Commits on Aug 21, 2026

1. Prevent broken grant chains when indirect grant options are held

   recursive_revoke() is meant to protect against cases where a grantor
   loses their grant option after issuing dependent grants to other roles.
   In that case, the user must specify CASCADE to prune the dependent ACLs.
   However, if a grantor happens to hold grant options (or table ownership)
   indirectly, whether via INHERIT or SUPERUSER, recursive_revoke()
   short-circuits and allows the REVOKE to break the grant chain. Symptoms
   include general user confusion as well as problems during dump/restore,
   which cannot recreate the original state.
   To fix, switch from aclmask() to aclmask_direct().
   Discussion: https://postgr.es/m/CAOYmi%2B%3DKTLd%2BXsEP%3DTDiZ48iVf-CEc7JrZd5uhWPYWKEfOgyyQ%40mail.gmail.com
   Backpatch-through: 14

   

   authored and Commitfest Bot committed

   Aug 21, 2026
   Configuration menu

   Browse the repository at this point in the history

2. Configuration menu

   Browse the repository at this point in the history