--- title: Postgres 19 fixes replica reads, npm worm rides a signed... description: PostgreSQL 19 ships a WAIT FOR command that finally kills stale replica reads without the usual sleep-and-pray hacks. A new npm worm variant called ChainDrop... canonical: https://daily.dev/posts/postgres-19-fixes-replica-reads-npm-worm-rides-a-signed-pipeline-hkelzsgpl twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Postgres 19 fixes replica reads, npm worm rides a signed pipeline | daily.dev og:description: PostgreSQL 19 ships a WAIT FOR command that finally kills stale replica reads without the usual sleep-and-pray hacks. A new npm worm variant called ChainDrop... og:url: https://daily.dev/posts/postgres-19-fixes-replica-reads-npm-worm-rides-a-signed-pipeline-hkelzsgpl og:image: https://api.daily.dev/og/posts/hkeLzSGpl.png og:image:alt: Postgres 19 fixes replica reads, npm worm rides a signed pipeline og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Postgres 19 fixes replica reads, npm worm rides a signed pipeline **[Backend Digest](https://daily.dev/sources/backend_digest)** · 4 min read · 0 upvotes · 0 comments ## Summary PostgreSQL 19 ships a WAIT FOR command that finally kills stale replica reads without the usual sleep-and-pray hacks. A new npm worm variant called ChainDrop compromised 400+ packages in four hours by hijacking a legitimate signed release pipeline. Traefik patched an HTTP/3 timeout bug that let attackers exhaust connection pools while looking like normal traffic. Lyft published real numbers from migrating its entire Flink fleet to the open-source Kubernetes operator, and the kernel.org sysadmin dropped a genuinely infuriating stat about AI scraper waste. ## Content **TLDR:** PostgreSQL 19 ships a WAIT FOR command that finally kills stale replica reads without the usual sleep-and-pray hacks. A new npm worm variant called ChainDrop compromised 400+ packages in four hours by hijacking a legitimate signed release pipeline. Traefik patched an HTTP/3 timeout bug that let attackers exhaust connection pools while looking like normal traffic. Lyft published real numbers from migrating its entire Flink fleet to the open-source Kubernetes operator, and the kernel.org sysadmin dropped a genuinely infuriating stat about AI scraper waste. --- ## PostgreSQL 19 adds WAIT FOR LSN to solve read-your-own-writes on replicas After years of sleep-based hacks and misunderstanding what synchronous_commit actually guarantees, Postgres 19 lets a replica session block until WAL replay reaches a specific LSN before returning results. It adds roughly 1-2ms over reading straight from the primary, versus 50ms+ for sleep-based workarounds. The catch: it can't run inside a function or above READ COMMITTED isolation, and connection poolers in transaction mode (PgBouncer) will break the guarantee unless you switch to session mode. This one's been in the works since 2016 and reverted three times, so the snapshot interaction was clearly not trivial to get right. [Read more](https://daily.dev/posts/cGblwOly7) ## ChainDrop compromises 400+ npm packages by riding a legitimate signed pipeline The Shai-Hulud worm family keeps evolving, and ChainDrop is the nastiest variant yet: it compromised over 400 packages in four hours by exploiting a legitimate signed release pipeline, obtaining valid SLSA provenance attestations, and hiding its command infrastructure in an Ethereum smart contract. The same self-propagation mechanics apply to Terraform providers and modules, not just npm. If you're not pinning to commit SHAs and lock file checksums yet, this is the incident that should finally justify the migration cost. [Read more](https://daily.dev/posts/eI6P8MPz3) ## Traefik's HTTP/3 timeout bug let slow requests exhaust connection pools for four years Bishop Fox found that Traefik's default 60-second request read timeout has had zero effect on HTTP/3 traffic since August 2022, when a library change quietly dropped the timeout-carrying component for the HTTP/3 server. Unauthenticated clients could hold upstream connections open indefinitely with slow requests, exhausting backend pools while looking like normal low-volume traffic that evades rate limiting. Traefik Labs shipped fixes in 2.11.56 and 3.7.12 within twelve days of the report, but if you're running HTTP/3 on any version from 2.8.2 through 3.7.11, you were exposed for years without knowing it. [Read