Sunday, October 11, 2026

PostgreSQL 17 introduces a check that raises 'infinite recursion detected in policy' when row-level security policies trigger themselves. The analysis breaks down the specific conditions causing this recursion and evaluates the performance cost of various fixes on a million-row dataset. Benchmarks show fix costs ranging from 0.09 ms to 6.6 seconds, highlighting significant trade-offs between correctness and query speed.

• PostgreSQL 17 detects and blocks recursive RLS policy execution to prevent stack exhaustion.
• Fix performance varies widely: 0.09 ms for optimal cases up to 6.6 seconds for complex logic.
• Review RLS policies for self-referencing conditions that trigger infinite loops.
• Optimize policy expressions to minimize evaluation overhead on large tables.

Chris van Eijk investigates the specific triggers for 'new row violates row-level security policy' errors in PostgreSQL 17. The analysis measures failure modes across plain inserts, upserts, MERGE statements, and queries using RETURNING clauses. It details four distinct variations of the error message to help pinpoint the exact context of the policy breach.

• RLS checks apply during INSERT, UPDATE, and MERGE operations in PG 17
• RETURNING clauses can trigger violations if the filtered row is inaccessible
• UPsERTs and MERGE statements have distinct error signatures to debug
• Four message forms exist; matching the exact text aids rapid triage
• Policy logic must account for all write paths including upserts

Hollis Varden benchmarks five common SQL keywords that trigger unnecessary work in PostgreSQL 18.6, revealing significant performance penalties for implicit operations. Using a 2 million row table on default settings, the test highlights UNION as the most costly, taking 13.6 seconds compared to 0.68 seconds for UNION ALL. The analysis measures execution time via EXPLAIN ANALYZE to isolate the overhead added by each keyword.

• UNION adds ~13 seconds of overhead vs UNION ALL on 2M rows due to implicit deduplication and sorting
• Always prefer UNION ALL unless distinct results are strictly required to avoid unnecessary work
• Default settings (4MB work_mem) can exacerbate performance gaps for queries requiring disk-based sorting
• Explain ANALYZE TIMING OFF provides consistent median metrics for warm-cache benchmarks
• Five specific SQL keywords were identified as hidden sources of extra computational load

AWS Database Blog outlines a method to run Change Data Capture migrations from self-managed SQL Server instances without requiring sysadmin privileges for the DMS endpoint. The approach leverages certificate-signed wrapper procedures and granular permissions to maintain full CDC functionality while adhering to separation-of-duties policies. AWS Secrets Manager is integrated to handle credential management securely within this restricted access model.

• Eliminate sysadmin requirement for DMS SQL Server endpoints using certificate-signed wrappers.
• Granular permissions enable full CDC capture while meeting strict separation-of-duties needs.
• Integrate AWS Secrets Manager for secure credential handling in least-privilege workflows.

PGX Inc. has released version 1.0 of pgx-bm25, introducing a native index access method for Okapi BM25 ranked full-text search in PostgreSQL. The extension, installed as bm25_native, allows users to create indexes that support relevance scoring and filtering without external dependencies. Queries leverage ordered index scans, eliminating the need for separate sort nodes, while the index is fully managed by PostgreSQL through WAL logging, crash recovery, and VACUUM.

• Native index access method removes need for external search engines like Elasticsearch.
• Supports PostgreSQL 17 and 18 with standard VACUUM and WAL integration.
• Uses @@@ for matching and &@@ for relevance ordering in a single scan.
• No separate runtime or external dependencies required for operation.
• Index pages are stored within the index relation for physical replication.

Production issues with MySQL Galera Cluster rarely involve write-set replication errors. Instead, operators frequently encounter silent stalls where queries pile up without log errors, leading to extended downtime until manual intervention. The primary culprit is typically flow control mechanisms rather than the replication library itself.

• Galera stability issues usually relate to flow control, not replication correctness.
• Silent query piling is a key symptom of flow control saturation.
• Manual node termination is often the only way to recover from these stalls.
• Monitor flow control metrics to detect saturation before downtime occurs.

Amazon Bedrock now supports the reasoning.summary parameter for OpenAI models via the Responses API. This feature returns a human-readable summary of the model's thought process alongside the final answer. It provides developers with context for debugging and evaluating complex tasks like coding and multi-step problem solving.

• Use reasoning.summary in the Responses API to get model thought traces.
• Improves debugging and evaluation for complex analysis and coding tasks.
• Available for all OpenAI models on Bedrock in supported regions.
• Summary is returned in the reasoning output item's summary array.

