--- title: Supabase buys Turso and ships a dozen features,... description: Supabase had a big day: it announced Multigres, OrioleDB, and a wave of agent-facing MCP tooling at Select 2026, then turned around and acquired Turso to chase... canonical: https://daily.dev/posts/supabase-buys-turso-and-ships-a-dozen-features-pgbouncer-patches-two-pre-auth-cves-vw5kpzmnt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Supabase buys Turso and ships a dozen features, PgBouncer patches two pre-auth CVEs | daily.dev og:description: Supabase had a big day: it announced Multigres, OrioleDB, and a wave of agent-facing MCP tooling at Select 2026, then turned around and acquired Turso to chase... og:url: https://daily.dev/posts/supabase-buys-turso-and-ships-a-dozen-features-pgbouncer-patches-two-pre-auth-cves-vw5kpzmnt og:image: https://api.daily.dev/og/posts/vw5KPzMnt.png og:image:alt: Supabase buys Turso and ships a dozen features, PgBouncer patches two pre-auth CVEs og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Supabase buys Turso and ships a dozen features, PgBouncer patches two pre-auth CVEs **[Databases Digest](https://daily.dev/sources/databases_digest)** · 4 min read · 0 upvotes · 0 comments ## Summary Supabase had a big day: it announced Multigres, OrioleDB, and a wave of agent-facing MCP tooling at Select 2026, then turned around and acquired Turso to chase the agentic-database-sprawl use case. Meanwhile PgBouncer 1.26.0 quietly fixed three CVEs, two of them pre-authentication, in a pooler most teams haven't patched in years. ClickHouse published a genuinely useful direct I/O writeup showing how to stop Postgres backups from evicting your warm cache. And turbopuffer is live-blogging its own migration disasters, which is more honest engineering content than you usually get from a vendor. ## Content **TLDR:** Supabase had a big day: it announced Multigres, OrioleDB, and a wave of agent-facing MCP tooling at Select 2026, then turned around and acquired Turso to chase the agentic-database-sprawl use case. Meanwhile PgBouncer 1.26.0 quietly fixed three CVEs, two of them pre-authentication, in a pooler most teams haven't patched in years. ClickHouse published a genuinely useful direct I/O writeup showing how to stop Postgres backups from evicting your warm cache. And turbopuffer is live-blogging its own migration disasters, which is more honest engineering content than you usually get from a vendor. --- ## Supabase acquires Turso while announcing Multigres, OrioleDB, and dbarena Supabase is buying Turso to build infrastructure for agents that spin up databases on demand, since Turso's Rust-based SQLite platform can manage millions of on-demand databases on a single server. Existing users of either product see no immediate change, and Turso founders Glauber Costa and Pekka Enberg are joining Supabase to lead the agentic infrastructure push. This came alongside Select 2026 announcements: Multigres (multi-node HA Postgres from the Vitess team, private alpha), OrioleDB (an undo-log storage engine claiming up to 1.8x throughput over heap, public beta), and dbarena, an open benchmarking site comparing Supabase, RDS, and Cloud SQL on cost and performance. [Read more](https://daily.dev/feed-by-ids?id=vKjh5o3DZ&id=EMGQDLEIi&id=b9q5iPDwk) ## Supabase ships Docker-free dev, declarative schemas, and agent guardrails The rest of Select 2026 leaned hard into letting coding agents run the backend: schema-as-SQL-in-repo with a new pg-delta diff engine for auto-generated migrations, a query_logs MCP tool, Health Check Advisors, and MCP Elicitations that force a confirmation prompt before destructive SQL or paid actions. Pipelines (public alpha) now streams Postgres data to BigQuery, ClickHouse, DuckLake, or Snowflake. Scoped personal access tokens default to read-only now, which is the kind of default you want when agents are holding the keys. [Read more](https://daily.dev/feed-by-ids?id=57EK84lKt&id=fPLZJNg2W) ## PgBouncer 1.26.0 patches two pre-auth CVEs nobody was watching for CVE-2026-19888 is a NULL pointer dereference in SCRAM parsing that's been sitting there since 1.11.0 in 2019; a malformed client-final-message crashes the process pre-authentication. CVE-2026-6668 is worse in a quiet way: an integer overflow in packet buffer growth makes PgBouncer hang instead of crash, silently freezing every client since it's single-threaded. The post's framing is right: PgBouncer doesn't ride the regular Postgres minor-version upgrade cadence, so it rots. If you're running it, this is not a someday-patch. [Read more](https://daily.dev/posts/RhxrDVMAu) ## ClickHouse details the direct I/O tuning behind its Postgres backup fix Backups reading off the same NVMe drives as live queries blow out the page cache