[SCM] PostGIS branch master updated. 3.7.0beta2-40-ge3d6e352d

[git at osgeo.org]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PostGIS".

The branch, master has been updated
       via  e3d6e352d7b90b99afbd7bd0a1c21261389d061a (commit)
       via  8d0d0e0e04c7ded0d62fcd3a40dccdfde7e479fa (commit)
      from  ed950a3b0b2aeda97bfcbb6db62c8be9ad38be0c (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit e3d6e352d7b90b99afbd7bd0a1c21261389d061a
Merge: ed950a3b0 8d0d0e0e0
Author: Darafei Praliaskouski <komzpa at gmail.com>
Date:   Fri Aug 14 04:17:09 2026 -0700

    Merge pull request 'docs: avoid password argv in Docker setup' (!733) from Komzpa/postgis:fix/docker-dev-password-argv-20260814 into master
    
    The Docker development setup prompted for POSTGIS_DEV_PASSWORD and then passed it to psql with `-v password=...`, which made the entered password visible in process arguments.
    
    Use psql's built-in `\password postgres` prompt instead, so the password is read by psql and is not carried in the shell command line.
    
    References https://chatgpt.com/codex/cloud/security/findings/a54251275c8081919b2111d42cfa5e6b.
    
    Reviewed-on: https://gitea.osgeo.org/postgis/postgis/pulls/733


commit 8d0d0e0e04c7ded0d62fcd3a40dccdfde7e479fa
Author: Darafei Praliaskouski <me at komzpa.net>
Date:   Fri Aug 14 14:13:12 2026 +0400

    docs: avoid password argv in Docker setup

diff --git a/doc/development/environment/docker.md b/doc/development/environment/docker.md
index c453df502..808f6cde4 100644
--- a/doc/development/environment/docker.md
+++ b/doc/development/environment/docker.md
@@ -64,17 +64,15 @@ the cluster:
 ```sh
 export PGVER=15
 export PGPORT="$(grep ^port /etc/postgresql/${PGVER}/main/postgresql.conf | awk '{print $3}')"
-read -rs POSTGIS_DEV_PASSWORD
-printf '\n'
 psql -d postgres -c "ALTER SYSTEM SET listen_addresses='*';"
 printf '%s\n' "host all all 0.0.0.0/0 scram-sha-256" >> "/etc/postgresql/${PGVER}/main/pg_hba.conf"
-psql -d postgres -v password="$POSTGIS_DEV_PASSWORD" -c "ALTER ROLE postgres PASSWORD :'password';"
-unset POSTGIS_DEV_PASSWORD
+psql -d postgres -c '\password postgres'
 service postgresql restart "${PGVER}"
 ```
 
-Use a strong password and narrower `pg_hba.conf` rule on shared hosts. The
-example is intended for a short-lived local development container.
+Enter a strong password when `psql` prompts for it, and use a narrower
+`pg_hba.conf` rule on shared hosts. The example is intended for a short-lived
+local development container.
 
 From the host, connect to the PostgreSQL version whose container port you
 exposed. For example, if PostgreSQL inside the container listens on `5436` and

-----------------------------------------------------------------------

Summary of changes:
 doc/development/environment/docker.md | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)


hooks/post-receive
-- 
PostGIS