DBMS Weekly — 2026-08-10 (week of 2026-08-10–2026-08-16)

Security-release week, and a heavy one: on Thursday the project shipped 18.6 / 17.11 / 16.15 / 15.19 / 14.24 plus 19 Beta 3, closing 28 CVEs at once — seventeen scored 8.0 or higher, nine with "executes arbitrary code" in the title — after an embargoed commit barrage that landed through Noah Misch's tree in a single push. A curiosity for version historians: 18.5 was stamped and then never shipped ("due to a regression", says the announcement), so the 18 branch jumps straight from 18.4 to 18.6. Outside the release: wal_compression=on quietly changed meaning to "zstd if you have it", Jakub Wartak filed a patch series pushing pg_basebackup toward 23 Gbps without abandoning its single-connection design, Tailscale's hunt for a 16-year-old SQLite WAL-reset bug owned Hacker News, and the CommitFest tracker produces its first real week-over-week balance.

PostgreSQL

• PostgreSQL 18.6, 17.11, 16.15, 15.19, 14.24 and 19 Beta 3 released — 28 security vulnerabilities and 110+ bugs fixed across every supported branch (Aug 13). The arbitrary-code-execution cluster alone: heap overflows in regexp match/split, to_char(), pg_stat_statements query normalization, pg_dump and PL/Perl tied objects; type confusion via "internal" arguments, in cursor CLOSE + DECLARE, in pg_restore_attribute_stats() and in refint's plan cache; plus psql executing COPY data lines as commands and \unrestrict letting a pg_dump origin server run code in your psql. Two fixes change behavior: logical decoding's dlopen hole is closed by a new output_plugin_libraries GUC blessing trusted plugins, and pgcrypto's silent-cleartext bug comes with a compatibility escape hatch. (PostgreSQL Global Development Group) [committed]
  • Post-update actions: check reltuples on tables with GIN indexes (parallel builds could leave Infinity/NaN, silently starving autovacuum — the announcement has the query); reindex btree_gist indexes on float/bit columns (NaN and sorting bugs); reindex btree indexes over ltree values with >14,653 labels (integer-overflow corruption).
  • If you run 14/15/16 standbys: this update fixes a self-deadlock replaying WAL from an older-minor primary — a regression from the previous minor round that could wedge a standby.
  • Also fixed: DEFAULT partition wrongly skipped by range partition pruning (missing rows), a SERIALIZABLE conflict-detection race on initially-empty btree indexes, visibility-map WAL logging that could corrupt incremental backups, GiST/SP-GiST index-only scans emitting corrupt data, and autovacuum processing databases in exactly the wrong priority order. PostgreSQL 14 goes EOL November 12 — one update left.
• 18.5 was stamped, then burned — Tom Lane stamped 18.5 on Monday, then release notes for 18.6 and a new stamp followed; the official line is that "18.5 was not shipped due to a regression". Only the 18 branch was re-wrapped. (Tom Lane · pgsql-committers)
• 19 Beta 3 rounds off the sharp edges — the beta rolls up the GROUP BY ALL revert, several FOR PORTION OF temporal fixes (including WITH CHECK OPTION enforcement on DELETE leftovers), fixes to logical-replication sequence sync including a REFRESH SEQUENCES race, subscription-ownership fixes, a postgres_fdw wrong-results fix for pushed-down = ANY($1) with implicit coercion, and a pg_plan_advice literal-parsing fix. (PGDG)
• wal_compression=on now means zstd, lz4, then pglz — previously on was an alias for pglz and, in practice, nobody made the "informed choice" to pick better; now it maps to the best algorithm the build supports (zstd preferred — per Tomas Vondra's benchmarks the ratio pays for the speed). Backpatched into 19 during beta; the default remains off. Author wenhui qiu, reviewed by Christoph Berg. (Tomas Vondra · pgsql-committers) [committed]
• Index statistics move into their own pgstats kind — relation stats no longer lump tables and indexes together in one struct (CF #7113, filed Aug 6, committed Aug 14); groundwork for leaner per-index accounting and the ongoing pgstats refactoring. (Michael Paquier · pgsql-committers) [committed]
• Master grab-bag — EXPLAIN shows the estimated number of groups for Incremental Sort (David Rowley); PQfn() retired from libpq and CLUSTER (ANALYZE) now rejected (Nathan Bossart); an authorization-check fix for role membership changes backpatched everywhere (Nathan Bossart); vacuumdb uses ANALYZE ONLY for partitioned tables and a common LSN parser for user-supplied locations (Fujii Masao); the EXISTS-to-ANY converted subplan is renamed exists_to_any in EXPLAIN; pg_stat_statements counts entries in int64 (Daniel Gustafsson); channel binding uses explicitly-fetched digests on OpenSSL ≥ 3.0 and an ASAN failure after flex errors in GUC parsing (Michael Paquier); pg_strupper/lower/title/fold() fixed for the C locale (Heikki Linnakangas). [committed]

