diff --git a/flake.lock b/flake.lock
index ca935bd1..704715ee 100644
--- a/flake.lock
+++ b/flake.lock
@@ -18,16 +18,16 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1764521362,
-        "narHash": "sha256-M101xMtWdF1eSD0xhiR8nG8CXRlHmv6V+VoY65Smwf4=",
+        "lastModified": 1780145889,
+        "narHash": "sha256-md0zn0RnwNvPyASas1yG5YUuwQ4ALA6ucL50l0DvqCo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "871b9fd269ff6246794583ce4ee1031e1da71895",
+        "rev": "8c50a710ddca43d7a530fb805ad55bde8d0141c5",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "25.11",
+        "ref": "26.05",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -43,16 +43,16 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1785529904,
-        "narHash": "sha256-DDIeJCHRtmvB7yocWTo1MISIGf0DsUmyLw6ISuEV4e0=",
+        "lastModified": 1791394750,
+        "narHash": "sha256-SMv4EKUaGmfUyXyeGHW3AiX1vbef7El56RKTIxio8jQ=",
         "owner": "supabase",
         "repo": "xpg",
-        "rev": "e7d47eb58f19168b5facc6b78a64f6cc7f04bbcb",
+        "rev": "8f2a2005e8e020e0db5a7cbb94a87a9dd3227411",
         "type": "github"
       },
       "original": {
         "owner": "supabase",
-        "ref": "v2.5.0",
+        "ref": "v2.6.0",
         "repo": "xpg",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 7c450df0..76446927 100644
--- a/flake.nix
+++ b/flake.nix
@@ -4,7 +4,7 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/91c9a64ce2a84e648d0cf9671274bb9c2fb9ba60";
     xpg = {
-      url = "github:supabase/xpg/v2.5.0";
+      url = "github:supabase/xpg/v2.6.0";
     };
   };
 
diff --git a/test/core_patches/15/privileges.out.patch b/test/core_patches/15/privileges.out.patch
index 85c6f941..95be1259 100644
--- a/test/core_patches/15/privileges.out.patch
+++ b/test/core_patches/15/privileges.out.patch
@@ -1,7 +1,7 @@
 # Differences here are expected due to the "Enhanced Hints" feature
 --- a/expected/privileges.out
 +++ b/expected/privileges.out
-@@ -134,10 +134,12 @@
+@@ -201,10 +201,12 @@
  INSERT INTO atest1 VALUES (2, 'two'); -- ok
  INSERT INTO atest2 VALUES ('foo', true); -- fail
  ERROR:  permission denied for table atest2
@@ -14,7 +14,7 @@
  SELECT * FROM atest1 FOR UPDATE; -- ok
   a |  b  
  ---+-----
-@@ -147,8 +149,10 @@
+@@ -214,8 +216,10 @@
  
  SELECT * FROM atest2 FOR UPDATE; -- fail
  ERROR:  permission denied for table atest2
@@ -25,7 +25,7 @@
  TRUNCATE atest2; -- fail
  ERROR:  permission denied for table atest2
  BEGIN;
-@@ -185,21 +189,27 @@
+@@ -252,21 +256,27 @@
  
  INSERT INTO atest2 VALUES ('foo', true); -- fail
  ERROR:  permission denied for table atest2
@@ -53,7 +53,7 @@
  SET SESSION AUTHORIZATION regress_priv_user3;
  SELECT session_user, current_user;
      session_user    |    current_user    
-@@ -216,24 +226,33 @@
+@@ -283,24 +293,33 @@
  
  SELECT * FROM atest2; -- fail
  ERROR:  permission denied for table atest2
@@ -87,7 +87,7 @@
  TRUNCATE atest2; -- fail
  ERROR:  permission denied for table atest2
  BEGIN;
-@@ -244,8 +263,10 @@
+@@ -311,8 +330,10 @@
  -- checks in subquery, both fail
  SELECT * FROM atest1 WHERE ( b IN ( SELECT col1 FROM atest2 ) );
  ERROR:  permission denied for table atest2
@@ -98,15 +98,18 @@
  SET SESSION AUTHORIZATION regress_priv_user4;
  COPY atest2 FROM stdin; -- ok
  SELECT * FROM atest1; -- ok
-@@ -324,6 +345,7 @@
- -- This should not show any "leak" notices before failing.
+@@ -389,8 +410,10 @@
+ -- These should not show any "leak" notices before failing.
  EXPLAIN (COSTS OFF) SELECT * FROM atest12 WHERE a >>> 0;
  ERROR:  permission denied for table atest12
 +HINT:  Grant the required privileges to the current role with: GRANT SELECT ON public.atest12 TO regress_priv_user2;
- -- These plans should continue to use a nestloop, since they execute with the
- -- privileges of the view owner.
- EXPLAIN (COSTS OFF) SELECT * FROM atest12v x, atest12v y WHERE x.a = y.b;
-@@ -417,6 +439,7 @@
+ EXPLAIN (COSTS OFF) SELECT * FROM atest12v WHERE a >>> 0;
+ ERROR:  permission denied for view atest12v
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON public.atest12v TO regress_priv_user2;
+ EXPLAIN (COSTS OFF) SELECT * FROM atest12sbv WHERE a >>> 0;
+ ERROR:  permission denied for view atest12sbv
+ -- Now regress_priv_user1 grants access to regress_priv_user2 via the views.
+@@ -491,6 +514,7 @@
  SET SESSION AUTHORIZATION regress_priv_user1;
  SELECT * FROM atest3; -- fail
  ERROR:  permission denied for table atest3
@@ -114,7 +117,7 @@
  DELETE FROM atest3; -- ok
  BEGIN;
  RESET SESSION AUTHORIZATION;
-@@ -424,6 +447,7 @@
+@@ -498,6 +522,7 @@
  SET SESSION AUTHORIZATION regress_priv_user1;
  DELETE FROM atest3;
  ERROR:  permission denied for table atest3
@@ -122,7 +125,7 @@
  ROLLBACK;
  -- views
  SET SESSION AUTHORIZATION regress_priv_user3;
-@@ -442,6 +466,7 @@
+@@ -516,6 +541,7 @@
  
  SELECT * FROM atestv2; -- fail
  ERROR:  permission denied for table atest2
@@ -130,7 +133,7 @@
  GRANT SELECT ON atestv1, atestv3 TO regress_priv_user4;
  GRANT SELECT ON atestv2 TO regress_priv_user2;
  SET SESSION AUTHORIZATION regress_priv_user4;
-@@ -454,6 +479,7 @@
+@@ -528,6 +554,7 @@
  
  SELECT * FROM atestv2; -- fail
  ERROR:  permission denied for view atestv2
@@ -138,7 +141,7 @@
  SELECT * FROM atestv3; -- ok
   one | two | three 
  -----+-----+-------
-@@ -461,6 +487,7 @@
+@@ -535,6 +562,7 @@
  
  SELECT * FROM atestv0; -- fail
  ERROR:  permission denied for view atestv0
@@ -146,7 +149,7 @@
  -- Appendrels excluded by constraints failed to check permissions in 8.4-9.2.
  select * from
    ((select a.q1 as x from int8_tbl a offset 0)
-@@ -468,6 +495,7 @@
+@@ -542,6 +570,7 @@
     (select b.q2 as x from int8_tbl b offset 0)) ss
  where false;
  ERROR:  permission denied for table int8_tbl
@@ -154,7 +157,7 @@
  set constraint_exclusion = on;
  select * from
    ((select a.q1 as x, random() from int8_tbl a where q1 > 0)
-@@ -475,6 +503,7 @@
+@@ -549,6 +578,7 @@
     (select b.q2 as x, random() from int8_tbl b where q2 > 0)) ss
  where x < 0;
  ERROR:  permission denied for table int8_tbl
@@ -162,7 +165,7 @@
  reset constraint_exclusion;
  CREATE VIEW atestv4 AS SELECT * FROM atestv3; -- nested view
  SELECT * FROM atestv4; -- ok
-@@ -487,6 +516,7 @@
+@@ -561,6 +591,7 @@
  -- Two complex cases:
  SELECT * FROM atestv3; -- fail
  ERROR:  permission denied for view atestv3
@@ -170,7 +173,7 @@
  SELECT * FROM atestv4; -- ok (even though regress_priv_user2 cannot access underlying atestv3)
   one | two | three 
  -----+-----+-------
-@@ -500,6 +530,7 @@
+@@ -574,6 +605,7 @@
  
