chore(deps): update dependency ash_postgres to v2.13.0 [security]

renovate commented

2026-10-08 14:25:07 +02:00

Collaborator

This PR contains the following updates:

Package	Type	Update	Change
ash_postgres (source)	prod	minor	`2.10.0` → `2.13.0`

rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres

CVE-2026-78699 / EEF-CVE-2026-78699 / GHSA-6fqq-j9c4-5766

More information

Details

Summary

Unchecked Return Value vulnerability in ash-project ash_postgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's schema to have their tenant record repointed at that other tenant's live schema, gaining access to its data.

AshPostgres.MultiTenancy.rename_tenant/3 issues the ALTER SCHEMA ... RENAME TO ... with the non-raising Ecto.Adapters.SQL.query/2, discards its {:ok, _} | {:error, _} result, and unconditionally returns :ok. PostgreSQL rejects the rename when the target schema already exists (and on insufficient privilege or lock timeout), but that failure never reaches the caller. The calling manage_tenant update action therefore sees success and commits the tenant row with the new name, which is the schema of a different existing tenant, so subsequent reads and writes for that tenant run against the other tenant's data.

This issue affects ash_postgres: from 0.25.0 before 2.13.0.

Configurations

An application must run ash_postgres schema-based multitenancy with a user-driven tenant rename (for example a manage_tenant update on an editable org slug or subdomain), letting a user choose a new tenant name that collides with an existing tenant's schema.

Severity

CVSS Score: 7.2 / 10 (High)
Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV.

Release Notes

ash-project/ash_postgres (ash_postgres)

`v2.13.0`

Compare Source

Features:

store a range in a native Postgres range column (#818) by Matt Beanland

Improvements:

teach the Postgrex types module a :duration attribute needs (#815) by Matt Beanland

Bug Fixes:

raise on a failed tenant rename instead of silently returning :ok (CVE-2026-78699) by Zach Daniel
update ltree casting failure mode by Zach Daniel
tighten tenant validation by Zach Daniel
run tenant migrations from mix ash.setup (#836) by TravelCurry02
only await table structure for custom statement dependencies (#826) by Alt-iOS
do not KeyError when Postgres omits DETAIL on a constraint violation (#824) by Michael Kuk

`v2.12.0`

Compare Source

Features:

add match_tenant? option for attribute multitenancy FKs (#813) by TravelCurry02
add after_resource to custom_statements so raw SQL can depend on another resource (#799) by Jechol Lee

Improvements:

replace pairwise operation ordering with a dependency-graph topological sort (#798) by Jechol Lee

Bug Fixes:

return upsert identity keys and correlate on the full key set so bulk upserts don't drop by Daniel Gollings
clean up obsolete serial sequences (#806) by Jechol Lee
fix ordering constraints for composite primary keys by Zach Daniel

`v2.11.0`

Compare Source

Features:

allow custom indexes to exclude base filters (#796) by Jechol Lee

Bug Fixes:

fix generated reference type value for identity and bigserial (#800) by Dmitry Maganov
return skipped upserts with nil identity values (#794) by Jechol Lee
warn when resources are skipped due to migrate?: false during miâ¦ (#792) by Jsime34
set tenant on destroy so exists() subqueries resolve against the tenant schema (#790) by Francisco-Castro
resolve actor/context templates in through relationship filters (#789) by Barnabas Jovanovics
correlate bulk upsert records by identity on the MERGE path (#786) by Johannes Welebil
ensure timeouts applied at repo level (#784) by torazar

Improvements:

Add partial index conditions for references (#795) by Jechol Lee
avoid generating uuidv7 by default, once postgres v18 is detected (#793) by Luca Venir
Added sort direction support to custom_indexes fields. (#775) by Thomas Lucas

