Thursday, October 01, 2026

Chris van Eijk benchmarks the performance cost of Row-level Security in PostgreSQL 17, identifying specific architectural pitfalls. The analysis highlights how function volatility, SELECT wrappers, and membership subqueries can degrade query efficiency. A critical finding is that the leakproof rule can inadvertently disable index usage, impacting throughput.

• Function volatility settings directly influence RLS execution overhead in PG17.
• Using SELECT wrappers for RLS policies introduces measurable query latency.
• Membership subqueries can become bottlenecks under high-concurrency loads.
• The leakproof rule may disable index scans, leading to sequential scan penalties.
• Review RLS policies for volatility and wrapper usage to optimize query plans.

This analysis measures Row Level Security behavior when PgBouncer operates in transaction pooling mode. It identifies specific scenarios where tenant context may leak between connections and explains how SET LOCAL behaves outside an active transaction block. Additionally, it highlights the risk of plans being shared across different tenant contexts, potentially impacting performance or security.

• Transaction-mode PgBouncer can cause tenant context leakage if not managed carefully.
• SET LOCAL has no effect outside a transaction block, leading to unexpected policy application.
• Shared plans across tenants may mask performance differences or security boundaries.
• Verify RLS policies are robust against connection reuse in pooled environments.

PostgreSQL 19 introduces query plan hints, allowing explicit SQL instructions to override the default query planner's execution path. This feature ends years of community resistance to hints, which were previously avoided in favor of relying on accurate table statistics. While the planner generally makes optimal choices, hints provide a fallback for specific scenarios where plans unexpectedly degrade.

• PostgreSQL 19+ supports explicit query plan hints for the first time.
• Hints override the default planner, useful for sudden plan regressions.
• Community previously resisted hints, preferring accurate statistics.
• New capability gives DBAs an explicit tool for plan control.

Amazon S3 Tables now natively supports all Apache Iceberg V3 data types, including geometry, geography, unknown, and nanosecond-precision timestamps. This eliminates the need to encode geospatial coordinates and high-precision event times as strings or integers, simplifying data architecture. The update enhances storage efficiency and query performance for workloads requiring precise location and time data.

• Native support for geometry and geography types enables efficient filtering on location data.
• Nanosecond timestamps improve precision for telemetry and financial event processing.
• Column default values are now supported alongside existing Variant and deletion vectors.
• Reduces architectural complexity by removing the need for custom encoding of V3 types.

pgEdge introduced Starfleet, a cloud database platform designed to move agentic AI applications from prototype to production. The service offers a unified developer experience with built-in AI tooling and supports flexible deployments, including on-premises and multi-region clusters. This release addresses the industry-wide challenge where less than half of AI prototypes successfully reach production environments.

• Starfleet bridges the gap between AI prototyping and production with native agentic AI tooling.
• Supports zero-downtime, highly available multi-region clusters for global scalability.
• Enables hybrid and on-premises deployments to satisfy strict data sovereignty requirements.
• Aims to solve the 54% prototype failure rate cited in recent IDC and Lenovo research.
• Provides a 100% Postgres-native cloud experience for enterprise AI workloads.

AWS has enabled UltraFast mode for OpenAI's GPT-6 Astra on Amazon Bedrock, targeting high-speed inference needs. This premium tier claims up to 6x faster throughput, reaching 300 tokens per second. It is designed for latency-sensitive production workloads like real-time coding assistants and interactive agents.

• UltraFast mode delivers up to 300 tokens/sec for low-latency apps
• Optimized for real-time coding assistants and interactive agents
• Leverages existing Bedrock security, governance, and audit controls
• Available via Bedrock console or programmatic API access

Amazon Bedrock now supports Anthropic's Claude Opus 5.5 and Claude Sonnet 5 via in-region inference in the UK (London) area. This allows customers in regulated sectors to run models locally, ensuring data never leaves the region during processing. The service is accessible through the bedrock-runtime endpoint within the eu-west-2 Region.