  SELECT * FROM atestv2; -- fail (even though regress_priv_user2 can access underlying atest2)
  ERROR:  permission denied for table atest2
@@ -178,7 +181,7 @@
  -- Test column level permissions
  SET SESSION AUTHORIZATION regress_priv_user1;
  CREATE TABLE atest5 (one int, two int unique, three int, four int unique);
-@@ -510,6 +541,7 @@
+@@ -584,6 +616,7 @@
  SET SESSION AUTHORIZATION regress_priv_user4;
  SELECT * FROM atest5; -- fail
  ERROR:  permission denied for table atest5
@@ -186,7 +189,7 @@
  SELECT one FROM atest5; -- ok
   one 
  -----
-@@ -520,10 +552,12 @@
+@@ -594,10 +627,12 @@
  1
  SELECT two FROM atest5; -- fail
  ERROR:  permission denied for table atest5
@@ -199,7 +202,7 @@
  COPY atest5 (one,two) TO stdout; -- fail
  ERROR:  permission denied for table atest5
  SELECT 1 FROM atest5; -- ok
-@@ -540,14 +574,19 @@
+@@ -614,14 +649,19 @@
  
  SELECT 1 FROM atest5 a JOIN atest5 b USING (two); -- fail
  ERROR:  permission denied for table atest5
@@ -219,7 +222,7 @@
  SELECT one FROM (atest5 a JOIN atest5 b(one,x,y,z) USING (one)) j; -- ok
   one 
  -----
-@@ -562,38 +601,55 @@
+@@ -636,38 +676,55 @@
  
  SELECT two FROM (atest5 a JOIN atest5 b(one,x,y,z) USING (one)) j; -- fail
  ERROR:  permission denied for table atest5
@@ -275,7 +278,7 @@
  SELECT atest1.* FROM atest1, atest5; -- ok
   a |  b  
  ---+-----
-@@ -610,6 +666,7 @@
+@@ -684,6 +741,7 @@
  
  SELECT atest1.*,atest5.one FROM atest1 JOIN atest5 ON (atest1.a = atest5.two); -- fail
  ERROR:  permission denied for table atest5
@@ -283,7 +286,7 @@
  SELECT atest1.*,atest5.one FROM atest1 JOIN atest5 ON (atest1.a = atest5.one); -- ok
   a |  b  | one 
  ---+-----+-----
-@@ -619,11 +676,13 @@
+@@ -693,11 +751,13 @@
  
  SELECT one, two FROM atest5; -- fail
  ERROR:  permission denied for table atest5
@@ -297,7 +300,7 @@
  SET SESSION AUTHORIZATION regress_priv_user1;
  GRANT SELECT (two) ON atest5 TO regress_priv_user4;
  SET SESSION AUTHORIZATION regress_priv_user4;
-@@ -639,19 +698,24 @@
+@@ -713,19 +773,24 @@
  COPY atest5 (two) FROM stdin; -- ok
  INSERT INTO atest5 (three) VALUES (4); -- fail
  ERROR:  permission denied for table atest5
@@ -322,7 +325,7 @@
  -- Ok.  May SELECT on column "one":
  INSERT INTO atest5(two) VALUES (6) ON CONFLICT (two) DO UPDATE set three = 10 RETURNING atest5.one;
   one 
-@@ -665,20 +729,26 @@
+@@ -739,20 +804,26 @@
  -- Error. No select rights on three
  INSERT INTO atest5(two) VALUES (6) ON CONFLICT (two) DO UPDATE set three = EXCLUDED.three;
  ERROR:  permission denied for table atest5
@@ -349,7 +352,7 @@
  INSERT INTO atest5(four) VALUES (4); -- ok
  SET SESSION AUTHORIZATION regress_priv_user1;
  GRANT SELECT (four) ON atest5 TO regress_priv_user4;
-@@ -691,8 +761,10 @@
+@@ -765,8 +836,10 @@
  SET SESSION AUTHORIZATION regress_priv_user4;
  SELECT one FROM atest5; -- fail
  ERROR:  permission denied for table atest5
@@ -360,7 +363,7 @@
  SELECT atest6 FROM atest6; -- ok
   atest6 
  --------
-@@ -720,6 +792,7 @@
+@@ -794,6 +867,7 @@
  WHEN NOT MATCHED THEN
  	INSERT VALUES (a, NULL);
  ERROR:  permission denied for table msource
@@ -368,7 +371,7 @@
  -- fail (s.b used in the INSERTed values)
  MERGE INTO mtarget t USING msource s ON t.a = s.a
  WHEN MATCHED THEN
-@@ -727,6 +800,7 @@
+@@ -801,6 +875,7 @@
  WHEN NOT MATCHED THEN
  	INSERT VALUES (a, b);
  ERROR:  permission denied for table msource
@@ -376,7 +379,7 @@
  -- fail (s.b used in the WHEN quals)
  MERGE INTO mtarget t USING msource s ON t.a = s.a
  WHEN MATCHED AND s.b = 'x' THEN
-@@ -734,6 +808,7 @@
+@@ -808,6 +883,7 @@
  WHEN NOT MATCHED THEN
  	INSERT VALUES (a, NULL);
  ERROR:  permission denied for table msource
@@ -384,7 +387,7 @@
  -- this should be ok since only s.a is accessed
  BEGIN;
  MERGE INTO mtarget t USING msource s ON t.a = s.a
-@@ -763,6 +838,7 @@
+@@ -837,6 +913,7 @@
  WHEN NOT MATCHED THEN
  	INSERT VALUES (a, NULL);
  ERROR:  permission denied for table mtarget
@@ -392,7 +395,7 @@
  -- fail (no UPDATE on t.a)
  MERGE INTO mtarget t USING msource s ON t.a = s.a
  WHEN MATCHED THEN
-@@ -770,6 +846,7 @@
+@@ -844,6 +921,7 @@
  WHEN NOT MATCHED THEN
  	INSERT VALUES (a, b);
  ERROR:  permission denied for table mtarget
@@ -400,7 +403,7 @@
  -- fail (no SELECT on t.b)
  MERGE INTO mtarget t USING msource s ON t.a = s.a
  WHEN MATCHED AND t.b IS NOT NULL THEN
-@@ -777,6 +854,7 @@
+@@ -851,6 +929,7 @@
  WHEN NOT MATCHED THEN
  	INSERT VALUES (a, b);
  ERROR:  permission denied for table mtarget
@@ -408,7 +411,7 @@
  -- ok
  BEGIN;
  MERGE INTO mtarget t USING msource s ON t.a = s.a
-@@ -788,6 +866,7 @@
+@@ -862,6 +941,7 @@
  WHEN MATCHED AND t.b IS NOT NULL THEN
  	DELETE;
  ERROR:  permission denied for table mtarget
@@ -416,7 +419,7 @@
  -- grant delete privileges
  SET SESSION AUTHORIZATION regress_priv_user1;
  GRANT DELETE ON mtarget TO regress_priv_user4;
-@@ -877,8 +956,10 @@
+@@ -951,8 +1031,10 @@
  SET SESSION AUTHORIZATION regress_priv_user4;
  SELECT atest6 FROM atest6; -- fail
  ERROR:  permission denied for table atest6
@@ -427,7 +430,7 @@
  SET SESSION AUTHORIZATION regress_priv_user1;
  ALTER TABLE atest6 DROP COLUMN three;
  SET SESSION AUTHORIZATION regress_priv_user4;
-@@ -898,11 +979,14 @@
+@@ -972,11 +1054,14 @@
  SET SESSION AUTHORIZATION regress_priv_user4;
  SELECT * FROM atest6; -- fail
  ERROR:  permission denied for table atest6
@@ -442,7 +445,7 @@
  DELETE FROM atest5 WHERE two = 2; -- ok
  -- check inheritance cases
  SET SESSION AUTHORIZATION regress_priv_user1;
-@@ -934,6 +1018,7 @@
+@@ -1008,6 +1093,7 @@
  
  SELECT fy FROM atestc; -- fail
  ERROR:  permission denied for table atestc
@@ -450,7 +453,7 @@
  SET SESSION AUTHORIZATION regress_priv_user1;
  GRANT SELECT(fy,tableoid) ON atestc TO regress_priv_user2;
  SET SESSION AUTHORIZATION regress_priv_user2;
-@@ -969,12 +1054,15 @@
+@@ -1043,12 +1129,15 @@
  
  SELECT f2 FROM atestc; -- fail
  ERROR:  permission denied for table atestc
@@ -466,7 +469,7 @@
  TRUNCATE atestp1; -- ok
  TRUNCATE atestc; -- fail
  ERROR:  permission denied for table atestc
-@@ -1046,6 +1134,7 @@
+@@ -1120,6 +1209,7 @@
  ERROR:  permission denied for procedure priv_testproc1
  SELECT col1 FROM atest2 WHERE col2 = true; -- fail
  ERROR:  permission denied for table atest2
@@ -474,7 +477,7 @@
  SELECT priv_testfunc4(true); -- ok
   priv_testfunc4 
  ----------------
-@@ -1960,6 +2049,7 @@
+@@ -2086,6 +2176,7 @@
  SET SESSION AUTHORIZATION regress_priv_user1;
  SELECT * FROM pg_largeobject LIMIT 0;			-- to be denied
  ERROR:  permission denied for table pg_largeobject
@@ -482,7 +485,7 @@
  -- pg_signal_backend can't signal superusers
  RESET SESSION AUTHORIZATION;
  BEGIN;
-@@ -2029,6 +2119,7 @@
+@@ -2155,6 +2246,7 @@
  INSERT INTO datdba_only DEFAULT VALUES;
  SAVEPOINT q; DELETE FROM datdba_only; ROLLBACK TO q;
  ERROR:  permission denied for table datdba_only
@@ -490,7 +493,7 @@
  SET SESSION AUTHORIZATION regress_priv_user2;
  TABLE information_schema.enabled_roles;
       role_name      
-@@ -2038,6 +2129,7 @@
+@@ -2164,6 +2256,7 @@
  