by default, evicting Postgres's warm working set. ClickHouse switched Managed Postgres backups to Direct I/O, but naive O_DIRECT loses kernel readahead and tanks throughput on striped RAID0 unless reads are sized to span the full stripe (4 MiB across four drives in their test). On a 48 vCPU box with a 467 GB database, buffered backups pushed query p99 to 4.7x baseline; stripe-sized Direct I/O kept it at 1.5x, used 14% less CPU, and finished faster. This now ships by default, auto-sized per server from vCPU count, RAM, drive count, and NVMe family. [Read more](https://daily.dev/posts/Vf0nryKR9) --- ## Also notable - **turbopuffer live-blogs its own migration pain:** turbopuffer is publicly documenting its new architecture running up to 128x slower than the old one before a series of posted optimizations clawed performance back, which is a rare level of honesty about the ugly middle of a rewrite. [Read more](https://daily.dev/posts/1hG2lNQWX) - **Iceberg catalog clients: Rust wins on cold start, Python loses on OneLake:** Benchmarking iceberg-catalog-rest 0.10.1 against pyiceberg 0.12.0 found Rust 1.9x-4.29x faster locally (mostly the HTTP library, not the language), but the real gotcha is pyiceberg's load_table running 4x slower on OneLake because it requests a vended storage credential by default that the Rust client never sends. [Read more](https://daily.dev/posts/WrxhDEMfw) - **MariaDB's 2026 CVE reports jumped from 16/quarter to 92:** MariaDB Foundation says AI-assisted security research tools drove legitimate vulnerability reports from a historical high of 16 per quarter to 81 and then 92, and the team still fixed every confirmed issue, publishing 27 public security advisories. [Read more](https://daily.dev/posts/FwI1JhQaI) - **Neon doubles free-tier storage, keeps 100-project cap:** Neon's Free plan now gives 1 GB of Postgres storage per project (up from 0.5 GB) while still allowing 100 projects, plus 100 CU-hours of compute and 5 GB of S3-compatible object storage per project, with existing projects upgraded automatically. [Read more](https://daily.dev/posts/70Bw3UYbp) - **Spanner queues add transactional messaging with no separate broker:** Spanner queues, now GA, let you enqueue a message inside the same read-write transaction that updates state, so both commit or roll back atomically, with message leases and ASSERT_ROWS_MODIFIED for safe acknowledgment instead of needing a bolted-on message queue. [Read more](https://daily.dev/posts/8VKZAZHLP) ## Similar posts on daily.dev - [Scale without limits: Multigres, OrioleDB, and dbarena](https://daily.dev/posts/scale-without-limits-multigres-orioledb-and-dbarena-emgqdleii) · Supabase · 2 upvotes · 0 comments - [Supabase is acquiring Turso](https://daily.dev/posts/supabase-is-acquiring-turso-vkjh5o3dz) · Supabase · 43 upvotes · 5 comments --- Tags: [#postgresql](https://daily.dev/tags/postgresql), [#clickhouse](https://daily.dev/tags/clickhouse), [#supabase](https://daily.dev/tags/supabase) [View this post on daily.dev](https://daily.dev/posts/supabase-buys-turso-and-ships-a-dozen-features-pgbouncer-patches-two-pre-auth-cves-vw5kpzmnt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/supabase-buys-turso-and-ships-a-dozen-features-pgbouncer-patches-two-pre-auth-cves-vw5kpzmnt","headline":"Supabase buys Turso and ships a dozen features, PgBouncer patches two pre-auth CVEs","text":"Supabase had a big day: it announced Multigres, OrioleDB, and a wave of agent-facing MCP tooling at Select 2026, then turned around and acquired Turso to chase the agentic-database-sprawl use case. Meanwhile PgBouncer 1.26.0 quietly fixed three CVEs, two of them pre-authentication, in a pooler most teams haven't patched in years. ClickHouse published a genuinely useful direct I/O writeup showing how to stop Postgres backups from evicting your warm cache. And turbopuffer is live-blogging its own migration disasters, which is more honest engineering content than you usually get from a vendor.","url":"https://daily.dev/posts/supabase-buys-turso-and-ships-a-dozen-features-pgbouncer-patches-two-pre-auth-cves-vw5kpzmnt","datePublished":"2026-10-03T04:17:56.495Z","dateModified":"2026-10-03T04:18:14.379Z","author":{"@type":"Organization","name":"Databases Digest","logo":"https://media.daily.dev/image/upload/s--ir1hdV8b--/f_auto,q_auto/v1773839400/logos/databases_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/databases_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/databases_digest","name":"Databases Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Databases Digest","item":"https://daily.dev/sources/databases_digest"},{"@type":"ListItem","position":3,"name":"Supabase buys Turso and ships a dozen features, PgBouncer patches two pre-auth CVEs"}]} ```