AWS has added an Ultrafast inference mode for OpenAI's GPT-6.1 Sol model on Amazon Bedrock, optimizing for latency-sensitive workloads. This mode accelerates response times for real-time coding assistants, interactive agents, and customer-facing applications without compromising quality. The offering retains existing AWS security, governance, and audit controls for production reliability.

• Ultrafast mode targets latency-critical use cases like real-time coding and interactive agents.
• GPT-6.1 Sol aids in debugging, feature building, and complex codebase investigation.
• Existing AWS controls for security, access governance, and audit trails remain intact.
• Access is available via the Amazon Bedrock console or programmatic API integration.

Hugging Face and Liquid AI have jointly released the d1 decision models, a new class of multimodal AI designed specifically for edge deployment. These open models aim to bring complex reasoning and vision capabilities to resource-constrained environments. The release leverages Liquid AI's efficient architecture to optimize performance outside of centralized cloud data centers.

• Multimodal d1 models are open-weight and optimized for edge inference workloads.
• Collaboration between Hugging Face and Liquid AI focuses on efficient model deployment.
• Enables complex reasoning and vision tasks on devices without cloud connectivity.
• Suitable for practitioners building low-latency AI applications at the edge.

AWS has extended S3 Vectors metadata pre-filtering to GovCloud regions, allowing filters to evaluate before similarity search. This approach can return up to 5x more matching vectors for selective queries. The update also introduces a $startsWith operator for filtering path-like values, improving relevance for RAG and semantic search applications.

• Metadata pre-filtering runs before vector search, boosting recall by up to 5x for selective queries.
• New $startsWith operator enables efficient filtering on path and URL metadata values.
• GovCloud regions now support these features for compliant RAG and agentic workloads.
• Pre-filtering reduces unnecessary computation by narrowing candidate sets early.

Microsoft has released version 1.0.0 of Microsoft Execution Containers (Mxc), a new tool designed to provide policy-driven containment for AI agents. This release aims to isolate AI workloads to enhance security and resource management on Windows platforms. The technology allows developers to define strict boundaries for agent behavior and execution environments.

• Mxc v1.0 introduces official support for isolating AI agents on Windows.
• Policy-driven containment helps mitigate risks from untrusted or autonomous AI code.
• Enables granular control over resource usage and network access for AI workloads.
• Part of Microsoft's broader strategy to secure AI integration in enterprise environments.

The article explores constructing bespoke decision models to handle complex logic that standard LLMs struggle with. It emphasizes combining deterministic rules with probabilistic outputs to improve reliability. This approach allows engineers to maintain control over critical business logic while leveraging generative AI for flexibility.

• Combine deterministic rules with LLM outputs for critical logic
• Improve reliability by reducing hallucination in decision paths
• Maintain engineering control over complex business constraints
• Leverage generative flexibility without sacrificing accuracy

Anthropic has released Claude Sonnet 5.5 and Opus 5.5 in the Kiro IDE and CLI for AWS GovCloud (US). Opus 5.5 features adaptive thinking, reducing tool calls by 40% and token usage by half compared to Opus 5. Sonnet 5.5 delivers over 30% faster output while matching Opus 5.5 performance on coding tasks.

• Opus 5.5 uses adaptive effort to cut tool calls by 40% and tokens by 50% vs Opus 5.
• Sonnet 5.5 is 30% faster than previous Sonnet models with Opus 5.5-level coding performance.
• Opus 5.5 offers a 1M context window and 2.0x credit multiplier, down from 2.2x.
• Both models are now available in Kiro IDE/CLI for AWS GovCloud (US) regions.

The author details how they leveraged Nix's declarative build system to automate significant portions of their debugger implementation. By treating debugger logic as a reproducible, version-controlled artifact, the tool generation became deterministic and easier to debug. This approach highlights a shift from manual scripting to infrastructure-as-code methodologies even within personal development tooling.

• Declarative tooling reduces manual setup errors and ensures reproducible build environments.
• Treating debuggers as code allows for version control and automated testing of the tool itself.
• Nix can automate complex build steps, freeing developers to focus on core debugging logic.
• This method scales well for teams needing consistent debugging environments across machines.

Amazon SageMaker Unified Studio now enables domain administrators to define project foundations using custom CloudFormation templates. This feature allows teams to enforce organization-specific requirements, such as custom IAM role naming conventions and specific permission boundaries, replacing reliance on AWS managed policies. The service validates these templates at both registration and deployment stages to ensure required resources are present before user access.