  INSERT INTO datdba_only DEFAULT VALUES;
  ERROR:  permission denied for table datdba_only
diff --git a/test/core_patches/15/rowsecurity.out.patch b/test/core_patches/15/rowsecurity.out.patch
index 317a17db..3f36b46d 100644
--- a/test/core_patches/15/rowsecurity.out.patch
+++ b/test/core_patches/15/rowsecurity.out.patch
@@ -80,3 +80,39 @@
  SELECT * FROM rls_view; -- OK
   a  
  ----
+@@ -4472,6 +4487,7 @@
+ 
+ SELECT * FROM rls_child_tbl WHERE a <<< 1000;
+ ERROR:  permission denied for table rls_child_tbl
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON regress_rls_schema.rls_child_tbl TO regress_rls_alice;
+ SELECT * FROM rls_ptbl WHERE a <<< 1000;
+  a 
+ ---
+@@ -4491,6 +4507,7 @@
+ SELECT * FROM (SELECT * FROM rls_child_tbl UNION ALL
+                SELECT * FROM rls_child_tbl) t WHERE a <<< 1000;
+ ERROR:  permission denied for table rls_child_tbl
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON regress_rls_schema.rls_child_tbl TO regress_rls_alice;
+ RESET SESSION AUTHORIZATION;
+ REVOKE SELECT ON rls_tbl FROM regress_rls_alice;
+ CREATE VIEW rls_tbl_view AS SELECT * FROM rls_tbl;
+@@ -4500,8 +4517,10 @@
+ SET SESSION AUTHORIZATION regress_rls_alice;
+ SELECT * FROM rls_tbl WHERE a <<< 1000;
+ ERROR:  permission denied for table rls_tbl
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON regress_rls_schema.rls_tbl TO regress_rls_alice;
+ SELECT * FROM rls_tbl_view WHERE a <<< 1000;
+ ERROR:  permission denied for view rls_tbl_view
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON regress_rls_schema.rls_tbl_view TO regress_rls_alice;
+ SELECT * FROM rls_child_tbl WHERE a <<< 1000;
+  a 
+ ---
+@@ -4510,6 +4529,7 @@
+ SELECT * FROM (SELECT * FROM rls_tbl UNION ALL
+                SELECT * FROM rls_tbl) t WHERE a <<< 1000;
+ ERROR:  permission denied for table rls_tbl
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON regress_rls_schema.rls_tbl TO regress_rls_alice;
+ SELECT * FROM (SELECT * FROM rls_child_tbl UNION ALL
+                SELECT * FROM rls_child_tbl) t WHERE a <<< 1000;
+  a 
+
diff --git a/test/core_patches/15/stats_ext.out.patch b/test/core_patches/15/stats_ext.out.patch
index dae3cb91..cb1bd538 100644
--- a/test/core_patches/15/stats_ext.out.patch
+++ b/test/core_patches/15/stats_ext.out.patch
@@ -1,7 +1,7 @@
 # Differences here are expected due to the "Enhanced Hints" feature
 --- a/expected/stats_ext.out
 +++ b/expected/stats_ext.out
-@@ -3227,10 +3227,12 @@
+@@ -3262,10 +3262,12 @@
  SET SESSION AUTHORIZATION regress_stats_user1;
  SELECT * FROM tststats.priv_test_tbl; -- Permission denied
  ERROR:  permission denied for table priv_test_tbl
@@ -14,10 +14,14 @@
  -- Attempt to gain access using a leaky operator
  CREATE FUNCTION op_leak(int, int) RETURNS bool
      AS 'BEGIN RAISE NOTICE ''op_leak => %, %'', $1, $2; RETURN $1 < $2; END'
-@@ -3239,8 +3241,10 @@
+@@ -3279,11 +3281,14 @@
                       restrict = scalarltsel);
  SELECT * FROM tststats.priv_test_tbl WHERE a <<< 0 AND b <<< 0; -- Permission denied
  ERROR:  permission denied for table priv_test_tbl
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON tststats.priv_test_tbl TO regress_stats_user1;
+ SELECT * FROM tststats.priv_test_tbl t
+  WHERE a <<< 0 AND (b <<< 0 OR t.* <<< (1, 1) IS NOT NULL); -- Permission denied
+ ERROR:  permission denied for table priv_test_tbl
 +HINT:  Grant the required privileges to the current role with: GRANT SELECT ON tststats.priv_test_tbl TO regress_stats_user1;
  DELETE FROM tststats.priv_test_tbl WHERE a <<< 0 AND b <<< 0; -- Permission denied
  ERROR:  permission denied for table priv_test_tbl
@@ -25,3 +29,19 @@
  -- Grant access via a security barrier view, but hide all data
  RESET SESSION AUTHORIZATION;
  CREATE VIEW tststats.priv_test_view WITH (security_barrier=true)
+@@ -3330,11 +3335,14 @@
+ SET SESSION AUTHORIZATION regress_stats_user1;
+ SELECT * FROM tststats.priv_test_parent_tbl WHERE a <<< 0 AND b <<< 0; -- Permission denied
+ ERROR:  permission denied for table priv_test_parent_tbl
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON tststats.priv_test_parent_tbl TO regress_stats_user1;
+ SELECT * FROM tststats.priv_test_parent_tbl t
+  WHERE a <<< 0 AND (b <<< 0 OR t.* <<< (1, 1) IS NOT NULL); -- Permission denied
+ ERROR:  permission denied for table priv_test_parent_tbl
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON tststats.priv_test_parent_tbl TO regress_stats_user1;
+ DELETE FROM tststats.priv_test_parent_tbl WHERE a <<< 0 AND b <<< 0; -- Permission denied
+ ERROR:  permission denied for table priv_test_parent_tbl
++HINT:  Grant the required privileges to the current role with: GRANT SELECT, DELETE ON tststats.priv_test_parent_tbl TO regress_stats_user1;
+ -- Grant table access to parent, but hide all data with RLS
+ RESET SESSION AUTHORIZATION;
+ ALTER TABLE tststats.priv_test_parent_tbl ENABLE ROW LEVEL SECURITY;
+
diff --git a/test/core_patches/16/privileges.out.patch b/test/core_patches/16/privileges.out.patch
index d1d6855d..3c8b32fa 100644
--- a/test/core_patches/16/privileges.out.patch
+++ b/test/core_patches/16/privileges.out.patch
@@ -1,7 +1,7 @@
 # Differences here are expected due to the "Enhanced Hints" feature
 --- a/expected/privileges.out
 +++ b/expected/privileges.out
-@@ -240,10 +240,12 @@
+@@ -314,10 +314,12 @@
  INSERT INTO atest1 VALUES (2, 'two'); -- ok
  INSERT INTO atest2 VALUES ('foo', true); -- fail
  ERROR:  permission denied for table atest2
@@ -14,7 +14,7 @@
  SELECT * FROM atest1 FOR UPDATE; -- ok
   a |  b  
  ---+-----
-@@ -253,8 +255,10 @@
+@@ -327,8 +329,10 @@
  
  SELECT * FROM atest2 FOR UPDATE; -- fail
  ERROR:  permission denied for table atest2
@@ -25,7 +25,7 @@
  TRUNCATE atest2; -- fail
  ERROR:  permission denied for table atest2
  BEGIN;
-@@ -291,21 +295,27 @@
+@@ -365,21 +369,27 @@
  
  INSERT INTO atest2 VALUES ('foo', true); -- fail
  ERROR:  permission denied for table atest2
@@ -53,7 +53,7 @@
  SET SESSION AUTHORIZATION regress_priv_user3;
  SELECT session_user, current_user;
      session_user    |    current_user    
-@@ -322,24 +332,33 @@
+@@ -396,24 +406,33 @@
  
