resetwal print the updated value
+ when changing OldestXID (Heikki Linnakangas)
+ §
+
+
+
+ It already did that for every other variable it can change.
+
+
+
+
+
+
+ Make pg_resetwal allow setting next
+ multixact xid to 0 or next multixact offset to UINT32_MAX (Maxim
+ Orlov)
+ §
+
+
+
+ These are valid values, so rejecting them was incorrect. In the
+ worst case, if a pg_upgrade is attempted when exactly at the point
+ of multixact wraparound, the upgrade would fail.
+
+
+
+
+
+
+ In contrib/amcheck, use the correct snapshot
+ for btree index parent checks (Mihail Nikalayeu)
+ §
+
+
+
+ The previous coding caused spurious errors when examining indexes
+ created with CREATE INDEX CONCURRENTLY.
+
+
+
+
+
+
+ Fix contrib/amcheck to
+ handle half-dead
btree index pages correctly
+ (Heikki Linnakangas)
+ §
+
+
+
+ amcheck expected such a page to have a parent
+ downlink, but it does not, leading to a false error report
+ about mismatch between parent key and child high key
.
+
+
+
+
+
+
+ Fix contrib/amcheck to
+ handle incomplete btree root page splits correctly
+ (Heikki Linnakangas)
+ §
+
+
+
+ amcheck could report a false error
+ about block is not true root
.
+
+
+
+
+
+
+ Fix edge-case integer overflow
+ in contrib/intarray's selectivity estimator
+ for @@ (Chao Li)
+ §
+
+
+
+ This could cause poor selectivity estimates to be produced for cases
+ involving the maximum integer value.
+
+
+
+
+
+
+ Fix multibyte-encoding issue in contrib/ltree
+ (Jeff Davis)
+ §
+
+
+
+ The previous coding could pass an incomplete multibyte character
+ to lower(), probably resulting in incorrect
+ behavior.
+
+
+
+
+
+
+ Update time zone data files to tzdata
+ release 2025c (Tom Lane)
+ §
+
+
+
+ The only change is in historical data for pre-1976 timestamps in
+ Baja California.
+
+
+
+
+
+
+
+
Release 16.11