[DeliciousBuding]

Summary

Use the verified current stable PostgreSQL 18.6 in development, CI and fixture E2E.

• Pin the official postgres:18.6-alpine multi-platform digest sha256:10a5c69a83035ab5239f5620d708520e8b28f5aa1f2b20143e6024532edadfb5.
• Align root Compose, CI PostgreSQL service, E2E stack/manifest defaults and developer documentation.
• PG18 mounts /var/lib/postgresql with versioned PGDATA. Use a new pg18_data volume; do not reuse or delete the old PG16 volume.
• Production template wording is version-neutral because external live database facts are operator-owned.

Official version source: https://www.postgresql.org/support/versioning/ and https://www.postgresql.org/versions.json

Compatibility and migration boundary

A major-version image swap is not a database migration. Existing PG16 data needs a verified dump/restore or pg_upgrade with backup, stop-write and cutover checks. The old data volume remains available; this PR does not migrate or overwrite an external live database.

Verification

• Official image starts as PostgreSQL 18.6; observed PGDATA is /var/lib/postgresql/18/docker.
• Fresh mainline Hub full PostgreSQL/Redis integration passed on PG18: 48.472s (schema 79).
• Full pending Edge/schema80 integration passed on PG18: integration 62.050s, enrollment 27.270s, device 14.330s.
• Isolated synthetic PG16 -> PG18 custom-format dump/restore passed; restored schema 80 is clean and has 42 public tables. This is fixture migration evidence, not a live-data acceptance claim.
• Documentation SSOT, OpenAPI/router contract, 28 manifest-verifier tests, shell syntax and Compose parse passed.
• No existing live container/database volume was replaced or deleted.

Pending

• GitHub required checks.
• External live database migration and runtime postchecks are separate remaining work.
• The newly disclosed frontend decode-uri-component advisory is addressed independently by fix(deps): patch decode-uri-component denial of service #2412; do not weaken the vulnerability gate for this PR.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: TokenDanceLab/AgentHub
• Branch: chore/pg18-stable
• File: .coderabbit.yaml
• Commit: 7d9154d
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8fa6a2c4-085a-4a75-adce-2bd77d3a01f8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}