• Claude Opus 5.5 and Sonnet 5 are now available in UK London for in-region inference.
• Data stays within the region, aiding compliance for finance, healthcare, and public sector.
• Access models via the bedrock-runtime endpoint in eu-west-2.
• No data leaves the region during processing, reducing cross-border transfer risks.

Concurrent autoregressive inference suffers from prefill interference, where long prompt processing delays active decoding. The researchers introduce Decode-Latency Feedback Prefill (DLFP), a model-free controller that dynamically adjusts prefill chunk sizes based on observed latency intervals. Implemented in vLLM, DLFP targets only overlapping work, leaving isolated prefills unrestricted to balance throughput and latency.

• DLFP acts as a proportional controller, resizing prefill chunks based on real-time decode latency feedback.
• It specifically targets prefill work that overlaps with active decoding to minimize interference.
• Implementation is integrated into vLLM, evaluated against Poisson arrivals and raw request traces.
• Isolated prefill operations remain unrestricted, preserving performance for non-conflicting tasks.

Researchers propose an Entropy-Driven Adaptive Router (EDAR) that dynamically chooses between retrieval-augmented generation and full long-context processing at inference time. The framework leverages predictive entropy from token-level probability distributions to decide whether retrieved chunks are sufficient or if the model must process the entire input. This hybrid approach aims to mitigate the high costs and middle-information loss of pure long-context models, while addressing the retrieval quality limitations of pure RAG systems.

• Hybrid routing avoids high costs of pure long-context processing when retrieval suffices.
• Predictive entropy serves as the metric for switching between RAG and full context modes.
• Addresses the 'middle information loss' problem inherent in standard long-context LLMs.
• Reduces RAG errors caused by partially relevant or contradictory retrieved chunks.
• Enables cost-performance optimization by escalating queries only when necessary.

The modelcontextprotocol/servers repository provides reference implementations for the Model Context Protocol, serving as educational examples rather than production-ready solutions. It is maintained by the MCP steering group to demonstrate SDK usage and specific features. For a broader list of available servers, users should consult the MCP Registry instead of this repo.

• Treat these repos as educational reference code, not production assets.
• Use the MCP Registry to find a wider list of community-built servers.
• Steering group maintains only a small set of core reference implementations.

AWS has expanded the CLI for the Agent Toolkit for AWS to streamline agent skill management. Users can now run check-skill-updates to compare installed skills against the registry and use update-skill --all to patch outdated skills in a single command. This replaces the previous workflow of manually checking and updating individual skills, which covered storage, networking, and analytics guidance via the MCP Server.

• New CLI command checks all installed skills against the registry for version mismatches.
• Bulk update capability allows patching every outdated skill with a single --all flag.
• Saves operational overhead by eliminating manual per-skill update workflows.
• Skills provide expert guidance across AWS services via the MCP Server interface.

This paper proposes Environment Steering, a method that enforces safety by modeling agent execution state as database tables and tracking record-level data flows. Unlike pre-execution constraints or LLM judges, this approach checks data flows against declarative policies at runtime. When a violation is detected, the system provides context-specific feedback to steer the agent toward safe alternatives.

• Shifts safety enforcement from pre-execution or model-dependent judges to runtime environment controls.
• Uses database-style table modeling and data flow tracking to detect policy violations dynamically.
• Enables agent recovery by steering behavior via feedback rather than just blocking actions.
• Addresses the gap where instructed-safe agents still make unsafe tool calls during execution.

Lookahead-R addresses the latency-accuracy trade-off in LLM tool retrieval by reformulating it as a resource-constrained decision problem. It employs a lightweight execution-aware surrogate model to predict success, latency, and utility without calling real APIs. This model drives a cost-sensitive Monte Carlo Tree Search to select optimal tools efficiently.

