docs: import CloudNativePG main

Author: cnpg-bot

website/docs/preview_version.md

@@ -20,12 +20,16 @@ intended for public testing prior to the final release.
 
 ## Current Preview Version
 
-The current preview version is **1.30.0-rc1**.
+There are currently no preview versions available.
+
+<!--
+The current preview version is **1.31.0-rc1**.
 
 For more information on the current preview version and how to test, please view the links below:
 
-- [Announcement](https://cloudnative-pg.io/releases/cloudnative-pg-1-30.0-rc1-released/)
-- [Documentation](https://cloudnative-pg.io/docs/1.30/)
+- [Announcement](https://cloudnative-pg.io/releases/cloudnative-pg-1-31.0-rc1-released/)
+- [Documentation](https://cloudnative-pg.io/docs/1.31/)
+-->
 
 ## Purpose of Release Candidates
 
@@ -73,7 +77,7 @@ non-production environment:
 - **Report Issues:** **Immediately report any issues or unexpected behavior**
   by opening a GitHub issue and clearly marking it with a **`Release
   Candidate`** tag or label, along with the RC version number
-  (e.g., `1.29.0-rc1`).
+  (e.g., `1.31.0-rc1`).
 
 ## Usage Advisory
 

website/docs/release_notes.md

@@ -9,15 +9,16 @@ title: Release notes
 
 History of user-visible changes for CloudNativePG, classified for each minor release.
 
-- [CloudNativePG 1.30 - Release Candidate](release_notes/v1.30.md) (preview)
+<!-- - [CloudNativePG 1.31 - Release Candidate](release_notes/v1.31.md) (preview) -->
+- [CloudNativePG 1.30](release_notes/v1.30.md)
 - [CloudNativePG 1.29](release_notes/v1.29.md)
-- [CloudNativePG 1.28](release_notes/v1.28.md)
 
 For information on the community support policy for CloudNativePG, please
 refer to ["Supported releases"](supported_releases.md).
 
 Older releases:
 
+- [CloudNativePG 1.28](release_notes/v1.28.md)
 - [CloudNativePG 1.27](release_notes/v1.27.md)
 - [CloudNativePG 1.26](release_notes/old/v1.26.md)
 - [CloudNativePG 1.25](release_notes/old/v1.25.md)

website/docs/release_notes/v1.28.md

@@ -11,6 +11,257 @@ For a complete list of changes, please refer to the
 [commits](https://github.com/cloudnative-pg/cloudnative-pg/commits/release-1.28)
 on the release branch in GitHub.
 
