[windows] PostgreSQL pinned to vulnerable version on Windows

[AtOMiCNebula]

Description

In #10014, the Windows images were pinned to a 14.12-forked version of PostgreSQL. v14.13 is available, contains security fixes, and the version in the agents should be updated. The PR suggested the pinning was temporary, but it was never revisited. Can it be unpinned now?

Also, why do the Windows agents use some Enterprise-y distribution of PostgreSQL, instead of the official one?

Platforms affected

• Azure DevOps
• GitHub Actions - Standard Runners
• GitHub Actions - Larger Runners

Runner images affected

• Ubuntu 20.04
• Ubuntu 22.04
• Ubuntu 24.04
• macOS 12
• macOS 13
• macOS 13 Arm64
• macOS 14
• macOS 14 Arm64
• macOS 15
• macOS 15 Arm64
• Windows Server 2019
• Windows Server 2022

Image version and build link

Latest Windows 2019/2022 images

Is it regression?

No

Expected behavior

Latest secure version of PostgreSQL available is included in the image

Actual behavior

A vulnerable version of PostgreSQL is included in the image

Repro steps

1. Open image readme, scroll to PostgreSQL section

[AtOMiCNebula]

Relevant CVE: https://www.postgresql.org/support/security/CVE-2024-7348/

Also, I'm happy to propose a PR to fix this, but given that I don't know the context around why this was pinned, I wanted to at least discuss first.

[kishorekumar-anchala]

Hi @AtOMiCNebula ,

Thanks for bringing to us , we will look into this and update. Thank you !

[taspeotis]

Also, why do the Windows agents use some Enterprise-y distribution of PostgreSQL, instead of the official one?

I wouldn't say it's not official but if nothing else it's endorsed as the Windows distribution of Postgres.

https://www.postgresql.org/download/windows/

[AtOMiCNebula]

Wow, I stand enlightened. Thank you for pointing that out, I definitely read the PostgreSQL page a bit too quickly. 😇

[TopperKain]

I'll plus 1 the request to upgrade the postgres version to 14.13. The current version (14.12) is triggering security alerts for us due to the missing security fixes.