← All digests

DBMS Weekly — 2026-09-07 (week of Sep 7–13)

This was the week PostgreSQL 19 got smaller. Five separate reverts landed in seven days: Peter Eisentraut pulled SQL Property Graph Queries in a single commit that reverted 47 commits across 125 files, Andrew Dunstan pulled the whole pg_get_*_ddl() family (13 commits, ~1500 lines), Tom Lane pulled "more object types within CREATE SCHEMA" on compatibility grounds, Jeff Davis pulled provider-specific identifier casefolding, and Amit Langote removed the RI fast-path batching layer from v19 because a buffered check could go unperformed and let a permanent FK violation commit silently. Alexander Korotkov's revert of an FSM-buffer change went back to v14 — the original had assumed that because FSM code tolerates torn pages, everything does, which ALTER TABLE SET TABLESPACE, CREATE DATABASE STRATEGY=wal_log and base-backup checksum verification all quietly disproved. Noah Misch is the reported-by line on three of those. Meanwhile REPACK (CONCURRENTLY) absorbed at least eleven separate fixes in one week, Michael Paquier widened the object-ID counter to 8 bytes in master as the enabling step for 8-byte TOAST pointers, and Andres Freund read the FOR PORTION OF code and found the in-tree comments openly documenting incorrect concurrency behaviour. Outside the tree: PlanetScale launched sharded Postgres and published an honest 118M QPS benchmark with the caveats attached, Elastic shipped three storage-engine posts in five days, and a pg_stat_wal probe measured index maintenance at ~70% of WAL volume on a three-index table.

PostgreSQL

  • Two features just left PostgreSQL 19 — the clearest account of the revert wave: SQL/PGQ out on Sep 7, ALTER TABLE … MERGE/SPLIT PARTITION out on Aug 27 with a commit message citing "multiple design issues which are too late to address in this release cycle", both following Robert Haas's Aug 25 -hackers question about six heavily-patched features. (Joshua D. Drake · commandprompt.com)
  • The unbearable lightness of one more index — built a harness, loaded 30 model-generated schemas and audited 838 indexes across twelve of them; only ten served no requirement he could find. The methodology is disclosed and the result is the opposite of the expected one. (Radim Marek · boringsql.com)
  • The Real Cost of a Single Insert in Postgres — a pg_current_wal_lsn() + pg_stat_wal probe around a 100k-row insert on a three-index table: 4 WAL records per row, 10.74x amplification straight after a checkpoint, 8.73x steady, 2.44x with the indexes dropped — index maintenance is ~70% of the WAL. Ratios are reproducible; hardware isn't disclosed and the last 15% is a funnel, so cite the measured pair, not the vendor conclusion. (tigerdata.com)
  • PG Phriday: The Folder That Ate the Publisher — traces a pg_replslot spill directory filling with thousands of anonymous files back to the barely-documented WITH (…) options on CREATE SUBSCRIPTION. (Shaun Thomas · pgedge.com)
  • Your Agent Can Turn Off Its Own Kill Switch — statement_timeout and default_transaction_read_only are USERSET, so a role-level guardrail set on an agent's login can be lifted by the agent's own session. Shows the timeout working (pg_sleep(4) cancelled at 2.060s) and then defeated. (Mikhail Shytsko · seedfa.st)
  • The lifecycle of a sharded Postgres query — a query walked end to end through auth, wire protocol, parser, shard-aware distributed planner, failure handling and pooling across four shards. The substance the launch post lacked. (planetscale.com)
  • 118 million queries per second on Neki — 118,538,803 QPS sustained 16 minutes across 512 shards and 1.22 PiB, with the scaling table, hardware, p99s and error rate published — and, unusually, the limits stated in the post: primary-only, read-only single-shard PK selects, no failover during the measured window. Worth reading for the caveats as much as the number. (Florent Poinsard, Hirad Pourtahmasbi · planetscale.com)
