← All digests

DBMS Weekly — 2026-07-27 (week of 2026-07-27–2026-08-02)

Another quiet announce week (postgresql.org's only in-window post was a plRuby revival), so the story is again in the commit stream and the writing. PG19 beta stabilization continued: the release notes gained their official "major features" list, a one-line fix turned autovacuum's new prioritization right-side-up, and Tom Lane spent Sunday closing memory-safety holes in the text-search dictionary loader. Outside core, the week's two loudest items were a 3D "working model" of the Postgres engine that hit ~930 points on HN, and Wiz disclosing a takeover of every database in Azure Cosmos DB.

PostgreSQL

Reading

  • PostgreSQL's MVCC is bad. So is everyone else's. — the week's best read: reproduces all four classic charges (write amplification, bloat, idle-snapshot poisoning, XID wraparound) on a live PG19 beta2, then audits what Oracle/InnoDB undo, SQL Server's tempdb version store, WiredTiger's cache, and LSM engines pay instead — including SQL Server spending years of engineering (ADR) to buy the constant-time abort Postgres has had for free. The four questions to ask any "we solved MVCC" claim are worth stealing. (Radim Marek · boringsql.com)
  • Waiting for PostgreSQL 19: SQL Property Graph Queries (SQL/PGQ) — depesz works through CREATE PROPERTY GRAPH and GRAPH_TABLE with his usual runnable examples. (Hubert Lubaczewski)
  • Data lineage in PostgreSQL 19 via SQL/PGQ — a genuinely useful application of the same feature: store pipeline edges as tables, declare a property graph over them, and answer "where did this report number come from" / "what breaks if I change this loader" in one query; honest caveat that PG19's GRAPH_TABLE lacks variable-length paths, so deep chains still need WITH RECURSIVE. (Hans-Jürgen Schönig · cybertec) [vendor blog — substantive]
  • Introducing pg-java, a new PostgreSQL driver for the JVM — a from-scratch JVM driver from a longtime pgjdbc maintainer, developed under the pgjdbc org; worth watching for anyone who has fought the 20-year-old JDBC codebase. (Sehrope Sarkuni)
  • SQL Improvements in PostgreSQL 11–18: A Personal Selection — Dimitri Fontaine's tour of eight versions of accumulated SQL: procedures, generated columns, MERGE, multirange, JSON_TABLE and friends — a good "what did I miss while running old versions" checklist. (Dimitri Fontaine)
  • Highlights of Fujitsu's contribution in PostgreSQL 19 — first-party rundown of the sequence-synchronization and logical-replication work (much of it patched again this very week, see above). (Hayato Kuroda · Fujitsu) [vendor blog — substantive]
  • PostgreSQL 18's extension_control_path — how the new GUC decouples extension installation from the server image — the missing piece for immutable/container deployments. (Muhammad Aqeel · pgEdge) [vendor blog — substantive]
  • Let's Break Autovacuum: Reproducing Failures to Make It Observable — deliberately drives autovacuum into its failure modes (long transactions, cost limits, worker starvation) to derive what's actually worth monitoring. (Nikolay Sivko · Coroot) [vendor blog — substantive]
  • The right way to give a third-party DBA access to your database — scoped roles for monitoring, canceling runaway queries, vacuum/reindex — without handing over ownership or superuser. (Shridhar Khanal · Stormatics)

Community pulse

  • PGSimCity — How PostgreSQL Works, in 3D — Nikolay Samokhvalov built a SimCity-style interactive 3D model of the Postgres engine: wander around buffers, WAL, and vacuum, and break things to see what happens. Self-labelled "early, reviewed prototype" with a correction template — and the standout community artifact of the week. (Hacker News · 928 pts, 92 comments) site
  • SQLite in Production: Optimizing WAL Mode, Concurrency, and VFS Layers — practical WAL-mode/VFS tuning write-up whose thread turned into a referendum on SQLite-as-server-database. (Hacker News · 258 pts, 77 comments)
  • Making Postgres queues scale — DBOS follows up last week's LISTEN/NOTIFY piece with the queue-side story (batching, SKIP LOCKED, partitioned queue tables); the thread is the usual—and useful—"just use Kafka" vs. "Postgres is enough" fight. (Hacker News · 126 pts, 33 comments) article
  • Choose DuckDB rather than SQLite — opinionated comparison; the pushback in the comments (OLTP vs OLAP, durability defaults) is better calibrated than the article. (Hacker News · 87 pts, 57 comments)