+## Version 1.28.4
+
+**Release date:** Jun 29, 2026
+
+:::warning
+This is the final release in the 1.28.x series.
+Users are strongly encouraged to upgrade to a newer minor version, as 1.28
+is no longer supported.
+:::
+
+### Important changes
+
+- The `cluster` reference is now immutable on the `Database`, `Pooler`,
+  `Publication`, `Subscription`, and `ScheduledBackup` resources. Pointing
+  one of these objects at a different cluster has no well-defined semantics and
+  previously left the controllers in an inconsistent state; the update is now
+  rejected at the API server via a CEL validation rule.
+  ([#10743](https://github.com/cloudnative-pg/cloudnative-pg/pull/10743)) <!-- 1.29 1.28 1.25 -->
+
+### Enhancements
+
+- Added a label selector to the `Cluster` scale subresource
+  (`status.selector`), making a `Cluster` a valid `targetRef` for the Vertical
+  Pod Autoscaler (VPA) and Horizontal Pod Autoscaler (HPA), which can now map a
+  `Cluster` to its instance pods.
+  Contributed by @sebv004.
+  ([#8996](https://github.com/cloudnative-pg/cloudnative-pg/pull/8996)) <!-- 1.29 1.28 1.25 -->
+
+- The operator now emits a `Warning` `PrimaryStatusCheckFailed` event on the
+  `Cluster` when the primary pod is `Ready` from the kubelet perspective but
+  the operator's `/pg/status` check fails and failover is deferred, giving
+  users visibility into the deferral via `kubectl describe cluster`.
+  ([#10509](https://github.com/cloudnative-pg/cloudnative-pg/pull/10509)) <!-- 1.29 1.28 1.25 -->
+
+- The operator now reloads a CNPG-i plugin automatically when its pods are
+  rolled: it watches the `EndpointSlices` backing plugin `Services` and
+  re-enqueues every cluster using the plugin once the new pods become `Ready`,
+  so an upgraded plugin is picked up without waiting for the next resync.
+  ([#10836](https://github.com/cloudnative-pg/cloudnative-pg/pull/10836)) <!-- 1.29 1.28 1.25 -->
+
+### Security and Supply Chain
+
+- **`search_path` pinning on operator-issued connections**: a database owner
+  could plant overloaded built-in operators in the `public` schema and alter the
+  `search_path` so that operator introspection probes, running as the cluster
+  superuser, resolved those overloads before `pg_catalog`, a `CWE-426`
+  privilege-escalation chain (same class as `CVE-2018-1058`) that could lead to
+  in-pod RCE via `COPY ... FROM PROGRAM`. The operator now pins
+  `search_path = pg_catalog, public, pg_temp` on every pooled connection so it
+  ships in the startup message and takes precedence over tenant-controlled
+  defaults.
+  ([#10774](https://github.com/cloudnative-pg/cloudnative-pg/pull/10774)) <!-- 1.29 1.28 1.25 -->
+
+- **Operator-side SCRAM-SHA-256 password encoding**: the operator now
+  SCRAM-SHA-256 encodes cleartext role passwords before issuing
+  `CREATE`/`ALTER ROLE ... PASSWORD`, so the literal PostgreSQL parses (and that
+  extensions such as `pg_stat_statements` or `pgaudit` may capture) is the SCRAM
+  verifier rather than the cleartext secret. Pre-hashed (MD5 or SCRAM) values
+  are forwarded unchanged, and the per-Secret annotation
+  `cnpg.io/passwordPassthrough: "enabled"` opts out.
+  ([#10724](https://github.com/cloudnative-pg/cloudnative-pg/pull/10724)) <!-- 1.29 1.28 1.25 -->
+
+### Changes
+
+- Added support for Kubernetes 1.35 and enabled unit tests on Kubernetes 1.36.
+  ([#10900](https://github.com/cloudnative-pg/cloudnative-pg/pull/10900)) <!-- 1.29 1.28 -->
+
+- Updated the default PostgreSQL version to 18.4.
+  ([#10719](https://github.com/cloudnative-pg/cloudnative-pg/pull/10719)) <!-- 1.29 1.28 1.25 -->
+
+- Updated the Kubernetes versions used to test the operator on public cloud
+  providers.
+  ([#10720](https://github.com/cloudnative-pg/cloudnative-pg/pull/10720), <!-- 1.29 1.28 1.25 -->
+  [#10563](https://github.com/cloudnative-pg/cloudnative-pg/pull/10563)) <!-- 1.29 1.28 1.25 -->
+
+### Fixes
+
+- Fixed `spec.postgresql.parameters` accepting keys that are not valid
+  PostgreSQL parameter names, which could inject arbitrary directives into
+  `postgresql.conf`; key names are now validated by the webhook.
+  ([#11029](https://github.com/cloudnative-pg/cloudnative-pg/pull/11029)) <!-- 1.29 1.28 1.25 -->
+
+- Fixed declarative `Database`, `Publication`, and `Subscription` objects
+  reporting a stale primary-side status forever after their cluster was demoted
+  to a replica; the controller now re-checks the replica condition and watches
+  the `Cluster` so a demotion is detected promptly.
+  ([#10871](https://github.com/cloudnative-pg/cloudnative-pg/pull/10871)) <!-- 1.29 1.28 1.25 -->
+
+- Fixed non-sequential pod names (for example `-1`, `-3`) caused by the instance