  • PostgreSQL MVCC: why bloat doesn't automatically mean expensive reads — takes apart the bloat-equals-slow-reads reflex with the MVCC mechanics behind it; part of a sustained cross-engine series. (Franck Pachot · dev.to)
  • Misc Learnings: SBOMs, Provenance and Attestations — working notes on attaching provenance and attestations to CNPG extension images, including getting pgrx extensions' full Rust dependency graph into the SBOM so trivy can flag RUSTSEC advisories buried in the tree. Rare supply-chain material for Postgres extensions. (Jeremy Schneider · ardentperf.com)
  • 100,000 Lines of C Later: pgSafe at PGDay UK 2026 — the rules a backup tool has to obey, and what they look like rebuilt from scratch in Go after pgBackRest lost corporate backing and the maintainer archived the repo in April. (Jimmy Angelakos · vyruss.org)
  • 30 Years of Postgres Architecture: Tom Lane interview — oral history rather than retrospective: the libjpeg years (he maintained it ~5 years; the Perseverance engineering cameras run it) and then how he actually thinks about Postgres architecture. (Elizabeth Garrett Christensen · snowflake.com)
  • Introducing the chdb Postgres extension — in-process ClickHouse wrapped as an extension for import/export against cloud object storage, benchmarked against pg_lake, pg_duckdb and aws_s3 on NYC Taxi from a colocated bucket; hardware disclosed, three-run averages, benchmark source published. (David Wheeler · clickhouse.com)
  • All Your GUCs in a Row — the GUC-a-day series ran all seven days this week (logical_decoding_work_mem through max_function_args); the max_function_args entry is the one with an operational sting — the 100-argument cap is a compile-time constant, so raising it means rebuilding every extension on the box. (Christophe Pettus · thebuild.com)
  • Inter-documentation and image links now work on PGXN — closes a 2015 issue and its 2024 follow-up: relative links between rendered docs and to images now resolve, which changes what an extension author can ship as documentation. Reindex of all extensions in progress. (David E. Wheeler · blog.pgxn.org)
  • PostgreSQL Anonymizer 3.2 — security release, upgrade first and read later.
    • fixes three critical vulnerabilities allowing a user to gain superuser privileges in certain circumstances; the announcement rates the risk very high on PostgreSQL 14 and on upgraded instances
    • anon.pseudo_* deprecated in favour of anon.seeded_*, which are localisable (anon.seeded_street_name(id,'fr_FR')) and claimed 40x faster — no benchmark, workload or hardware given [unverified]
    • old functions kept for backward compatibility; removal planned
  • pg_vault_tde v1.7.1 — TDE via an encrypted_heap table AM, AES-256-GCM per tuple below the storage manager, per-table DEKs rotatable online, keys in Vault/OpenBao Transit, PKCS#11 HSM, or a local PKCS#12 wallet.
    • breaking: 1.7.1 corrects AAD derivation for out-of-line TOAST values, so TOAST data written by ≤1.7.0 will not authenticate under 1.7.1 — affected tables must be exported before installing the new binary
    • PostgreSQL 17 or 18, OpenSSL 3.x
  • Autobase 2.11 — completes a two-year roadmap turning the Console from a deployment UI into cluster lifecycle management: read-replica scaling from the UI, minor upgrades replica-by-replica then switchover at ~5–10 s write downtime, in-place major upgrades ~30–60 s, PITR in the UI. New playbooks enable_backups, backup_pgcluster, backup_list, restore_pgcluster. (vitabaks)
  • PostGIS 3.7.0rc2 — second RC; requires PostgreSQL 14–19beta3, GEOS 3.10+ (3.15+ for all features), Proj 6.1+, libgmp. (Regina Obe · postgis.net)

