[QGIS-Developer] PostgreSQL vulnerability in the QGIS application

[Greg Troxel]

Bo Victor Thomsen via QGIS-Developer <qgis-developer at lists.osgeo.org>
writes:

> Hi Greg -
>
> You're right about the source code distribution.
>
> What I was talking about - and didn't specifically explain - was the
> different  binary installation packages available through the QGIS.org
> homepage. Which is used by the large majority of QGIS-using
> organizations  to install QGIS.
>
> So here is information about the specific QGIS installation
> packages containing the latest PostgreSQL client version *18.4*:
>
>  * QGIS LTR, version *3.44.12*. Long term release, suitable for
>    enterprise use.
>  * QGIS lastest version *4.2.0*. Early adapter version, not (yet)
>    suitable for enterprise use.
>
> Both binary packages can be downloaded at QGIS.org homepage:
> https://qgis.org/download/

Sorry to seem difficult, but I can't reconcile the implied "there exist
only two specific packages" with finding on the order of a dozen at that
link.

At that link, there are multiple operating systems, and multiple
options.  It's not clear to me if all of them are full bundles, vs
normal packages with dependencies from the base system.  There is

  Windows
    osgeo4w
    LTR and stable
  macOS
    LTR and stable
  Linux
    7 distributions plus flatpack/spack
  BSD
    FreeBSD
      LTR and stable
    OpenBSD
      stable
  Container
    (hard to figure out)


Are you saying that every single one of those options will use pgsql
18.4.1?  I would think that the GNU/Linux (actual distributions not
flat-ish) would be using what the distribution was on, and it's not up
to qgis to fix that, vs installers that bundle everything (to remediate
the problem of the base OS not having a high-functioning packaging
system).

For the BSD packaging systems pointed to, surely those are maintained by
FreeBSD and OpenBSD people, just as I maintain the entries in pkgsrc
(NetBSD, illumos, and many others).  Thus qgis.org is not choosing pgsql
versions.

Or do you mean only the two Windows installers?

What I'm asking is that if you are talking about two specific windows
installers, to say that, to avoid people interpreting statements as
applying to the N other ways one can get binary distributions, many of
which have their own processes and change control.  The assumption that
"installing qgis" equals "installing qgis on windows" is not sound, even
if it is often true.

Thanks,
Greg