chore(deps): bump postgres from 17.10 to 17.11 in /compose/production/postgres

[dependabot]

Bumps postgres from 17.10 to 17.11.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[hleroy]

SAFE TO MERGE

Checks: ci / tests ✅ · conventional-title ✅ · GitGuardian ✅ · MERGEABLE/CLEAN

Package	Old → New	Type	Finding
postgres (Docker)	17.10 → 17.11	patch	Routine minor maintenance release (Aug 13 2026). 35+ CVEs + assorted bug fixes; no dump/restore. Post-upgrade actions listed by upstream (output_plugin_libraries for custom logical-decoding plugins; reindex for btree_gist on floats, ltree btrees on ≥14,653-label values, btree_gist <> on variable-length types; pgp_sym_decrypt ignore-cipher-failure=1 recovery for deprecated pgcrypto ciphers) all target extensions this repo doesn't ship. Major stays 17, and .github/dependabot.yml already ignores the 17→18 major (which needs pg_upgrade).

Impact on this codebase: Grepped radar/, config/, compose/, migrations for pgcrypto, btree_gist, ltree, CREATE EXTENSION, logical, wal_level, output_plugin, replication — no hits (the only "replication" matches are BUFR replication factors in radar/providers/bufr_decode.py, unrelated). Migrations use core RANGE partitioning (radar/migrations/0002_lightning_strike.py) only, no extensions. None of the flagged post-upgrade actions apply.

Invariants: Considered CLAUDE.md's Postgres invariants — no major bump (17 stays 17, so pg_upgrade isn't required), migrations remain backward-compatible (schema unchanged), production data path unchanged. CI builds this exact Dockerfile (.github/workflows/tests.yml runs docker build compose/production/postgres/Dockerfile) and ran the full dockerized suite against 17.11 → green.

Verdict rationale: A same-major security/stability patch on an extension-free schema, gated by CI that actually exercised the new image. Safe to squash.

_{Automated weekly Dependabot triage.}

---

Generated by Claude Code