Releases

• plx — write Postgres functions in Ruby, PHP, JavaScript, Python, TypeScript, Go, Oracle PL/SQL, T-SQL — or COBOL — and plx transpiles the body to plpgsql at CREATE FUNCTION time. Nothing new runs in the backend: the stored body is ordinary plpgsql in pg_proc.prosrc, inspectable and dumpable, with the original source kept as a comment. The PL/SQL and T-SQL dialects make it a migration tool in disguise. Third notable Command Prompt release in three weeks. (Command Prompt)
• SynchDB 1.4 — the heterogeneous-replication extension (Oracle/MySQL/SQL Server → Postgres/IvorySQL) grows up operationally. (Hornetlabs)
  • Oracle Container Database (CDB/PDB) support across all three Oracle paths: Debezium CDC, oracle_fdw snapshots, and Openlog Replicator; tested against Oracle 23ai
  • FDW snapshot connections can finally be secured (TLS for MySQL/PG sources, Oracle Wallet for Oracle/OLR)
  • runtime-adjustable Debezium log level — no more restarting a misbehaving connector to debug it; embedded Debezium jumps 2.6 → 3.5.2
• pg_walviz v0.1.0-beta.1 — a read-only browser visualizer for WAL segment files: synchronized views of pages, record fragments, continuation records, alignment padding, FPIs and raw bytes, navigable by LSN, page, record or file offset. pg_waldump shows you the records; this shows you where they physically live. No running server needed. (Bertrand Drouvot)
• sqlfmt — a gofmt-style SQL formatter implementing the indentation style from The Art of PostgreSQL: one opinionated style, zero configuration knobs. (Dimitri Fontaine)
• A new from-scratch JDBC driver, written with Claude — the pg-java announcement lands on postgresql.org: a long-time pgjdbc maintainer's Postgres-first JVM driver built on virtual threads, developed substantially with an AI assistant, and explicitly pre-release. (Sehrope Sarkuni · JDBC project)
• Dasha — open-source performance dashboard for PostgreSQL fleets; connects with a read-only role. (Dasha)
• pgsonify — an MIT-licensed experiment that maps stats views to actual elephant recordings so you can hear your database's health. Entirely unnecessary; included anyway. (Dinesh Kumar)

