Barman

Barman now verifies a snapshot's name or AWS Name tag directly against cloud provider metadata before deleting a snapshot-based backup, refusing deletion if it doesn't match Barman's naming convention instead of trusting the backup catalog as before, which closes CVE-2026-93853. This release also fixes GCS multipart uploads ignoring STORAGE_EMULATOR_HOST, incomplete WAL restoration when both complete and .partial files exist, Azure snapshot creation with azure-mgmt-compute SDK >= 38.0, and a crash in barman-cloud-backup-delete for GCP snapshot backups.

Matters for: Teams using a separate, more restricted upload or CI principal for writing the backup catalog than the cloud identity Barman uses for snapshot deletion, the least-privilege setup this CVE specifically targets.

Barman 3.20.0 adds AWS S3 SSE-C encryption support, parallel multipart uploads to Google Cloud Storage, concurrent download/decompress/extract for faster cloud restores, parallel WAL prefetching in barman-wal-archive, and more consistent command handling for inactive servers including automatic stopping of WAL receivers via cron. This release requires Python 3.12 or later, so installations running Python 3.8 through 3.11 must upgrade their Python interpreter before upgrading Barman, and restoring cloud-stored backups now requires the tar package as a dependency.

Matters for: Teams running PostgreSQL disaster recovery with backups stored on Google Cloud Storage or AWS S3, and those using CloudNativePG or automated WAL archiving pipelines.