Formal spec tool Quint finds over 10 bugs in SQLite while hardening Turso

Turso community member Pavan Nambi modeled the SQLite C API using Quint, a formal specification tool based on Temporal Logic of Actions (TLA). By generating traces from the Quint model and running them against real SQLite via small C programs, the process uncovered over 10 bugs in SQLite itself — including a crash in sqlite3_deserialize() when a read transaction was in progress. The approach complements Turso's existing testing arsenal (DST, fuzzers, differential testers, Antithesis) by exploring state-space regions that random SQL-based simulators miss. All found bugs were reported and fixed upstream in SQLite.

ChromaDB max-severity RCE CVE-2026-45829 affects 14M monthly download package with no patch

A maximum-severity vulnerability (CVE-2026-45829) in ChromaDB's Python FastAPI server allows unauthenticated attackers to execute arbitrary code on exposed servers. The flaw exists because a vulnerable API endpoint loads and executes a malicious model from Hugging Face before authentication is checked, meaning the payload runs even though the server ultimately returns a 500 error. The bug was introduced in ChromaDB 1.0.0 and affects the PyPI package with ~14 million monthly downloads. Despite being reported in February, the maintainer has not responded to HiddenLayer's disclosure attempts, and it remains unclear whether version 1.5.9 patches the issue. About 73% of internet-exposed ChromaDB instances run a vulnerable version. Mitigations include switching to the Rust frontend, avoiding public exposure of the Python server, restricting network access to the API port, and scanning ML model artifacts before runtime.

Valkey 9.1 ships 10% memory reduction, database-level ACLs and full-text search integration

Valkey 9.1 is now generally available, announced at Open Source Summit North America. Key highlights include up to 10% memory reduction with no configuration changes, database-level ACLs for multi-tenant isolation, automated TLS certificate reloading, and a new CLUSTERSCAN feature for consistent cluster-wide key iteration. The Valkey Search module (v1.2) now integrates full-text search, numeric filtering, and vector search directly into the data store. The Valkey Admin cluster management tool reached GA, and the GLIDE client library (v2.4) added C# and PHP support along with client-side caching, built on a shared Rust core. The project reports 6 million container pulls per week — a 17x increase year-over-year — with enterprise adopters including Apple and Uber. Lead maintainer Madelyn Olson also discussed using AI agents to combat maintainer burnout by automating backporting, CI testing, and security scanning.

pg_sorted_heap 0.14.0 adds partition-aware vector search and PostgreSQL 16–18 support

pg_sorted_heap 0.14.0 is a new release of a PostgreSQL extension providing physically sorted heap storage, zone-map pruning, planner-integrated vector search, and GraphRAG support. This version expands verified support to PostgreSQL 16, 17, and 18, adds pg_upgrade coverage, introduces partition-aware vector search, makes sorted_hnsw planner-visible via the Index AM path, adds composite zone-map metadata, and includes GraphRAG release gates covering lifecycle, dump/restore, crash recovery, and concurrent maintenance. Available on PGXN and installable via standard CREATE EXTENSION syntax.

Redis launches Iris context and memory engine for AI agents in preview

Redis is launching Redis Iris, a context and memory engine for AI agents composed of five tools: Context Retriever, Agent Memory, Redis Data Integration, LangCache, and Redis Search. Context Retriever lets developers define a semantic model for business data and auto-generates MCP tools for agents to use instead of direct database queries. Agent Memory handles short- and long-term state across sessions. The suite aims to solve the core production AI problem of fragmented, stale, or slow context by providing navigable, real-time, and compounding context in a single Redis-based runtime. Context Retriever and Agent Memory are now available in preview.