Release 3.2

Maintainer

-------------------------------------------------------------------------------

This software is mainly developed and maintained by Damien Clochard with the

help of many contributors.

This software is mainly developed and maintained by Damien Clochard and

Benoit Lobréau with the help of many contributors.

Contributors

-------------------------------------------------------------------------------

* Alain Lesage: Documentation, Performances, Major Contributions

* Sarath Kumar: Security report

* Mehmet Ince: Security report

* Buut: Security report

<!-- git log --oneline $(git describe --tags --abbrev=0 @^)..@ -->

20260904 : 3.2.0 - Faster Pseudonymization + Performance improvements

-------------------------------------------------------------------------------

* [core] CVE-2026-19633: Escalation via custom types, operators and rangevars

* [core] update dependencies

* [static] Define masking policy with parallel static masking

* [pseudo] Add seeded_street_name

* [static] CVE-2026-83534: Elevation in parallel masking

* [make] call extension+install before regress

* [pseudo] new panel of seeded_* functions

* [impexp] CVE-2026-19634: SQL injection via import functions

* [partial] Add anon.array_remove_regex()

* [static] Ignore a TABLESAMPLE sampling ratio on non-plain-table relations

* [parallel] Reject a materialized view before parallel masking

* [dynamic] Proper error message on write operations

* [static] Optionally drop indexes during static masking (beta)

* [doc] update the permission matrix

* [tests] Gate the impexp unit tests on cfg(test) only

* [doc] split Load and Support out of the Install page

* [docker] make the image ready for replica masking

* [tests] Introduce `cargo pgrx regress`

* [core] Upgrade dependencies

* [CI] generate a checksums file

* [core] Remove useless compatibility function

* [image] Define a default value for the sigma parameter

* [doc] Add the "Anonymized Replica" tutorial

* [docker] disable fsync during initdb

* [static] Improve performance and correctness for parallel masking

* [doc] how to fix cargo audit warnings

* [doc] Install on Fedora

* [core] Support PostgreSQL 19 (beta)

* [core] Upgrade to PGRX 0.19

20260629 : 3.1.3 - Missing ARM builds

-------------------------------------------------------------------------------

<!-- rumdl-disable MD024 MD025 MD053 -->

PostgreSQL Anonymizer 3.2 : Faster Pseudonymization

================================================================================

Eymoutiers, France, Septembre 4th, 2026

Dalibo is pleased to announce `PostgreSQL Anonymizer 3.2` introducing a new

panel of fast pseudonymization filters.

Enhanced Privacy Protection for Your Data

--------------------------------------------------------------------------------

`PostgreSQL Anonymizer` is an extension that hides or replaces personally

identifiable information (PII) or commercially sensitive data from a PostgreSQL

database.

The extension offers 6 different masking strategies:

* [Dynamic Masking] - Real-time data protection

* [Static Masking] - Permanent data transformation

* [Replica Masking] - Anonymized logical replication

* [Backup Masking] - Privacy-protected database exports

* [Masking Views] - Controlled data visibility

* [Masking Data Wrappers] - Extended protection across systems

Each strategy is complemented by an enhanced suite of Masking Functions, including

advanced techniques such as: Substitution, Randomization, Faking, Pseudonymization,

Partial Scrambling, Shuffling, Noise Addition and Generalization.

The extension can be installed with Debian and RPM packages, an Ansible role, a Docker

image, etc. You can use it on most major DBaaS providers including : Alibaba Cloud,

Crunchy Bridge, Google Cloud SQL, IBM Cloud, Microsoft Azure Database, Neon, Yandex

It is also available on some Postgres forks such as EDB Advanced Postgres, Greenplum

and Yugabyte.

See the [INSTALL] section of the documentation for more details!

[Masking Functions]: https://postgresql-anonymizer.readthedocs.io/en/latest/masking_functions/

[Backup Masking]: https://postgresql-anonymizer.readthedocs.io/en/latest/anonymous_dumps/

[Static Masking]: https://postgresql-anonymizer.readthedocs.io/en/latest/static_masking/

[Dynamic Masking]: https://postgresql-anonymizer.readthedocs.io/en/latest/dynamic_masking/

[Replica Masking]: https://postgresql-anonymizer.readthedocs.io/en/latest/replica_masking/

[Masking Views]: https://postgresql-anonymizer.readthedocs.io/en/stable/masking_views/

[Masking Data Wrappers]: https://postgresql-anonymizer.readthedocs.io/en/stable/masking_data_wrappers/

[INSTALL]: https://postgresql-anonymizer.readthedocs.io/en/latest/INSTALL/

Fast and Localized pseudonymization

--------------------------------------------------------------------------------

Although [Pseudonymization is not Anonymization], it may be useful in some

contexts.

Until version 3.1, this was achieved with a panel of `pseudo_*` functions,

such as `anon.pseudo_last_name(...)`, `anon.pseudo_email(...)`, etc.

These functions are now replaced by a new panel of `anon.seeded_*` functions,

such as `anon.seeded_last_name(...)`, `anon.seeded_email(...)`, etc.

The `anon.seeded_*` functions have 2 main advantages over the previous ones:

* They can be localized, e.g `anon.seeded_street_name(id,'fr_FR')`

* They are 40x faster :)

The `anon.pseudo_*` functions are kept for backward compatibility but are now

deprecated and will be removed in a future version. We encourage all users to

switch to the new `anon.seeded_*` functions as soon as possible.