Reading

• The dangers of Postgres subtransactions — the week's best internals read: cross the 64-subtransaction cache per backend and snapshots go "suboverflowed", forcing every visibility check through SLRU lookups under lock. A pgbench demo drops from 7,200 TPS to 160 TPS cluster-wide, and a freshly-provisioned read replica can refuse connections entirely — with clear WAL-level explanations of why replicas can't just consult pg_subtrans. Detection queries included. (Jan Nidzwetzki, Ben Berube · PlanetScale, Aug 11) [vendor blog — substantive]
• The curious case of Google's AlloyDB — twelve months of evaluating what "fully PostgreSQL compatible" means when the 8KB page is no longer the durable representation, WAL is the database, and VACUUM runs on a schedule you can't control. The verdict hinges on where compatibility ends, and he shows you where. (Radim Marek · boringsql.com)
• The agent is not the system. Postgres is. — a design essay with measurements behind it: long-lived agent work survives agent death only because the coordination layer is a Postgres schema — campaign rows, leases with fencing tokens, trigger-enforced state machines, append-only hash-chained events, and a stored-function API as the sole write path. (Payal Singh · Instaclustr)
• Let's build a Postgres extension for estimating memory usage — every executor node gets its own work_mem, so nobody can answer "how much RAM will this query take?"; this walks the planner internals needed to build a proof-of-concept estimator, machete in hand. (Shaun Thomas · pgEdge) [vendor blog — substantive]
• Diagnosing high-cardinality workloads in pg_stat_statements (part 6) — ORMs, dynamic SQL and AI-generated queries can outrun pg_stat_statements.max so fast the extension silently sheds the data you need; side-by-side PG17 vs PG18 demo plus concrete checks for whether it's happening to you. (Ryan Booz · pganalyze)
• Postgres checkpoint follow-up — "an HA replica saves me from long crash recovery" glosses over the fact that restartpoints follow checkpoints: a replica restart takes just as long, and rolling-restart automation plus one OOM-triggering query can take out both nodes. (Jeremy Schneider · ardentperf.com)
• Multi-tenant BYOK encryption with pgcrypto — customer-managed keys for per-tenant column encryption, entirely in-database. Reads differently the same week pgcrypto picked up a silent-cleartext CVE — patch first. (Tudor Golubenco · Xata)
• Choosing the right PostgreSQL partition key — you can partition a huge table "perfectly" and make nothing faster: pruning only fires when the important queries filter on the key, and the post is a method for finding that out before the migration you can't take back. (Umair Shahid · Stormatics)
• All Your GUCs in a Row reaches the I/O and JIT chapters — seven more entries this week, covering PG18's AIO knobs (io_method/io_workers, io_max_concurrency, io_combine_limit) and the JIT family — including the reminder that jit=on silently does nothing without the LLVM library installed, and that IntervalStyle can flip the sign of your data on input. (Christophe Pettus · thebuild.com)
• Introducing the CYBERTEC PG Operator — yet another Kubernetes operator, but open source and aimed squarely at the gap the others leave: multi-site clusters with cross-site replication and failover as first-class objects. (Hans-Jürgen Schönig · Cybertec)

CommitFest (open: PG20-2, #61)

• Queue (as of Aug 17): 413 entries — 274 needs review · 44 ready for committer · 27 waiting on author · 39 committed · 23 moved · 5 withdrawn · 1 returned with feedback. First real week-over-week delta (vs the Aug 10 snapshot, 381 total): +32 entries, +18 committed, needs-review +5, waiting-on-author +7. The queue is growing faster than it drains — September's review month has material.
• Flow (Aug 12–16, partial): ~16 new patch records and ~16 closures (14 committed, 1 returned with feedback, 1 withdrawn) visible in the activity log; the ~100-row cap had already rolled off Aug 10–12, so both counts undercount the full week.
• New this week: enhancing pg_basebackup speeds up to ~23Gbps (Jakub Wartak) — keeps the single-threaded, single-connection design and still gets ~1.85x on AWS (1,610 → ~2,900 MB/s) from fewer syscalls, eliminated libpq memory copies, and client-side io_uring with Direct I/O; his MPTCP entry (#6061) moved in alongside as the path past that ceiling. Also notable: Thread-safe stringToNode()/pg_strtok() (#7148, Matthias van de Meent — the multithreading drumbeat continues), Reduce cost of ProcArrayRemove/ProcArrayAdd (#7139), pgstat: per-kind dedicated dsa/dshash (#7145, Sami Imseih — feeding the pg_stat_statements scalability work that moved in the same day), OpenSSL auto-selected DH parameters (#7151, Peter Eisentraut), window-function-aware GROUP BY reordering (#7150), and a Tom Lane pair converting formatting.c and tsqueryout() to StringInfo — buffer-overflow-proofing the very code family this week's CVEs lived in.
• Closed: index/table statistics split (#7113, committed), retire PQfn() (#6802, committed), injection point conditions (#6663, committed), walreceiver crash on malformed CREATE_REPLICATION_SLOT reply (#7014, committed), REPLICA IDENTITY USING INDEX on invalid NOT NULL (#6801, committed), Reject CLUSTER (ANALYZE) (#7051, committed); Redundant qualifier elimination (#7127) returned with feedback.
• Promoted to Ready for Committer: pg_wal_preallocate() to eagerly create future WAL segments (#7052, Sunday night), among a handful of docs/cleanup entries.

