DB Weekly: 500 GB of Postgres moved in a night, and Weaviate 1.40 goes GA
The October 5-12 brief turns a 500 GB live Postgres migration with published benchmark numbers, Weaviate 1.40's general availability, a two-CVE PostgreSQL JDBC release, a MongoDB driver wave and MySQL's switch to calendar versioning into concrete upgrade and migration gates for backend teams.
The week from October 5, 2026 at 10:00 a.m. through October 12, 2026 at 10:00 a.m. (UTC-08:00) carried the clearest production migration result this brief has reported in weeks. Clera, an AI recruiting platform, moved a 500 GB Postgres database between hosting providers in a single night while production traffic kept running, and published its own throughput numbers. 1
Weaviate took its 1.40 line to general availability, with namespaces as a licensed feature. 2 PostgreSQL's JDBC driver fixed two CVEs, MongoDB's drivers restored a namespace-redirect fix, and Oracle's MySQL team renamed its innovation releases to a calendar scheme.
Neither the PostgreSQL project nor Oracle shipped a server release inside the window. The PostgreSQL news archive still ends at the September 24 PostgreSQL 19 Beta 4, and the MySQL announcements feed still ends at the August 25 release train. 34 Core-engine upgrade work for both families stays where the previous brief left it.
Decision table
| Date (UTC-08:00) | Component | Verified change | Trade-off or gate | Immediate check |
|---|---|---|---|---|
| Oct 6-12 | Weaviate 1.40.0 and a six-tag patch wave | 1.40.0 is GA with Namespaces, drop-vector-index and deduplicated backups, plus RQ4 quantization and a REST search API; the stable-branch patches repair LSM-store, object-TTL and schema paths and pin zlib and golang.org/x/net for two CVEs 256 | 1.40.0 lists no breaking changes, and two headline features need a license key; the patch wave moves recovery, backup and schema code | Test schema drop/recreate, backups and restart recovery on the branch you run |
| Oct 7-9 | PostgreSQL JDBC 42.7.14 | Fixes CVE-2026-107314, where an all-exclusion requireAuth value was read as no restriction, and CVE-2026-107315, where an undersized stream value was padded with bytes of earlier messages 78 | 42.7.11 through 42.7.13 and 42.7.4 through 42.7.13 carry the two flaws; a connection using an all-exclusion requireAuth value stops connecting after the upgrade | Audit every requireAuth value and any ByteStreamWriter use, then upgrade |
| Oct 7 | pgx-bm25 1.0 | A BM25 ranked full-text index access method for PostgreSQL 17 and 18, living in the index relation's own pages with WAL logging, crash recovery and VACUUM maintenance 9 | An in-database option beside an external search engine; PostgreSQL 19 is tested but unsupported | Benchmark it against your current GIN or ts_rank setup |
| Oct 7 | pg_plan_filter 1.0.0 | A loadable module that refuses a statement whose planner cost exceeds statement_cost_limit, or caps a transaction's combined cost, for PostgreSQL 14 through 18 10 | It trusts planner cost estimates and works at statement granularity | Set a statement cost ceiling as a guard against runaway queries |
| Oct 6-9 | MongoDB drivers: Go 2.9.2, PyMongo 4.18.3, C 1.30.13, PyMongoCrypt 1.20.0, plus two more patches | Go 2.9.2 restores the CVE-2026-81521 fix, where a period in a caller-supplied database name could redirect Client.BulkWrite; PyMongo 4.18.3 hardens BSON regex decoding against malformed documents, CVE-2026-106435 1112 | The Go fix shipped in 2.8.2 and was missing from 2.9.0 and 2.9.1 | Move the Go driver to 2.9.2 and PyMongo to 4.18.3, then re-run field-encryption tests |
| Oct 7 | MySQL 26.7 | The innovation line moves to calendar versioning, Year.Month.Patch, so the release after 9.7 becomes 26.7.0; it adds the Change Stream Applier and brings the thread pool plugin to Community builds 13 | Reaching the 26.x line requires being on 9.7 LTS first, and group_replication_communication_stack now defaults to MySQL | Map your upgrade path to 9.7 LTS before planning a 26.x move |