[Pseudonymization is not Anonymization]: https://postgresql-anonymizer.readthedocs.io/en/latest/masking_functions/#pseudonymization-is-not-anonymization

Important Security Update

--------------------------------------------------------------------------------

Version 3.2 includes fixes for 3 critical vulnerabilities allowing a user

 to gain superuser privileges under certain circumstances. The risk is very high

on PostgreSQL 14 and on instances upgraded from PostgreSQL 14 and earlier.

These vulnerabilities are declared below:

* [CVE-2026-19633]: Privilege elevation via custom types, operators and rangevars

* [CVE-2026-19634]: SQL injection in the masking rules import functions

* [CVE-2026-83534]: Privilege elevation via parallel static masking

[CVE-2026-19633]: https://www.cve.org/CVERecord?id=CVE-2026-19633

[CVE-2026-19634]: https://www.cve.org/CVERecord?id=CVE-2026-19634

[CVE-2026-83534]: https://www.cve.org/CVERecord?id=CVE-2026-83534

**All users should upgrade the extension to version 3.2 as soon as possible.**

See [issue 665] and [issue 666] for more details.

[issue 665]: https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/665

[issue 666]: https://gitlab.com/dalibo/postgresql_anonymizer/-/work_items/666

Version 3.2 introduces a new security barrier that forbids superusers from

using any kind of masking (static, dynamic, etc.). Enforcing the principle of

"Least Privilege", the extension now refuses to run any masking function on

behalf of a superuser.

Especially if you are currently using static masking, replica masking or backup

masking with a superuser, we advise you to create a dedicated role for that.

The previous behaviour can be restored by setting `anon.nosuperuser` to `FALSE`,

in which case the security barrier will be removed and superusers will be able

to execute masking rules at their own risk.

Upgrade

--------------------------------------------------------------------------------

The JSON schema used for imports / exports has changed between version 3.1 and

3.2. It is recommended to re-export the rules after the upgrade to 3.2

See the [UPGRADE] section for more details.

[UPGRADE]: https://postgresql-anonymizer.readthedocs.io/en/latest/UPGRADE

Acknowledgments

--------------------------------------------------------------------------------

This release includes code, bugfixes, documentation, code reviews and ideas

from Alain Lesage, Benoit Lobréau and other [contributors]. Kudos to Alain for

his first contributions !

[CVE-2026-19633] and [CVE-2026-19634] were reported by Sarath Kumar, IITM

Pravartak Security Team

[CVE-2026-83534] was reported by Alexander Kukushkin.

Many thanks to them and to the PostgreSQL Security Team.

We would also like to thanks the people at [Efluid] who helped us with their

ideas, comments and testing.

[Efluid]: https://www.efluid.com/

And also special thanks to the [PGRX] team for their amazing work!

[contributors]: https://gitlab.com/dalibo/postgresql_anonymizer/-/blob/master/AUTHORS.md

[PGRX]: https://github.com/pgcentralfoundation/pgrx

Join our community to improve data privacy!

--------------------------------------------------------------------------------

PostgreSQL Anonymizer is part of the [Dalibo Labs] initiative. It is mainly

developed by [Damien Clochard] and [Benoit Lobréau].

This is an open project, contributions are welcome. We need your feedback and

ideas! Let us know what you think of this tool, how it fits your needs and

what features are missing.

If you want to help, you can find a list of [Junior Jobs].

[Junior Jobs]: https://gitlab.com/dalibo/postgresql_anonymizer/issues?label_name%5B%5D=Junior+Jobs

--------------------------------------------------------------------------------

PostgreSQL Anonymizer 3.1 : Introducing Local Differential Privacy

================================================================================

# Upgrade

==============================================================================

Upgrade

=============================================================================

<!-- rumdl-disable-file MD003 -->

Currently there's no way to upgrade easily from a version to another.

The operation `ALTER EXTENSION ... UPDATE ...` is not supported.

You need to drop and recreate the extension after every upgrade.

## Upgrade to version 3.0 and further versions

Upgrade to version 3.2 and further versions

-------------------------------------------------------------------------------

### Security Barrier

For security reason, superusers are not forbidden from running any kind of

masking. Following the principle of "Least Privilege", the extension now

refuses to run any masking function on behalf of a superuser.

Especially if you are currently using static masking, replica masking or backup

masking with a superuser, we advise you to create a dedicated role for that.

The previous behaviour can be restored by setting `anon.nosuperuser` to `FALSE`,

in which case the security barrier will be removed and superuser will be able

to execute masking rules at their own risk.

### New import / export format

The JSON schema used for imports / exports has changed between version 3.1 and

3.2. It is recommended to re-export the rules after the upgrade to 3.2

The migration path for export files is:

* Import the rules in anon version N;

* Upgrade anon from version N to N+1;

* Export the rules using the new schema.

Upgrade to version 3.0 and further versions

-------------------------------------------------------------------------------

### PostgreSQL 13 is not supported anymore

replace them with `anon.user_rules` view and adapt accordingly.

## Upgrade to version 2.0 and further versions

Upgrade to version 2.0 and further versions

-------------------------------------------------------------------------------

With version 2, the entire core library was rewritten in Rust. This is a major

    `dnf install https://yum.dalibo.org/labs/dalibo-labs-4-1.noarch.rpm`

## Upgrade to version 1.3 and further versions

Upgrade to version 1.3 and further versions

-------------------------------------------------------------------------------

Starting with version 1.3, the extension enforces a series of security checks