Christophe Pettus explains that max_parallel_maintenance_workers serves as a hard ceiling for parallel workers launched by a single utility command. The default value is 2, configurable by the user within a range of 0 to 1024, where 0 disables parallel maintenance entirely. In practice, this limit is often lower than the ceiling due to other resource constraints.
Acts as a hard cap on parallel workers per utility command, not a guarantee of allocation.
Default is 2; set to 0 to completely disable parallel maintenance operations.
Configurable by the user with a maximum limit of 1024.
Actual worker count may be lower than this setting due to system resource limits.
Mikhail Shytsko demonstrates a tenant data leakage vulnerability where an agent using the MCP protocol receives another client's rows. This occurs because PgBouncer in transaction mode reuses connections, causing the second client to inherit the first client's session state without resetting it. The issue specifically affects setups relying on session variables like current_setting('app.tenant') within Row Level Security policies, as the MCP protocol lacks its own session isolation.
MCP protocol agents lack inherent session isolation, defaulting to this vulnerable connection pattern.
RLS policies using current_setting() are unsafe when session state is not explicitly reset.
Avoid relying on session variables for tenant isolation behind pooled connections.
Implement explicit SET commands or use statement pooling to mitigate leakage risks.
Fleet impact: If you use PgBouncer in transaction mode with PostgreSQL RLS policies dependent on session variables (e.g., app.tenant), you are vulnerable to cross-tenant data leakage. Audit your connection pooling configuration and ensure session state is explicitly reset or migrated to statement pooling. For MCP-based agents, verify that the protocol layer enforces proper session boundaries or switch to a connection mode that guarantees isolation.
MariaDB Community Server 13.0 has reached General Availability, bringing expanded procedural SQL support and new DML capabilities. The release focuses on improving developer experience and observability while introducing specific deprecations. Performance improvements are also included to enhance overall stability for production workloads.
Expanded procedural SQL support aids in migrating complex Oracle logic.
New DML capabilities streamline data manipulation tasks for developers.
Enhanced observability features improve monitoring and debugging efforts.
Review deprecations to ensure existing scripts remain compatible.
Stable GA release signals readiness for broader production adoption.
Mark Wong outlines a systematic, iterative approach to sizing an OLTP workload using DBT-5, a TPC-E-like implementation, on an EC2 instance. He leveraged Claude Fable 5.1 to automate the process of scaling from 5,000 customers and incrementally increasing user concurrency from one. The method involves pre-configuring known critical parameters like shared_buffers and max_wal_size before characterizing system behavior for deeper tuning.
Use DBT-5 for TPC-E-like OLTP sizing on AWS EC2 environments.
Deploy AI tools like Claude to automate iterative concurrency scaling tests.
Pre-configure shared_buffers and max_wal_size before detailed characterization.
Treat workload sizing as an iterative process requiring system behavior analysis.
Christophe Pettus highlights a critical oversight in PostgreSQL security: role-level settings like timeouts and read-only flags can be overridden by the session itself within a single statement. This means that relying solely on role definitions to enforce strict operational boundaries is insufficient, as active sessions can bypass these constraints. The issue underscores the gap between static role configuration and dynamic session behavior.
Role-level read-only and timeout settings are not immutable once a session is active.
A single SQL statement within a session can override these protective role flags.
Static role definitions provide a false sense of security for strict access control.
Implement additional session-level or connection-level controls to enforce boundaries.
Review application privilege models to account for session-level setting overrides.
Amazon Keyspaces has reached general availability in 11 additional AWS regions, expanding access to its managed Apache Cassandra-compatible service. This expansion enables customers to deploy latency-sensitive applications closer to their users while ensuring data residency compliance. The serverless architecture continues to offer pay-per-use pricing with virtually unlimited throughput and storage capabilities.
Keyspaces is now GA in 11 new regions, expanding global coverage for Cassandra-compatible workloads.
New regions help meet data residency requirements by keeping data within specific geographic boundaries.
Serverless model supports thousands of requests per second with no infrastructure management overhead.
Pricing remains on-demand, charging only for resources consumed without upfront commitments.
Shaun Thomas reflects on the promising but incomplete feature set of Postgres 19, noting that several anticipated capabilities failed to materialize. The situation came into sharp focus after Robert Haas initiated a 'scary patch contest' on pgsql-hackers to evaluate high-risk contributions based on post-freeze bug fixes. This discussion highlighted the tension between ambitious feature development and the stability requirements of the release process.
Postgres 19 features did not fully hatch as anticipated, leaving some high-value capabilities unimplemented.
Robert Haas used a 'scary patch contest' to identify high-risk patches requiring intense post-freeze bug fixing.
The pgsql-hackers thread revealed significant community scrutiny regarding patch stability and risk management.
Expectations for Postgres 19 were high, but the final release reflects a more conservative approach to complex changes.
Supabase is trending as a development platform built on dedicated Postgres instances, aiming to replicate Firebase's feature set using open-source tools. The platform provides auto-generated REST and GraphQL APIs, real-time subscriptions, edge functions, and file storage. It also includes a dedicated AI toolkit for vector embeddings, targeting web, mobile, and AI application development.
Offers a managed Postgres experience with auto-generated APIs to accelerate full-stack development.
Integrates real-time subscriptions and edge functions directly into the database layer.
Includes built-in support for AI vector embeddings, simplifying semantic search implementation.
Positions itself as an enterprise-grade open-source alternative to Firebase's proprietary stack.
