Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wEdFE-004EDH-26 for pgsql-announce@arkaria.postgresql.org; Mon, 20 Apr 2026 01:16:13 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1wEdFD-00HHbo-2f for pgsql-announce@arkaria.postgresql.org; Mon, 20 Apr 2026 01:16:11 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wEdFC-00HHao-2e for pgsql-announce@lists.postgresql.org; Mon, 20 Apr 2026 01:16:11 +0000 Received: from mahout.postgresql.org ([2001:4800:3e1:1::227]) by makus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wEdF8-00000001qbg-1emX for pgsql-announce@lists.postgresql.org; Mon, 20 Apr 2026 01:16:09 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=postgresql.org; s=20171124; h=Message-ID:Date:Reply-To:From:To:Subject: MIME-Version:Content-Type:Sender:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:In-Reply-To:References; bh=oAHPnxVJoyCWrNiNuXe4g9xQV8sSH+Uuijx0jX73wc8=; b=Ob0/rM8xvEsCKvG8RxOAOh/GrJ M3reVNHajKFPZlSirPmEAWsB8M20KtLaBDMRLZCGsWSuBhZdvnjiN/WPeU+uwoYsboIx8EuQ5PXsk RXf3O/VsAshUPWo9qoGdMp/2qBmcBWa9URENUhEVFv/3Qr3DLVSr8w2GLgAeCZHetE/m3yDDrJy3e kKYMUGYYpiKSyg3BS5GjaWs0ussjr4W+BWyhMh5hlt1mygXyDIznA52oPd9v7VDiPn9ZeYUIxKs1n yXL6TQ7pOTnGq5CeFrb0d8DxrPl2xhawjHynCuUVQvyPRQddWkn5ilYrybg4/kw+K4BOpfr9cg+Mr 4AmS9BgA==; Received: from wrigleys.postgresql.org ([2a02:16a8:dc51::60]) by mahout.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wEdF7-005UpE-0W for pgsql-announce@lists.postgresql.org; Mon, 20 Apr 2026 01:16:05 +0000 Received: from localhost ([127.0.0.1] helo=wrigleys.postgresql.org) by wrigleys.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1wEdF5-00CF13-1C for pgsql-announce@lists.postgresql.org; Mon, 20 Apr 2026 01:16:03 +0000 Content-Type: multipart/alternative; boundary="===============4749963812533566026==" MIME-Version: 1.0 Subject: credcheck v4.7 has been released To: PostgreSQL Announce From: HexaCluster via PostgreSQL Announce Reply-To: gilles@hexacluster.ai Date: Mon, 20 Apr 2026 01:16:02 +0000 Message-ID: <177664776247.403058.7443930351063374292@wrigleys.postgresql.org> X-Auto-Response-Suppress: All Auto-Submitted: auto-generated X-pglister-tags: related X-pglister-tagsig: 426c1cf74848f308ac3e2be771d892e39e4cf73c15d3341ad7b6a4310f550606 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --===============4749963812533566026== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Antananarivo, Madagascar - April 19, 2026 ## PostgreSQL credcheck extension The credcheck PostgreSQL extension provides few general credential checks, = which will be evaluated during the user creation, during the password chang= e and user renaming. By using this extension, we can define a set of rules: * allow a specific set of credentials * reject a certain type of credentials * deny password that can be easily cracked * enforce use of an expiration date with a minimum of day for a password * define a password reuse policy * define the number of authentication failure allowed before a user is ba= nned * define a delay on authentication failures * force users to change their password after first login * throw a warning N days before when the password user is about to expire This release fixes issues reported by users since last release and adds two new features. - Allow no password policy checks at all for changes done by a superuser enabling new GUC `credcheck.superuser_nocheck`. - Add feature "Disallow password change" to disallow users to change their password. This behavior is enabled by enabling new GUC `credcheck.disallow_password_change`. It returns the following message when a user tries to change its password: `ERROR: you are not allowed to change your password.` - Fix `credcheck.password_valid_until` when CREATE/ALTER ROLE is called f= rom a plpgsql block. - Fix password_valid_until / password_valid_max behavior. Upgrade require a PostgreSQL restart to reload the credcheck library. Complete list of changes and acknowledgements are available [here](https://= github.com/HexaCluster/credcheck/releases/tag/v4.7) ## Links & Credits credcheck is an open project under the PostgreSQL license maintained by [He= xaCluster](https://github.com/HexaCluster/credcheck/). Any contribution to build a better tool is welcome. You can send your ideas= , features requests or patches using the GitHub tools. **Links :** * Download: [https://github.com/HexaCluster/credcheck/releases/](https://g= ithub.com/HexaCluster/credcheck/releases/) * Support: use GitHub report tool at [https://github.com/HexaCluster/credch= eck/issues](https://github.com/HexaCluster/credcheck/issues) ## About credcheck The credcheck extension is developed and maintained by Gilles Darold at [ht= tps://hexacluster.ai](HexaCluster Corp). If you need more information pleas= e [https://hexacluster.ai/contact-us/](contact us). Documentation at [https://github.com/HexaCluster/credcheck#readme](https://= github.com/HexaCluster/credcheck#readme) --===============4749963812533566026== Content-Type: text/html; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable credcheck v4.7 has been released
 

credcheck v4.7 has been released

Antananarivo, Madagascar - April 19, 2026

PostgreSQL credcheck extension<= /h2>

The credcheck PostgreSQL extension provides= few general credential checks, which will be evaluated during the user cre= ation, during the password change and user renaming. By using this extensio= n, we can define a set of rules:

  • allow a specifi= c set of credentials
  • reject a certai= n type of credentials
  • deny password t= hat can be easily cracked
  • enforce use of = an expiration date with a minimum of day for a password
  • define a passwo= rd reuse policy
  • define the numb= er of authentication failure allowed before a user is banned
  • define a delay = on authentication failures
  • force users to = change their password after first login
  • throw a warning= N days before when the password user is about to expire

This release fixes issues reported by users= since last release and adds two new features.

  • Allow no passwo= rd policy checks at all for changes done by a superuser enabling new GUC credcheck.superuser_nocheck.
  • Add feature "Di= sallow password change" to disallow users to change their password. This behavior is enabled by enabling new GUC credcheck.disallow_password_change. It returns the followi= ng message when a user tries to change its password: ERROR: you are not allowed to change your password.
  • Fix credc= heck.password_valid_until when CREATE/ALTER ROLE is called from a pl= pgsql block.
  • Fix password_va= lid_until / password_valid_max behavior.

Upgrade require a PostgreSQL restart to rel= oad the credcheck library.

Complete list of changes and acknowledgemen= ts are available here<= /p>

Links & Credits

credcheck is an open project under the Post= greSQL license maintained by HexaCluster. Any contribution to build a better tool is welcome. You can send your ideas= , features requests or patches using the GitHub tools.

Links :

About credcheck

The credcheck extension is developed and ma= intained by Gilles Darold at https://hexacluster.ai. If you need more information please <= a style=3D"color: #3498db; text-decoration: underline">https://hexacluster.= ai/contact-us/.

Documentation at https://github.com/HexaCluster/credcheck#readme
This email was sent to you from HexaCluster. It was delivered on their beha= lf by the PostgreSQL project. Any questions about the content of the message shou= ld be sent to HexaCluster.

You were sent this email as a subscriber of the pgsql-announce mai= linglist, for the content tag Related Open Source. To unsubscribe from further emails, or change which emails you want to receive, please click th= e personal unsubscribe link that you can find in the headers of this email, or visit https://lists.postgresql.org/unsubscribe/.
 
--===============4749963812533566026==--