fix: allowlist wal2json in output_plugin_libraries + finish version strings (15.19/17.11)

PG 15.19/17.11 introduce output_plugin_libraries (CVE-2026-6471) defaulting
to pgoutput+test_decoding only, which breaks wal2json slots (Realtime, CI
wal2json tests). Allowlist wal2json in the shared config; comment it out for
orioledb builds (17.9 base, GUC absent, unknown parameter is fatal at
startup). Also bump schema dump headers left at 15.14/17.6.

Author: utkarash2991

ansible/files/postgresql_config/postgresql.conf.j2

@@ -204,6 +204,9 @@ shared_buffers = 128MB			# min 128kB
 
 wal_level = logical			# minimal, replica, or logical
 					# (change requires restart)
+output_plugin_libraries = 'pgoutput, test_decoding, wal2json'	# allowlist of logical decoding
+					# output plugins (PG 15.19 / 17.11+); wal2json is
+					# required by Realtime and shipped in the image
 #fsync = on				# flush data to disk for crash safety
 					# (turning this off can cause
 					# unrecoverable data corruption)

ansible/tasks/stage2-setup-postgres.yml

@@ -36,6 +36,12 @@
       when: stage2 and is_psql_oriole
       become: true
       block:
+        - name: Comment out output_plugin_libraries if orioledb build (GUC does not exist before PG 17.11)
+          ansible.builtin.replace:
+            path: '/etc/postgresql/postgresql.conf'
+            regexp: '^output_plugin_libraries'
+            replace: '#output_plugin_libraries'
+
         - name: Append orioledb to shared_preload_libraries append within closing quote
           ansible.builtin.replace:
             path: '/etc/postgresql/postgresql.conf'

migrations/schema-15.sql

@@ -4,8 +4,8 @@
 
 \restrict SupabaseTestDumpKey123
 
--- Dumped from database version 15.14
--- Dumped by pg_dump version 15.14
+-- Dumped from database version 15.19
+-- Dumped by pg_dump version 15.19
 
 SET statement_timeout = 0;
 SET lock_timeout = 0;

migrations/schema-17.sql

@@ -4,8 +4,8 @@
 
 \restrict SupabaseTestDumpKey123
 
--- Dumped from database version 17.6
--- Dumped by pg_dump version 17.6
+-- Dumped from database version 17.11
+-- Dumped by pg_dump version 17.11
 
 SET statement_timeout = 0;
 SET lock_timeout = 0;

nix/checks.nix

@@ -410,6 +410,10 @@
                   # Add orioledb to shared_preload_libraries
                   perl -pi -e "s/(shared_preload_libraries = ')/\$1orioledb, /" "$PGTAP_CLUSTER/postgresql.conf"
                   log info "OrioleDB added to shared_preload_libraries"
+                else
+                  # PG 15.19 / 17.11+: allowlist wal2json for logical decoding (GUC does not
+                  # exist on the orioledb 17.9 base, hence the else branch)
+                  echo "output_plugin_libraries = 'pgoutput, test_decoding, wal2json'" >> "$PGTAP_CLUSTER"/postgresql.conf
                 fi
 
                 # Check if postgresql.conf exists

nix/ext/tests/lib.nix

@@ -115,6 +115,9 @@ let
       ${
         if majorVersion == "orioledb-17" then
           ''
+            # OrioleDB: comment out output_plugin_libraries (GUC does not exist before PG 17.11;
+            # orioledb line is on a 17.9 base and would fail to start on an unknown parameter)
+            sed -i 's/^output_plugin_libraries/#output_plugin_libraries/' $out/postgresql.conf
             # OrioleDB: also remove pgjwt from supautils privileged_extensions
             sed -i 's/ pgjwt,//g;' $out/supautils.conf
             # OrioleDB: append orioledb to shared_preload_libraries