Fourth in a series of dispassionate tours of managed PostgreSQL services. Previously: RDS, Aurora, and Cloud SQL. AlloyDB is Google’s distributed-storage PostgreSQL, the closest architectural parallel on GCP to Aurora on AWS, with enough distinctive differences to be worth understanding as its own thing rather than “GCP’s Aurora.”

refint is a vintage referential-integrity workaround (committed September 10, 1997! that became pointless the day real foreign keys shipped in PostgreSQL 7.3, twenty-three years ago. It is still in the contrib tree because… well, that’s a good question. And on May 14 it shipped a stack buffer overflow plus SQL injection (CVE-2026-6637, CVSS 8.8) that lets any unprivileged

client_min_messages controls how much the server says to you: the messages that come back over the wire to your session. It is constantly confused with the parameter that controls what the server writes to its own log. Those are different concerns with different parameters, and the confusion is where most of the trouble starts.

The default is NOTICE

A genuinely useful parameter that almost nobody knows about. Added in PostgreSQL 14, off by default, fixes a specific pathology that anyone who has run analytics workloads has lived through at least once.

In Wednesday’s post on table access methods, I grouped Snowflake with Databricks and Microsoft as vendors with “bespoke storage layers underneath their Postgres-shaped products.” Elizabeth Christensen wrote in to point out that this is wrong about Snowflake, and she is right.

Snowflake Postgres is community Postgres. The storage, the heap, the table access method machinery, all of it is

client_encoding declares what character encoding the client speaks. The server uses it to convert between its own internal encoding (set at initdb time, per-database, often UTF-8) and whatever the client is sending and expecting. Default is “the server’s encoding” — that is, no conversion. Context is user, with PGCLIENTENCODING as the environment variable that libpq honors automatically, mirroring application_name

Two checkpoint-adjacent parameters paired by alphabetical proximity rather than topical kinship. checkpoint_flush_after is the third of the four *_flush_after writeback parameters; checkpoint_warning is a logging knob that emits a complaint when checkpoints fire too frequently. Different jobs, different audiences, but neither needs 400 words of its own.

pgvector 0.8.2 is out. It fixes CVE-2026-3172, a heap buffer overflow in parallel HNSW index builds that can leak data from other relations or crash the backend. If you run pgvector and have it pinned to a version below 0.8.2, upgrade. If you are on a managed provider, check which pgvector version they actually ship — a non-trivial number of

The C cluster opens with the first two checkpoint parameters. We take them out of alphabetical order because checkpoint_completion_target is defined as a fraction of checkpoint_timeout and is unintelligible without it. The alphabet can wait one post.

It’s a heap out-of-bounds write that an unprivileged role can reach over an ordinary database connection, with a plausible path to arbitrary code execution as the OS user running the backend. CVSS 8.8. Fixed in 18.4, 17.10, 16.14, 15.18, and 14.23, which shipped yesterday. If you maintain a PostgreSQL deployment, the upgrade window for this one is shorter than your