| Oct 8 | Clera to ClickHouse Managed Postgres | 500+ tables and 500 GB moved from the EU to the US in one night with production traffic live; CPU fell from days at 100% to 10-20%; up to 42% more transactions per second than the runner-up on sysbench TPC-C 1 | A provider choice inside Postgres, with the engine unchanged; local NVMe storage decided it; extension portability was the largest preparation cost | Measure point-lookup latency under analytics load and compare storage backend before any provider move |
| Oct 12 | Percona thread-pool benchmark, part 2 | MySQL 26.7.0 and 9.7.2 perform within noise of each other; for MySQL the pool helps at 1,280 connections and above, while Percona Server's pool helps from 80 14 | One harness, one engine family, and a result that depends on buffer-pool size and thread-pool settings | Size thread_pool_size against your buffer pool and peak connection count |
A named migration with numbers: Clera to ClickHouse Managed Postgres
Clera is an AI recruiting agent that represents more than 200,000 candidates and lists around 2,250 live jobs. Its operational database held 500 GB of Postgres data at migration time, across more than 500 tables, and has grown since toward a terabyte. 1
The symptoms are worth naming because they define the failure this migration solved. A single candidate lookup took around three seconds. The database sat at 100% CPU for six straight days at a stretch. Point lookups — the small primary-key reads and writes — were being blocked behind background analytics queries and spiky scrape bursts, and the team saw timeouts and failed writes. 1
Clera evaluated four managed providers: Supabase, Neon, PlanetScale and ClickHouse Managed Postgres. The team replayed roughly 500 GB of production data on each and measured queries per second, p99 latency, error rate, connection-acquire times and wait events, then confirmed the result with sysbench TPC-C on the same machine class with 500 GB of generated data, at 8, 16, 32, 64 and 128 threads, three runs each. ClickHouse Managed Postgres won most of the replay and finished ahead on TPC-C by about 16% at 128 threads and 42% at 16 threads. 1
The deciding variable was storage. ClickHouse Managed Postgres runs vanilla Postgres on local NVMe disks, while the other providers use network-attached storage that adds latency to every read and write. That difference eliminated Supabase and Neon on the replay alone. 1
The migration itself ran overnight through two ClickPipes pipelines, with the database crossing the Atlantic while production traffic hit it. Rebuilding triggers and indexes and resequencing tables took longer than the copy. Extension portability was the largest preparation cost: providers ship extensions the others lack, and the team spent days beforehand rewriting around them. Cutover finished by early morning, and the service has run since at 10-20% CPU with no settings changed. 1
Two limits apply to the numbers. The two finalists did not ship identical Postgres settings by default, and ClickHouse notes that PlanetScale supplied tuning guidance the team partly applied, so the 42% margin includes a configuration gap that is hard to price. Huge pages could not be tested on one provider without its engineering team. Everything else is in an open repository, including logs, scripts and Terraform, so the result is reproducible. 1
Read this as a provider choice inside Postgres. Clera kept the engine and changed the company running it, and the report names the managed Postgres service as the destination, with the analytics engine a separate product to move to later. Teams whose point lookups stall behind analytics should compare storage backend and point-lookup latency before they compare engines.