• Admins can replace AWS managed policies with custom permission boundaries for tighter security.
• CloudFormation templates are validated at registration and post-deployment to ensure compliance.
• Enforces consistent IAM role naming standards across all new SageMaker projects.
• Centralizes project environment setup, reducing manual configuration overhead for teams.

AWS Batch now automatically emits job state transition and duration metrics to the AWS/Batch CloudWatch namespace. These metrics provide visibility into job queue health, failure rates, and lifecycle timing across states like submitted, running, and failed. The data includes dimensions such as JobQueueName and is accessible via the console, CLI, or SDKs for immediate monitoring.

• Native observability for batch workloads without custom instrumentation
• Track job state transitions (submitted, running, succeeded, failed)
• Monitor duration metrics between lifecycle states for performance tuning
• Access data via AWS/Batch namespace with JobQueueName dimension
• View metrics in CloudWatch console, AWS Batch console, or CLI

Amazon EC2 R8gd instances are now available in the AWS European Sovereign Cloud (Germany) region. Powered by Graviton4 processors, these instances deliver up to 30% better performance than Graviton3 while offering up to 11.4 TB of local NVMe storage. The fleet supports 12 instance sizes with up to 50 Gbps network bandwidth and adjustable EBS throughput via bandwidth weighting.

• R8gd instances are now live in AWS European Sovereign Cloud (Germany).
• Graviton4 processors provide up to 30% performance gain over Graviton3.
• Up to 11.4 TB local NVMe storage suits low-latency, high-IOPS workloads.
• Network bandwidth scales up to 50 Gbps with 25% adjustable EBS weighting.

AWS has added a new dimension to Cost Explorer, Budgets, and Dashboards to analyze Amazon Bedrock costs by specific product attributes. This update allows teams to group and filter expenses by model, provider, inference type, and feature. Finance and platform engineers can now directly identify which models and workloads drive spending using existing billing tools.

• Filter Bedrock costs by model (e.g., Claude Sonnet 5) and provider (e.g., Anthropic, Cohere).
• Break down spend by inference type such as input tokens, output tokens, or reranker features.
• Apply new attribute filters directly in AWS Budgets for precise cost monitoring.
• Enable platform teams to attribute AI workload costs to specific model choices and providers.

Amazon GuardDuty has expanded RDS Protection to detect data exfiltration and destruction attacks on Aurora PostgreSQL and RDS for PostgreSQL. The new data activity capability uses machine learning and threat intelligence to monitor query patterns for anomalies. It operates without agents or configuration changes, addressing risks from compromised credentials.

• Covers data exfiltration and destruction, not just login anomalies.
• No agents or config changes required for deployment.
• Uses ML and threat intel to flag unusual query patterns.
• Protects Aurora PostgreSQL and RDS for PostgreSQL instances.
• Mitigates risk from valid credentials obtained via phishing.

Amazon RDS for Oracle now allows users to manually run minor version upgrade prechecks before initiating an upgrade or maintenance window. The service also emits a new event signaling when the DB instance is accepting connections again, enabling applications to reconnect while background maintenance tasks continue. These prechecks automatically halt upgrades if issues like insufficient storage or invalid objects are detected.

• Run manual prechecks before scheduled maintenance to identify blockers like invalid objects or low storage.
• Use the new connection-ready event to restore app traffic earlier, reducing total downtime.
• Upgrades now halt automatically on critical issues, preventing partial failures during minor version jumps.
• Monitor RDS events closely to trigger application failovers or reconnects at the precise moment connectivity returns.

Fleet impact: For RDS for Oracle, this reduces maintenance window risk by allowing pre-validation of upgrade readiness and shortening outage duration via the connection-ready event. Verify that your monitoring systems are subscribed to the new event to automate application reconnection logic.

PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. The platform supports imperative experiences and allows engineers to extend functionality using familiar packages like NumPy and SciPy. It offers installation binaries for various hardware including NVIDIA CUDA, AMD ROCm, and Intel GPUs.

• Leverages tape-based autograd for dynamic neural network construction.
• Supports NVIDIA CUDA, AMD ROCm, and Intel GPU acceleration.
• Seamlessly integrates with NumPy, SciPy, and Cython extensions.
• Provides GPU-ready tensor libraries comparable to NumPy performance.