E-Maj 5.0.1 closes a PostgreSQL superuser escalation path for extension administrators
E-Maj 5.0.1 patches an emaj_adm-to-superuser escalation flaw in a niche but security-sensitive PostgreSQL rollback extension.
Search
Search results for “PostgreSQL administration”
Find published research by company, product, platform or technology.
Showing 1–20 of 50 dossiers
Web DevelopmentCloud & InfrastructureDeployment & DevOpsDeveloper ToolsDatabases & StorageActive dossier
PostgreSQL 19's AI-discovered bug backlog helps explain its November release delay
The RC2/GA schedule has not changed. A PostgreSQL committer now explains why review and backpatch workload overwhelmed the release process, with caveats around attributing every extra bug to AI.
PostgreSQL Anonymizer 3.3 patches 12 masking bypasses — upgrades require more than a version bump
PostgreSQL Anonymizer 3.3 fixes a dozen privacy and privilege flaws. Its migration is unusually sensitive: no ALTER EXTENSION UPDATE, possible salt exposure, and new restrictions on masking functions.
pg_ivm 1.17 repairs PostgreSQL incremental-view restore bugs that could duplicate maintenance triggers
pg_ivm 1.17 fixes restore state, duplicated incremental-maintenance triggers and upgrade metadata handling, plus index inference and LATERAL crash bugs.
PostgreSQL retires RHEL 9.6 and 10.0 RPM repositories, ending package updates on those minor releases
PGDG's 20 October repository retirement requires RHEL, Rocky and AlmaLinux 9.6/10.0 operators to update their OS minor release or deliberately switch to the frozen archive. Rolling EL9 and EL10 repository packages are unaffected.
PostgreSQL JDBC 42.7.14 closes authentication and SQL-data leakage flaws
Two pgJDBC vulnerabilities affect different older driver ranges and only specific connection or binary-write configurations. Upgrade and verify the affected paths rather than treating this as a PostgreSQL server vulnerability.
pg_plan_filter 1.0 lets PostgreSQL reject expensive query plans — but not hostile users
PostgreSQL operators gain per-statement and per-transaction estimated-cost limits across versions 14–18, useful for runaway reports and ORMs. The guard is disabled by default and can be bypassed by users allowed to change planner cost parameters.
pgx-bm25 1.0 brings ranked full-text search into PostgreSQL's index layer
The third-party pgx-bm25 1.0 extension gives PostgreSQL 17 and 18 native-index BM25 ranked retrieval with ordered scans and no external engine, but it is not built into PostgreSQL core and has important planner and RLS caveats.
Azure starts charging PostgreSQL 11–13 servers for Extended Support on September 1
Azure’s old PostgreSQL versions do not switch off on September 1, but they do become a paid legacy choice. Extended Support is automatic, billed by vCore-hour for running servers, and cannot be declined while an unsupported engine version remains in use.
A reproducible PostgreSQL benchmark shows BRIN can collapse under modest update churn
The useful finding is not that BRIN is bad: it is that a table can still report strong column correlation while update churn has destroyed the physical range locality BRIN actually depends on. DeepSQL published the full Docker/SQL harness so teams can reproduce the failure mode on their own workloads.
SaaSCloud & InfrastructureIndie BusinessBootstrappingHostingPricing & BillingDatabases & StorageActive dossier
Neon doubles free PostgreSQL storage to 1GB per project across 100 projects
Neon now includes 100 separate free Postgres projects with 1GB each, 100 compute-unit hours per project and branching. It is a meaningful per-project allowance increase, not an unrestricted production database tier.
pg_vault_tde 1.7.2 fixes encrypted PostgreSQL corruption — but upgrades require table rewrites
The important part of pg_vault_tde's 1.7.2 release is the operational migration: v4 rows can still be read after upgrade, but UPDATE can crash until they are rewritten.
Web DevelopmentCloud & InfrastructureCloud PlatformsDeveloper ToolsDatabases & StorageActive dossier
Cloudflare makes Python Workers GA — with Hyperdrive and first-class platform bindings
The Hyperdrive integration was the practical database unlock; the larger September 21 change is that Python Workers themselves are now GA. Cloudflare is explicitly positioning Python as a production language on Workers, with native platform bindings and framework support rather than an experimental compatibility layer.
Railway turns PostgreSQL major upgrades into a one-click migration with rollback
The useful change is operational rather than a new PostgreSQL feature: Railway is packaging major-version migration into a managed workflow while keeping the two dangerous boundaries explicit — downtime during the upgrade and post-upgrade writes lost if you revert.
Cloud SQL regional API endpoints are now GA across MySQL, PostgreSQL and SQL Server
The change is not about where database rows live; Cloud SQL already has regional instance placement. It changes where API control traffic is processed, reducing dependence on global frontend infrastructure and making data-in-transit boundaries easier to align with sovereignty requirements.
Jepsen finds 96 ParticleDB faults, including lost committed writes on a single node
ParticleDB's claimed ACID guarantees failed Jepsen tests: acknowledged writes disappeared, queries returned wrong rows, and even healthy single-node tests exposed integrity faults.
pgAdmin 4 9.19 patches 15 security flaws — server operators must check a one-time command migration
A 15-CVE pgAdmin update also changes how server-mode password commands are migrated, with a potentially irreversible first-start consequence.
pgBackRest 2.60 makes corrupt-page checks block restores and backup expiry by default
A safer default can surprise an incident-response runbook: pgBackRest 2.60 aborts restores with invalid page checksums and refuses certain backup expirations. Here's what operators should test.
Stripe can now keep a Postgres copy of payments and subscriptions up to date — without webhook plumbing
Stripe's new Postgres destination gives SaaS teams a managed payment-data mirror, not a zero-latency replacement for every webhook.
Neon opens live SQL subscriptions in Realtime beta — but row-level security is not ready
Live SQL subscriptions, a React/TypeScript SDK and scale-to-zero integration are available in four regions. Realtime is free during beta, but compute and egress still cost money, row-level security is absent, and the protocol is changing.