Community pulse

• Does anyone run Postgres without PgBouncer? — Brandur's ten-years-later fragment tables which managed providers ship a pooler (nearly all) and asks why Postgres still needs one bolted on; the thread relitigates process-per-connection, transaction-mode gotchas, and whether PG18's AIO changes the calculus. (Hacker News · 144 pts, 94 comments; also Lobsters · 38 comments)
• Asynchronous I/O in DuckDB: work, thread, work — DuckDB's write-up (published Jul 31, surfaced big this week) on retrofitting async I/O into a synchronous engine without a rewrite: I/O tasks yield to compute on the same thread pool. The comments compare it against Postgres 18's io_method choices. (Hacker News · 275 pts, 31 comments)
• How we pushed CDC into Postgres — and turned replication into clockwork — Snowflake's Postgres service rebuilt CDC around the publisher (post is Jul 23, by Marco Slot of Citus fame); the thread is practitioners comparing fragile Debezium pipelines with engine-adjacent approaches. (Hacker News · 152 pts, 31 comments)
• How are you managing your schemas in a database-first project? — a code-first refugee asks how DB-first teams avoid drift; 42 comments of migration-tool taxonomy (declarative vs imperative, pgroll/sqitch/plain SQL in git) and hard-won "the database is the source of truth, act like it" positions. (r/PostgreSQL · 8 pts, 42 comments)
• Is there a database which stores its data files on object storage? — naive question, useful thread: 51 comments mapping the actual design space — Aurora/Neon-style paged storage, DuckDB-over-Parquet, SlateDB-style LSM-on-S3 — and where each breaks. (r/dataengineering · 16 pts, 51 comments)

Wider DBMS & distributed data

• Tracking down the 16-year-old SQLite WAL-reset bug — the week's engineering blockbuster: Tailscale traced sporadic corruption to a WAL-reset race present in SQLite since 2010, reproduced it, and walked it upstream with D. Richard Hipp. A model post-mortem of finding a heisenbug in someone else's battle-tested code. (Tailscale · Hacker News 1,212 pts, 236 comments)
• Electric is joining Neon at Databricks — the team behind PGlite (Postgres compiled to WASM) and the Electric sync engine gets folded into Neon, itself inside Databricks; Electric's own account is franker about what stays open source. The Postgres-adjacent startup consolidation continues. (Neon / Electric, Aug 11)
• pg_clickhouse 0.10 — the Postgres-to-ClickHouse FDW adds subquery pushdown, IN-list pushdown and aggregate pushdown improvements; the headline "1000x faster TPC-H" is the vendor's own comparison of pushed-down vs row-by-row execution — directionally obvious, numerically theirs. (ClickHouse · HN 65 pts) [vendor blog — substantive]
• Exploiting a PostGIS memory-corruption bug at NeonDB, Supabase and others — part 1 (from late July, surfaced this week) of a promised six-part series on managed-Postgres attack surface: a four-star extension bug turned into privilege escalation across several providers, responsibly disclosed. The author now claims part 2 will cover five PostgreSQL core RCE 0-days that still work on 18.6 — treat that claim as exactly that until published. (Mehmet Ince · mehmetince.net) [unverified — the 0-day claim; the PostGIS chain is documented]

Research & cutting edge

• Over the Memory Wall, Into the Instruction Wall: The New Bottleneck in GPU Data Processing — HBM bandwidth grew 13.4x between L4 and GH200, but cuDF's TPC-H kernels didn't keep up: profiling with their Valk tool shows GPU relational operators are now instruction-issue-bound, not memory-bound. The "bandwidth is everything" era of GPU databases may be over. (Hepkema, Wu, Kozyrakis, Chronis, Alonso · Aug 13) [paper]
• Time to Move on: Querying without Nulls and Bags — Aref, Libkin and Martens argue from production experience with the Rel language that fully-normalized relations — no bags, no NULLs, Codd's "corrupted relations" excised — are implementable and deployable, not just theory-clean. Fighting words for anyone maintaining three-valued-logic code. (Aref, Libkin, Martens · Aug 12) [paper]
• Enabling Differentiated QoS Degradation for Replicated Databases under Failures — when a replicated database loses capacity, degrade per-tenant service levels deliberately instead of letting whoever retries hardest win; SRDS 2026. (Djeffal, Bourhis, Rouvoy · Aug 13) [paper]
• AI Query Compilation for Unified and Optimized Execution — Fatma Ozcan's group on compiling queries that mix relational operators and model inference into one optimized plan rather than gluing an engine to an inference service; PVLDB. (Chung, Caminal, Ozcan) [paper]
• InSituANN: Revisiting IVF for PCIe-Efficient Billion-Scale Vector Search — IVF isn't dead: restructure it around PCIe transfer efficiency and billion-scale ANN gets cheaper than graph indexes on the same hardware budget. (Xu et al. · Aug 11) [paper]