  SELECT * FROM atest2; -- fail
  ERROR:  permission denied for table atest2
@@ -87,7 +87,7 @@
  TRUNCATE atest2; -- fail
  ERROR:  permission denied for table atest2
  BEGIN;
-@@ -350,8 +369,10 @@
+@@ -424,8 +443,10 @@
  -- checks in subquery, both fail
  SELECT * FROM atest1 WHERE ( b IN ( SELECT col1 FROM atest2 ) );
  ERROR:  permission denied for table atest2
@@ -98,15 +98,21 @@
  SET SESSION AUTHORIZATION regress_priv_user4;
  COPY atest2 FROM stdin; -- ok
  SELECT * FROM atest1; -- ok
-@@ -430,6 +451,7 @@
- -- This should not show any "leak" notices before failing.
+@@ -502,10 +523,13 @@
+ -- These should not show any "leak" notices before failing.
  EXPLAIN (COSTS OFF) SELECT * FROM atest12 WHERE a >>> 0;
  ERROR:  permission denied for table atest12
 +HINT:  Grant the required privileges to the current role with: GRANT SELECT ON public.atest12 TO regress_priv_user2;
- -- These plans should continue to use a nestloop, since they execute with the
- -- privileges of the view owner.
- EXPLAIN (COSTS OFF) SELECT * FROM atest12v x, atest12v y WHERE x.a = y.b;
-@@ -523,6 +545,7 @@
+ EXPLAIN (COSTS OFF) SELECT * FROM atest12v WHERE a >>> 0;
+ ERROR:  permission denied for view atest12v
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON public.atest12v TO regress_priv_user2;
+ EXPLAIN (COSTS OFF) SELECT * FROM atest12sbv WHERE a >>> 0;
+ ERROR:  permission denied for view atest12sbv
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON public.atest12sbv TO regress_priv_user2;
+ -- Now regress_priv_user1 grants access to regress_priv_user2 via the views.
+ SET SESSION AUTHORIZATION regress_priv_user1;
+ GRANT SELECT ON atest12v TO PUBLIC;
+@@ -604,6 +628,7 @@
  SET SESSION AUTHORIZATION regress_priv_user1;
  SELECT * FROM atest3; -- fail
  ERROR:  permission denied for table atest3
@@ -114,7 +120,7 @@
  DELETE FROM atest3; -- ok
  BEGIN;
  RESET SESSION AUTHORIZATION;
-@@ -536,12 +559,14 @@
+@@ -617,12 +642,14 @@
  SET SESSION AUTHORIZATION regress_priv_user1;
  DELETE FROM atest3; -- fail
  ERROR:  permission denied for table atest3
@@ -129,7 +135,7 @@
  ROLLBACK;
  -- views
  SET SESSION AUTHORIZATION regress_priv_user3;
-@@ -560,6 +585,7 @@
+@@ -641,6 +668,7 @@
  
  SELECT * FROM atestv2; -- fail
  ERROR:  permission denied for table atest2
@@ -137,7 +143,7 @@
  GRANT SELECT ON atestv1, atestv3 TO regress_priv_user4;
  GRANT SELECT ON atestv2 TO regress_priv_user2;
  SET SESSION AUTHORIZATION regress_priv_user4;
-@@ -572,6 +598,7 @@
+@@ -653,6 +681,7 @@
  
  SELECT * FROM atestv2; -- fail
  ERROR:  permission denied for view atestv2
@@ -145,7 +151,7 @@
  SELECT * FROM atestv3; -- ok
   one | two | three 
  -----+-----+-------
-@@ -579,6 +606,7 @@
+@@ -660,6 +689,7 @@
  
  SELECT * FROM atestv0; -- fail
  ERROR:  permission denied for view atestv0
@@ -153,7 +159,7 @@
  -- Appendrels excluded by constraints failed to check permissions in 8.4-9.2.
  select * from
    ((select a.q1 as x from int8_tbl a offset 0)
-@@ -586,6 +614,7 @@
+@@ -667,6 +697,7 @@
     (select b.q2 as x from int8_tbl b offset 0)) ss
  where false;
  ERROR:  permission denied for table int8_tbl
@@ -161,7 +167,7 @@
  set constraint_exclusion = on;
  select * from
    ((select a.q1 as x, random() from int8_tbl a where q1 > 0)
-@@ -593,6 +622,7 @@
+@@ -674,6 +705,7 @@
     (select b.q2 as x, random() from int8_tbl b where q2 > 0)) ss
  where x < 0;
  ERROR:  permission denied for table int8_tbl
@@ -169,7 +175,7 @@
  reset constraint_exclusion;
  CREATE VIEW atestv4 AS SELECT * FROM atestv3; -- nested view
  SELECT * FROM atestv4; -- ok
-@@ -605,6 +635,7 @@
+@@ -686,6 +718,7 @@
  -- Two complex cases:
  SELECT * FROM atestv3; -- fail
  ERROR:  permission denied for view atestv3
@@ -177,7 +183,7 @@
  SELECT * FROM atestv4; -- ok (even though regress_priv_user2 cannot access underlying atestv3)
   one | two | three 
  -----+-----+-------
-@@ -618,6 +649,7 @@
+@@ -699,6 +732,7 @@
  
  SELECT * FROM atestv2; -- fail (even though regress_priv_user2 can access underlying atest2)
  ERROR:  permission denied for table atest2
@@ -185,7 +191,7 @@
  -- Test column level permissions
  SET SESSION AUTHORIZATION regress_priv_user1;
  CREATE TABLE atest5 (one int, two int unique, three int, four int unique);
-@@ -628,6 +660,7 @@
+@@ -709,6 +743,7 @@
  SET SESSION AUTHORIZATION regress_priv_user4;
  SELECT * FROM atest5; -- fail
  ERROR:  permission denied for table atest5
@@ -193,7 +199,7 @@
  SELECT one FROM atest5; -- ok
   one 
  -----
-@@ -638,10 +671,12 @@
+@@ -719,10 +754,12 @@
  1
  SELECT two FROM atest5; -- fail
  ERROR:  permission denied for table atest5
@@ -206,7 +212,7 @@
  COPY atest5 (one,two) TO stdout; -- fail
  ERROR:  permission denied for table atest5
  SELECT 1 FROM atest5; -- ok
-@@ -658,14 +693,19 @@
+@@ -739,14 +776,19 @@
  
  SELECT 1 FROM atest5 a JOIN atest5 b USING (two); -- fail
  ERROR:  permission denied for table atest5
@@ -226,7 +232,7 @@
  SELECT one FROM (atest5 a JOIN atest5 b(one,x,y,z) USING (one)) j; -- ok
   one 
  -----
-@@ -680,38 +720,55 @@
+@@ -761,38 +803,55 @@
  
  SELECT two FROM (atest5 a JOIN atest5 b(one,x,y,z) USING (one)) j; -- fail
  ERROR:  permission denied for table atest5
@@ -282,7 +288,7 @@
  SELECT atest1.* FROM atest1, atest5; -- ok
   a |  b  
  ---+-----
-@@ -728,6 +785,7 @@
+@@ -809,6 +868,7 @@
  
  SELECT atest1.*,atest5.one FROM atest1 JOIN atest5 ON (atest1.a = atest5.two); -- fail
  ERROR:  permission denied for table atest5
@@ -290,7 +296,7 @@
  SELECT atest1.*,atest5.one FROM atest1 JOIN atest5 ON (atest1.a = atest5.one); -- ok
   a |  b  | one 
  ---+-----+-----
-@@ -737,11 +795,13 @@
+@@ -818,11 +878,13 @@
  
