OffNet Newsroom

Daily topic roundup

Database Technology

Thursday, September 24, 2026 · 8 stories, curated & summarized — click any story for the source.

Amazon FireTV redesigned its watch-progress data model in DynamoDB to handle millions of users by splitting large items into smaller, vertically partitioned entities. The team uses hash-prefixed sort keys to enable parallel reads, effectively removing item-size limits and maintaining read latency under 50 milliseconds regardless of profile size. This architecture resulted in a 97% reduction in write costs while supporting high-throughput scenarios.

  • Vertical partitioning eliminates DynamoDB 400KB item limits for large datasets.
  • Hash-prefixed sort keys enable parallel read operations across shards.
  • Write costs dropped 97% by avoiding large item overwrites.
  • Read latency stays under 50ms even as profile data grows.
PostgreSQL News database

PgBouncer 1.26.0 patches three CVEs and adds SCRAM fixes

PgBouncer 1.26.0 addresses three denial-of-service vulnerabilities triggered by unauthenticated clients or malicious servers. The fixes target issues in SCRAM authentication, packet buffer integer overflows, and unbounded login workloads. The release also introduces search_path tracking, new timeout settings, and Meson build support while removing deprecated restart functionality.

  • Patch immediately to prevent DoS via SCRAM nonce, integer overflow, and unbounded login iterations.
  • Update to track search_path and default_transaction_read_only by default for better context awareness.
  • New pool_idle_timeout and per-user/query_wait_timeout settings allow finer-grained resource control.
  • Meson build is now supported; remove usage of deprecated online restart (-R) flag.
CHECKLISTPgBouncer 1.26 Update ActionsPatch immediately to prevent DoS via SCRAM nonceFix integer overflow and unbounded login iteration issuesEnable search_path and read_only tracking by defaultConfigure new pool and query timeout settingsAdopt Meson build and remove deprecated restart flag

A community member attempted to back up a promoted standby after setting archive_mode=off, expecting pgBackRest to proceed with archive-mode-check=n. The tool rejected the operation, requiring archive_mode to be enabled even when source code checks were removed. The author recommends sticking to supported configurations like restarts or controlled switchover rather than relying on this unsupported workaround.

  • pgBackRest enforces archive_mode=on even if archive-mode-check=n is set
  • Removing source code checks allows the backup but breaks support guarantees
  • Promoted standbys with archive_mode=off cannot be backed up via pgBackRest
  • Use restarts or controlled switchovers to restore valid archiving state
  • Avoid unsupported source modifications for production backup strategies
CHECKLISTSafe pgBackRest Recovery StepsPerform restarts to restore valid archiving stateUse controlled switchovers for promoted standbysAvoid unsupported source code modificationsEnsure archive_mode is enabled for backups

Mehmet Ince's Part 2 of his research highlights that most managed PostgreSQL vendors currently have no monitoring for the shared-buffer-based superuser backdoor technique. While Databricks has begun publicly addressing these systemic risks, the broader industry remains largely unresponsive to extension-based threats. Ince's findings indicate that risks stemming from security-hardening extensions are comparable in severity to core zero-days, yet receive insufficient attention.

  • Managed Postgres vendors lack monitoring for shared-buffer superuser backdoors.
  • Extension-based risks are as critical as core PostgreSQL zero-days.
  • Industry response has been limited, with few vendors addressing the issue.
  • Databricks is an early adopter in publicly discussing these systemic risks.

AWS highlights a integration between Amazon Neptune and Linkurious Enterprise that allows business users to explore graph data without writing code. The solution supports full-text search via Amazon OpenSearch Service and facilitates complex queries for anti-money laundering compliance, such as tracing ultimate beneficial owners. This setup bridges the gap between technical graph databases and intuitive business intelligence tools.

  • Linkurious Enterprise connects directly to Amazon Neptune for visual graph exploration.
  • Business users can perform risk investigations without coding knowledge.
  • Full-text search capabilities are powered by Amazon OpenSearch Service.
  • Useful for AML compliance and tracing ultimate beneficial owners.

Mikhail Shytsko reports that 40 DELETE statements vanished from pg_stat_statements due to the view's default 5,000-entry limit. A subsequent agent performed two full schema reads, generating 12,800 zero-row statements that evicted the DELETE entries. This is documented LRU behavior where single-run statements are discarded to make room for more frequent queries.

  • Default 5,000 entry limit causes eviction of low-frequency statements like batch deletes.
  • High-volume schema reads or DDL can displace critical DML metrics from the view.
  • pg_stat_statements tracks least-executed statements first, not just oldest.
  • Monitor pg_stat_statements_info.dealloc to detect active eviction pressure.
  • Increase max_entries if monitoring rare but important administrative operations.
WORTH QUOTINGThe gist“Mikhail Shytsko reports that 40 DELETE statements vanishedfrom pg_stat_statements due to the view's default5,000-entr…— Planet PostgreSQL
AWS Database Blog awsdatabase ↺ since 09-22

Replacing SQL Server Refcursors in PostgreSQL with Temp Tables or JSON

PostgreSQL lacks native support for returning multiple result sets from a single stored procedure call, unlike SQL Server. This guide details two PostgreSQL-native alternatives: session-scoped temporary tables and JSON aggregation. It provides implementation and validation strategies for both approaches using .NET and Npgsql.

  • PostgreSQL cannot replicate SQL Server's multi-result-set behavior directly.
  • Use session-scoped temp tables or JSON aggregation as viable alternatives.
  • Both methods require specific refactoring of existing stored procedure logic.
  • Validation and implementation examples are provided for .NET and Npgsql.
  • Performance comparison against refcursor baselines is included in the full guide.
PostgreSQL Releases databasereleases ↺ since 09-23

PostgreSQL 19 Beta 4 released for testing

The PostgreSQL global development group has published the fourth beta release for version 19. This build continues the iterative hardening process leading toward the final stable release. It includes accumulated code changes and bug fixes identified since the previous beta.

  • Target this release for functional testing of upcoming PG 19 features.
  • Verify compatibility with existing extensions and custom PL/pgSQL code.
  • Monitor for regressions in performance-critical query paths.
  • Use for schema migration validation before production upgrade planning.
↑