Weaviate 1.40.0 reaches GA, with a patch wave behind it
Weaviate published v1.40.0 on October 7 and listed no breaking changes. Its main feature is Namespaces, which adds control-plane and data isolation between tenants on a shared cluster; the release makes namespaces a feature that requires a license. 2
Three more items arrive at general availability or preview in the same tag. Dropping a vector index through the schema API is GA and enabled by default, which lets a team reclaim disk space by removing an index it no longer needs. Reindexing a property's index types is in preview. Deduplicated backups are opt-in and also gated on a license key; the option archives converged shards once and fans the restore out to every replica. 2
HFresh, the disk-based vector index, gets a long list of allocations, memory and disk-write reductions, and MUVERA gains a decoupling of routing and reranking budgets. A new 4-bit rotational quantization scheme arrives. The release also drops the experimental flag on a dedicated REST search API, hardens async replication and replica movement, and reworks backup reliability. 2
A patch wave covers the stable branches across the same week. 15 and v1.38.20, both on October 6, repair the LSM store, stop a panicking shard delete from ending a collection's TTL sweep, make module settings configurable on an existing collection, and bound Parquet export memory. 16 v1.39.11 on October 9 replays a failed queue batch instead of blocking workers, recovers unreadable chunks, refuses multi-vector writes on indexes that lack support, and carries two CVE pins: zlib for CVE-2026-85091 and
golang.org/x/net for CVE-2026-78663. 5The last two tags landed on the closing morning, between 9:42 and 9:50 a.m. Pacific on October 12. v1.39.12 and v1.38.21 fix a schema bug that could drop a live class differing from an orphan only by letter case, and speed up reindexing vector dimensions at startup. 617 Earlier in the wave, v1.38.19 improved Parquet export but its release page would not render for verification. 18
PostgreSQL: two JDBC CVEs and two control extensions
The PostgreSQL JDBC driver published 42.7.14 with two fixes, dated October 7 and announced on October 9. The first is CVE-2026-107314: a
requireAuth value that excludes every authentication method, such as !password,!md5,!gss,!sspi,!scram-sha-256,!none, was treated as if requireAuth were unset. Releases 42.7.11 through 42.7.13 then accepted any method the server asked for, including cleartext password. After the upgrade, a connection with such a value fails with SQLState 08004, so the fix is also a behaviour change. 78The second is CVE-2026-107315. When an application sent a value shorter than the length it declared — a
ByteStreamWriter whose getLength() is larger than what writeTo() writes is the example — releases 42.7.4 through 42.7.13 padded the value with bytes of messages sent earlier on the same connection. A stored value could then contain SQL text and parameter values from earlier statements. The fix pads with zeros. 8Two new extensions widen what runs inside the database rather than beside it. pgx-bm25 1.0 adds Okapi BM25 ranked full-text search as a native index access method, installed as
bm25_native, for PostgreSQL 17 and 18. The index lives in its own relation's pages, so it inherits WAL logging, crash recovery and physical replication from core, and VACUUM maintains it. It supports BM25F scoring across multiple columns with per-field boosts, exact phrases, proximity search, boolean queries, prefix wildcards and highlighted snippets, and it uses block-max WAND so a top-10 query avoids scoring every match. 9That mechanism connects to a second release this week. Neon shipped
lakebase_tokenizer, which moves the synonym and stop-word dictionaries that shape BM25 scoring out of server-side text files and into SQL tables, so a managed Postgres user can teach the index that "k8s" and "kubernetes" are one term. The post shows the score moving once the tokens merge: two tickets tied at -2.477 under the default dictionary separate to -3.727 and -3.331. 19pg_plan_filter 1.0.0 is a smaller addition with a clear operational use. The loadable module tests a statement against configured cost criteria before execution and raises an error when they are violated, so an administrator can refuse a statement whose plan is too expensive, cap the combined cost of a transaction, or restrict the filter to
SELECT statements. It supports PostgreSQL 14 through 18. 10Two more PostgreSQL items sit on the window's opening edge. pg_ivm 1.16 adds PostgreSQL 19 support and fixes a segfault when a materialized view is maintained and dropped in one transaction, and pg_vault_tde 1.7.2 ships crash fixes and a new on-disk format. 3 Both are dated October 5 with no publication time, so neither can be placed inside the window with confidence. 20
MongoDB: a namespace-redirect fix and migration tooling at 1.0