PostgreSQL mailing lists

  • [hackers] Revert RI fast-path batching from REL_19_STABLE — the batching layer comes out of v19 while the per-row FK fast path stays; the commit states the risk plainly — a buffered check left unperformed lets a transaction commit a permanent foreign key violation with no error. Batch state has to survive nested trigger firing, subtransactions, deferred constraints and SET CONSTRAINTS; batching stays in master for v20. (Amit Langote) [committed]
  • [hackers] pg_get_*_ddl() needs a redesign — the week's second-largest thread, and the functions lost. Noah Misch argued the deliberate omission of PASSWORD is incoherent when pg_dumpall already emits password hashes, and rejected the security rationale outright: "I also don't see a security distinction arising merely because SQL is the conduit." Reverted three days later. (Noah Misch · Andrew Dunstan) [reverted]
  • [hackers] ON CONFLICT DO SELECT takes no predicate lock on the returned row — reported as a bug in the new DO SELECT; Dean Rasheed's reply is the news. It is the same pre-existing SSI hole in DO NOTHING / DO UPDATE, live on HEAD today, and he reproduces two SERIALIZABLE transactions reaching a final state consistent with neither serial order while neither aborts. The missing SIREAD lock is on the arbiter-index probe, so he argues against the narrow fix. (Dean Rasheed) [open]
  • [bugs] BUG #19680: FK integrity bypassed by session timezone — PostgreSQL permits FKs between types whose equality is timezone-dependent (timestamp = timestamptz), and the RI reverse check converts using the session's TimeZone — so the same constraint answers differently per session. Insert under UTC, SET timezone TO 'Asia/Tokyo', delete the parent: succeeds, no error, orphan row. No extension, no concurrency, no superuser. (chunling qin, against 18.6) [open]
  • [hackers] FOR PORTION OF code review — Andres Freund was asked whether the feature is shippable, read the code, and found the in-tree comments and isolation spec admitting incorrect concurrency: under READ COMMITTED, concurrent updates and deletes overlook each other's temporal leftovers. "Incorrect concurrency behavior seems like … a problem? And I don't think it's good to explain the details of the problem and workarounds in the spec file." He notes MariaDB is wrong the same way and DB2 is right. (Andres Freund) [open]
  • [hackers] Temporal fkey bugs — split out of that review and neither one FPO-specific: relcache doesn't count an exclusion constraint's columns as key columns, so FOR KEY SHARE is taken and does not conflict with UPDATE; and QueueFKConstraintValidation() never copies conperiod into conwithperiod, so VALIDATE CONSTRAINT silently takes the non-temporal path. (Andres Freund) [open]
  • [hackers] Trying to break online checksums with LLMs — Noah Misch ran automated reviews over the feature; Gustafsson posted the reports and a fix series, and is honest about the yield: "none of the issues would lead to incorrect results or false negatives or positives in page verification." The two that matter are asymmetric — an interrupted enable self-heals, an interrupted disable strands the cluster in inprogress-off, and he deliberately declined to auto-heal it. (Daniel Gustafsson) [patch posted]
  • [hackers] Recovery at replica stuck because recovery incorrectly trusts an old high-water mark — a standby can hang forever: walreceiver streams past a corrupt record leaving flushedUpto ahead of it, startup fails validation and re-requests streaming, RequestXLogStreaming() only resets flushedUpto on first start or timeline change, so WaitForWALToBecomeAvailable() concludes the WAL is already on disk and rereads the same bytes. Replay never advances. Reproduced on master with a new TAP test. (Konstantin Knizhnik) [patch posted]
  • [bugs] table_rewrite event trigger can corrupt rows by inserting into the table being rewritten — ten-line reproducer on 20devel. ATExecAlterColumnType() updates pg_attribute in phase 2, so when ATRewriteTables() fires the trigger the catalog says bigint while the heap still has the old layout. The ALTER succeeds and leaves a malformed tuple committed on disk; reading the wrong column then errors with invalid memory alloc request size 18446744073709551613. (路国庆) [open]
  • [hackers] Rework the executor opcodes to be position independent to improve JIT and interpreter performance — framed explicitly as a response to JIT going off by default in v19. Opcodes embed raw pointers today, which makes it impossible for a JIT to compare two opcode sets for equality or prove an argument constant; he replaces them with indirection types, has llvmjit working on the new design, and reports interpreter impact as background noise. (Pierre Ducroquet) [patch posted]
  • [hackers] Race conditions in logical decoding — review found the proposed CLOG-wait cache living in static variables that persist across decoding sessions in one backend, so after XID wraparound a cached value could refer to a different transaction and skip the very CLOG wait the patch exists to add. Álvaro accepts it, wants a backpatch because the underlying bug is in released versions, and is reluctant to touch SnapBuild in back branches. (Álvaro Herrera, Zhijie Hou, Antonin Houska) [needs review]
  • [hackers] ExecForceStoreHeapTuple() loses tts_tid — one-line fix with a backpatch-to-v13 argument: in the TTS_IS_BUFFERTUPLE branch ExecClearTuple() invalidates tts_tid and nothing restores it from tuple->t_self, so any plan that re-stores a heap tuple through this path and projects ctid gets (4294967295,0). The sibling ExecStoreHeapTuple() does set it, which reads as asymmetry rather than intent. (Greg Burd) [patch posted]

What landed (pgsql-committers)