International (non-English sources)

• Why is numeric so popular in PostgreSQL databases — and what it costs — the week's top-voted RU post: teams default every number to numeric for safety, and this walks through what that means at the storage and arithmetic level versus int/bigint/double precision, and when the flexibility is actually worth it. (Tantor · habr.com, +40) [ru] (orig: «Почему в БД на PostgreSQL популярен тип numeric?»)
• Queries with ANY: when PostgreSQL plans longer than it executes — large = ANY(array) lists can push planning time past execution time; where the cost hides and what to do instead. (Tantor · habr.com, +33) [ru] (orig: «Запросы с ANY: когда PostgreSQL дольше планирует, чем выполняет»)
• Pigsty v4.5: 575 extensions, Silo object storage, Valkey — the self-hosted Postgres distribution's extension count reaches 575, object storage switches to the MinIO-fork Silo, the Redis module gains a Valkey engine, and Kafka/MySQL pilot modules appear. (Ruohang Feng · blog.vonng.com, Aug 15) [zh] (orig: «Pigsty v4.5：575扩展、Silo、Valkey、Kafka与MySQL»)
• Guarding long external-API sections with a lease table instead of advisory locks — a tidy pattern write-up: advisory locks die with the connection, so for minutes-long jobs use a single-row lease with a UUID token and a 30-second heartbeat, takeover after silence. (like-mountain · Qiita, Aug 14) [ja] (orig: «外部API呼び出しを含む処理を、advisory lockではなく自作のハートビートで排他制御する»)

New sources added this week

• mehmetince.net — vulnerability researcher mid-way through a six-part series on the managed-PostgreSQL industry's attack surface, with working exploit chains and provider names. Claims should be read as a researcher's claims, but this is rare first-hand security content about the Postgres ecosystem. (Mehmet Ince)

~44 items · sources scanned: Planet PostgreSQL (live, full window), pgsql-committers via mail-archive (msg47874–msg48254, boundary timestamps verified in −0700), postgresql.org news archive + security pages, CommitFest #61 queue totals + activity log (captured 03:30 Monday; log reached back to Aug 12), Postgres Weekly #661, HN via the Algolia API (verified points/comments over the Aug 10–16 epoch window), Lobsters /t/databases, seven subreddits via the read-only JSON API, DBA Stack Exchange via the API (scanned; top question of the week: 3 points — nothing qualified, though four separate PolarDB-for-PostgreSQL questions in one week is a small curiosity), arXiv cs.DB (Aug 11–17 enumerated, submission dates spot-checked), Habr PostgreSQL hub [ru], blog.vonng.com [zh], Qiita [ja], publickey1.jp [ja], blog.dalibo.com [fr], cybertec-postgresql.com [de/en], postgresql.org events page · filtered out as marketing/ads: ~10 (a conference-booth promo, an AI-frameworks essay series, a product-install PR, two tool self-promos, a vendor HA-feature piece, an AI-agents listicle, three newsletter sponsor slots) · out-of-window but surfaced this week: DuckDB's async-I/O write-up (Jul 31), Snowflake's CDC post (Jul 23) and the PostGIS exploit chain (Jul 28), each listed for its in-window discussion.

Source note: browser available this run via the Control_Chrome MCP path (claude-in-chrome extension reported no paired browser) — it carried the HN Algolia queries, the Reddit JSON sweep, Lobsters, Qiita, and date verification on client-rendered pages. Mailing lists: pgsql-hackers/-bugs/-performance archives remain unreachable to plain fetch; coverage is the pgsql-committers stream (fresh through Sunday) plus hackers threads reached via postgresql.org/message-id from CommitFest links. CommitFest: both activity logs were live but the ~100-row retention again ate Mon–Wed; queue totals come from the authoritative /61/ status-summary line, and this is the first week with a stored prior-week snapshot, so the balance above is a real delta rather than a baseline. Non-English: ru/zh/ja produced items; fr was a translation of the release announcement plus a job ad (verified quiet), de's in-window output was English-language posts counted elsewhere; modb.pro [zh] still resists enumeration — front, search and tag pages are all client-rendered shells even in a real browser; next attempt should try its mobile site or XHR endpoints. Unverified claims flagged: the "five core RCE 0-days working on 18.6" statement (researcher's own, part 2 unpublished) and pg_clickhouse's 1000x TPC-H figure (vendor's own harness).