• Eliminates real API calls during planning, avoiding prohibitive latency
• Surrogate model predicts execution success, cost, and semantic utility
• Monte Carlo Tree Search optimizes selection under budget constraints
• Bridges the semantic-functional gap in heterogeneous API ecosystems

AWS has announced availability changes for specific services, with Amazon Chime SDK SIP Media Application moving to maintenance and Amazon WorkSpaces Secure Browser entering sunset. Starting October 29, 2026, new customer access to services in maintenance will cease, though existing customers retain access and support. Users are advised to consult product documentation for detailed sunset timelines and migration paths.

• Amazon Chime SDK SIP Media Application moves to maintenance on Oct 29, 2026.
• New sign-ups blocked for maintenance services; existing users keep access.
• Amazon WorkSpaces Secure Browser is entering its sunset phase.
• Review product pages for specific deprecation timelines and actions required.

Amazon Managed Grafana now allows creation of workspaces running Grafana 13.2, inheriting features from versions 13.0 through 13.2. Key additions include Git Sync for treating dashboards as code via version control, and dynamic dashboards for responsive, variable-driven layouts. The Amazon CloudWatch data source plugin also gains support for PromQL queries, enabling Prometheus-style metric retrieval.

• Enable Git Sync to version control dashboards, allowing review and revert workflows for changes.
• Use dynamic dashboards to build responsive views that adapt based on data variables and conditions.
• Query CloudWatch metrics using PromQL syntax via the updated data source plugin.
• New workspaces default to 13.2; existing workspaces require manual upgrade to access these features.

AWS CloudTrail now offers an Event Coverage console view to identify missing data event logging across accounts and organizations. This tool highlights which services and resource types lack data plane monitoring, such as S3 object-level operations. The feature automates the detection of blind spots that manual scanning previously required, helping teams spot unauthorized access or exfiltration risks faster.

• New console view shows data event coverage status at account and org levels.
• Identifies specific services and resource types missing data plane logging.
• Eliminates need for manual scanning to find security monitoring blind spots.
• Helps detect unauthorized data access or exfiltration attempts earlier.

AWS Transform now supports migration assessments for moving on-premises Apache Kafka clusters to Amazon MSK using agentic AI. The tool analyzes workloads to recommend right-sized MSK Express brokers, performs compatibility checks, and generates TCO business cases. Users can interact via natural language chat or the MCP server to get actionable next steps quickly.

• Agentic AI automates compatibility checks and workload analysis for Kafka-to-MSK moves.
• Generates TCO business cases with pricing options and recommended broker sizes.
• Supports interaction via natural language chat or AWS Transform MCP server.
• Accelerates migration decisions by providing actionable next steps in minutes.

Amazon S3 Vectors now evaluates metadata filters before executing similarity search, which can increase recall by up to 5x for selective queries. The update introduces a prefix match operator for filtering paths and URLs, enhancing precision for RAG and semantic search workloads. New vector buckets enable this pre-filtering by default without requiring code changes to existing vector writes.

• Pre-filtering runs before similarity search to boost recall for selective metadata filters.
• New $startsWith operator enables efficient prefix matching on paths and URLs.
• Improves RAG and agentic app relevance by returning more complete filtered results.
• Enabled by default on new vector buckets with no code changes required.

Amazon Aurora Serverless now increases capacity in 16 ACU increments within a single second, supporting up to 256 ACUs. This acceleration is optimized for agentic AI applications characterized by unpredictable traffic and long idle periods. The feature is active by default on Platform Versions 3 and 4, requiring no configuration changes.

• Supports 16 ACU scaling steps per second for faster response to traffic bursts.
• Ideal for agentic AI workloads with high variability and idle windows.
• Enabled by default on Aurora Serverless Platform Versions 3 and 4.
• Existing workloads must upgrade to Platform Version 4 to utilize this feature.

Amazon Aurora and RDS now support R8a instances powered by 5th generation AMD EPYC processors, offering one physical core per vCPU for consistent per-core performance. These instances leverage sixth-generation Nitro Cards and provide up to 75 Gbps network bandwidth and 60 Gbps EBS bandwidth. Support extends to Aurora PostgreSQL, Aurora MySQL, RDS PostgreSQL, MySQL, and MariaDB across multiple regions.

