Postgres Weekly
Plus critical Postgres releases, a way to encrypt PL/pgSQL code, and SQLite with a Postgres interface.

#​649 — May 20, 2026

Web Version

Together with  Greptile

Postgres Weekly

Postgres 18.4, 17.10, 16.14, 15.18, and 14.23 Released — All supported versions get an update to fix 11 security vulnerabilities and over 60 bugs. The vulnerabilities include serious memory corruption and trust-boundary bugs, not just in the server but also in clients that connect to malicious servers.

PostgreSQL Global Development Group

💡 Christophe Pettus digs deeper in Eleven CVEs Walk Into a Release.

Would Greptile Have Caught That Postgres Bug? — Paste the GitHub PR that introduced it without signing up. Greptile reviews the old PR like a new one and shows the comments it would have left.

Greptile sponsor

IN BRIEF:

Four Features You'll Actually Feel in Postgres 19 Beta — The final release isn’t till September, but the beta is due soon. Rather than look at headline features, Christophe focuses on things that change “how the database feels in production”, like JIT being turned off by default and parallel autovacuum index workers.

Christophe Pettus

The ORDER BY Jungle: Why ORDER BY Aliases Behave StrangelyORDER BY a and ORDER BY -a look almost identical but hit two different parsers: the SQL-92 name path and the SQL-99 expression path. Radim traces the seam through aliases, GROUP BY, window functions, quoted identifiers, COLLATE, and UNION, down to the responsible function.

Radim Marek

📄 Building Automatic, Contextual Clinical Trial Audit Logging in Postgres Without Triggers – Using TypeScript and Drizzle, specifically. Nathan Leung (Harbor)

📄 How We Saved 40GB of Space Wasted on Indexes“TLDR: Don’t randomly add indexes to your db tables.” Ravi Ojha

RELEASES AND CODE:

plpgsql_wrap 1.0: A Way to Obfuscate PL/pgSQL Code — HexaCluster has open sourced its extension for distributing and running encrypted PL/pgSQL procedures that can be dumped and reloaded without end users being able to read them. Inspired by Oracle’s ‘wrap’ approach.

Gilles Darold (HexaCluster)

🤖 Supabase is Now an Official ChatGPT App — Supabase can now integrate with the ChatGPT app so you can manage your database, projects, and branches directly from it.

Greg Richardson (Supabase)

pgsqlite: A Postgres Protocol Adapter for SQLite Databases — A wire-protocol adapter that makes an SQLite database pretend to be Postgres, so the usual psql/pgAdmin/driver stack just works against it.

Eran Sandler

📰 Classifieds

🧠 Postgres alerts that come with diagnoses and proposed SQL fixes, not just thresholds. Open source.


🐘 Self-hosting Postgres? Try out ParadeDB, a Postgres extension that enables Elasticsearch-quality full-text, vector and hybrid search. No ETL pipeline, no Elastic cluster.


Start building with Aiven’s dev tier for Apache Kafka. Build on an enterprise stack for $35/mo. Provision managed Kafka with 100 partitions, Schema Registry & REST Proxy in under 2 mins.

  • 📈 pg_statviz 1.0 – Extension and utility for analysis and visualization of Postgres internal statistics. Now with a new AI-powered analysis option.

  • Postgres Language Server 0.25 – Supabase's Language Server Protocol (LSP) implementation for Postgres.

  • SQLsmith 1.5 – Random SQL query generator to produce and execute diverse statements for testing.

Issue 648 #649