AnsibleByExample

community.postgresql 5.1.0 Released - SQL Injection-style Quoting Fixes Across the Collection

Beginner
2026-10-235By Luca Berton

Lesson 1 of 15 in Foundations

Ansible Foundations to Production — full curriculum
  1. 1. Introduction to Ansible and Automation
  2. 2. Installing and Configuring Ansible
  3. 3. Running Ad-Hoc Commands
  4. 4. Writing Your First Playbook
  5. 5. Understanding and Using Modules
  6. 6. Variables and Facts
  7. 7. Conditionals and Loops
  8. 8. Handlers and Idempotency
  9. 9. Structuring Projects with Roles
  10. 10. Inventory Management
  11. 11. Using Ansible Vault for Secrets
  12. 12. Debugging and Troubleshooting
  13. 13. Real-World Automation Examples
  14. 14. Final Project: Deploy a Web Server
  15. 15. Bonus - What's Next with Ansible?
View path overview →

Introduction

community.postgresql is the Ansible Collection that provides the PostgreSQL modules (postgresql_db, postgresql_user, postgresql_privs, postgresql_schema, postgresql_ext, and more) used to manage PostgreSQL databases, roles and permissions from playbooks. Version 5.1.0 has been published on Ansible Galaxy, replacing 5.0.0.

This release is primarily a security-hardening bugfix release: it fixes a large number of SQL string-interpolation issues across the collection where object names (databases, roles, schemas, extensions, sequences, tablespaces, languages...) containing a double quote (") could produce invalid SQL, or in some cases let part of the name be executed as SQL. Anyone managing PostgreSQL objects with names coming from untrusted or user-supplied input should upgrade.

Whats New

Minor Changes

  • postgresql_user - the role name passed in name is now taken literally, consistent with every other module in the collection. The value "foo" now creates a role literally called "foo" (not foo), and we""ird creates we""ird (not we"ird). Playbooks that relied on the previous (inconsistent) unquoting behavior must pass the literal role name going forward.

Bugfixes

All of the following fixes address double-quote (and in one case, per cent sign) characters in object names breaking or corrupting the generated SQL:

  • postgres module_utils - session_role containing a double quote produced invalid SQL in the SET ROLE statement issued on connect, affecting every module in the collection.
  • postgres module_utils - set_comment interpolated the object name into COMMENT ON unquoted; a name with a double quote produced invalid SQL or, under psycopg2, let the rest of the name execute as SQL. Affects postgresql_user, postgresql_db, postgresql_schema, postgresql_ext, postgresql_publication, postgresql_subscription and postgresql_tablespace.
  • postgresql_db - database, owner or tablespace names with a double quote produced invalid SQL in ALTER DATABASE and DROP DATABASE.
  • postgresql_db - database, owner, template and tablespace names in CREATE DATABASE were interpolated unquoted; they are now quoted as single identifiers.
  • postgresql_ext - extension or schema names with a double quote broke CREATE EXTENSION, ALTER EXTENSION and DROP EXTENSION; a per cent sign in such a name also broke the query-parameter handling in CREATE EXTENSION/ALTER EXTENSION.
  • postgresql_idx - index, schema, table or tablespace names with a double quote produced invalid SQL in CREATE INDEX and DROP INDEX. Schema-qualified names are now quoted per part, so a dot inside either name stays part of that name.
  • postgresql_info - fixed the module failing with 'bool' object is not iterable' when a database has no extensions installed; a query returning no rows now yields an empty result instead of False (issue #959).
  • postgresql_owner - database, tablespace or language names with a double quote produced invalid SQL in ALTER DATABASE, ALTER TABLESPACE and ALTER LANGUAGE; the language name was unquoted and is now quoted as a single identifier.
  • postgresql_owner - a role name containing a double quote produced invalid SQL in OWNER TO and REASSIGN OWNED BY; the name is now quoted as a single identifier with embedded quotes doubled.
  • postgresql_privs - a double quote in a name listed in objs produced invalid SQL for non-schema-qualified object types (database, schema, language, tablespace, foreign_server, foreign_data_wrapper, parameter, and type=group).
  • postgresql_privs - a role named in target_roles containing a double quote produced invalid SQL in the generated ALTER DEFAULT PRIVILEGES FOR ROLE statement.
  • postgresql_privs - an object name with a double quote produced invalid SQL for schema-qualified types, and session_role with a double quote produced invalid SQL in SET ROLE.
  • postgresql_publication - an owner name with a double quote produced invalid SQL in ALTER PUBLICATION ... OWNER TO.
  • postgresql_schema - an owner name with a double quote produced invalid SQL in CREATE SCHEMA ... AUTHORIZATION and ALTER SCHEMA ... OWNER TO.
  • postgresql_sequence - a sequence, schema or owner name with a double quote produced invalid SQL in ALTER SEQUENCE.
  • postgresql_subscription - related ownership/name quoting fix in line with the rest of the collection (see the full changelog on Galaxy for the exact wording, truncated in the upstream notes available at the time of writing).

Affected modules summary

ModuleIssue type
postgresql_dbunquoted names in CREATE/ALTER/DROP DATABASE
postgresql_extunquoted names, per cent sign in query params
postgresql_idxunquoted names in CREATE/DROP INDEX
postgresql_infocrash on empty extension list (#959)
postgresql_ownerunquoted names in ALTER/OWNER TO/REASSIGN
postgresql_privsunquoted names in GRANT/DEFAULT PRIVILEGES/SET ROLE
postgresql_publicationunquoted owner in ALTER PUBLICATION
postgresql_schemaunquoted owner in CREATE/ALTER SCHEMA
postgresql_sequenceunquoted names in ALTER SEQUENCE
postgresql_subscriptionname quoting fix
postgresql_userrole name now taken literally (behavior change)

How to Test

Install or upgrade the collection from Ansible Galaxy and confirm the installed version before rolling it out to production playbooks.

# Install the collection explicitly at 5.1.0
ansible-galaxy collection install community.postgresql:5.1.0

# Or upgrade from a previously installed version
ansible-galaxy collection install community.postgresql --upgrade

# Verify the installed version
ansible-galaxy collection list community.postgresql

After upgrading, review any playbook that creates PostgreSQL roles, databases, schemas, extensions, indexes, sequences or publications with names containing a double quote, since the quoting behavior has changed to be correct SQL rather than silently broken or dangerous. In particular, re-check any postgresql_user task where name previously relied on the old, inconsistent unquoting, since that value is now taken literally.

Conclusion

community.postgresql 5.1.0 is a focused bugfix release closing a long list of SQL-quoting issues that affected nearly every module in the collection when object names contained a double quote. Anyone building database, role or schema names dynamically from variables should upgrade and re-test affected playbooks.

All Tutorials