Database news and engineering summaries

A persistent MySQL bug, identified in 2005, caused triggers to fail during cascading foreign key operations. After 20 years of community discussion and controversy regarding database integrity, the issue has finally been resolved as part of WL#17024, enabling triggers on referenced tables during cascade events.

An early, unreviewed prototype modeling the PostgreSQL engine internals. This educational project aims to explain database mechanisms but is currently in a preliminary state. The author encourages community feedback and contributions through GitHub issues or pull requests to improve accuracy.

Tailscale experienced significant uptime instability due to a 16-year-old 'WAL-Reset' bug in SQLite. Triggered by Tailscale's non-standard, aggressive manual checkpointing, the bug caused silent data corruption. After months of forensic investigation and collaboration with SQLite maintainers, the issue was identified, patched, and verified, restoring reliability and hardening Tailscale's database infrastructure.

SELF (Structured Executable & Linkable Format) is a prototype that replaces ELF with SQLite databases that can be chmod +x and executed. It represents segments, symbols, relocations, and dependencies as queryable tables, enabling SQL-based tooling, dynamic linking, closures, and transactional modifications. Built with Nix, it is lossless but currently has startup, memory-mapping, and size overheads.

The author argues that Object-Relational Mappers (ORMs) often cause more problems than they solve due to issues like attribute creep, complex foreign key joins, and the Object-Relational Impedance Mismatch. Instead of relying on ORMs for query generation, the author advocates for mastering SQL and treating the database as an API-driven data type.

The article strongly advocates for migrating from MySQL to MariaDB due to the deteriorating state of the former under Oracle's stewardship. By 2026, MySQL showed significant declines in git commits, limited bug tracking transparency, and a shift toward closed-door development. The author highlights technical regressions, performance degradation in newer versions, and a lack of new features in long-term support releases like MySQL 8.4. In contrast, MariaDB maintains a transparent, community-driven development model. Security concerns are also emphasized, noting that MySQL published significantly more CVEs with less disclosure compared to MariaDB. For users seeking to maintain software sovereignty and better performance, the author recommends MariaDB as a compatible, truly open-source alternative that provides an easy migration path for classic LAMP stacks and custom applications.

DuckDB v2.0 “Cyanoptera,” arriving this fall, expands DuckDB from an in-process database into a server-capable analytical platform. Key updates include Quack/CONNECT, first-class VARIANT, triggers, a new SQL parser and storage format, asynchronous I/O, major query and partition-pruning improvements, native timezone support, and a stable C API for portable, signed extensions.

A major security vulnerability in the meeting recording platform tl;dv allows any authenticated user to access metadata for all meetings across the entire platform due to a lack of Firestore tenant isolation. Additionally, an internal employee application leaks sensitive personnel information without authentication. Despite disclosures starting in January 2026, the issues remain unaddressed by the company.

The article proposes using SQLite instead of Postgres for durable workflow execution, particularly for AI agents. By utilizing a local database file combined with Litestream for S3 backups, developers can achieve durable state management without complex infrastructure. This approach offers cost-effective, simple, and fault-isolated solutions, though Postgres remains better for high-availability requirements.

A recent security scan of 198 iOS apps revealed that 196 of them have exposed data, highlighting significant vulnerabilities in the mobile ecosystem. Major applications including Chat & Ask AI, GenZArt, and YPT - Study Group account for hundreds of millions of exposed records and files. This public registry showcases the scale of data exposure across various categories ranging from AI tools to educational games.

Shopify replaced its Redis-based inventory reservation system with a MySQL-powered solution using SKIP LOCKED. By optimizing index design, transactional isolation, and connection management, they eliminated overselling risks while maintaining high-throughput concurrency during peak sales. The transition leveraged shadow mode monitoring to ensure scalability and ACID compliance across critical checkout operations.

SQLite strict tables, introduced in version 3.37.0, enforce rigid data typing by preventing invalid type insertions and bogus column declarations. While strict tables add validation overhead and require table recreation for migration, they improve data integrity and prevent subtle bugs caused by SQLite's default flexible typing, despite the official advocacy for flexible schemas.

A database migration caused significant replication lag on May 12, 2026, leading to delayed Code Scanning, notifications, and webhooks processing. The issue, which lasted several hours, was resolved by scaling up processing workers. Future measures include creating dedicated worker pools for high-usage queues to maintain system stability and performance.

F3 is a next-generation open-source columnar data file format designed for efficiency, extensibility, and interoperability. It addresses layout limitations in formats like Parquet by embedding Wasm decoders within files, ensuring future-proof compatibility and platform-agnostic performance. The project provides a research prototype and API for developers, enabling adaptable data encoding schemes for evolving analytics workloads.

Many development teams prematurely adopt complex architectures, adding unnecessary databases like Redis, Elasticsearch, or MongoDB. Postgres is often sufficient for most use cases, offering robust features for caching, queues, search, and analytics. Prioritizing simplicity reduces operational overhead, maintenance burdens, and costs, allowing startups to focus on innovation until actual scale necessitates more specialized solutions.

The US Library of Congress recommends SQLite as a top-tier storage format for datasets. It joins XML, JSON, and CSV due to its high level of transparency, self-documentation, and low dependency requirements, ensuring long-term digital preservation and archival accessibility for critical datasets.

Using random UUID4 as primary keys in SQLite leads to significant performance degradation due to B-tree rebalancing and increased paging. Performance testing reveals that UUID4 inserts are 10-12 times slower than integer primary keys. Switching to time-ordered UUID7 effectively mitigates these issues, bringing performance near baseline levels despite the larger byte size of UUIDs.

PgDog is an open-source proxy project designed to make Postgres horizontally scalable, supporting over 1 million queries per second and 100 TB+ datasets. Founded by experienced infrastructure engineers backed by $5.5M in funding, it aims to eliminate scaling challenges for Postgres while providing flexible deployment options across cloud and on-prem environments.

Hister is AGPLv3 free software for building a private, self-hosted search index of selected web pages, files, browser history, and crawled sites. It extracts full text, stores previews, and supports advanced queries through web, CLI, HTTP API, and MCP. No telemetry or required cloud service; optional semantic search uses an endpoint you configure.

This guide covers essential Postgres management for startups, emphasizing iterative schema design, performance-oriented querying with indices, and effective connection management. It covers intermediate topics like the query planner, query optimization with EXPLAIN ANALYZE, balancing autovacuum settings to prevent bloat, and advanced strategies such as partitioning and FOR UPDATE SKIP LOCKED to ensure production reliability.