MongoDB's driver wave carries the week's most interesting security fix. Go Driver 2.9.2, published October 6, restores the fix for CVE-2026-81521: a caller-controlled database name containing a period can be interpreted as a different namespace when the operation is forwarded to the server, which redirects the write to a database or collection the application did not name. The flaw covers v2.1.0 through v2.8.1 and v2.9.0 through v2.9.1, and the fix shipped in v2.8.2 but was left out of both 2.9 releases. The same tag restores a v2.8.1 fix for
Database.RunCommand returning a nil error when a command failed with NoWritesPerformed. 11The rest of the wave is routine, with one security entry. PyMongo 4.18.3, published October 8, hardens BSON regex decoding against malformed documents under CVE-2026-106435. 12 The C driver's 1.30.13 line fixes Decimal128 parsing, enforces a minimum size in
bson_reserve_buffer and corrects bson_writer_new on empty documents, while its libmongoc side is unchanged. 21 PyMongoCrypt 1.20.0 bundles libmongocrypt 1.20.5, which fixes a possible abort while parsing endpoints and rejects more payloads that cannot be decrypted. 22 A C++11 driver patch and a 2.x-line C driver patch round out the same days. 23Percona moved its MongoDB migration tool to a supported release. ClusterSync for MongoDB 1.0.0, announced October 6, adds high availability to the replication process itself, promotes sharding support to GA, and can replicate one source cluster to several targets at once with per-instance namespace filters. Percona reports that PriceShape, a Danish pricing-intelligence company, moved about 6.6 TB off MongoDB Atlas to Percona Server for MongoDB on Amazon EKS, keeping both clusters in lockstep until its cutover window. 24
An independent read of MongoDB 9.0 arrived the same week. Percona's Ivan Groenewold reports that MongoDB's own benchmarks claim up to 35% faster
findOne, 30% faster updateOne, 20% higher transactional throughput and 2x throughput on large instances, and that he could find neither the methodology nor the raw data behind them. He points to behaviour changes a product announcement leaves out: dotted-path comparisons involving null, server-side JavaScript date handling, change streams during elections, cross-database renameCollection and BSON validation. He also flags that $queryStats output changed structure in 9.0, so any tooling consuming it needs a check before an upgrade. 25MySQL: calendar versioning arrives, and Galera's support ends
Oracle renamed MySQL's innovation releases. Percona's explanation, published October 12, lays out the change: the release after 9.7 is 26.7.0, not 9.8, and the scheme is Year.Month.Patch, where 26 is 2026, 7 is July and 0 is the patch number. The quarterly cadence continues, so the next innovation release is expected as 26.10.0. The LTS line stays on a roughly two-year cycle, with the next LTS expected as 28.4.0 in April 2028. 13
The upgrade path is the decision that matters here. MySQL 9.7 LTS is the only entry point into the calendar-versioned line, so a team on 8.4 LTS has to reach 9.7 first, and a team on an end-of-life release has to climb through 8.4 and 9.7 in order. 13
26.7.0 itself ships four changes worth a staging pass. The Change Stream Applier separates applying a transaction from ordering its commit, so a worker that finishes applying can start another ready transaction instead of waiting; it is enabled per replication channel with
APPLIER_VERSION=2, APPLIER_WORKER_COUNT and APPLIER_EVENT_MEMORY_LIMIT, and it needs row-based replication and GTID. The thread pool plugin is now available in Community builds, removing its Enterprise dependency. Undo truncation state moved out of a separate log file into the undo tablespace header. And group_replication_communication_stack now defaults to MySQL rather than XCOM, which simplifies cluster addresses but requires stopping Group Replication on every member and re-bootstrapping the cluster to switch. XCOM is deprecated. 13The other MySQL-family event this week is a deadline that has already passed. End of support for all current MySQL Galera Cluster versions landed on September 30, 2026, after MariaDB plc acquired Codership. Percona's Valeria Bogatyreva frames the consequence as diagnostic rather than mechanical: the incidents teams remember are flashcache, a shadowed
wsrep_provider_options line, DNS resolving to the wrong interface or a one-way firewall path, and those are hard to diagnose when logs are clean and writes are stalled. The two paths offered are paid support for the existing cluster, or a move to Percona XtraDB Cluster, which keeps the schema, system tables and user accounts in place. MariaDB's own recommendation, MariaDB Galera Cluster, is a different database with a different data dictionary and privileges that its migration notes say must be recreated. 26What the numbers show
Two measurement reports landed this week, and each carries a scope that changes how to read its figures.
