A package upgrade swaps binaries without rewriting bytes already committed to an index. That gap is why two entries in this release come with homework attached.
The btree_gist work changes comparison behaviour: NaN handling for float4 and float8 that could give wrong answers on columns containing NaN, plus correct sorting of bit and bit varying values during index building [8]. New code that sorts correctly does nothing for pages an older build already laid down in the old order, which is why the announcement says you may need to reindex btree_gist indexes on float or bit columns after updating [8]. ltree has the same shape. Values carrying more than about 14,653 labels could compare incorrectly, and the symptom is a B-tree index that presents as corrupt [9].
The third item is nastier, because it is stored state rather than page layout. A parallel worker could report an uninitialized row count, leaving reltuples in pg_class set to a bogus value including Infinity or NaN [6]. Autovacuum and autoanalyze then stop processing the table, and the situation will not self-correct [6]. Upgrading stops new bad values from arriving, but the one already sitting in the catalog stays put. The project recommends checking that reltuples looks reasonable on any table with a GIN index, and points at the release notes' Updating section for how to identify and repair affected tables [7]. The announcement counts three issues that may require extra steps after updating, and names btree_gist and ltree in that list [4].
On the security side there are 28 vulnerabilities closed across the five supported branches [2][16], with affected versions carried in per-vulnerability links rather than in the announcement body [13]. One issue is flagged as affecting only 14, 15 and 16, highlighted for its severity [14]; the remaining listed items affect 18, and many affect other supported versions as well [15]. Triage by severity therefore means opening the links, not reading the release note.
Several bug fixes justify the window on their own. The DEFAULT partition of a RANGE-partitioned table is no longer skipped in cases where it should be scanned, a bug that could leave rows missing from query results [10]. Under SERIALIZABLE, a conflict could be missed when examining an initially-empty btree index, allowing conflicting transactions to commit [11]. jsonpath's @? and @@ operators now raise an error for an undefined variable instead of treating it as JSON null, which could also lead to unbounded memory consumption [12]. And a large effective_io_concurrency could let a single read stream consume all local buffers, producing "no empty local buffer available" errors during temporary table access [18].
Version numbering on 18 has a hole in it. Operators move from 18.4 to 18.6, and 18.5 exists only as a gap because it was not shipped after a regression [3][17].
Whether this update costs a restart or a maintenance window is an inventory question: btree_gist indexes on float or bit columns [8], ltree values deep enough to pass roughly 14,653 labels [9], and GIN indexes anywhere in the cluster [7]. Answer those three and the size of the job is known. Anyone still on 14 has a longer answer to write, since fixes stop on November 12, 2026 and a major-version upgrade is a bigger piece of planning than any reindex here [5].