  SELECT one, two FROM atest5; -- fail
  ERROR:  permission denied for table atest5
@@ -304,7 +310,7 @@
  SET SESSION AUTHORIZATION regress_priv_user1;
  GRANT SELECT (two) ON atest5 TO regress_priv_user4;
  SET SESSION AUTHORIZATION regress_priv_user4;
-@@ -757,19 +817,24 @@
+@@ -838,19 +900,24 @@
  COPY atest5 (two) FROM stdin; -- ok
  INSERT INTO atest5 (three) VALUES (4); -- fail
  ERROR:  permission denied for table atest5
@@ -329,7 +335,7 @@
  -- Ok.  May SELECT on column "one":
  INSERT INTO atest5(two) VALUES (6) ON CONFLICT (two) DO UPDATE set three = 10 RETURNING atest5.one;
   one 
-@@ -783,20 +848,26 @@
+@@ -864,20 +931,26 @@
  -- Error. No select rights on three
  INSERT INTO atest5(two) VALUES (6) ON CONFLICT (two) DO UPDATE set three = EXCLUDED.three;
  ERROR:  permission denied for table atest5
@@ -356,7 +362,7 @@
  INSERT INTO atest5(four) VALUES (4); -- ok
  SET SESSION AUTHORIZATION regress_priv_user1;
  GRANT SELECT (four) ON atest5 TO regress_priv_user4;
-@@ -809,8 +880,10 @@
+@@ -890,8 +963,10 @@
  SET SESSION AUTHORIZATION regress_priv_user4;
  SELECT one FROM atest5; -- fail
  ERROR:  permission denied for table atest5
@@ -367,7 +373,7 @@
  SELECT atest6 FROM atest6; -- ok
   atest6 
  --------
-@@ -838,6 +911,7 @@
+@@ -919,6 +994,7 @@
  WHEN NOT MATCHED THEN
  	INSERT VALUES (a, NULL);
  ERROR:  permission denied for table msource
@@ -375,7 +381,7 @@
  -- fail (s.b used in the INSERTed values)
  MERGE INTO mtarget t USING msource s ON t.a = s.a
  WHEN MATCHED THEN
-@@ -845,6 +919,7 @@
+@@ -926,6 +1002,7 @@
  WHEN NOT MATCHED THEN
  	INSERT VALUES (a, b);
  ERROR:  permission denied for table msource
@@ -383,7 +389,7 @@
  -- fail (s.b used in the WHEN quals)
  MERGE INTO mtarget t USING msource s ON t.a = s.a
  WHEN MATCHED AND s.b = 'x' THEN
-@@ -852,6 +927,7 @@
+@@ -933,6 +1010,7 @@
  WHEN NOT MATCHED THEN
  	INSERT VALUES (a, NULL);
  ERROR:  permission denied for table msource
@@ -391,7 +397,7 @@
  -- this should be ok since only s.a is accessed
  BEGIN;
  MERGE INTO mtarget t USING msource s ON t.a = s.a
-@@ -881,6 +957,7 @@
+@@ -962,6 +1040,7 @@
  WHEN NOT MATCHED THEN
  	INSERT VALUES (a, NULL);
  ERROR:  permission denied for table mtarget
@@ -399,7 +405,7 @@
  -- fail (no UPDATE on t.a)
  MERGE INTO mtarget t USING msource s ON t.a = s.a
  WHEN MATCHED THEN
-@@ -888,6 +965,7 @@
+@@ -969,6 +1048,7 @@
  WHEN NOT MATCHED THEN
  	INSERT VALUES (a, b);
  ERROR:  permission denied for table mtarget
@@ -407,7 +413,7 @@
  -- fail (no SELECT on t.b)
  MERGE INTO mtarget t USING msource s ON t.a = s.a
  WHEN MATCHED AND t.b IS NOT NULL THEN
-@@ -895,6 +973,7 @@
+@@ -976,6 +1056,7 @@
  WHEN NOT MATCHED THEN
  	INSERT VALUES (a, b);
  ERROR:  permission denied for table mtarget
@@ -415,7 +421,7 @@
  -- ok
  BEGIN;
  MERGE INTO mtarget t USING msource s ON t.a = s.a
-@@ -906,6 +985,7 @@
+@@ -987,6 +1068,7 @@
  WHEN MATCHED AND t.b IS NOT NULL THEN
  	DELETE;
  ERROR:  permission denied for table mtarget
@@ -423,7 +429,7 @@
  -- grant delete privileges
  SET SESSION AUTHORIZATION regress_priv_user1;
  GRANT DELETE ON mtarget TO regress_priv_user4;
-@@ -995,8 +1075,10 @@
+@@ -1076,8 +1158,10 @@
  SET SESSION AUTHORIZATION regress_priv_user4;
  SELECT atest6 FROM atest6; -- fail
  ERROR:  permission denied for table atest6
@@ -434,7 +440,7 @@
  SET SESSION AUTHORIZATION regress_priv_user1;
  ALTER TABLE atest6 DROP COLUMN three;
  SET SESSION AUTHORIZATION regress_priv_user4;
-@@ -1016,11 +1098,14 @@
+@@ -1097,11 +1181,14 @@
  SET SESSION AUTHORIZATION regress_priv_user4;
  SELECT * FROM atest6; -- fail
  ERROR:  permission denied for table atest6
@@ -449,7 +455,7 @@
  DELETE FROM atest5 WHERE two = 2; -- ok
  -- check inheritance cases
  SET SESSION AUTHORIZATION regress_priv_user1;
-@@ -1052,6 +1137,7 @@
+@@ -1133,6 +1220,7 @@
  
  SELECT fy FROM atestc; -- fail
  ERROR:  permission denied for table atestc
@@ -457,7 +463,7 @@
  SET SESSION AUTHORIZATION regress_priv_user1;
  GRANT SELECT(fy,tableoid) ON atestc TO regress_priv_user2;
  SET SESSION AUTHORIZATION regress_priv_user2;
-@@ -1087,12 +1173,15 @@
+@@ -1168,12 +1256,15 @@
  
  SELECT f2 FROM atestc; -- fail
  ERROR:  permission denied for table atestc
@@ -473,7 +479,7 @@
  TRUNCATE atestp1; -- ok
  TRUNCATE atestc; -- fail
  ERROR:  permission denied for table atestc
-@@ -1164,6 +1253,7 @@
+@@ -1245,6 +1336,7 @@
  ERROR:  permission denied for procedure priv_testproc1
  SELECT col1 FROM atest2 WHERE col2 = true; -- fail
  ERROR:  permission denied for table atest2
@@ -481,7 +487,7 @@
  SELECT priv_testfunc4(true); -- ok
   priv_testfunc4 
  ----------------
-@@ -2083,6 +2173,7 @@
+@@ -2216,6 +2308,7 @@
  SET SESSION AUTHORIZATION regress_priv_user1;
  SELECT * FROM pg_largeobject LIMIT 0;			-- to be denied
  ERROR:  permission denied for table pg_largeobject
@@ -489,7 +495,7 @@
  -- pg_signal_backend can't signal superusers
  RESET SESSION AUTHORIZATION;
  BEGIN;
-@@ -2152,6 +2243,7 @@
+@@ -2285,6 +2378,7 @@
  INSERT INTO datdba_only DEFAULT VALUES;
  SAVEPOINT q; DELETE FROM datdba_only; ROLLBACK TO q;
  ERROR:  permission denied for table datdba_only
@@ -497,7 +503,7 @@
  SET SESSION AUTHORIZATION regress_priv_user2;
  TABLE information_schema.enabled_roles;
       role_name      
-@@ -2161,6 +2253,7 @@
+@@ -2294,6 +2388,7 @@
  