more](https://daily.dev/posts/XtG9Lj52x) ## Lyft moves its entire streaming fleet off a homegrown Flink operator Lyft ditched a 2020-era in-house Flink Kubernetes operator for the open-source Apache Flink Kubernetes Operator, building a translation layer that converts their legacy CRD into the community FlinkDeployment CRD at the deploy-API boundary so the migration could happen incrementally without touching developer workflows. The payoff was concrete: zero-downtime deploys via FlinkBlueGreenDeployments, in-place autoscaling from upgrading to Flink 1.19, and several million dollars a year in infra savings. Worth reading if you're still maintaining a homegrown operator and wondering when the maintenance tax stops being worth it. [Read more](https://daily.dev/posts/FbW5s7h5N) --- ## Also notable - **AI scrapers burn 20% of the Linux kernel's compute for data that's free to clone:** Kernel.org's sysadmin found AI crawlers consuming 14-16 of 90 CPU cores across five nodes just to re-render git commit pages as HTML, when a full linux.git clone costs 200 CPU-seconds versus 280 CPU-hours to scrape the same commits through cgit. [Read more](https://daily.dev/posts/kdQNcp1qP) - **TigerBeetle holds latency steady at 100k+ TPS where Postgres collapses under contention:** In a multinode GCP cluster benchmark, TigerBeetle scaled past 100,000 transfers per second with lower latency than Postgres managed at just 5,000 TPS once row-lock contention kicked in under high account skew. [Read more](https://daily.dev/posts/FZ3QLeMYi) - **GitHub Copilot Chat data retention switches from 28-day deletion to lifetime, opt-out required:** Starting no earlier than September 28, 2026, Copilot Chat, Mobile, and cloud agent merge into one default-on experience that retains chat data for the life of the account instead of deleting it after 28 days. [Read more](https://daily.dev/posts/42cDsia28) - **OpenTelemetry hits CNCF graduated status with over 12,000 contributions from 2,800+ companies:** OTel is now the second-highest velocity project in CNCF after seven years, and is expanding next into GenAI observability semantic conventions and zero-code instrumentation via the OpenTelemetry Injector. [Read more](https://daily.dev/posts/Lxq1MT1wr) - **Express.js ecosystem patches six vulnerabilities across hbs, multer, and morgan:** multer 2.3.0 fixes three DoS issues (file descriptor leak, RangeError crash, event-loop blocking) plus a fileFilter size-limit bypass, while hbs 4.3.0 and morgan 1.12.0 patch XSS and log-forging flaws respectively. [Read more](https://daily.dev/posts/kDzxQxLtI) --- Tags: [#cyber](https://daily.dev/tags/cyber), [#kubernetes](https://daily.dev/tags/kubernetes), [#infrastructure](https://daily.dev/tags/infrastructure), [#postgresql](https://daily.dev/tags/postgresql), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/postgres-19-fixes-replica-reads-npm-worm-rides-a-signed-pipeline-hkelzsgpl) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/postgres-19-fixes-replica-reads-npm-worm-rides-a-signed-pipeline-hkelzsgpl","headline":"Postgres 19 fixes replica reads, npm worm rides a signed pipeline","text":"PostgreSQL 19 ships a WAIT FOR command that finally kills stale replica reads without the usual sleep-and-pray hacks. A new npm worm variant called ChainDrop compromised 400+ packages in four hours by hijacking a legitimate signed release pipeline. Traefik patched an HTTP/3 timeout bug that let attackers exhaust connection pools while looking like normal traffic. Lyft published real numbers from migrating its entire Flink fleet to the open-source Kubernetes operator, and the kernel.org sysadmin dropped a genuinely infuriating stat about AI scraper waste.","url":"https://daily.dev/posts/postgres-19-fixes-replica-reads-npm-worm-rides-a-signed-pipeline-hkelzsgpl","datePublished":"2026-09-01T04:17:38.074Z","dateModified":"2026-09-01T04:18:02.514Z","author":{"@type":"Organization","name":"Backend Digest","logo":"https://media.daily.dev/image/upload/s--9uCSrsAb--/f_auto,q_auto/v1773839398/logos/backend_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/backend_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/backend_digest","name":"Backend Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Backend Digest","item":"https://daily.dev/sources/backend_digest"},{"@type":"ListItem","position":3,"name":"Postgres 19 fixes replica reads, npm worm rides a signed pipeline"}]} ```