pg_vault_tde’s stability patch requires a coordinated upgrade

pg_vault_tde 1.7.2 fixes crashes and correctness problems in encrypted PostgreSQL tables, including updates involving indexed variable-length columns and key-rotation failures. It introduces a new on-disk tuple layout and changes its write-ahead-log resource-manager identifier. Those changes make this more than a binary replacement: older rows remain readable but must be rewritten before they can be safely updated.

Miriade Srl · Oct 5, 2026

Why it matters

Operators need a migration window and a table-rewrite plan, not just a package upgrade.

More context

Follow the project’s full upgrade procedure: cleanly shut down, coordinate primary and standby upgrades when toast_custom_rmgr is enabled, then run VACUUM FULL on every encrypted table. The extension version remains 1.7; pg_vault_tde_build_version() distinguishes this build.

Keep in mind

The announcement explicitly rules out a rolling upgrade with toast_custom_rmgr enabled. Existing v4 rows can crash on UPDATE until rewritten. Verify backups and rehearse the migration; 1min has not tested it.

Original read