# PostgreSQL credcheck 6.0 adds PgBouncer integration, last-login history

> **Key takeaway:** The PostgreSQL credential-checking extension credcheck 6.0 improves PgBouncer compatibility, adds Unix-style login history tracking, and fixes a privilege escalation vulnerability.

**Published:** 2026-10-18T00:00:00+00:00 
**Source:** PostgreSQL Official News 
**Category:** databases-storage 
**Canonical URL:** https://fosswire.org/news/postgresql-credcheck-60-adds-pgbouncer-integration-last-logi.html 

## Summary
HexaCluster has released version 6.0 of credcheck, a PostgreSQL extension that enforces password and authentication policies. The update allows two existing features—max_auth_failure and password_change_first_login—to work with PgBouncer, adds an optional last-login history modeled on Unix wtmp, introduces a minimum password validity window setting, and provides a pg_check_password() function for testing credentials against policy without modifying roles. The release also fixes a privilege escalation bug, memory leaks, and a heap overflow. Upgrading requires a PostgreSQL restart to reload the library.

## What's new in credcheck 6.0
- **PgBouncer integration**: max_auth_failure and password_change_first_login now work through PgBouncer connection pooling
- **credcheck.password_valid_min**: forces a short VALID UNTIL window on new roles, ensuring password changes even when clients like DBeaver or pgAdmin mishandle the first-login error
- **Last-login history**: optional wtmp-style session logging with username, login time, duration, backend PID, source IP/port, and optional last SQL query; also records PostgreSQL boot/shutdown/crash events
- **Safer password logging**: no_password_logging now redacts PASSWORD '<literal>' clauses in-place with dots rather than hiding entire error statements
- **pg_check_password()**: new function to validate a username/password pair against policy without CREATE/ALTER ROLE operations
- **Security fixes**: privilege escalation via self-ALTER ROLE when password_valid_until is set, plus memory leaks and heap overflow

## Why it matters
Database administrators running PostgreSQL with PgBouncer in production gain tighter security policy enforcement without losing connection-pooling benefits. The new pg_check_password() function and minimum validity window address practical deployment friction with GUI tools, while the login history feature fills a long-standing observability gap in PostgreSQL user session tracking.