A parameter most operators have never knowingly used, even though every PostgreSQL dump file they have ever inspected sets it. check_function_bodies controls whether PostgreSQL validates the body of a CREATE FUNCTION or CREATE PROCEDURE at creation time. Default on. Context is user.

The Table Access Method API has been in PostgreSQL since version 12. For most of that time it has been a quiet piece of infrastructure with very little extension activity attached to it — the kind of API that gets a paragraph in the docs, an enthusiastic conference talk, and then five years of silence.

That is changing.

bytea_output controls how PostgreSQL formats binary data when sending it to a client. Two values: hex (the default since PostgreSQL 9.0, released in 2010) and escape (the traditional format, dating back to the early 2000s). Context is user. The parameter affects output only — bytea input has accepted both formats forever, and a SET bytea_output setting changes nothing about

PgBouncer 1.25.2 shipped on May 8 with four new CVEs. The one you actually need to care about is CVE-2026-6664: an integer overflow in the SCRAM authentication packet parser. It is reachable before authentication. A malformed packet crashes the process.

Anything that can open a TCP connection to PgBouncer can take PgBouncer down.

A short post about two parameters that were a charming idea in 2002 and have aged into a curiosity.

bonjour, when on, makes the PostgreSQL server advertise itself on the local network via Apple’s Bonjour service-discovery protocol (mDNS/DNS-SD). bonjour_name sets the name under which it advertises, defaulting to the computer’s hostname. Both are postmaster context — change

The PostgreSQL 19 first beta is imminent. Feature freeze hit on April 8, the PG19-Final commitfest closed on April 9, and the release notes are well into draft on pgsql-hackers. The headline list will include SQL/PGQ graph queries, and every other preview post is going to lead with them. I am not going to.

There are four other

A parameter you cannot change. block_size lives in the “Preset Options” section of the docs, alongside its read-only cousins like data_checksums, wal_block_size, and server_version. It reports the size of a PostgreSQL page — the fundamental unit of on-disk storage and buffer-pool accounting. Default is 8192 bytes. It is read-only at runtime, settable only when PostgreSQL is compiled,

These two parameters close out the bgwriter cluster. Together with bgwriter_delay, they govern how the background writer decides what to write each round, and they are where the actual leverage lives — the previous post ended by saying so explicitly. Here is why.

The B cluster shifts gears: from one-off oddities to the background writer parameters, which span four GUCs. We do the first two as a pair because bgwriter_delay introduces the process at all, and bgwriter_flush_after slots cleanly into the writeback tour from backend_flush_after.

On May 4, ZeroDay.Cloud published the technical writeups for CVE-2026-2005 and CVE-2026-2006. Both are remote code execution bugs in pgcrypto. Both have been in the tree since pgcrypto was first contributed in 2005.

That’s the headline. It deserves a beat to land.

CVE-2026-2005 is a 32-byte heap overflow in pgp_parse_pubenc_sesskey(). The code decrypts an RSA or