• R8a instances map vCPUs to physical cores, ensuring predictable per-core latency for CPU-bound workloads.
• High I/O workloads benefit from 75 Gbps network and 60 Gbps EBS bandwidth on Nitro-based hardware.
• Broad compatibility covers Aurora PostgreSQL, Aurora MySQL, and RDS for PostgreSQL, MySQL, and MariaDB.
• Available in US East, US West, Canada, and Asia Pacific regions for immediate deployment.

Fleet impact: For Oracle ExaCC/RAC fleets, this is an AWS-native alternative for horizontal scaling; monitor licensing costs if migrating from Oracle. For Aurora PostgreSQL/MySQL on RDS, R8a instances offer consistent per-core performance ideal for latency-sensitive OLTP; verify AMI compatibility and test IOPS scaling with the new Nitro bandwidth limits.

Amazon CloudWatch Logs now automatically identifies and indexes fields used in filtering operations like equals and IN, eliminating the need for manual configuration. This dynamic indexing adapts to changing query patterns over a 30-day window, allowing queries to run faster by scanning less data. These auto-created indexes are temporary and do not consume the 20-field-per-log-group limit.

• Auto-indexing targets fields used in = and IN filters for faster Insights queries.
• Temporary indexes last 30 days and do not count against the 20-field limit.
• Promote persistent fields to a field index policy for permanent indexing.
• Reduces manual ops overhead as query patterns evolve over time.

AWS Systems Manager now allows sharing SSM Documents with entire AWS Organizations or specific Organizational Units through AWS Resource Access Manager. This replaces the previous limitation of sharing only publicly or with individual account IDs. The integration ensures automatic updates as accounts are added or removed from the target scope, eliminating manual tracking. Access control is handled via standard AWS RAM resource-based policies.

• Share SSM Documents org-wide or by OU, removing per-account manual management.
• RAM integration automates propagation when accounts join or leave target scopes.
• Use standard resource-based policies for consistent access control.
• Replaces legacy public or individual account ID sharing methods.

The official Firebase Apple SDK repository has announced that new versions will cease publication to CocoaPods after October 2026, though existing installs remain functional. Developers are directed to a migration guide for future updates. Additionally, a preview release of the Firebase AI Logic Gemini Foundation Models framework adapter is now available for testing.

• Plan migration from CocoaPods before October 2026 for new Firebase Apple SDK versions
• Existing CocoaPods installations remain valid and functional post-deprecation deadline
• Preview the new Gemini Foundation Models adapter via the Firebase AI Logic framework
• Repository excludes FirebaseAnalytics source code from the main Apple SDK distribution

NVIDIA released OpenShell 0.1.0, a runtime designed to safely execute fleets of autonomous AI agents. It uses kernel instrumentation to enforce strict policies on file access, system calls, and network connections, preventing agents from touching unauthorized data or secrets. This approach allows agents to perform necessary tasks like installing packages or calling APIs without granting unrestricted system access.

• Kernel-level instrumentation enforces policies on every syscall, file, and network event.
• Prevents autonomous agents from accessing unauthorized secrets, data, or network resources.
• New 0.1.0 release adds isolation primitives and an expanded extension surface.
• Enables safe agent capabilities like package installation and API calls via declared policies.

Dasha 1.8 expands its open-source PostgreSQL performance dashboard with new capabilities including index recommendations, I/O analysis, schema checks, and log insights. The tool operates agentlessly by connecting to clusters via a read-only role, aggregating statistics from every host to provide a unified view of the fleet. It leverages pg_stat_statements across all nodes to propose missing B-tree indexes, accounting for load distribution between primaries and standbys.

• Dasha 1.8 introduces index recommendations based on pg_stat_statements data across the entire cluster.
• The tool performs I/O analysis and schema checks to identify performance bottlenecks without installing agents.
• Read-only access aggregates stats from all hosts, revealing index usage on standbys that primaries miss.
• Log insights are now available, helping engineers correlate database activity with system events.
• Single instance deployment serves multiple clusters and their replicas for centralized monitoring.