--- title: PostgreSQL 19 Beta 4 released, with some features rolled... description: PostgreSQL 19 Beta 4 is available, with several previously planned features rolled back - including partition merge/split, SQL graph data structures, some... canonical: https://daily.dev/posts/postgresql-19-beta-4-released-with-some-features-rolled-back-ahead-of-october-ga-rajzl9sob twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: PostgreSQL 19 Beta 4 released, with some features rolled back ahead of October GA | daily.dev og:description: PostgreSQL 19 Beta 4 is available, with several previously planned features rolled back - including partition merge/split, SQL graph data structures, some... og:url: https://daily.dev/posts/postgresql-19-beta-4-released-with-some-features-rolled-back-ahead-of-october-ga-rajzl9sob og:image: https://api.daily.dev/og/posts/rAjZl9soB.png og:image:alt: PostgreSQL 19 Beta 4 released, with some features rolled back ahead of October GA og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # PostgreSQL 19 Beta 4 released, with some features rolled back ahead of October GA **[Collections](https://daily.dev/sources/collections)** · 4 min read · 1 upvotes · 0 comments ## Summary PostgreSQL 19 Beta 4 is available, with several previously planned features rolled back - including partition merge/split, SQL graph data structures, some pg_get_* functions, and CREATE PUBLICATION ... EXCEPT - to keep the release schedule predictable and stable. The release candidate is expected in early October with GA shortly after. Beta 4 fixes REPACK, deadlock handling in WAIT FOR, FOR PORTION OF, MERGE/SPLIT PARTITIONS, pg_get_*_ddl() functions, COPY FROM SIMD optimization, and pgbench --continue-on-error. Also covered: PgBouncer 1.26 patches three CVEs (two unauthenticated-exploitable), a PostGIS memory corruption vulnerability exploited for RCE against Neon and Supabase, PlanetScale's new Postgres sharding tool Nekki, and a new physical replication tool called WAL Shadow. ## Content PostgreSQL 19 Beta 4 is out. The release candidate is expected in early October, with general availability possibly following in October. The cycle has run about a month late, and several features that were planned for 19 have been reverted. The project says it did this to prioritize stability and a predictable schedule, and the features will be revisited in a later major release. Among those mentioned are partition merge/split, SQL graph data structures, and some of the pg_get_*_ddl() functions. Beta 4 also fixes bugs in REPACK, WAIT FOR deadlocks, FOR PORTION OF, MERGE/SPLIT PARTITIONS, the new pg_get_*_ddl() functions, CREATE PUBLICATION ... EXCEPT, the COPY FROM SIMD optimization, and pgbench --continue-on-error. Upgrading works as usual for a major version, with pg_upgrade or pg_dump/pg_restore. Testing and bug reports before the final release are welcome. ## What REPACK (CONCURRENTLY) costs while it runs PostgreSQL 19 introduces REPACK, which unifies VACUUM FULL and CLUSTER. Its REPACK (CONCURRENTLY) mode rewrites a table online without any extension. In benchmarks against pg_repack and pg_squeeze under write load, it was the fastest and generated the least WAL. That doesn't make it free. The measurements show several costs: - **Autovacuum:** REPACK uses a temporary replication slot, so dead tuples pile up cluster-wide while it runs. - **The final swap:** it takes an ACCESS EXCLUSIVE lock, which can stall both writers and readers. Set lock_timeout before you start. - **MVCC behavior:** it is not MVCC-safe. An old REPEATABLE READ snapshot will see an empty table afterward. - **A hard ceiling:** if roughly 105 million rows are updated or deleted during a run, it fails outright on a memory allocation limit. In practice, that means estimating run duration against your write rate, sizing disk for the extra WAL and the rewritten copy, and checking requirements up front: a replica identity index on the table and enough free replication slots. ## Are the reverts AI's fault? A Postgres contributor went through the mailing list threads for 12 reverts in this cycle. Only 4 came out of AI-assisted reviews. The rest came from ordinary human review by experienced contributors such as Andres Freund and Noah Misch. Comparing git history back to Postgres 14, the number and size of the reverts isn't unprecedented. What changed is timing: they landed much later in the cycle than usual. The clearer AI effect is on security reports. There have been 44 CVEs this year against roughly 5 last year. Handling them pulled senior reviewers away from regular patch review, which plausibly explains the late reverts. I find that more believable than the "AI found all the bugs" story, and a bit more mundane. ## MD5 password warnings get teeth PostgreSQL 18 added the md5_password_warnings GUC and a deprecation warning for MD5 hashes. The catch: it only fired when a password was set, through CREATE ROLE, ALTER ROLE, or a pg_dumpall replay. Logging in with an existing MD5 hash warned nobody. Clusters that carried old hashes through pg_upgrade never saw it, and pg_upgrade discards the log output unless you pass --retain. Beta 4 fixes this by warning on every successful MD5 authentication. The warning goes to both the client and the server log, under the md5 and password methods, including replication connections. One caveat: the GUC's context is user, so any role, including the one being warned, can silence it with ALTER ROLE or connection options. A quiet log doesn't prove MD5 is unused. The reliable check is to query pg_authid as a superuser and list every role with an MD5 hash. Leave the parameter on. The eventual plan is for a future release to refuse MD5 authentication outright by changing