<formalpara>

<title>Release date:</title>

<para>2017-??-?? (current as of 2017-07-09, commit3381898f9)</para>

<para>2017-??-?? (current as of 2017-08-05, commiteccead9ed)</para>

</formalpara>

<sect2>

-->

<para>

Add configuration option <xref linkend="guc-ssl-dh-params-file"> to

specifyfilename for custom OpenSSL DH parameters (Heikki Linnakangas)

specifyfile name for custom OpenSSL DH parameters (Heikki Linnakangas)

</para>

<para>

This replaces the hardcoded, undocumented <filename>dh1024.pem</>

filename. Note that <filename>dh1024.pem</> is no longer used by default;

you must set the option to use custom DH parameters.

This replaces the hardcoded, undocumented file

name <filename>dh1024.pem</>. Note that <filename>dh1024.pem</> is

no longer examined by default; you must set this option to use custom

DH parameters.

</para>

</listitem>

2017-07-31 [c0a15e07c] Always use 2048 bit DH parameters for OpenSSL ephemeral

-->

<para>

Increase the size of DH parameters used for OpenSSL ephemeral DH ciphers

to 2048 bits (Heikki Linnakangas)

Increase the size ofthe defaultDH parameters used for OpenSSL

ephemeral DH ciphersto 2048 bits (Heikki Linnakangas)

</para>

<para>

The size of the compiled-in DH parameters has been increased from 1024

to 2048 bits, making DH key exchange more resistent to a brute-force

attack. However, some old SSL implementations, notably some revisions of

Java Runtime Environment version 6, will not accept DH parameters longer

than 1024 bits, and will not be able to connect over SSL. As a

work-around, you can use custom 1024-bit DH parameters, instead of the

compiled-in defaults. See <xref linkend="guc-ssl-dh-params-file"> for

information on using custom DH parameters.

The size of the compiled-in DH parameters has been increased from

1024 to 2048 bits, making DH key exchange more resistant to

brute-force attacks. However, some old SSL implementations, notably

some revisions of Java Runtime Environment version 6, will not accept

DH parameters longer than 1024 bits, and hence will not be able to

connect over SSL. If it's necessary to support such old clients, you

can use custom 1024-bit DH parameters instead of the compiled-in

defaults. See <xref linkend="guc-ssl-dh-params-file">.

</para>

</listitem>

<listitem>

<!--

2017-08-04 [c30f1770a] Apply ALTER ... SET NOT NULL recursively in ALTER ... AD

-->

<para>

When <command>ALTER TABLE ... ADD PRIMARY KEY</> marks

columns <literal>NOT NULL</>, that change now propagates to

inheritance child tables as well (Michael Paquier)

</para>

</listitem>

<para>

This module provided compatibility with the version of full text

search that shipped in pre-8.3 <productname>PostgreSQL</> releases.

</para>

</para>

</listitem>

<listitem>

<listitem>

<!--

2017-03-25 [b8d7f053c] Faster expression evaluation and targetlist projection.

2017-07-30 [cc9f08b6b] Move ExecProcNode from dispatch to function pointer base

-->

<para>

Reduce expression evaluation overhead during query execution (Andres

Freund)

Reduce expression evaluation overhead during query execution,

as well as plan node calling overhead (AndresFreund)

</para>

<para>

<!--

2016-11-03 [274bb2b38] libpq: Allow connection strings and URIs to specify mult

2017-05-19 [5f374fe7a] libpq: Try next host if one of them times out.

2017-07-10 [7b02ba62e] Allow multiple hostaddrs to go with multiple hostnames.

-->

<para>

Allow specification of <link

linkend="libpq-connect-host">multiple host names</> in libpq

connection strings and URIs

(Robert Haas)

Allow specification of <link linkend="libpq-connect-host">multiple

host names or addresses</> in libpq connection strings and URIs

(Robert Haas, Heikki Linnakangas)

</para>

<para>