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ash_postgres](https://hex.pm/packages/ash_postgres) ([source](https://github.com/ash-project/ash_postgres)) | prod | minor | `2.10.0` → `2.13.0` | --- ### rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres [CVE-2026-78699](https://nvd.nist.gov/vuln/detail/CVE-2026-78699) / EEF-CVE-2026-78699 / [GHSA-6fqq-j9c4-5766](https://github.com/advisories/GHSA-6fqq-j9c4-5766) <details> <summary>More information</summary> #### Details ##### Summary Unchecked Return Value vulnerability in ash-project ash_postgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's schema to have their tenant record repointed at that other tenant's live schema, gaining access to its data. `AshPostgres.MultiTenancy.rename_tenant/3` issues the `ALTER SCHEMA ... RENAME TO ...` with the non-raising `Ecto.Adapters.SQL.query/2`, discards its `{:ok, _} | {:error, _}` result, and unconditionally returns `:ok`. PostgreSQL rejects the rename when the target schema already exists (and on insufficient privilege or lock timeout), but that failure never reaches the caller. The calling `manage_tenant` update action therefore sees success and commits the tenant row with the new name, which is the schema of a different existing tenant, so subsequent reads and writes for that tenant run against the other tenant's data. This issue affects ash_postgres: from 0.25.0 before 2.13.0. ##### Configurations An application must run ash_postgres schema-based multitenancy with a user-driven tenant rename (for example a `manage_tenant` update on an editable org slug or subdomain), letting a user choose a new tenant name that collides with an existing tenant's schema. #### Severity - CVSS Score: 7.2 / 10 (High) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/ash-project/ash_postgres/security/advisories/GHSA-6fqq-j9c4-5766](https://github.com/ash-project/ash_postgres/security/advisories/GHSA-6fqq-j9c4-5766) - [https://cna.erlef.org/cves/CVE-2026-78699.html](https://cna.erlef.org/cves/CVE-2026-78699.html) - [https://github.com/ash-project/ash_postgres/commit/8544ab15fe45784553c2d2da8ee1a388eee0174b](https://github.com/ash-project/ash_postgres/commit/8544ab15fe45784553c2d2da8ee1a388eee0174b) - [https://hex.pm/packages/ash_postgres](https://hex.pm/packages/ash_postgres) This data is provided by [OSV](https://osv.dev/vulnerability/EEF-CVE-2026-78699). </details> --- ### Release Notes <details> <summary>ash-project/ash_postgres (ash_postgres)</summary> ### [`v2.13.0`](https://github.com/ash-project/ash_postgres/blob/HEAD/CHANGELOG.md#v2130-2026-08-30) [Compare Source](https://github.com/ash-project/ash_postgres/compare/v2.12.0...v2.13.0) ##### Features: - store a range in a native Postgres range column ([#818](https://github.com/ash-project/ash_postgres/issues/818)) by Matt Beanland ##### Improvements: - teach the Postgrex types module a :duration attribute needs ([#815](https://github.com/ash-project/ash_postgres/issues/815)) by Matt Beanland ##### Bug Fixes: - raise on a failed tenant rename instead of silently returning :ok (CVE-2026-78699) by Zach Daniel - update ltree casting failure mode by Zach Daniel - tighten tenant validation by Zach Daniel - run tenant migrations from mix ash.setup ([#836](https://github.com/ash-project/ash_postgres/issues/836)) by TravelCurry02 - only await table structure for custom statement dependencies ([#826](https://github.com/ash-project/ash_postgres/issues/826)) by Alt-iOS - do not KeyError when Postgres omits DETAIL on a constraint violation ([#824](https://github.com/ash-project/ash_postgres/issues/824)) by Michael Kuk ### [`v2.12.0`](https://github.com/ash-project/ash_postgres/blob/HEAD/CHANGELOG.md#v2120-2026-08-14) [Compare Source](https://github.com/ash-project/ash_postgres/compare/v2.11.0...v2.12.0) ##### Features: - add match\_tenant? option for attribute multitenancy FKs ([#813](https://github.com/ash-project/ash_postgres/issues/813)) by TravelCurry02 - add after\_resource to custom\_statements so raw SQL can depend on another resource ([#799](https://github.com/ash-project/ash_postgres/issues/799)) by Jechol Lee ##### Improvements: - replace pairwise operation ordering with a dependency-graph topological sort ([#798](https://github.com/ash-project/ash_postgres/issues/798)) by Jechol Lee ##### Bug Fixes: - return upsert identity keys and correlate on the full key set so bulk upserts don't drop by Daniel Gollings - clean up obsolete serial sequences ([#806](https://github.com/ash-project/ash_postgres/issues/806)) by Jechol Lee - fix ordering constraints for composite primary keys by Zach Daniel ### [`v2.11.0`](https://github.com/ash-project/ash_postgres/blob/HEAD/CHANGELOG.md#v2110-2026-07-22) [Compare Source](https://github.com/ash-project/ash_postgres/compare/v2.10.0...v2.11.0) ##### Features: - allow custom indexes to exclude base filters ([#796](https://github.com/ash-project/ash_postgres/issues/796)) by Jechol Lee ##### Bug Fixes: - fix generated reference type value for identity and bigserial ([#800](https://github.com/ash-project/ash_postgres/issues/800)) by Dmitry Maganov - return skipped upserts with nil identity values ([#794](https://github.com/ash-project/ash_postgres/issues/794)) by Jechol Lee - warn when resources are skipped due to migrate?: false during miâ¦ ([#792](https://github.com/ash-project/ash_postgres/issues/792)) by Jsime34 - set tenant on destroy so exists() subqueries resolve against the tenant schema ([#790](https://github.com/ash-project/ash_postgres/issues/790)) by Francisco-Castro - resolve actor/context templates in through relationship filters ([#789](https://github.com/ash-project/ash_postgres/issues/789)) by Barnabas Jovanovics - correlate bulk upsert records by identity on the MERGE path ([#786](https://github.com/ash-project/ash_postgres/issues/786)) by Johannes Welebil - ensure timeouts applied at repo level ([#784](https://github.com/ash-project/ash_postgres/issues/784)) by torazar ##### Improvements: - Add partial index conditions for references ([#795](https://github.com/ash-project/ash_postgres/issues/795)) by Jechol Lee - avoid generating uuidv7 by default, once postgres v18 is detected ([#793](https://github.com/ash-project/ash_postgres/issues/793)) by Luca Venir - Added sort direction support to custom\_indexes fields. ([#775](https://github.com/ash-project/ash_postgres/issues/775)) by Thomas Lucas </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate added the

security

label

2026-10-08 14:25:07 +02:00

renovate added 1 commit

2026-10-08 14:25:07 +02:00