Wider DBMS & distributed data

  • CosmosEscape: taking over every database in Azure Cosmos DB — Wiz escaped Cosmos DB's custom .NET Gremlin sandbox via reflection, got code execution on the multi-tenant DB Gateway, and found a platform-wide signing key (the "Cosmos Master Key") that could fetch the primary key of any account — plus a Config Store to enumerate targets by tenant. Reported Nov 2025, hot-fixed in 48h, architectural fix completed and disclosed Jul 30; Microsoft says no evidence of exploitation. The sharpest multi-tenant-isolation postmortem you'll read this year. (Wiz Research)

Research & cutting edge

International (non-English sources)

  • Double booking: catching a write race and closing it with an EXCLUDE constraint — a booking-service war story done right: why check-then-insert races past advisory locks (they're a convention, not a guarantee), EXCLUDE USING gist (… WITH =, tstzrange(…) WITH &&) with btree_gist as the real moat, the IMMUTABLE trap when the interval end is computed (timestamptz + interval is only STABLE — wrap deterministic minute-arithmetic in an IMMUTABLE function, and don't lie to the planner about month arithmetic), and SAVEPOINTs to turn the constraint violation into a polite "slot taken". (Denis Melnikov · habr.com) [ru] (orig: «Двойная бронь: как мы поймали гонку в записи и закрыли её EXCLUDE-констрейнтом»)
  • One difference between the Postgres and Oracle optimizers — migration field note: Oracle can stop a row_number() OVER (ORDER BY …) early under a rn=1 filter (window-with-stopkey), Postgres computes the full window first — and how to rewrite the query to get the Oracle-era plan back. (GNIVC · habr.com) [ru] (orig: «Об одном различии работы оптимизатора Postgres и Oracle»)

Upcoming events

  • Hacking Workshop, September 2026 — Robert Haas's discussion series hosts David Rowley on Optimizing code in the hot path, with examples from tuple deformation; sign-ups open, watch the talk beforehand and bring questions. No prerequisites — first-time patch writers welcome.

New sources added this week

  • Coroot blog — infra-observability vendor whose Postgres posts reproduce failure modes instead of listing metrics; kept after the autovacuum piece. link
  • launchbylunch.com (Sehrope Sarkuni) — pgjdbc maintainer's blog; primary source for the new pg-java driver line of work. link

~24 items · sources scanned: pgsql-committers via mail-archive (thread index fresh through Aug 2; msg47528–47692 ≈ this week's commits, boundary timestamps verified in −0700), postgresql.org news archive (one in-window post), Planet PostgreSQL rss20.xml (live, covered the full window — 23 in-window posts), Postgres Weekly #659, live HN via the Algolia API (points/comments verified in-window), arXiv cs.DB July month listing (submission dates verified per paper), GitHub releases API, Habr PostgreSQL hub [ru], blog.vonng.com [zh] (reachable again, nothing in-window) · filtered out as marketing/ads: ~8 (sponsor slots, product-only release notes, a Show-HN cloud pitch, an audit listicle, a course-blog reblog) · out-of-window: pg_partman 5.5 with CVE fixes (Jul 22), pgEdge's autovacuum-tweaks explainer (Jul 24 — context for the sort-order fix above), and Andrei Lepikhov's "Why your pioneering Postgres feature should start in a fork" (Jul 26, surfaced by Postgres Weekly this week).

Source note: browser-assisted run end-to-end. Mailing lists — pgsql-hackers/-bugs archives were again not usably reachable; core coverage is the pgsql-committers stream (what actually landed), with committer names verified per message. CommitFest — not sampled this run; commit ground-truth shows the beta-stabilization pattern continuing (logical replication/decoding, planner correctness, recovery edge cases). Community pulse ranked from live HN Algolia data; the boringsql MVCC post's own HN threads peaked at 33 pts, so it's listed as an article, not a thread. DB Weekly is confirmed dormant (site says "archives only", 360 issues) and retired from the source list.