+  serial counter being advanced before the corresponding `Job` and PVCs were
+  created; the bump is now persisted only after those resources exist.
+  ([#10491](https://github.com/cloudnative-pg/cloudnative-pg/pull/10491)) <!-- 1.29 1.28 1.25 -->
+
+- Fixed a switchover deadlock when a WAL-archiver plugin was enabled on an
+  existing cluster: with `primaryUpdateMethod: switchover` the primary could
+  not be rolled out because a clean demotion needs the archiver sidecar that is
+  still missing. The operator now recreates the primary Pod in place so the
+  sidecar is injected and archiving resumes.
+  ([#11032](https://github.com/cloudnative-pg/cloudnative-pg/pull/11032)) <!-- 1.29 1.28 1.25 -->
+
+- Fixed a cluster staying in `Setting up primary` indefinitely when the
+  instance-creation Job exhausted its backoff limit; the operator now detects
+  the terminal Job failure and marks the cluster unrecoverable, naming the
+  failed Job and pointing to its logs.
+  ([#11035](https://github.com/cloudnative-pg/cloudnative-pg/pull/11035)) <!-- 1.29 1.28 1.25 -->
+
+- Fixed deletion of a `Database`, `Publication`, or `Subscription` getting stuck
+  in `Terminating` on a replica cluster, where the replica gate ran before the
+  finalizer reconciler and the finalizer was never released. On a replica the
+  PostgreSQL object is left to the primary cluster.
+  ([#10853](https://github.com/cloudnative-pg/cloudnative-pg/pull/10853)) <!-- 1.29 1.28 1.25 -->
+
+- Fixed a conflicting duplicate `Database` or `Subscription` with a `delete`
+  reclaim policy dropping the PostgreSQL object owned by the surviving CR; the
+  drop is now gated on a recorded reconciliation.
+  ([#10870](https://github.com/cloudnative-pg/cloudnative-pg/pull/10870)) <!-- 1.29 1.28 1.25 -->
+
+- Fixed the `postgres` superuser being left locked out after superuser access
+  was disabled and then re-enabled, because the cached secret version was not
+  invalidated and the password was never re-applied.
+  Diagnosed by @mhartmann-jaconi.
+  ([#10834](https://github.com/cloudnative-pg/cloudnative-pg/pull/10834)) <!-- 1.29 1.28 1.25 -->
+
+- Fixed backups getting stuck in the `started` phase when the instance manager
+  running them was restarted (for example by the in-place upgrade following an
+  operator upgrade) before the backup reached `running`; the reconciliation is
+  now rescheduled so the lost session is detected.
+  ([#10859](https://github.com/cloudnative-pg/cloudnative-pg/pull/10859)) <!-- 1.29 1.28 -->
+
+- Fixed resource leaks when concurrent `Backup` objects raced: backups now run
+  in strict creation-time order, so an already-executing backup is never
+  preempted by a newer one and its replication slot and PostgreSQL session are
+  no longer orphaned on the primary.
+  Contributed by @GabriFedi97.
+  ([#10747](https://github.com/cloudnative-pg/cloudnative-pg/pull/10747)) <!-- 1.29 1.28 1.25 -->
+
+- Fixed role reconciliation clearing the password on a PostgreSQL role when the
+  referenced Secret could not be fetched; the role is now left untouched until
+  the Secret becomes available, and per-action errors are aggregated for better
+  visibility.
+  ([#10053](https://github.com/cloudnative-pg/cloudnative-pg/pull/10053)) <!-- 1.29 1.28 1.25 -->
+
+- Fixed a bootstrap failure where a metrics-exporter setup error (commonly a
+  duplicate-key race with the controller) rolled back `streaming_replica`
+  creation and wedged replica joins. The metrics-exporter step now runs in a
+  separate transaction.
+  Contributed by @BlaiseAntony.
+  ([#10749](https://github.com/cloudnative-pg/cloudnative-pg/pull/10749)) <!-- 1.29 1.28 1.25 -->
+
+- Fixed a `ScheduledBackup` controller loop that occurred when a `Backup` was
+  created but its status patch never landed; the controller now adopts an
+  existing `Backup` for the next iteration instead of looping on
+  `AlreadyExists`.
+  ([#10612](https://github.com/cloudnative-pg/cloudnative-pg/pull/10612)) <!-- 1.29 1.28 1.25 -->
+
+- Fixed a nil-pointer panic when reconciling a `Pooler` whose `Cluster` has
+  been deleted.
+  ([#10667](https://github.com/cloudnative-pg/cloudnative-pg/pull/10667)) <!-- 1.29 1.28 -->
+
+- Fixed bootstrap log handling so that all named log pipes (`postgres`,
+  `postgres.csv`, and `postgres.json`) get consumers during
+  `WithActiveInstance`, preventing regular files from being created in place of
+  the named pipes.
+  ([#10043](https://github.com/cloudnative-pg/cloudnative-pg/pull/10043)) <!-- 1.29 1.28 1.25 -->
+
+- Fixed generation of invalid IPv6 URLs by wrapping the address in square
+  brackets.
+  Contributed by @Infinoid.
+  ([#10682](https://github.com/cloudnative-pg/cloudnative-pg/pull/10682)) <!-- 1.29 1.28 1.25 -->
+
