package/postgresql: security bump to v17.8

For more information about the release, see:
  - https://www.postgresql.org/docs/17/release-17-8.html

Fixes the following vulnerabilities:

- CVE-2026-2003:
    Improper validation of type "oidvector" in PostgreSQL allows a
    database user to disclose a few bytes of server memory.  We have not
    ruled out viability of attacks that arrange for presence of
    confidential information in disclosed bytes, but they seem unlikely.
    Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are
    affected.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-2003

- CVE-2026-2004:
    Missing validation of type of input in PostgreSQL intarray extension
    selectivity estimator function allows an object creator to execute
    arbitrary code as the operating system user running the database.
    Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are
    affected.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-2004

- CVE-2026-2005:
    Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext
    provider to execute arbitrary code as the operating system user
    running the database.  Versions before PostgreSQL 18.2, 17.8, 16.12,
    15.16, and 14.21 are affected.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-2005

- CVE-2026-2006:
    Missing validation of multibyte character length in PostgreSQL text
    manipulation allows a database user to issue crafted queries that
    achieve a buffer overrun.  That suffices to execute arbitrary code as
    the operating system user running the database.  Versions before
    PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-2006

COPYRIGHT year updated in [1].

[1] 625e4495bf

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Reviewed-by: Maxim Kochetkov <fido_max@inbox.ru>
(cherry picked from commit a5a1171ca3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>

package/postgresql/postgresql.hash

@@ -1,4 +1,4 @@
-# From https://ftp.postgresql.org/pub/source/v17.7/postgresql-17.7.tar.bz2.sha256
-sha256  ef9e343302eccd33112f1b2f0247be493cb5768313adeb558b02de8797a2e9b5  postgresql-17.7.tar.bz2
+# From https://ftp.postgresql.org/pub/source/v17.8/postgresql-17.8.tar.bz2.sha256
+sha256  a88d195dd93730452d0cfa1a11896720d6d1ba084bc2be7d7fc557fa4e4158a0  postgresql-17.8.tar.bz2
 # License file, Locally calculated
-sha256  5ed3ce5c9373dff7f98b1fae7a6c7ccd98df7d734d46d24c1bcebf1240be8307  COPYRIGHT
+sha256  3d6af92ff8a4c2cdf69afb1cf44edea727922f5cd0cf8b5f72b11cdecac8fdfd  COPYRIGHT

package/postgresql/postgresql.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-POSTGRESQL_VERSION = 17.7
+POSTGRESQL_VERSION = 17.8
 POSTGRESQL_SOURCE = postgresql-$(POSTGRESQL_VERSION).tar.bz2
 POSTGRESQL_SITE = https://ftp.postgresql.org/pub/source/v$(POSTGRESQL_VERSION)
 POSTGRESQL_LICENSE = PostgreSQL