<p><strong>TLDR:</strong> pgBackRest got rescued from archival after a coalition of sponsors stepped up to fund continued development. <a href="http://monday.com" target="_blank" rel="noopener nofollow">monday.com</a> published a detailed post-mortem on replacing MySQL, Cassandra, and Redis with a DuckDB-backed columnar layer across 1M+ organizations. ChromaDB has an unpatched max-severity RCE that’s been sitting open since February. Valkey hit 6 million container pulls per week, up 17x year-over-year, and shipped 9.1 with memory reductions and cluster-wide key iteration.</p>
<hr>
<h2>pgBackRest is back under active development</h2>
<p>David Steele archived pgBackRest in April after running out of sponsorship. On May 18 he announced that a coalition of sponsors has committed funding to keep it going. No details yet on who’s backing it or what the roadmap looks like, but the project is no longer in limbo. If you were quietly evaluating alternatives, you can probably stand down.</p>
<hr>
<h2><a href="http://monday.com" target="_blank" rel="noopener nofollow">monday.com</a> replaced MySQL with DuckDB at trillion-table scale</h2>
<p>This is one of the more interesting architecture posts in a while. <a href="http://monday.com" target="_blank" rel="noopener nofollow">monday.com</a>’s mondayDB 3 uses a CQRS design with DuckDB files stored per-tenant in S3, a distributed WAL, and Go processes on NVMe-backed Kubernetes nodes doing sync-then-query reads. They report 5x faster board loads on average, 20x for large boards, 50x for aggregations, and 40-60% infrastructure cost reduction. The 18-month migration of 1M+ organizations ran with zero downtime using dual-read validation and feature flags. The same layer is now being extended for semantic search and RAG.</p>
<hr>
<h2>ChromaDB has an unpatched RCE, 73% of exposed instances are vulnerable</h2>
<p>CVE-2026-45829 is a max-severity flaw in ChromaDB’s Python FastAPI server. An unauthenticated attacker can hit an endpoint that loads and executes a malicious model from Hugging Face before authentication is checked — the server returns a 500 error, but the payload already ran. The bug was introduced in 1.0.0, affects the PyPI package with roughly 14 million monthly downloads, and HiddenLayer says the maintainer hasn’t responded to disclosure attempts since February. It’s unclear whether 1.5.9 patches it. If you’re running the Python server anywhere network-accessible, restrict access to the API port now. The Rust frontend is the safer option.</p>
<hr>
<h2>Valkey 9.1 ships with memory savings and new search capabilities</h2>
<p>Valkey 9.1 is generally available, announced at Open Source Summit North America. The headline numbers: up to 10% memory reduction with no config changes, 6 million container pulls per week (17x year-over-year), and enterprise adoption from Apple and Uber. The release adds database-level ACLs for multi-tenant isolation, automated TLS certificate reloading, and CLUSTERSCAN for consistent cluster-wide key iteration. The Valkey Search module (v1.2) now bundles full-text search, numeric filtering, and vector search directly in the data store. The GLIDE client library added C# and PHP support with client-side caching built on a shared Rust core.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Tinybird / ClickHouse orphaned objects:</strong> Stale zero-copy replication references left behind after replica removal were costing Tinybird ~45% of their cloud storage bill; fixing GC tooling recovered it, but a silent timeout during metadata snapshot collection caused a temporary data loss incident that exposed gaps in their recovery procedures.</li>
<li><strong>Barman 3.18.0:</strong> EnterpriseDB shipped experimental block-level incremental backups for S3, Azure Blob, and GCS, a new <code>backup_method=local-to-cloud</code> option, LZ4 compression support, and a fix for a WAL archiving file handle leak; the standalone <code>barman-cloud-*</code> scripts are moving toward deprecation.</li>
<li><strong>Turso / SQLite formal verification:</strong> A Turso community member used Quint (TLA-based formal spec tool) to model the SQLite C API, generated traces, and ran them against real SQLite — finding over 10 bugs including a crash in <code>sqlite3_deserialize()</code> when a read transaction was in progress; all were reported and fixed upstream.</li>
<li><strong>ClickHouse vs Prometheus cardinality:</strong> Part 2 of this series covers how ClickHouse’s wide-events model shifts cardinality costs from ingestion to query-time aggregation, with sharded Map types, materialized columns, and sparse primary indexes; Prometheus still wins for targeted single-series lookups and PromQL-native alerting.</li>
<li><strong>Databricks SQL Alerts GA:</strong> Over 4,000 customers already using it; lets teams turn any SQL query into scheduled monitoring with notification destinations, integrates with Lakeflow Jobs to expose alert state (OK, TRIGGERED, ERROR) as task outputs for pipeline flow control.</li>
<li><strong>Databricks real-time fraud detection:</strong> New solution accelerator uses Spark Structured Streaming in Real-Time Mode (sub-300ms latency) and Lakebase (serverless Postgres built into Databricks) for credit card fraud scoring; benchmarks show P50 under 40ms and P99 between 215-392ms.</li>
<li><strong>Confluent Private Cloud benchmarks:</strong> Published data shows up to 73% fewer brokers versus standard Kafka using Intelligent Replication, 83% tail latency reduction on identical hardware, with broker-native multi-tenancy (logical Kafka clusters on shared physical infra) previewed for upcoming release.</li>
<li><strong>plpgsql_wrap v1.0:</strong> New PostgreSQL extension that encrypts PL/pgSQL stored procedure source with AES-256-GCM, storing the ciphertext in <code>pg_proc.prosrc</code>; pg_dump output is obfuscated but fully restorable, compatible with PostgreSQL 12+.</li>
<li><strong>dltHub Pro GA:</strong> 91% of new dlt pipelines are now agent-built (up from 5% a year ago), monthly pipeline volume up 34x; platform includes AI Workbench, managed runtime, and secrets management, starting at $119/month.</li>
<li><strong>Confluent PII detection in Flink SQL:</strong> Automated PII detection and redaction now available in Flink SQL pipelines, alongside a free open-source dbt adapter for Flink SQL and a fully managed MCP server for natural language streaming operations.</li>
</ul>


Query optimization, schema design, and data store coverage across PostgreSQL, MongoDB, Redis, and more.

Databases Digest

A roundup of notable database and data infrastructure news: pgBackRest has been rescued from archival after sponsors stepped up to fund continued development. monday.com published a detailed architecture post on replacing MySQL, Cassandra, and Redis with a DuckDB-backed columnar layer (mondayDB 3) across 1M+ organizations, achieving 5x faster board loads and 40-60% infrastructure cost reduction with zero-downtime migration. ChromaDB has an unpatched max-severity RCE (CVE-2026-45829) affecting its Python FastAPI server — unauthenticated attackers can execute arbitrary code via a Hugging Face model endpoint, with no patch confirmed. Valkey 9.1 shipped with up to 10% memory reduction, database-level ACLs, CLUSTERSCAN for cluster-wide key iteration, and bundled full-text/vector search, now hitting 6M container pulls per week. Additional items cover Barman 3.18.0, ClickHouse vs Prometheus cardinality tradeoffs, Tinybird storage cost recovery, SQLite formal verification bug findings, Databricks SQL Alerts GA, and Confluent Private Cloud benchmarks.

pgBackRest survives, monday.com ditches MySQL for DuckDB