  • Revert SQL Property Graph Queries (SQL/PGQ) — 2b9e1aff4d reverts 47 commits across 125 files, from the original feature commit through a long tail of segfault and rewrite fixes that were still arriving after freeze. That fix list is the argument. (Peter Eisentraut, Sep 7)
  • Revert pg_get_role_ddl / pg_get_tablespace_ddl / pg_get_database_ddl — db169985c1, 13 commits and ~1500 lines including ddlutils.c and the TAP test. (Andrew Dunstan, Sep 13)
  • Revert "Support more object types within CREATE SCHEMA" — f1920437cd, "concerns have been raised that the compatibility impact of that outweighs the benefit." The wrinkle he documents: the psql BEGIN/END heuristics commit could not be reverted verbatim because the CVE-2026-6464 fixes were built on its infrastructure, so he removed only the CREATE FUNCTION-inside-CREATE-SCHEMA lexer bits. (Tom Lane, Sep 11)
  • Revert "Mark modified the FSM buffer as dirty during recovery" — 35e4b760a5, backpatched through v14. The original assumed that because FSM code tolerates torn pages, everything does; RelationCopyStorage(), the read stream behind CREATE DATABASE STRATEGY=wal_log, and checksum verification in base backups and pg_checksums all read FSM pages without tolerating tears. Reported by Noah Misch. (Alexander Korotkov, Sep 8)
  • Revert provider-specific identifier casefolding — ba9e747c49: "Until we have a plan to change that, provider-specific identifier casefolding doesn't make sense." Reported by Noah Misch. (Jeff Davis, Sep 11)
  • Widen Object ID counter to 8 bytes — cb29861646, master. New GetNewObjectId8(); CheckPoint.nextOid goes Oid → Oid8 in the control file, with pg_control_checkpoint(), pg_resetwal and pg_upgrade updated so a 2^32 value carries across upgrade. Bumps catversion, PG_CONTROL_VERSION and XLOG_PAGE_MAGIC. Explicitly the enabling step for 8-byte external TOAST pointers — and the matching toast_value_type reloption landed the next day. (Michael Paquier, Sep 10)
  • Fix crash on UPDATE or DELETE of a partition pending detach — blast radius far larger than the subject: an interrupted DETACH PARTITION CONCURRENTLY leaves relispartition true while get_partition_ancestors() returns nothing, and RelationBuildPublicationDesc() takes the last element of that empty list. CheckCmdReplicaIdentity() builds that descriptor for every UPDATE and DELETE of a publishable relation, so no publication need exist — a plain UPDATE crashes the backend. (Amit Kapila; authors Mikhail Nikalayeu, shveta malik, Nisha Moond, Sep 11)
  • Fix hangs in COPY FROM (FORMAT text) — the new SIMD path read ahead whenever fewer than sizeof(Vector8) bytes remained, even when those bytes were a complete \. marker, so COPY from a pipe whose writer sent the marker without closing blocked forever. Checking inside the SIMD helper was rejected for measurably slowing short-line COPY. CSV unaffected. (Nathan Bossart; author Nazir Bilal Yavuz, Sep 9)
  • Fix concurrency issues with DROP TABLESPACE — backpatched to seven branches. DROP TABLESPACE checked pg_shdepend without locking the tablespace first, so a concurrent command could commit a dependency on a tablespace that no longer exists. The fix introduced a new deadlock risk through ALTER TABLESPACE RENAME/SET and DROP OWNED / REASSIGN OWNED, closed by taking AccessShareLock first in all four paths. (Andrew Dunstan; author Ayush Tiwari, Sep 9)
  • Fix pg_iswcased() — "Previously, ILIKE using an index scan could cause wrong results." Encoding nuances lost in two earlier commits, affecting libc + EUC and ICU + any non-UTF8. Reported by Noah Misch. (Jeff Davis, Sep 10)
  • Fix logical decoding to ignore updates without a new tuple — REPACK (CONCURRENTLY)'s suppressed updates on the transient heap still wrote a WAL record, so output plugins emitted a data-less UPDATE attributed to the repacked table. Reported by Thom Brown. (Masahiko Sawada, Sep 11)
  • Fix option argument lookup in in-tree getopt_long() — backpatched to 17: vacuumdb postgres --jobs silently took postgres as the job count instead of erroring. (Nathan Bossart; author Sehrope Sarkuni, Sep 11)
  • REPACK hardening — at least eleven separate fixes in the window (reject REPACK (ANALYZE) in a transaction block, restrict CONCURRENTLY to the heap AM and off user catalog tables, handle an owner lacking CONNECT, a dropped replica-identity index, !indisready indexes, matview error messages, progress reporting). A feature still visibly shaking out. (Álvaro Herrera, Masahiko Sawada, Fujii Masao)
  • Planner — Richard Guo committed four related fixes in four days: duplicate qual clauses in parameterized paths (twice), nestloop parameter handling for PlaceHolderVars in child joins (seven branches), and duplicate enforcement of EC-derived conditions.

