PostgreSQL 19 Is Almost Here. Here’s What To Know.

PostgreSQL 19 hit its fourth beta on September 24, with a release candidate expected in early October and general availability targeted for the end of the month. The release brings improvements to table maintenance, logical replication, and query planning. Some anticipated features, including SQL/PGQ and partition merging and splitting, have been deferred.

Among the deferred features is SQL/PGQ, which would have added native SQL syntax for graph queries over relationships in existing tables. MERGE PARTITIONS and SPLIT PARTITIONS were also deferred. The PostgreSQL community chose to give these features more development and review time, prioritizing reliability for the release. If you were planning around an earlier beta, check the Beta 4 announcement for the changes.

What's coming in PostgreSQL 19 includes several practical improvements for database operators:

• REPACK, and REPACK CONCURRENTLY. A new command that reclaims disk space and reorganizes a table, combining what VACUUM FULL and CLUSTER did before. The CONCURRENTLY option is the highlight news, since it repacks a bloated table without holding an exclusive lock throughout the rewrite, though it still needs one, typically briefly, for the final file swap. For anyone who has scheduled downtime just to reclaim space, this is the one to note.
• Logical replication that synchronizes sequence values. Sequence values can now be copied during initial synchronization and refreshed explicitly, which closes a long-standing gap in logical replication. It can also be enabled without a server restart when wal_level is already set to replica.
• Planner improvements around joins. More cases where NOT IN converts to an efficient ANTI JOIN when NULLs aren't present, more LEFT JOINs that can become ANTI JOINs, and some aggregate work that can now happen before joins to cut the rows processed. These are quiet, but they make existing queries faster without changes to your SQL.
• Security tightening. MD5 password authentication, deprecated back in 18, now warns on use, and RADIUS-over-UDP has been removed for being unfixably insecure. If you're still on MD5 auth, 19 is the nudge to move.

None of this is a reason to rush an upgrade the week it ships. The practical move is one that always applies to a new major version, wait for the GA release notes, and test against your real workload in staging before you touch production. REPACK with the CONCURRENTLY option alone puts 19 on the radar, since reclaiming table space without downtime is a problem operators have worked around for years.

🔍 What We're Watching in the Database Ecosystem

Jev vs. LLMs: When AI Moves from Generation to Decision-Making

Jev returns a choice from a predefined set with a probability attached, rather than prose a program has to parse. Tested across 3,080 classification tasks, its expected calibration error came in at 0.002 to 0.047 against 0.078 to 0.163 for four chat models on the same benchmark. The author's caution is that calibration holding on one dataset doesn't mean it holds on yours.

Forty Deletes Vanished From pg_stat_statements

Mikhail Shytsko flooded pg_stat_statements past its 5,000-entry default with 12,800 agent-issued reads. What got evicted was forty one-off DELETE statements, while the application's hot query at 500 calls stayed put. Rarely executed statements can be evicted as new entries arrive, so pg_stat_statements alone can't tell you everything an agent did to your database.

Breaking the Postgres Superuser Guardrails, Part 2

Mehmet Ince reports 76 vulnerabilities in managed Postgres providers' security-hardening extensions. Part two covers a foreign data wrapper validator bypass and a search_path trick that runs an attacker's function during an elevated-privilege window, showing how the safeguards intended to restrict access can introduce vulnerabilities of their own.

In Case You Missed It

What's New in RDST: Free Inference and an Apache 2.0 License: RDST now runs on free Readyset-hosted inference when you sign in, so no Anthropic key needed or per-token cost to pay, and it's moved to an Apache 2.0 license, which clears it for forking, embedding, and internal tooling.

We're getting more social, catch the latest on Bluesky, X, dev.to, and Medium too.

Know a database aficionado who'd appreciate this? Forward it their way.