Can the embedded PostgreSQL database in a standalone Chef Infra Server be upgraded independently of the Chef Infra Server package? If not, what is the recommended approach for addressing PostgreSQL security vulnerabilities, and what PostgreSQL versions will future Chef Infra Server releases include?

The embedded PostgreSQL shipped with Chef Infra Server is an integrated component of the product and is fully supported by Progress. Upgrading PostgreSQL independently of the Chef Infra Server package is not supported and is not recommended.

Progress partners with Tuxcare to provide ongoing security fixes for embedded third-party components, including PostgreSQL, without requiring customers to perform manual upgrades.

If your security scans identify PostgreSQL vulnerabilities, please open a Chef Support ticket and provide the CVE details so they can be reviewed and validated.

The embedded PostgreSQL version included with Chef Infra Server will not receive future major version upgrades. Instead, Progress will continue delivering security fixes on the existing supported PostgreSQL version through Tuxcare.

For example, current Chef Infra Server releases ship with:

PostgreSQL 13.22.tuxcare.1.0.1

This is a Progress-maintained PostgreSQL build based on PostgreSQL 13.22 with Tuxcare security updates applied.

Official Product Team Communication

Official Response: Progress Chef Product Support for End-of-Life Dependencies

Reassuring Continued Support and Security for Chef Customers During Migration

Dear Chef Customer,

We recognise that many organisations might need additional time to migrate Chef environments and that, in some cases, these transitions may extend beyond the published end-of-support dates for key dependencies such as Postgres, OpenSearch, and Ruby. We appreciate your diligence and understand the challenges involved in managing complex infrastructure updates, particularly when working to align internal priorities and resources.

Our Comprehensive Support Strategy

To ensure your ongoing operational stability and security throughout this migration period, the Progress Chef Product team has developed a robust support strategy, which includes:

• Dependency Identification: We systematically review and track all third-party components within Chef products to proactively identify dependencies approaching end-of-life.
• Specialist Partnerships: We have established collaborations with extended support specialists who are experts in legacy technology maintenance, enabling us to deliver targeted support for dependencies beyond their official vendor support window.
• Service Level Agreements (SLAs): Our support commitments are underpinned by clear SLAs to guarantee prompt response times and resolution of issues relating to legacy dependencies.

What This Means for You

As a valued Chef customer, you can expect:

• Ongoing Security Patches: We will continue to provide security updates for all third-party dependencies, mitigating risks and protecting your environment from vulnerabilities during the migration period until December 2026 unless extended by mutual agreement.
• Maintenance Updates: Essential maintenance releases will be delivered to ensure stability, performance, and compatibility for Chef products reliant on end-of-life technologies.
• Transparent Communication: You will receive regular updates on support timelines, patch availability, and any changes affecting the status of dependencies, ensuring you remain informed and prepared.

Our Commitment to You

Progress Chef is dedicated to maintaining the security, reliability, and continuity of your Chef deployments. Throughout the migration period until December 2026 unless extended by mutual agreement, we will provide comprehensive support and security fixes for all third-party dependencies, regardless of their vendor support status. Our team remains steadfast in its commitment to helping you achieve a successful transition, and we will continue to deliver the high standards of service you expect from Progress Chef.

Next Steps & Contact Information

We encourage you to reach out to your Progress Chef support contact or account manager should you have any questions or require additional guidance regarding migration planning or dependency support. Our team is here to provide clarity and confidence as you move forward.

Thank you for your continued partnership and trust in Progress Chef.

References

• https://docs.chef.io/release_notes/server/
• https://tuxcare.com/