CheckMD5Auth(). ## Other news from the week - **PgBouncer 1.26** patches three CVEs, two of them exploitable by unauthenticated clients. - A multi-part security research series describes a PostGIS memory corruption bug used for remote code execution against managed Postgres providers including Neon and Supabase. - A Postgres FM episode covers ClickHouse's acquisition-like collaboration with Ubiq Cloud and its new WAL Shadow physical replication tool. - PlanetScale announced a Postgres sharding product called Nekki. - Other reading includes advice on reviewing Postgres patches, a retrospective on 10 years of declarative partitioning, guidance on safely giving AI agents database access, and a podcast on Peter Eisentraut's 25 years of Postgres contributions. ## Questions this post answers ### What features were removed from PostgreSQL 19 before its beta 4 release? Partition merge/split, SQL graph data structures, some pg_get_* functions, and CREATE PUBLICATION ... EXCEPT were reverted from PostgreSQL 19 ahead of beta 4 to prioritize stability and keep the release schedule predictable. These features are expected to be revisited in a later major version rather than dropped permanently. _Track which PostgreSQL 19 features actually ship by following release coverage on daily.dev before planning an upgrade._ ### Is PgBouncer 1.26 a critical security update? Yes, PgBouncer 1.26 patches three CVEs, two of which are exploitable by unauthenticated clients, making prompt updating advisable for anyone running PgBouncer in front of PostgreSQL. No further detail on exploit specifics is given beyond the unauthenticated-access risk. _Database teams patching connection poolers can follow pgbouncer security updates on daily.dev._ ### How was PostGIS exploited for remote code execution against managed Postgres providers? A memory corruption vulnerability in PostGIS was exploited to achieve remote code execution against managed Postgres providers, including Neon and Supabase. The issue is detailed across a multi-part security research series and is especially relevant to anyone running PostGIS in a managed cloud environment. _Anyone running PostGIS in managed Postgres can keep up with vulnerability research via daily.dev._ ## Similar posts on daily.dev - [PostgreSQL 19 Beta Introduces SQL Graph Queries and Concurrent Table Repacking](https://daily.dev/posts/postgresql-19-beta-introduces-sql-graph-queries-and-concurrent-table-repacking-2adopzbmz) · InfoQ · 91 upvotes · 4 comments --- Tags: [#security](https://daily.dev/tags/security), [#database](https://daily.dev/tags/database), [#postgresql](https://daily.dev/tags/postgresql) [View this post on daily.dev](https://daily.dev/posts/postgresql-19-beta-4-released-with-some-features-rolled-back-ahead-of-october-ga-rajzl9sob) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"PostgreSQL 19 Beta 4 released, with some features rolled back ahead of October GA","url":"https://daily.dev/posts/postgresql-19-beta-4-released-with-some-features-rolled-back-ahead-of-october-ga-rajzl9sob","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/postgresql-19-beta-4-released-with-some-features-rolled-back-ahead-of-october-ga-rajzl9sob"},"datePublished":"2026-09-27T21:07:11.124Z","dateModified":"2026-10-02T02:02:36.469Z","description":"PostgreSQL 19 Beta 4 is available, with several previously planned features rolled back - including partition merge/split, SQL graph data structures, some...","image":"https://i.ytimg.com/vi/01DIq0ydMJ8/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/01DIq0ydMJ8/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/postgresql-19-beta-4-released-with-some-features-rolled-back-ahead-of-october-ga-rajzl9sob","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,database,postgresql","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"PostgreSQL 19 Beta 4 released, with some features rolled back ahead of October GA"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/postgresql-19-beta-4-released-with-some-features-rolled-back-ahead-of-october-ga-rajzl9sob#faq","mainEntity":[{"@type":"Question","name":"What features were removed from PostgreSQL 19 before its beta 4 release?","acceptedAnswer":{"@type":"Answer","text":"Partition merge/split, SQL graph data structures, some pg_get_* functions, and CREATE PUBLICATION ... EXCEPT were reverted from PostgreSQL 19 ahead of beta 4 to prioritize stability and keep the release schedule predictable. These features are expected to be revisited in a later major version rather than dropped permanently. Track which PostgreSQL 19 features actually ship by following release coverage on daily.dev before planning an upgrade."}},{"@type":"Question","name":"Is PgBouncer 1.26 a critical security update?","acceptedAnswer":{"@type":"Answer","text":"Yes, PgBouncer 1.26 patches three CVEs, two of which are exploitable by unauthenticated clients, making prompt updating advisable for anyone running PgBouncer in front of PostgreSQL. No further detail on exploit specifics is given beyond the unauthenticated-access risk. Database teams patching connection poolers can follow pgbouncer security updates on daily.dev."}},{"@type":"Question","name":"How was PostGIS exploited for remote code execution against managed Postgres providers?","acceptedAnswer":{"@type":"Answer","text":"A memory corruption vulnerability in PostGIS was exploited to achieve remote code execution against managed Postgres providers, including Neon and Supabase. The issue is detailed across a multi-part security research series and is especially relevant to anyone running PostGIS in a managed cloud environment. Anyone running PostGIS in managed Postgres can keep up with vulnerability research via daily.dev."}}]} ```