SECURITY Signal 425
pgBackRest 2.59.0 Released
pgBackRest 2.59.0 was released, adding PostgreSQL 19 support and new storage and security options.
The release adds official PostgreSQL 19 support, enabling backups of the latest major version. It introduces S3 Outposts support and S3 process authentication for improved cloud security. New root-access controls and async archive-push error handling change how privileged operations and failure scenarios are managed.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Adds PostgreSQL 19 support.
Adds S3 Outposts support and S3 process authentication.
Enforces root-access via allow-root and makes async archive-push exit on first error.
THE READ
What elseif makes of it.
pgBackRest 2.59.0 introduces PostgreSQL 19 support, allowing the tool to work with the newest major release without additional patches. It also adds S3 Outposts support and S3 process authentication, expanding secure cloud storage options. User-group caching speeds manifest building, while SFTP storage now reconnects after idle drops. Per-repo backup progress appears in the info command, and Azure storage gains batch delete capability. Backup.info checks are added to the verify command, the S3 STS endpoint becomes configurable, and systemd notify integration is included.
Adopting this version requires upgrading to pgBackRest 2.59.0 and reviewing any existing configurations that rely on the previous behavior. Scripts that run pgBackRest as root must now either set the allow-root flag or be adjusted to avoid root execution. Users wishing to use the new S3 features must configure Outposts endpoints or process authentication credentials, and those using SFTP should verify that the reconnect logic does not interfere with existing connection handling. The async archive-push change means that the first encountered error will stop the process, which may affect workflows that previously tolerated transient failures.
Where the new release may stop working is primarily in environments that depend on the old root-access permissiveness; invoking pgBackRest as root without allow-root will now produce an error. Similarly, any automation that expected async archive-push to continue after an error will need to be updated to handle early termination. The S3 Outposts and process authentication features are only usable when the corresponding AWS infrastructure and STS setup are present; otherwise they remain inactive but do not cause failure.
Overall, the release strengthens security by limiting unintended root use and adding authenticated S3 access, while improving reliability through faster manifest construction and stricter error handling. Operational teams must invest time in testing the new options and adjusting scripts, but the enhancements provide clearer failure signals and broader cloud-storage compatibility.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER