Neues vom PostgreSQL Planet

PgBouncer 1.25.2 shipped a patch for a pre-authentication crash (CVE-2026-6664). Any TCP connection can take down your pooler. Patch this week.

PostgreSQL, often through platforms like Supabase, is increasingly becoming part of the default stack for many AI applications. That level of adoption says something important about where engineering teams are placing their trust.

Supabase has become one of the most common starting points for AI products. Most AI frameworks support PostgreSQL and pgvector directly. For many teams, PostgreSQL is already part of the stack before the AI layer is even introduced. 

PostgreSQL's Bonjour parameters let you advertise a server on the local network via Apple's service-discovery protocol—a clever 2002 idea that hasn't aged well.

The conversation around AI infrastructure today is heavily focused on models, GPUs, inference speed, and vector databases. These are important building blocks, but they often distract from a deeper architectural challenge that is beginning to emerge as enterprises move from experimentation toward operational AI systems.

The challenge is memory.

Note: this post was not rewritten by AI

I’ve been saying for a long time that AI can’t help me because no one else codes the way I do, so it doesn’t have any reference points. Then I realized many advantages of having AI perform some boring tasks, like writing tests (we know we need unit tests, and why we are not writing them? because we don’t have time!).

PostgreSQL 19 beta arrives with four operational game-changers: 64-bit MultiXact Members kill a decades-old "vacuum or die" failure mode, parallel autovacuum…

This article compares CloudNativePG and Crunchy PGO, two of the most adopted open-source operators for running PostgreSQL on Kubernetes. It covers architecture, image design, backup strategy, major version upgrades, observability, licensing and community health. As a co-founder and maintainer of CloudNativePG, I make no claim to neutrality, and I say so upfront. What I can offer is informed bias, grounded in years of daily work on the project and a genuine respect for what Crunchy Data built in this space.

Introduction

If you’ve been running PostgreSQL for any length of time, you’ve probably heard about transaction ID (XID) wraparound. It’s one of the most well-known maintenance concerns in Postgres, and there’s no shortage of blog posts, conference talks, and war stories about it. But there’s a quieter, less-discussed cousin that can cause the exact same kind of outage: MultiXact ID wraparound.

A parameter you cannot change. block_size lives in the “Preset Options” section of the docs, alongside its read-only cousins like data_checksums, wal_block_size, and server_version. It reports the size of a PostgreSQL page — the fundamental unit of on-disk storage and buffer-pool accounting. Defa…

These two parameters close out the bgwriter cluster. Together with bgwriter_delay, they govern how the background writer decides what to write each round, and they are where the actual leverage lives — the previous post ended by saying so explicitly. Here is why. The bgwriter’s algorithm, in one …

The B cluster shifts gears: from one-off oddities to the background writer parameters, which span four GUCs. We do the first two as a pair because bgwriter_delay introduces the process at all, and bgwriter_flush_after slots cleanly into the writeback tour from backend_flush_after. What the backgr…

Two remote code execution bugs lived in pgcrypto for twenty years until an AI fuzzer found them in a weekend. Here's what you need to know.

Debug PostgreSQL errors by capturing C-level stack traces for specific internal functions.

SQL is fun and not at all boring. The latest article by Markus Winand on Order by Has Come a Long Way sent me on quite a journey.

First, set up a table called nums with one integer column and four rows:

CREATE TABLE nums (a int); INSERT INTO nums VALUES (0), (1), (2), (3);

Try to guess what these two queries return.

PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are out as of May 14, 2026. The release fixes eleven security issues and more than sixty bugs. That is not a typo. Eleven CVEs is the largest single-release security batch I can remember, and three of them are CVSS 8.8 with practical exploitation pa…

PostgreSQL 19 brings back MERGE PARTITIONS and SPLIT PARTITION—but simpler and safer than the first attempt.

Yesterday, we had our first meetup at our new venue, which we hope will become our permanent home: the Chicago Innovations Center at 1 W. Monroe. We had the pleasure of having Elizabeth Christensen from Snowflake, who delivered a talk pg_lake: Unifying transactional and analytical data with Postgres.

I find the topic exceptionally valuable, and I was delighted when Elizabeth suggested it. Below are some photos and a presentation recording.

Many thanks to:

A 2006 SQL injection vulnerability and multibyte character encodings created `backslash_quote`, a GUC parameter that remains in PostgreSQL for backward…

It's that time again. The upcoming Postgres v18.4 release (along with minor releases for all Major versions) has dropped some serious hints in the git logs, and it's bringing a significant payload of CVE tagged patches. As a seasoned Postgres end-user and an erstwhile DBA, whenever I see a flurry of high-vulnerability security commits, I immediately start recommending that customers begin planning their patching cycles.

A heap buffer overflow in pgcrypto's OpenPGP code lurked for two decades—until a December 2025 exploit made it real.