+- Fixed an external cluster plugin still being treated as active when its
+  configuration set `enabled: false`.
+  ([#10932](https://github.com/cloudnative-pg/cloudnative-pg/pull/10932)) <!-- 1.29 1.28 1.25 -->
+
+- Fixed a race during bootstrap recovery from an object store where the restore
+  job could read a stale `Cluster` (primary not yet recorded and timeline still
+  unset) and have its `.history` files rejected by the split-brain guard. When
+  this happened, recovery stopped at the base backup's timeline and silently
+  dropped transactions committed on later timelines. History files are now
+  allowed while the cluster timeline is unset.
+  Contributed by @dennispidun.
+  ([#10818](https://github.com/cloudnative-pg/cloudnative-pg/pull/10818)) <!-- 1.29 1.28 1.25 -->
+
+- Fixed a cache race during cluster creation when the server and client CA
+  resolve to the same Secret (the default): a stale informer cache triggered a
+  redundant `Create` that failed with `AlreadyExists` and could leave the
+  cluster stuck in `Unable to create required cluster objects`. The operator
+  now reuses the already-fetched CA Secret when the names match.
+  ([#10989](https://github.com/cloudnative-pg/cloudnative-pg/pull/10989)) <!-- 1.29 1.28 1.25 -->
+
+- Fixed the `pg_basebackup` bootstrap path overwriting or failing on a
+  pre-existing `PGDATA` (for example after a replica Pod restart) by enforcing
+  the same pre-flight directory check already applied by the other bootstrap
+  methods; this also protects statically provisioned PVCs from being silently
+  overwritten.
+  ([#11006](https://github.com/cloudnative-pg/cloudnative-pg/pull/11006)) <!-- 1.29 1.28 1.25 -->
+
+- Fixed the `Cluster` phase flapping between `Healthy` and a plugin-failure
+  phase when a post-reconcile plugin hook returned an error; the `Healthy`
+  phase is now registered as the last step of a successful reconciliation, so a
+  loop that ends in a plugin error never reports `Healthy`.
+  Contributed by @GabriFedi97.
+  ([#10421](https://github.com/cloudnative-pg/cloudnative-pg/pull/10421)) <!-- 1.29 1.28 1.25 -->
+
+- Fixed stale certificate data and partial reads after an external server's
+  Secret was rotated (for example a CA bundle shrinking from two certificates
+  to one): the file is now written atomically, so libpq always reads either the
+  old or the new value, never a mix.
+  Contributed by @Anand-240.
+  ([#10975](https://github.com/cloudnative-pg/cloudnative-pg/pull/10975)) <!-- 1.29 1.28 1.25 -->
+
+- Fixed plugin connectivity to use the plugin `Service` FQDN instead of its
+  short name, avoiding failures when a cluster-level proxy is automatically
+  injected into pods.
+  Contributed by @kdautrey.
+  ([#10921](https://github.com/cloudnative-pg/cloudnative-pg/pull/10921)) <!-- 1.29 1.28 1.25 -->
+
+- Fixed excessive operator log noise from the per-request `Cluster`
+  create/update validation webhook messages, now logged at `debug`
+  instead of `info`.
+  ([#10984](https://github.com/cloudnative-pg/cloudnative-pg/pull/10984)) <!-- 1.29 1.28 1.25 -->
+
+- Fixed a first-primary bootstrap deadlock where a status-patch conflict after
+  the data PVC was created but before the initialization Job was started left
+  the orphan Pending PVC counted as an instance, blocking the bootstrap gate;
+  the PVC-state reconciler now recreates the bootstrap Job reusing the assigned
+  serial.
+  ([#11039](https://github.com/cloudnative-pg/cloudnative-pg/pull/11039)) <!-- 1.29 1.28 1.25 -->
+
+- Fixed external cluster names and secret selector references being joined into
+  filesystem paths without validation, letting a `..` component or path
+  separator escape the external secrets directory when the instance manager
+  dumps connection material; these values are now rejected at the validating
+  webhook and re-checked at the write site.
+  Reported by @r0binak.
+  ([#11045](https://github.com/cloudnative-pg/cloudnative-pg/pull/11045)) <!-- 1.29 1.28 1.25 -->
+
+- `cnpg` plugin:
+
+    - Fixed `kubectl cnpg psql` on Windows, where execution relied on a
+      Unix-only system call and failed with "not supported by windows"; Windows
+      now launches `kubectl exec` as a child process.
+      Contributed by @Utkarsh-sharma47.
+      ([#10972](https://github.com/cloudnative-pg/cloudnative-pg/pull/10972)) <!-- 1.29 1.28 1.25 -->
+
+    - Fixed an unbounded memory leak in `kubectl cnpg logs -f` on busy
+      clusters, where a per-log-group timer was never released; timers are now
+      reused across iterations.
+      Contributed by @Anand-240.
+      ([#10976](https://github.com/cloudnative-pg/cloudnative-pg/pull/10976)) <!-- 1.29 1.28 1.25 -->
+
 ## Version 1.28.3
 
 **Release date:** May 8, 2026