<p><strong>TLDR:</strong> pgAdmin 4 v9.16 drops with seven security fixes including RCE and SQL injection — patch immediately if you’re running it. ClickHouse’s 10-year open-source anniversary produced a wave of real migration numbers: Appcues cut P95 query times 90% and Snowflake spend 23%, Open Electricity hit 92x faster queries on a fraction of the hardware. POSETTE 2026 keeps delivering: standout talks today cover LISTEN/NOTIFY serialization surprises, Citus parallel rebalancing, and PG 18 vacuum overhaul. Confluent shipped a dbt adapter for Flink SQL that finally makes streaming pipelines testable.</p>
<hr>
<h2>pgAdmin 4 v9.16 patches seven CVEs including RCE and unauthenticated SQL injection</h2>
<p>Seven CVEs (CVE-2026-12044 through CVE-2026-12050) were patched in pgAdmin 4 v9.16. The worst of them: an AI Assistant bypass that lets a read-only transaction execute COPY TO PROGRAM for RCE, unauthenticated SQL Editor endpoints with a pickle deserialization sink, and SQL injection in dialog templates including the named restore point endpoint. There’s also stored XSS enabling credential exfiltration and an open redirect in the MFA flow. If you’re running pgAdmin in any shared or network-accessible environment, this is a drop-everything update. pgAgent is also deprecated and will be removed within six months. <a href="https://app.daily.dev/posts/43lcqxnYC" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>ClickHouse at 10: real migration numbers from Appcues and Open Electricity</h2>
<p>Appcues migrated 410 billion events from Snowflake and Airflow to ClickHouse Cloud, cutting P95 query times 90% (20+ seconds to under 2 seconds), ingestion latency 99% (10+ minutes to 5 seconds), and analytics spend 23%. Open Electricity moved ~1 billion rows of time-series data from Postgres and TimescaleDB: a query that took 313 seconds on Postgres now runs in 3.4 seconds, or 60ms via a materialized view — on 4 cores and 4GB RAM versus 16 cores and 32GB. Both teams landed on ReplacingMergeTree and materialized views as the core pattern. The 10-year milestone also brought ClickHouse 26.5 with 20x faster ORDER BY…LIMIT through JOINs and 185x less peak memory for GROUP BY…LIMIT. <a href="https://app.daily.dev/feed-by-ids?id=cbsl50ole&amp;id=CE1BDFQJE&amp;id=5TrLYtqlZ&amp;id=4M4SvdJad" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>POSETTE 2026: LISTEN/NOTIFY serialization bug tripled throughput after fix, Citus rebalancing 26-30% faster</h2>
<p>Two POSETTE talks worth your time today. The LISTEN/NOTIFY talk documents a production incident where every COMMIT with a pending NOTIFY required an access-exclusive lock on pg_database, serializing concurrent transactions — the fix was an unlogged queue table with advisory locks, which tripled throughput in stress tests. The Citus talk covers parallel rebalancing (at least 26-30% faster with logical replication mode) and snapshot-based node addition that reduced a 3-4 day data migration on 18-20 TB clusters to a fraction of that time by cloning nodes and deleting unwanted shards rather than copying data. <a href="https://app.daily.dev/posts/EdWvcHFL6" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Confluent ships dbt adapter for Flink SQL, solves deterministic testing for streaming</h2>
<p>The dbt-confluent adapter brings standard dbt workflows to Confluent Cloud’s Apache Flink SQL, with new materializations for streaming (streaming_table, streaming_source, view) backed by an open-source DB-API v2 Python driver. The genuinely interesting part is automatic switching to bounded/snapshot execution during dbt test runs — deterministic testing for unbounded streaming queries has been a real pain point, and this is a practical answer to it. Install via pip install dbt-confluent; supports dbt run, dbt test, dbt docs, and CI/CD via GitHub Actions. <a href="https://app.daily.dev/posts/sUtMwimY2" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>pgfmt 2.1 adds in-place formatting and pg_dump-compatible output:</strong> pgfmt 2.1 ships --inplace/-i for writing formatted SQL back to source files and a --style pg_dump mode that’s byte-idempotent on genuine deparser output, making it useful for diffing migrations against what PostgreSQL actually stores internally. <a href="https://app.daily.dev/posts/iujCxXIFH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>PostgreSQL 18 vacuum: autovacuum_vacuum_max_threshold default 100M, async I/O, dynamic worker scaling:</strong> The POSETTE vacuum talk consolidates what’s new in PG 18: autovacuum_vacuum_max_threshold caps dead tuples at 100M per table by default, async I/O prefetch during heap scans via io_method and io_workers, dynamic autovacuum_max_workers scaling without restarts, eager freezing to eliminate anti-wraparound I/O storms, and four new timing counters in pg_stat_all_tables. <a href="https://app.daily.dev/posts/8ku2MUQ5e" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Neon vs Supabase benchmark: 2.4s vs 39s compute resize, 8s vs 181s read replica provisioning:</strong> A production-tier benchmark found Neon resizes compute in 2.4 seconds with zero downtime versus Supabase’s 39 seconds of real SQL downtime, and provisions read replicas in 8 seconds versus 181 seconds on Supabase — a gap that widens with database size. <a href="https://app.daily.dev/posts/z2nFRuKK2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ColdFront v1.0.0-beta1: writable Iceberg cold tier on stock PostgreSQL 17/18 with embedded DuckDB:</strong> pgEdge’s ColdFront adds a transparent data tiering extension to upstream PostgreSQL 17/18 — no proprietary fork — using Apache Iceberg on S3-compatible storage for cold data and embedded DuckDB for columnar analytics, with full write support on archived data via standard SQL. <a href="https://app.daily.dev/posts/D3XYpXeMT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>SQL/PGQ property graph queries committed to PostgreSQL 19:</strong> Basic SQL/PGQ support (2023 SQL standard Part 16) has been committed to PostgreSQL 19, enabling GRAPH_TABLE queries with MATCH clauses, variable-length paths, and label disjunction over ordinary relational tables — no native graph storage engine, just a query layer on top of existing schemas. <a href="https://app.daily.dev/posts/LXGS1jaZu" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


Query optimization, schema design, and data store coverage across PostgreSQL, MongoDB, Redis, and more.

Databases Digest

A database-focused roundup covering several major developments: pgAdmin 4 v9.16 patches seven CVEs including RCE via AI Assistant bypass, unauthenticated SQL injection with pickle deserialization, stored XSS, and open redirect — immediate patching required. ClickHouse marks its 10-year open-source anniversary with real migration benchmarks: Appcues cut P95 query times 90% and Snowflake spend 23% after migrating 410B events; Open Electricity achieved 92x faster queries on a fraction of the hardware. POSETTE 2026 talks highlight a LISTEN/NOTIFY serialization bug fix that tripled throughput and Citus parallel rebalancing improvements of 26-30%. Confluent shipped a dbt adapter for Flink SQL enabling deterministic testing for streaming pipelines. Also notable: PostgreSQL 18 vacuum overhaul, Neon vs Supabase provisioning benchmarks, ColdFront v1.0 Iceberg cold tiering for PostgreSQL, and SQL/PGQ graph queries committed to PostgreSQL 19.

pgAdmin patches seven CVEs, ClickHouse turns 10 with 92x query gains