CommitFest (open: PG20-3, #62)

  • Balance (Sep 8 14:59 – Sep 13, partial): 20 created · 17 closed (8 committed / 5–6 withdrawn / 3 returned with feedback) → net +3, plus 8 promotions to Ready for Committer. [unverified] — both the /62/ and /61/ activity logs return the same global 100-row feed with no pagination, so all of Sep 7 and most of Sep 8 are invisible; these are lower bounds, not the week's totals.
  • Queue totals (authoritative, from the Status summary): #62 went 44 → 79 (+35) as new work piles into the open CF; #61, now In Progress, moved 520 → 525 overall but its Committed count went 81 → 90 (+9) with Needs review down 23 — month two is draining as it should.
  • New this week: Improve Hash/Merge Join estimate accuracy when all predicates are Hash/Merge clauses (Ilia Evdokimov) — the planner calls approx_tuple_count() even when the join restriction clauses are exactly the hash/merge equality clauses, where path->jpath.path.rows is both more accurate and already computed; his table shows approx returning 1 against a true count of 10,000. The v1 select_parallel and updatable_views regressions traced to the same root cause — neither is a plain inner join — so v3 restricts the optimisation accordingly. Also new: Allow subquery pull-up past inlineable CTEs (#7283), Use maintenance_io_concurrency for parallel index builds (#7280).
  • Closed — the SQL/PGQ fallout: four entries died within three days of the revert (label/property error reporting and outer-level aggregate restrictions both withdrawn Sep 8; label conjunction & and undirected-edge rewriting both returned with feedback Sep 10). Also Batched clock sweep to reduce cross-socket atomic contention withdrawn Sep 11.
  • Promoted to Ready for Committer: Support for 8-byte TOAST values, round two — consistent with the OID8 and toast_value_type commits landing the same week — plus Optimize UUID parse using SIMD, Reduce cost of ProcArrayRemove/ProcArrayAdd, Avoid streaming zero-filled WAL switch padding.

Community pulse

  • Neki — Sharded Postgres — the launch thread split three ways: a large contingent complaining the post never says what Neki is, a substantive push on cross-shard constraints where a PlanetScale engineer conceded that cross-shard transactions work but atomic 2PC is still WIP (drawing "so this is just like having multiple postgres clusters"), and PgDog's author turning up to compare 2PC implementations, which became a Vitess-lineage credibility argument. Unresolved, technically rich. (Hacker News · 277 pts, 153 comments)
  • ID design and primary keys — the week's best design debate, running on two platforms at once. Commenters argued the post's invented terms ("external ID", "anchor ID") should just be natural key and surrogate key so readers can find the literature; the author pushed back that classical relational terminology — "including normalization" — is unsatisfactory for teaching design from business requirements. The parallel r/Database thread (38 comments) is the war-story half: an owner who refused customer numbers so every lookup was a seq scan, hash-of-all-columns PKs, smart-code PKs. (Lobsters · 23 pts, 26 comments)
  • I've operated petabyte-scale ClickHouse clusters for 5 years — practitioner agreement rather than dispute, with an ex-PostHog ingestion owner confirming "every single company handling ClickHouse struggles with ingestion". The interesting fork argues the post's "you need a full-time person above 20k rows/s" is a rediscovery of DBA culture — that the value was never query-writing but schema and behaviour guidance. A commenter notes the piece was originally published April 2025, so this is a resurface. (Hacker News · 243 pts, 89 comments)
  • How much SQL do you still write manually? — the highest comment count anywhere this week, and strikingly one-directional for 226 comments: top answer "98% myself" at 303 points, with the strongest arguments being context-loading cost exceeding writing cost for ad-hoc work, and the memory cost of parsing someone else's code. Dissent is narrow and specific — boilerplate joins, syntax debugging, string mangling. (r/SQL · 106 upvotes, 226 comments)
  • Is OrioleDB still active after the Supabase acquisition? — small thread, on-record answer: a self-identified Supabase employee said the company is "very enthusiastic", that it is "one of our priorities", and linked an open req for paid contributors. Nobody in the thread reported production use. (r/PostgreSQL · 27 upvotes, 10 comments)

