The credcheck PostgreSQL extension, which enforces credential and password policy rules at user creation, password change and user renaming time, has published version 6.0. According to the announcement out of Antananarivo, Madagascar (October 14, 2026), this major release adds new features and fixes issues reported by users since the previous release. The extension's core purpose is to let administrators define rules that allow or reject specific credentials, deny easily cracked passwords, enforce expiration dates with a minimum number of days, set a password reuse policy, and limit authentication failures before a user is banned.
The most significant changes in v6.0 center on PgBouncer, the widely used connection pooler for PostgreSQL:
- The
max_auth_failurefeature — the limit on failed authentication attempts before an account is banned — can now integrate with PgBouncer. - The
password_change_first_loginfeature, which forces users to change their password after their first login, is now usable with PgBouncer. - A new setting,
credcheck.password_valid_min, is introduced to enforce a minimum password validity period. - The release also resolves issues reported by users since the last version.
The extension's documented rule set already covers prohibiting password changes based on last login and boot/shutdown information, throwing a warning a configurable number of days before a password expires, and defining a delay on authentication failures. Version 6.0 extends that enforcement to deployments that route connections through a pooler.
This matters to developers and DBAs running PostgreSQL behind PgBouncer: previously, policy features tied to the authentication path could not be reliably enforced when connections were pooled. With v6.0, two of the most security-relevant controls — banning accounts after repeated failures and forcing credential rotation on first login — now apply in pooled architectures, while credcheck.password_valid_min closes a common loophole where users cycle passwords rapidly. Teams should review the linked documentation before upgrading, since PgBouncer integration may require configuration changes.
Source: https://www.postgresql.org/about/news/crecheck-v60-has-been-released-3407/