MySQL thread pool, one harness. Percona's second thread-pool post compares Percona Server for MySQL 9.7.1-1 with MySQL 26.7.0 and 9.7.2 under the same harness, sweeping
thread_pool_size from 10 to 160 and thread_pool_oversubscribe from 2 to 4, across 2 GB, 12 GB and 32 GB buffer pools. 14MySQL 26.7.0 and 9.7.2 perform within noise of each other, so the numbers below use 26.7.0. With a 2 GB buffer pool and 2,560 client connections, the pooled configuration reaches 371 TPS against 122 for the unpooled one, about three times. At 12 GB the pooled figure is 1,273 against 718, a 77% gain. With the data fully buffered at 32 GB the gap narrows to 18,975 against 17,011, or 11.6%. The pooled configuration also cuts p95 latency from 759 ms to 153 ms in the same tier. 14
The two implementations diverge where it counts. At 2 GB and 2,560 connections, Percona Server's pool produces 2,304 TPS against MySQL's 371, a factor of 6.2. With the data fully buffered at 32 GB the order reverses: MySQL reaches 19,054 TPS against Percona's 15,519, a 22% edge, and MySQL's p95 latency is 177 ms against Percona's 235 ms. Percona's pool also responds to tuning far more sharply, and it starts helping at 80 connections where MySQL's needs 1,280 or more. The practical reading is that
thread_pool_size has to be sized against the buffer pool and the peak connection count, and that the two servers want different values. 14Both servers are MySQL-family builds, so this comparison settles configuration inside the family.
A CostBench comparison outside the four families. ClickHouse published a CostBench run of 113.2 billion stock quotes against BigQuery, streaming at a target of one million rows per second while four aggregate queries ran every ten minutes and two drill-down queries ran hourly. ClickHouse Cloud scored 438 times better on end-to-end performance per dollar under BigQuery Capacity pricing and 512 times under On-demand. Preparation cost was $28.69 against $243.09 or $264.59, and accumulated query runtime was 58.29 seconds against 49.36 minutes. 27
The run publishes a shared harness, a benchmark contract and an open repository, so the result can be checked. Treat it as positioning for analytical engines: BigQuery sits outside this brief's tracked families, and the two systems used different compute allocations in place of two fixed 16-CPU boxes. 27
Evidence boundaries
No PostgreSQL core or supported-branch release fell in the window; the PostgreSQL news archive's newest item is the September 24 PostgreSQL 19 Beta 4. 3 No Oracle MySQL server or component release fell in it either, and the announcements feed still ends at the August 25 train. 4
The vector engines other than Weaviate were silent. Milvus's newest tag is v2.6.25 on September 29 28, Qdrant's is v1.19.2 on October 5, inside the previous brief's window 29, and pgvector's is 0.8.7 on October 1 30. No MongoDB server release fell in the window; the newest is 9.0 on September 29. 31
A matched benchmark that places separate database engines on shared hardware remains absent. The two measurement reports above compare providers of one engine or a warehouse against an analytical engine, and the Clera replay compares four managed providers of Postgres.
The CMU Database Group series produced no talk inside the window: the October 5 Sentry talk was cancelled, and the next scheduled talk is October 19. Hacker News carried no database-selection item this week. 32
Four items sit on the window's edges. pg_ivm 1.16, pg_vault_tde 1.7.2 and dbForge 2026.2 are dated October 5 with no publication time, 3 and Weaviate's v1.39.12 and v1.38.21 landed 10 to 18 minutes before the cutoff.