Wider DBMS & distributed data

  • Jetpack: Consensus Made Generally Fast (OSDI '26) — a 1-RTT fast path that bolts onto existing leader-based consensus (Raft/Paxos/Zab) as a shim rather than replacing the battle-tested engine, which is what Fast Paxos, EPaxos and SwiftPaxos all get wrong operationally by coupling the fast path to the core protocol. (Murat Demirbaş · muratbuffalo.blogspot.com)
  • Query rewrite rules in Elasticsearch: 2.3x faster wildcard scans — two Lucene-level rewrites: wildcard matching without building an automaton (1.75x, 2.3x with SIMD substring search, benchmarked on ClickBench Q20), and empty-string filters 1.6x faster by reading lengths from the offset array without decompressing. The section on why the rules live in Lucene rather than the ES|QL optimizer is the transferable part. (Parker Timmins, Martijn van Groningen · elastic.co)
  • One field, one copy: how Elasticsearch columnar storage drops the inverted index — store each field once with no inverted index, read doc values in bulk, and let skippers jump document ranges; new mapping attributes multi_value, nullability and on_failure constrain what a field may contain. Written by the implementer. (Martijn van Groningen · elastic.co)
  • How we built PromQL into Elasticsearch — PromQL on the same compute engine as ES|QL, no plugin and no separate process, which required changing how the engine evaluates time windows and builds grouping keys. (Sergey Sidorov et al. · elastic.co)
  • Trust, but benchmark: how we let an AI agent optimize Elasticsearch — a harness that finds and implements optimizations in the engine codebase with benchmarks as the gate. A rare honest account of agentic work on a real database. (Thomas Veasey et al. · elastic.co)
  • Measuring real-time performance per dollar under continuous load: CostBench's first results — a benchmark that treats ingest-to-query-ready cost and query cost as one continuous workload rather than two separate numbers, streaming 100B+ stock quotes at a target 1M rows/s using each vendor's recommended real-time path. The methodology is the contribution; the headline 412–1,996x spread is a vendor measuring competitors, with no independent reproduction found [unverified]. (Tom Schreiber, Lionel Palacin · clickhouse.com)
  • Full-text search, object storage backend, and more in ScyllaDB 2026.3 — full-text search directly in CQL: a fulltext_index custom index type managed through CREATE/DROP/DESCRIBE INDEX, a MATCH() function in the parser, ES query-string syntax, and BM25 relevance scoring with results ordered by relevance while honouring LIMIT. Also an S3 object-store backend (preview), experimental strongly-consistent tables, and online vNode→tablet migration. (scylladb.com)
  • ClickHouse 26.8 (LTS) — 98 features, 128 performance optimizations, 556 bug fixes; headlines are background queries, pipelined SQL, new text tokenizers, and Parquet / GROUP BY / join performance work. (clickhouse.com)
  • DuckLake and QuestDB: the same Parquet, a different table format — third in the open-table-format series: what actually changes when the file format is shared but the table format isn't. (Javier Ramirez · questdb.com)
  • Run DuckDB analytics on your DynamoDB data with zero-ETL — DynamoDB replicated into Iceberg on S3 Tables on a refresh interval, with a Lambda running DuckDB serving SQL over it through an IAM-authorized endpoint. The architecture is the interesting part, and the timing is not a coincidence. (Lee Hannigan · aws.amazon.com)
  • Finding big keys in a running Valkey cluster — Valkey Admin 1.1 surfaces the largest keys across every shard of a live cluster from one view, replacing offline RDB parsing and hand-rolled SCAN loops. (valkey.io)

Commercial engines (SQL Server, Oracle, MySQL, …)

  • Rethinking PAM — the only genuinely new engine-level work on a commercial-engine blog this week, and it is a good security postmortem. v1 loaded the PAM module into mariadbd, so it could not read /etc/shadow — and worse, whatever it could read was reachable by any user with FILE privilege via LOAD DATA INFILE. The suid-helper redesign (10.4.0, stable in 10.4.10) also stopped a crashing PAM module from taking the server down and fixed modules misbehaving under concurrent authentication from multiple threads. (Daniel Black · mariadb.org) [by maintainer]
  • Enabling TLS in PXC without downtime — rolling procedure to turn on replication-traffic encryption in a Percona XtraDB Cluster that predates the 8.0 default. (Juan Arruti · percona.com)
  • SQL Server September security update — one coordinated wave across SQL Server 2025, 2022 and 2019 on both the CU and GDR tracks (2025 RTM CU8/GDR, 2022 RTM CU26/GDR, 2019 RTM CU32/GDR). Patch-now item; the posts link out to the Download Center rather than listing CVE numbers [unverified]. (SrinivasSQL · techcommunity.microsoft.com)
  • Percona Operator for PostgreSQL 3.1.0 — pg_tde encrypting data and WAL at rest, in-cluster logical replicas for reporting, and logs that survive Pod restarts, all configured inside the CR; adds RKE2 support and full ARM64 images. (Viacheslav Sarzhan · percona.com)

Migration experience

  • How to de-risk a mission-critical PostgreSQL migration — method, not product: define success in numbers first (zero rows lost, RTO, a signed-off window), let the downtime budget choose dump/restore vs logical replication rather than the other way round, validate with row counts plus checksums plus business totals, and rehearse against a production copy while timing it. (Umair Shahid · stormatics.tech)
  • PostgreSQL Migrator 1.0 — first stable release — first stable after a year of beta, a pure Go binary with no proprietary dependencies.
    • offline catalog inspection, so conversion can be iterated without re-hitting the source; complexity scoring; web UI over original and converted catalogs; streamed bulk COPY; companion transqlate transpiles SQL/PL-SQL routines
    • scope limit worth knowing before you plan around it: inspection is full, but conversion covers only roles, schemas, sequences, tables, virtual columns, constraints and indexes — views and procedural objects are planned, not shipped
    • sources Oracle 11g–26ai, MySQL 8.4+, MariaDB 10+ → PostgreSQL 16–19; PostgreSQL licence (Dalibo)