  INSERT INTO datdba_only DEFAULT VALUES;
  ERROR:  permission denied for table datdba_only
diff --git a/test/core_patches/16/rowsecurity.out.patch b/test/core_patches/16/rowsecurity.out.patch
index bdefa797..7f7d0b47 100644
--- a/test/core_patches/16/rowsecurity.out.patch
+++ b/test/core_patches/16/rowsecurity.out.patch
@@ -1,6 +1,6 @@
 # Differences here are expected due to the "Enhanced Hints" feature
 --- a/expected/rowsecurity.out
-+++ b/expected/rowsecurity.out
++++ b/results/rowsecurity.out
 @@ -2634,8 +2634,10 @@
  SET SESSION AUTHORIZATION regress_rls_carol;
  SELECT * FROM rls_view; --fail - permission denied.
@@ -80,3 +80,38 @@
  SELECT * FROM rls_view; -- OK
   a  
  ----
+@@ -4444,6 +4459,7 @@
+ 
+ SELECT * FROM rls_child_tbl WHERE a <<< 1000;
+ ERROR:  permission denied for table rls_child_tbl
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON regress_rls_schema.rls_child_tbl TO regress_rls_alice;
+ SELECT * FROM rls_ptbl WHERE a <<< 1000;
+  a 
+ ---
+@@ -4463,6 +4479,7 @@
+ SELECT * FROM (SELECT * FROM rls_child_tbl UNION ALL
+                SELECT * FROM rls_child_tbl) t WHERE a <<< 1000;
+ ERROR:  permission denied for table rls_child_tbl
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON regress_rls_schema.rls_child_tbl TO regress_rls_alice;
+ RESET SESSION AUTHORIZATION;
+ REVOKE SELECT ON rls_tbl FROM regress_rls_alice;
+ CREATE VIEW rls_tbl_view AS SELECT * FROM rls_tbl;
+@@ -4472,8 +4489,10 @@
+ SET SESSION AUTHORIZATION regress_rls_alice;
+ SELECT * FROM rls_tbl WHERE a <<< 1000;
+ ERROR:  permission denied for table rls_tbl
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON regress_rls_schema.rls_tbl TO regress_rls_alice;
+ SELECT * FROM rls_tbl_view WHERE a <<< 1000;
+ ERROR:  permission denied for view rls_tbl_view
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON regress_rls_schema.rls_tbl_view TO regress_rls_alice;
+ SELECT * FROM rls_child_tbl WHERE a <<< 1000;
+  a 
+ ---
+@@ -4482,6 +4501,7 @@
+ SELECT * FROM (SELECT * FROM rls_tbl UNION ALL
+                SELECT * FROM rls_tbl) t WHERE a <<< 1000;
+ ERROR:  permission denied for table rls_tbl
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON regress_rls_schema.rls_tbl TO regress_rls_alice;
+ SELECT * FROM (SELECT * FROM rls_child_tbl UNION ALL
+                SELECT * FROM rls_child_tbl) t WHERE a <<< 1000;
+  a 
diff --git a/test/core_patches/16/stats_ext.out.patch b/test/core_patches/16/stats_ext.out.patch
index 5fa517dc..d50f6637 100644
--- a/test/core_patches/16/stats_ext.out.patch
+++ b/test/core_patches/16/stats_ext.out.patch
@@ -1,7 +1,7 @@
 # Differences here are expected due to the "Enhanced Hints" feature
 --- a/expected/stats_ext.out
 +++ b/expected/stats_ext.out
-@@ -3242,10 +3242,12 @@
+@@ -3277,10 +3277,12 @@
  SET SESSION AUTHORIZATION regress_stats_user1;
  SELECT * FROM tststats.priv_test_tbl; -- Permission denied
  ERROR:  permission denied for table priv_test_tbl
@@ -14,10 +14,14 @@
  -- Attempt to gain access using a leaky operator
  CREATE FUNCTION op_leak(int, int) RETURNS bool
      AS 'BEGIN RAISE NOTICE ''op_leak => %, %'', $1, $2; RETURN $1 < $2; END'
-@@ -3254,8 +3256,10 @@
+@@ -3294,11 +3296,14 @@
                       restrict = scalarltsel);
  SELECT * FROM tststats.priv_test_tbl WHERE a <<< 0 AND b <<< 0; -- Permission denied
  ERROR:  permission denied for table priv_test_tbl
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON tststats.priv_test_tbl TO regress_stats_user1;
+ SELECT * FROM tststats.priv_test_tbl t
+  WHERE a <<< 0 AND (b <<< 0 OR t.* <<< (1, 1) IS NOT NULL); -- Permission denied
+ ERROR:  permission denied for table priv_test_tbl
 +HINT:  Grant the required privileges to the current role with: GRANT SELECT ON tststats.priv_test_tbl TO regress_stats_user1;
  DELETE FROM tststats.priv_test_tbl WHERE a <<< 0 AND b <<< 0; -- Permission denied
  ERROR:  permission denied for table priv_test_tbl
@@ -25,3 +29,18 @@
  -- Grant access via a security barrier view, but hide all data
  RESET SESSION AUTHORIZATION;
  CREATE VIEW tststats.priv_test_view WITH (security_barrier=true)
+@@ -3345,11 +3350,14 @@
+ SET SESSION AUTHORIZATION regress_stats_user1;
+ SELECT * FROM tststats.priv_test_parent_tbl WHERE a <<< 0 AND b <<< 0; -- Permission denied
+ ERROR:  permission denied for table priv_test_parent_tbl
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON tststats.priv_test_parent_tbl TO regress_stats_user1;
+ SELECT * FROM tststats.priv_test_parent_tbl t
+  WHERE a <<< 0 AND (b <<< 0 OR t.* <<< (1, 1) IS NOT NULL); -- Permission denied
+ ERROR:  permission denied for table priv_test_parent_tbl
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON tststats.priv_test_parent_tbl TO regress_stats_user1;
+ DELETE FROM tststats.priv_test_parent_tbl WHERE a <<< 0 AND b <<< 0; -- Permission denied
+ ERROR:  permission denied for table priv_test_parent_tbl
++HINT:  Grant the required privileges to the current role with: GRANT SELECT, DELETE ON tststats.priv_test_parent_tbl TO regress_stats_user1;
+ -- Grant table access to parent, but hide all data with RLS
+ RESET SESSION AUTHORIZATION;
+ ALTER TABLE tststats.priv_test_parent_tbl ENABLE ROW LEVEL SECURITY;
diff --git a/test/core_patches/17/jsonb_jsonpath.out.patch b/test/core_patches/17/jsonb_jsonpath.out.patch
deleted file mode 100644
index be60bcdf..00000000
--- a/test/core_patches/17/jsonb_jsonpath.out.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-# timezone shenanigans, TODO remove when we bump pg
---- a/expected/jsonb_jsonpath.out
-+++ b/expected/jsonb_jsonpath.out
-@@ -2637,7 +2637,7 @@
- select jsonb_path_query_tz('"12:34:56"', '$.time_tz().string()');
-  jsonb_path_query_tz 
- ---------------------
-- "12:34:56-07:00"
-+ "12:34:56-08:00"
- (1 row)
- 
- select jsonb_path_query('"12:34:56"', '$.time().string()');
diff --git a/test/core_patches/17/privileges.out.patch b/test/core_patches/17/privileges.out.patch
index d1d6855d..3c8b32fa 100644
--- a/test/core_patches/17/privileges.out.patch
+++ b/test/core_patches/17/privileges.out.patch
@@ -1,7 +1,7 @@
 # Differences here are expected due to the "Enhanced Hints" feature
 --- a/expected/privileges.out
 +++ b/expected/privileges.out
-@@ -240,10 +240,12 @@
+@@ -314,10 +314,12 @@
  INSERT INTO atest1 VALUES (2, 'two'); -- ok
  INSERT INTO atest2 VALUES ('foo', true); -- fail
  ERROR:  permission denied for table atest2
@@ -14,7 +14,7 @@
  SELECT * FROM atest1 FOR UPDATE; -- ok
   a |  b  
  ---+-----
-@@ -253,8 +255,10 @@
+@@ -327,8 +329,10 @@
  
  SELECT * FROM atest2 FOR UPDATE; -- fail
  ERROR:  permission denied for table atest2
@@ -25,7 +25,7 @@
  TRUNCATE atest2; -- fail
  ERROR:  permission denied for table atest2
  BEGIN;
-@@ -291,21 +295,27 @@
+@@ -365,21 +369,27 @@
  
  INSERT INTO atest2 VALUES ('foo', true); -- fail
  ERROR:  permission denied for table atest2
@@ -53,7 +53,7 @@
  SET SESSION AUTHORIZATION regress_priv_user3;
  SELECT session_user, current_user;
      session_user    |    current_user    
-@@ -322,24 +332,33 @@
+@@ -396,24 +406,33 @@
  
  SELECT * FROM atest2; -- fail
  ERROR:  permission denied for table atest2
@@ -87,7 +87,7 @@
  TRUNCATE atest2; -- fail
  ERROR:  permission denied for table atest2
  BEGIN;
-@@ -350,8 +369,10 @@
+@@ -424,8 +443,10 @@
  -- checks in subquery, both fail
  SELECT * FROM atest1 WHERE ( b IN ( SELECT col1 FROM atest2 ) );
  ERROR:  permission denied for table atest2
@@ -98,15 +98,21 @@
  SET SESSION AUTHORIZATION regress_priv_user4;
  COPY atest2 FROM stdin; -- ok
  SELECT * FROM atest1; -- ok
-@@ -430,6 +451,7 @@
- -- This should not show any "leak" notices before failing.
+@@ -502,10 +523,13 @@
+ -- These should not show any "leak" notices before failing.
  EXPLAIN (COSTS OFF) SELECT * FROM atest12 WHERE a >>> 0;
  ERROR:  permission denied for table atest12
 +HINT:  Grant the required privileges to the current role with: GRANT SELECT ON public.atest12 TO regress_priv_user2;
- -- These plans should continue to use a nestloop, since they execute with the
- -- privileges of the view owner.
- EXPLAIN (COSTS OFF) SELECT * FROM atest12v x, atest12v y WHERE x.a = y.b;
-@@ -523,6 +545,7 @@
+ EXPLAIN (COSTS OFF) SELECT * FROM atest12v WHERE a >>> 0;
+ ERROR:  permission denied for view atest12v
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON public.atest12v TO regress_priv_user2;
+ EXPLAIN (COSTS OFF) SELECT * FROM atest12sbv WHERE a >>> 0;
+ ERROR:  permission denied for view atest12sbv
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON public.atest12sbv TO regress_priv_user2;
+ -- Now regress_priv_user1 grants access to regress_priv_user2 via the views.
+ SET SESSION AUTHORIZATION regress_priv_user1;
+ GRANT SELECT ON atest12v TO PUBLIC;
+@@ -604,6 +628,7 @@
  SET SESSION AUTHORIZATION regress_priv_user1;
  SELECT * FROM atest3; -- fail
  ERROR:  permission denied for table atest3
@@ -114,7 +120,7 @@
  DELETE FROM atest3; -- ok
  BEGIN;
  RESET SESSION AUTHORIZATION;
-@@ -536,12 +559,14 @@
+@@ -617,12 +642,14 @@
  SET SESSION AUTHORIZATION regress_priv_user1;
  DELETE FROM atest3; -- fail
  ERROR:  permission denied for table atest3
@@ -129,7 +135,7 @@
  ROLLBACK;
  -- views
  SET SESSION AUTHORIZATION regress_priv_user3;
-@@ -560,6 +585,7 @@
+@@ -641,6 +668,7 @@
  
  SELECT * FROM atestv2; -- fail
  ERROR:  permission denied for table atest2
@@ -137,7 +143,7 @@
  GRANT SELECT ON atestv1, atestv3 TO regress_priv_user4;
  GRANT SELECT ON atestv2 TO regress_priv_user2;
  SET SESSION AUTHORIZATION regress_priv_user4;
-@@ -572,6 +598,7 @@
+@@ -653,6 +681,7 @@
  
  SELECT * FROM atestv2; -- fail
  ERROR:  permission denied for view atestv2
@@ -145,7 +151,7 @@
  SELECT * FROM atestv3; -- ok
   one | two | three 
  -----+-----+-------
-@@ -579,6 +606,7 @@
+@@ -660,6 +689,7 @@
  