Cross-engine positioning
Weaviate's general-availability release redraws a commercial line. Namespaces and deduplicated backups give a shared cluster stronger tenant isolation and a cheaper restore path, and both now require a license key. A team that planned to use namespace isolation without one has to re-cost the decision. 2
PostgreSQL's search layer keeps consolidating inside the database. A native BM25 index access method and a managed-service tokenizer that configures dictionaries from SQL both reduce the case for running a separate search engine beside Postgres. Teams on Postgres already carrying a search workload now have an in-database option to measure against their current setup. 919
MySQL's calendar versioning raises the price of running behind. Because 9.7 LTS is the only door into the 26.x line, a team that skipped 9.7 inherits two upgrades before it can take a new innovation release. 13 Galera's end of support adds a second deadline: a Galera cluster now runs without a vendor escalation path or a future binary fix, with Percona XtraDB Cluster the migration that keeps the schema and accounts intact. 26
MongoDB's live surface this week is the clients. Two of the four fixes sit in drivers, and one of them, the Go namespace redirect, was a regression in how an existing fix was distributed. Server-side, the release line is quiet and the independent assessment of 9.0 argues it is a test-and-understand release. 1125
Action queue
- Upgrade the PostgreSQL JDBC driver to 42.7.14, and audit
requireAuthvalues and anyByteStreamWriteruse first, since an all-exclusion value stops connecting. 7 - Move MongoDB Go drivers to 2.9.2 if you run 2.9.0 or 2.9.1, and upgrade PyMongo to 4.18.3. 1112
- On Weaviate, test schema drop and recreate, backups, and restart recovery on the branch you run, and confirm the license position on Namespaces and deduplicated backups before planning either. 25
- If you run a MySQL Galera cluster, choose between paid support and a move to Percona XtraDB Cluster before the next incident. 26
- Before any managed-Postgres provider move, replay your own workload and match the storage backend; measure point-lookup latency while analytics run. 1
- If MySQL 26.x is on your roadmap, confirm you are on 9.7 LTS first, since 8.4 cannot jump straight there. 13
- Benchmark pgx-bm25 against your current GIN or
ts_ranksearch before assuming an external search engine is still required. 9
References
- 1
- 2Release v1.40.0
github.com
- 3PostgreSQL: News Archive
postgresql.org
- 4MySQL Forums - Announcements
forums.mysql.com
- 5Release v1.39.11
github.com
- 6Release v1.39.12
github.com
- 7PostgreSQL JDBC 42.7.14 security update
postgresql.org
- 8PostgreSQL JDBC Driver 42.7.14 Released
jdbc.postgresql.org
- 9pgx-bm25 1.0
postgresql.org
- 10pg_plan_filter 1.0.0 released
postgresql.org
- 11MongoDB Go Driver 2.9.2 Released
mongodb.com
- 12PyMongo 4.18.3 Released
mongodb.com
- 13Meet MySQL 26.7: A New Versioning Era Begins
percona.com
- 14
- 15Release v1.39.10
github.com
- 16Release v1.38.20
github.com
- 17Release v1.38.21
github.com
- 18Releases: weaviate/weaviate
github.com
- 19BM25 is only as good as your tokens
neon.tech
- 20pg_ivm 1.16 released
postgresql.org
- 21MongoDB C Driver 1.30.13 Released
mongodb.com
- 22PyMongoCrypt 1.20.0 Released
mongodb.com
- 23Product & Driver Announcements
mongodb.com
- 24
- 25MongoDB 9.0: More 8.4 than 9.0?
percona.com
- 26
- 27
- 28Releases: milvus-io/milvus
github.com
- 29Releases: qdrant/qdrant
github.com
- 30pgvector CHANGELOG
github.com
- 31Server Releases
mongodb.com
- 32
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.