Research & cutting edge

  • Invisible Yet Dominant: Big Stalls of Kernel I/O Mechanisms in Cloud OLTP Databases — eBPF probes on writeback and block tracepoints show cloud block storage is drained by a single kernel flusher thread per device; when it falls behind, dirty throttling pauses write() and even reads that must evict dirty pages stall — invisible to iostat and every standard counter. Three configs with identical provisioned IOPS and bandwidth but 1, 2 and 4 devices: adding drains, not bandwidth, cut throttle pauses 70%, max transaction latency 59%, and raised throughput 23%. Names PostgreSQL explicitly. (Mitsumasa Kondo) [paper]
  • Generalized DBLog: A Verified Contract for Interleaving Database Rows with a Change Log — states the conditions a source and capture implementation must satisfy for the watermarked copy-to-log handoff to reconstruct rows correctly, proving no single database snapshot is required and that tables and key ranges read at different times still compose. Machine-checked in Isabelle/HOL, core re-verified in Lean 4, protocols bounded-model-checked in TLA+. Directly applicable to reasoning about logical replication's initial sync. (Andreas Andreakis) [paper]
  • Few Rows Tell Them Apart: Equivalence of Queries Mixing Set and Bag Semantics — computable bounds B such that agreement on all databases with ≤ B tuples per relation implies equivalence, in a framework that actually captures SQL's mix of DISTINCT and duplicate-preserving computation. For conjunctive queries the bound is 2^w·|Q| where w counts only columns actually read; declared keys shrink it. Turns "the counter-example search came back empty" from evidence into a proof — which is what you want before declaring a planner transformation safe. (Sara Cohen) [paper]
  • Factorized and Vectorized Execution: Optimizing Analytical and Semantic Queries over Relations — claims the first pipelined engine supporting arbitrary factorization schemes while preserving full vectorization, via packed factorized vectors and operators that keep contiguous cache-friendly layouts. The hierarchical-vs-flat tension is precisely what stops a Postgres-style executor adopting factorization for many-to-many joins with exploding intermediates. (Yasser, Dorbani, Mhedhbi) [paper]
  • You've Got a BUD in Me: Authenticated Reads from Per-Block Write Logs — replaces whole-state authenticated structures with a per-block write-log digest whose predecessor pointers chain successive modifications of each key, plus an exponential hierarchy so long unchanged intervals still give short proofs. Across a 50x state-size increase the base path rises 1.24x against 3.1x for in-memory and 69.5x for disk-backed Merkle Patricia tries. Blockchain-framed, but read it as WAL-as-authenticated-index. (Ranchal-Pedrosa, Littley, Marsh) [paper]
  • QEmbed: A Deep Learning Based Cardinality Estimator — a MADE-based autoregressive selectivity estimator with hybrid one-hot + embedding encoding, so small domains keep fine-grained detail while large sparse ones stay compact. Notably honest about a latency trade-off on wide schemas, and the headline is reduced maximum Q-error — avoiding catastrophic misestimates rather than winning on the median. (Rajput, Banerjee) [paper]
  • The Dataflow Model Revisited — the Dataflow/Beam model reassessed a decade on, by the original authors. (Fernández-Moctezuma et al. · PVLDB vol. 19) [paper]

International (non-English sources)