  SELECT * FROM atestv0; -- fail
  ERROR:  permission denied for view atestv0
@@ -153,7 +159,7 @@
  -- Appendrels excluded by constraints failed to check permissions in 8.4-9.2.
  select * from
    ((select a.q1 as x from int8_tbl a offset 0)
-@@ -586,6 +614,7 @@
+@@ -667,6 +697,7 @@
     (select b.q2 as x from int8_tbl b offset 0)) ss
  where false;
  ERROR:  permission denied for table int8_tbl
@@ -161,7 +167,7 @@
  set constraint_exclusion = on;
  select * from
    ((select a.q1 as x, random() from int8_tbl a where q1 > 0)
-@@ -593,6 +622,7 @@
+@@ -674,6 +705,7 @@
     (select b.q2 as x, random() from int8_tbl b where q2 > 0)) ss
  where x < 0;
  ERROR:  permission denied for table int8_tbl
@@ -169,7 +175,7 @@
  reset constraint_exclusion;
  CREATE VIEW atestv4 AS SELECT * FROM atestv3; -- nested view
  SELECT * FROM atestv4; -- ok
-@@ -605,6 +635,7 @@
+@@ -686,6 +718,7 @@
  -- Two complex cases:
  SELECT * FROM atestv3; -- fail
  ERROR:  permission denied for view atestv3
@@ -177,7 +183,7 @@
  SELECT * FROM atestv4; -- ok (even though regress_priv_user2 cannot access underlying atestv3)
   one | two | three 
  -----+-----+-------
-@@ -618,6 +649,7 @@
+@@ -699,6 +732,7 @@
  
  SELECT * FROM atestv2; -- fail (even though regress_priv_user2 can access underlying atest2)
  ERROR:  permission denied for table atest2
@@ -185,7 +191,7 @@
  -- Test column level permissions
  SET SESSION AUTHORIZATION regress_priv_user1;
  CREATE TABLE atest5 (one int, two int unique, three int, four int unique);
-@@ -628,6 +660,7 @@
+@@ -709,6 +743,7 @@
  SET SESSION AUTHORIZATION regress_priv_user4;
  SELECT * FROM atest5; -- fail
  ERROR:  permission denied for table atest5
@@ -193,7 +199,7 @@
  SELECT one FROM atest5; -- ok
   one 
  -----
-@@ -638,10 +671,12 @@
+@@ -719,10 +754,12 @@
  1
  SELECT two FROM atest5; -- fail
  ERROR:  permission denied for table atest5
@@ -206,7 +212,7 @@
  COPY atest5 (one,two) TO stdout; -- fail
  ERROR:  permission denied for table atest5
  SELECT 1 FROM atest5; -- ok
-@@ -658,14 +693,19 @@
+@@ -739,14 +776,19 @@
  
  SELECT 1 FROM atest5 a JOIN atest5 b USING (two); -- fail
  ERROR:  permission denied for table atest5
@@ -226,7 +232,7 @@
  SELECT one FROM (atest5 a JOIN atest5 b(one,x,y,z) USING (one)) j; -- ok
   one 
  -----
-@@ -680,38 +720,55 @@
+@@ -761,38 +803,55 @@
  
  SELECT two FROM (atest5 a JOIN atest5 b(one,x,y,z) USING (one)) j; -- fail
  ERROR:  permission denied for table atest5
@@ -282,7 +288,7 @@
  SELECT atest1.* FROM atest1, atest5; -- ok
   a |  b  
  ---+-----
-@@ -728,6 +785,7 @@
+@@ -809,6 +868,7 @@
  
  SELECT atest1.*,atest5.one FROM atest1 JOIN atest5 ON (atest1.a = atest5.two); -- fail
  ERROR:  permission denied for table atest5
@@ -290,7 +296,7 @@
  SELECT atest1.*,atest5.one FROM atest1 JOIN atest5 ON (atest1.a = atest5.one); -- ok
   a |  b  | one 
  ---+-----+-----
-@@ -737,11 +795,13 @@
+@@ -818,11 +878,13 @@
  
  SELECT one, two FROM atest5; -- fail
  ERROR:  permission denied for table atest5
@@ -304,7 +310,7 @@
  SET SESSION AUTHORIZATION regress_priv_user1;
  GRANT SELECT (two) ON atest5 TO regress_priv_user4;
  SET SESSION AUTHORIZATION regress_priv_user4;
-@@ -757,19 +817,24 @@
+@@ -838,19 +900,24 @@
  COPY atest5 (two) FROM stdin; -- ok
  INSERT INTO atest5 (three) VALUES (4); -- fail
  ERROR:  permission denied for table atest5
@@ -329,7 +335,7 @@
  -- Ok.  May SELECT on column "one":
  INSERT INTO atest5(two) VALUES (6) ON CONFLICT (two) DO UPDATE set three = 10 RETURNING atest5.one;
   one 
-@@ -783,20 +848,26 @@
+@@ -864,20 +931,26 @@
  -- Error. No select rights on three
  INSERT INTO atest5(two) VALUES (6) ON CONFLICT (two) DO UPDATE set three = EXCLUDED.three;
  ERROR:  permission denied for table atest5
@@ -356,7 +362,7 @@
  INSERT INTO atest5(four) VALUES (4); -- ok
  SET SESSION AUTHORIZATION regress_priv_user1;
  GRANT SELECT (four) ON atest5 TO regress_priv_user4;
-@@ -809,8 +880,10 @@
+@@ -890,8 +963,10 @@
  SET SESSION AUTHORIZATION regress_priv_user4;
  SELECT one FROM atest5; -- fail
  ERROR:  permission denied for table atest5
@@ -367,7 +373,7 @@
  SELECT atest6 FROM atest6; -- ok
   atest6 
  --------
-@@ -838,6 +911,7 @@
+@@ -919,6 +994,7 @@
  WHEN NOT MATCHED THEN
  	INSERT VALUES (a, NULL);
  ERROR:  permission denied for table msource
@@ -375,7 +381,7 @@
  -- fail (s.b used in the INSERTed values)
  MERGE INTO mtarget t USING msource s ON t.a = s.a
  WHEN MATCHED THEN
-@@ -845,6 +919,7 @@
+@@ -926,6 +1002,7 @@
  WHEN NOT MATCHED THEN
  	INSERT VALUES (a, b);
  ERROR:  permission denied for table msource
@@ -383,7 +389,7 @@
  -- fail (s.b used in the WHEN quals)
  MERGE INTO mtarget t USING msource s ON t.a = s.a
  WHEN MATCHED AND s.b = 'x' THEN
-@@ -852,6 +927,7 @@
+@@ -933,6 +1010,7 @@
  WHEN NOT MATCHED THEN
  	INSERT VALUES (a, NULL);
  ERROR:  permission denied for table msource
@@ -391,7 +397,7 @@
  -- this should be ok since only s.a is accessed
  BEGIN;
  MERGE INTO mtarget t USING msource s ON t.a = s.a
-@@ -881,6 +957,7 @@
+@@ -962,6 +1040,7 @@
  WHEN NOT MATCHED THEN
  	INSERT VALUES (a, NULL);
  ERROR:  permission denied for table mtarget
@@ -399,7 +405,7 @@
  -- fail (no UPDATE on t.a)
  MERGE INTO mtarget t USING msource s ON t.a = s.a
  WHEN MATCHED THEN
-@@ -888,6 +965,7 @@
+@@ -969,6 +1048,7 @@
  WHEN NOT MATCHED THEN
  	INSERT VALUES (a, b);
  ERROR:  permission denied for table mtarget
@@ -407,7 +413,7 @@
  -- fail (no SELECT on t.b)
  MERGE INTO mtarget t USING msource s ON t.a = s.a
  WHEN MATCHED AND t.b IS NOT NULL THEN
-@@ -895,6 +973,7 @@
+@@ -976,6 +1056,7 @@
  WHEN NOT MATCHED THEN
  	INSERT VALUES (a, b);
  ERROR:  permission denied for table mtarget
@@ -415,7 +421,7 @@
  -- ok
  BEGIN;
  MERGE INTO mtarget t USING msource s ON t.a = s.a
-@@ -906,6 +985,7 @@
+@@ -987,6 +1068,7 @@
  WHEN MATCHED AND t.b IS NOT NULL THEN
  	DELETE;
  ERROR:  permission denied for table mtarget
@@ -423,7 +429,7 @@
  -- grant delete privileges
  SET SESSION AUTHORIZATION regress_priv_user1;
  GRANT DELETE ON mtarget TO regress_priv_user4;
-@@ -995,8 +1075,10 @@
+@@ -1076,8 +1158,10 @@
  SET SESSION AUTHORIZATION regress_priv_user4;
  SELECT atest6 FROM atest6; -- fail
  ERROR:  permission denied for table atest6
@@ -434,7 +440,7 @@
  SET SESSION AUTHORIZATION regress_priv_user1;
  ALTER TABLE atest6 DROP COLUMN three;
  SET SESSION AUTHORIZATION regress_priv_user4;
-@@ -1016,11 +1098,14 @@
+@@ -1097,11 +1181,14 @@
  SET SESSION AUTHORIZATION regress_priv_user4;
  SELECT * FROM atest6; -- fail
  ERROR:  permission denied for table atest6
@@ -449,7 +455,7 @@
  DELETE FROM atest5 WHERE two = 2; -- ok
  -- check inheritance cases
  SET SESSION AUTHORIZATION regress_priv_user1;
-@@ -1052,6 +1137,7 @@
+@@ -1133,6 +1220,7 @@
  