  • PostgreSQL temp tables, part 2: when 1024 counters aren't enough — traces LWLock:LockManager stalls and lagging logical replication to the fast-path locking counter array — 1024 counters in four kilobytes, not configurable, unchanged since 2011 — and shows one session's temp tables denying all other sessions the fast path. The strongest non-English item of the week and squarely upstream-relevant. (@CrushBy · habr.com) [ru] (orig: «PostgreSQL и временные таблицы. Часть 2: почему 1024 счётчиков бывает мало»)
  • How we finally allowed reads from PostgreSQL replicas — after six years of saying no — a platform team reasoning explicitly about which guarantees change when user traffic lands on replicas, and why they held the line for six years first. Corporate blog, engineering-first, no pitch. (Кирилл Манин · habr.com/ru/companies/avito) [ru] (orig: «Как мы разрешили чтение с реплик PostgreSQL — и почему шесть лет говорили „нет"»)
  • Speeding up scans of large PostgreSQL tables without hand-built indexes: a look at iHeap — an alternative table access method with BRIN indexing built in and applied automatically to eligible columns. Genuine storage-engine territory; note it is a proprietary fork feature on the vendor's own blog. (@al-padun · habr.com/ru/companies/postgrespro) [ru] (orig: «Как ускорить выборку из больших таблиц PostgreSQL без ручного создания индексов: разбираем iHeap»)
  • Why TiKV splits transaction data into three "drawers" — the Default/Lock/Write column-family split laid out plainly; a concrete alternative to Postgres's in-tuple xmin/xmax, and useful contrast for anyone thinking about tuple layout. (@TiDBer_wangwenjing · pingkai.cn) [zh] (orig: 为什么 TiKV 要把事务数据拆成三个"抽屉"？)
  • Understanding the Percolator protocol through group-buying — clean explanation of Percolator's two-phase commit with a primary-lock pivot, the standard reference model for distributed transactions in the Chinese-language DB world. (@TiDBer_wangwenjing · pingkai.cn) [zh] (orig: 用"多人团购"理解Percolator协议)
  • Chinese PostgreSQL docs go live: 11 major versions, none skipped — pgsql.cc now carries Chinese documentation for PostgreSQL 10–20, mirrored site design, better full-text search, synced with upstream, explicitly ad-free. Community infrastructure; note it is the author's own project. (冯若航 / Ruohang Feng · blog.vonng.com) [zh] (orig: PG 中文文档发布：11 个大版本，一个不落)
  • From a classical DBMS to an open real-time data platform — where relational engines actually sit when sensor and IoT data arrives continuously: a component walkthrough with an explicit best-of-breed vs integrated-platform trade-off section and a lessons-learned close. Editorial feature, not an advertorial — and the first German-language DBMS item this digest has been able to run since Cybertec's German blog went dark. Behind the heise+ paywall. (Omar Tello · heise.de) [de] (orig: «Vom klassischen DBMS zur offenen Echtzeit-Datenplattform»)

Call for papers

  • CERN PGDay 2027 — CERN Campus, Geneva, 12 February 2027 — CFP closes 8 November 2026, 23:59 CET (submissions via Indico). Single-track, 6–7 sessions, English; listed themes include "Extensibility & Core PostgreSQL" and extreme write throughput / partitioning / HA at scale. Co-organised by SwissPUG and CERN. (community)

Upcoming events

  • PgPune / PGDay Pune #6 — Pune, India, 9 October 2026 — the Pune PostgreSQL User Group's sixth edition and first full-day event at a dedicated venue. Program not posted as of publication: the CFP is closed but no Event #6 speakers or schedule are up, so no internals picks yet. Worth watching — earlier editions drew Rahila Syed, Amul Sul, Rajkumar Raghuwanshi and Jeevan Chalke.

New sources added this week

  • heise.de — Datenbanken / PostgreSQL topic pages — server-rendered, dated, independently edited German IT press with a live database beat. This closes the [de] gap that has sat open since Cybertec's German blog was confirmed dead. (heise online)
  • MariaDB Foundation Zulip — general — publicly readable without login, and it is a live feed of MariaDB/InnoDB development (MDEV tickets, force-pushed PRs, JIRA bot traffic) rather than user chatter. No Reddit source provides this register. Best community find of the run.
  • valkey.io/blog — the Valkey project's own blog; the "Technical Deep Dive" category is actually technical, and it publishes roughly weekly.
  • vyruss.org — Jimmy Angelakos on Postgres backup internals, from someone rewriting the tooling after pgBackRest lost its corporate backing.
  • tigerdata.com/blog — the ex-Timescale blog is publishing plain Postgres-internals material again (write amplification, bloat) under the Tiger Data name; agency bylines, so check the method each time.
  • blog.pgxn.org — David E. Wheeler's PGXN development log; low volume, high signal on extension distribution infrastructure.
  • r/ClickHouse — 13 posts in the window with real practitioner threads; fills a gap where ClickHouse was only visible via HN.

87 items · yield — mailing lists: 1112 messages in window (846 hackers / 71 bugs / 0 performance / 27 general / 168 committers) → 22 shortlisted → 12 published (+14 committer items) · blogs: 73 posts in window → 31 shortlisted → 22 published · community: ~250 threads viewed → 12 shortlisted → 5 published · research: 25 cs.DB preprints in window → 8 shortlisted → 6 published · international: ru 13→6→3, zh 14→5→3, ja 20→1→0, de 3→2→1, fr 2→1→0.