  SELECT fy FROM atestc; -- fail
  ERROR:  permission denied for table atestc
@@ -457,7 +463,7 @@
  SET SESSION AUTHORIZATION regress_priv_user1;
  GRANT SELECT(fy,tableoid) ON atestc TO regress_priv_user2;
  SET SESSION AUTHORIZATION regress_priv_user2;
-@@ -1087,12 +1173,15 @@
+@@ -1168,12 +1256,15 @@
  
  SELECT f2 FROM atestc; -- fail
  ERROR:  permission denied for table atestc
@@ -473,7 +479,7 @@
  TRUNCATE atestp1; -- ok
  TRUNCATE atestc; -- fail
  ERROR:  permission denied for table atestc
-@@ -1164,6 +1253,7 @@
+@@ -1245,6 +1336,7 @@
  ERROR:  permission denied for procedure priv_testproc1
  SELECT col1 FROM atest2 WHERE col2 = true; -- fail
  ERROR:  permission denied for table atest2
@@ -481,7 +487,7 @@
  SELECT priv_testfunc4(true); -- ok
   priv_testfunc4 
  ----------------
-@@ -2083,6 +2173,7 @@
+@@ -2216,6 +2308,7 @@
  SET SESSION AUTHORIZATION regress_priv_user1;
  SELECT * FROM pg_largeobject LIMIT 0;			-- to be denied
  ERROR:  permission denied for table pg_largeobject
@@ -489,7 +495,7 @@
  -- pg_signal_backend can't signal superusers
  RESET SESSION AUTHORIZATION;
  BEGIN;
-@@ -2152,6 +2243,7 @@
+@@ -2285,6 +2378,7 @@
  INSERT INTO datdba_only DEFAULT VALUES;
  SAVEPOINT q; DELETE FROM datdba_only; ROLLBACK TO q;
  ERROR:  permission denied for table datdba_only
@@ -497,7 +503,7 @@
  SET SESSION AUTHORIZATION regress_priv_user2;
  TABLE information_schema.enabled_roles;
       role_name      
-@@ -2161,6 +2253,7 @@
+@@ -2294,6 +2388,7 @@
  
  INSERT INTO datdba_only DEFAULT VALUES;
  ERROR:  permission denied for table datdba_only
diff --git a/test/core_patches/17/rowsecurity.out.patch b/test/core_patches/17/rowsecurity.out.patch
index 0a8da543..4c4c4432 100644
--- a/test/core_patches/17/rowsecurity.out.patch
+++ b/test/core_patches/17/rowsecurity.out.patch
@@ -80,3 +80,38 @@
  SELECT * FROM rls_view; -- OK
   a  
  ----
+@@ -4515,6 +4530,7 @@
+ 
+ SELECT * FROM rls_child_tbl WHERE a <<< 1000;
+ ERROR:  permission denied for table rls_child_tbl
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON regress_rls_schema.rls_child_tbl TO regress_rls_alice;
+ SELECT * FROM rls_ptbl WHERE a <<< 1000;
+  a 
+ ---
+@@ -4534,6 +4550,7 @@
+ SELECT * FROM (SELECT * FROM rls_child_tbl UNION ALL
+                SELECT * FROM rls_child_tbl) t WHERE a <<< 1000;
+ ERROR:  permission denied for table rls_child_tbl
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON regress_rls_schema.rls_child_tbl TO regress_rls_alice;
+ RESET SESSION AUTHORIZATION;
+ REVOKE SELECT ON rls_tbl FROM regress_rls_alice;
+ CREATE VIEW rls_tbl_view AS SELECT * FROM rls_tbl;
+@@ -4543,8 +4560,10 @@
+ SET SESSION AUTHORIZATION regress_rls_alice;
+ SELECT * FROM rls_tbl WHERE a <<< 1000;
+ ERROR:  permission denied for table rls_tbl
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON regress_rls_schema.rls_tbl TO regress_rls_alice;
+ SELECT * FROM rls_tbl_view WHERE a <<< 1000;
+ ERROR:  permission denied for view rls_tbl_view
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON regress_rls_schema.rls_tbl_view TO regress_rls_alice;
+ SELECT * FROM rls_child_tbl WHERE a <<< 1000;
+  a 
+ ---
+@@ -4553,6 +4572,7 @@
+ SELECT * FROM (SELECT * FROM rls_tbl UNION ALL
+                SELECT * FROM rls_tbl) t WHERE a <<< 1000;
+ ERROR:  permission denied for table rls_tbl
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON regress_rls_schema.rls_tbl TO regress_rls_alice;
+ SELECT * FROM (SELECT * FROM rls_child_tbl UNION ALL
+                SELECT * FROM rls_child_tbl) t WHERE a <<< 1000;
+  a 
diff --git a/test/core_patches/17/stats_ext.out.patch b/test/core_patches/17/stats_ext.out.patch
index 5fa517dc..02ffcca7 100644
--- a/test/core_patches/17/stats_ext.out.patch
+++ b/test/core_patches/17/stats_ext.out.patch
@@ -1,7 +1,7 @@
 # Differences here are expected due to the "Enhanced Hints" feature
 --- a/expected/stats_ext.out
 +++ b/expected/stats_ext.out
-@@ -3242,10 +3242,12 @@
+@@ -3279,10 +3279,12 @@
  SET SESSION AUTHORIZATION regress_stats_user1;
  SELECT * FROM tststats.priv_test_tbl; -- Permission denied
  ERROR:  permission denied for table priv_test_tbl
@@ -14,10 +14,14 @@
  -- Attempt to gain access using a leaky operator
  CREATE FUNCTION op_leak(int, int) RETURNS bool
      AS 'BEGIN RAISE NOTICE ''op_leak => %, %'', $1, $2; RETURN $1 < $2; END'
-@@ -3254,8 +3256,10 @@
+@@ -3296,11 +3298,14 @@
                       restrict = scalarltsel);
  SELECT * FROM tststats.priv_test_tbl WHERE a <<< 0 AND b <<< 0; -- Permission denied
  ERROR:  permission denied for table priv_test_tbl
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON tststats.priv_test_tbl TO regress_stats_user1;
+ SELECT * FROM tststats.priv_test_tbl t
+  WHERE a <<< 0 AND (b <<< 0 OR t.* <<< (1, 1) IS NOT NULL); -- Permission denied
+ ERROR:  permission denied for table priv_test_tbl
 +HINT:  Grant the required privileges to the current role with: GRANT SELECT ON tststats.priv_test_tbl TO regress_stats_user1;
  DELETE FROM tststats.priv_test_tbl WHERE a <<< 0 AND b <<< 0; -- Permission denied
  ERROR:  permission denied for table priv_test_tbl
@@ -25,3 +29,18 @@
  -- Grant access via a security barrier view, but hide all data
  RESET SESSION AUTHORIZATION;
  CREATE VIEW tststats.priv_test_view WITH (security_barrier=true)
+@@ -3347,11 +3352,14 @@
+ SET SESSION AUTHORIZATION regress_stats_user1;
+ SELECT * FROM tststats.priv_test_parent_tbl WHERE a <<< 0 AND b <<< 0; -- Permission denied
+ ERROR:  permission denied for table priv_test_parent_tbl
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON tststats.priv_test_parent_tbl TO regress_stats_user1;
+ SELECT * FROM tststats.priv_test_parent_tbl t
+  WHERE a <<< 0 AND (b <<< 0 OR t.* <<< (1, 1) IS NOT NULL); -- Permission denied
+ ERROR:  permission denied for table priv_test_parent_tbl
++HINT:  Grant the required privileges to the current role with: GRANT SELECT ON tststats.priv_test_parent_tbl TO regress_stats_user1;
+ DELETE FROM tststats.priv_test_parent_tbl WHERE a <<< 0 AND b <<< 0; -- Permission denied
+ ERROR:  permission denied for table priv_test_parent_tbl
++HINT:  Grant the required privileges to the current role with: GRANT SELECT, DELETE ON tststats.priv_test_parent_tbl TO regress_stats_user1;
+ -- Grant table access to parent, but hide all data with RLS
+ RESET SESSION AUTHORIZATION;
+ ALTER TABLE tststats.priv_test_parent_tbl ENABLE ROW LEVEL SECURITY;