<p><strong>TLDR:</strong> Timescale released pg_textsearch v1.0.0, a production-ready BM25 full-text search extension for Postgres with a custom index type and Block-Max WAND optimization. MotherDuck launched a Postgres wire protocol endpoint, meaning any JDBC driver or BI tool can now talk to DuckDB without installing anything extra. Debezium 3.5.0 landed with parallel chunk-based snapshots, Oracle memory improvements, and initial CockroachDB snapshot support. A critical unauthenticated memory disclosure in MongoDB’s zlib layer affects every version from 4.4 through 8.2 — patch or disable zlib now.</p>
<hr>
<h2>pg_textsearch v1.0.0: BM25 full-text search lands in Postgres</h2>
<p>Timescale shipped a production-ready PostgreSQL extension that adds a native <code>bm25</code> index type and a <code>&lt;@&gt;</code> operator for relevance-ranked queries. The implementation uses Block-Max WAND for fast top-k retrieval, supports parallel index builds and partitioned tables, and exposes configurable k1/b parameters. Known gaps worth noting before you adopt it: no phrase queries, no expression indexing, no background compaction, and cross-partition statistics are partition-local. If you’ve been reaching for pg_trgm or external search for ranked full-text, this is worth a serious look — though the missing phrase query support will be a blocker for some workloads.</p>
<h2>MotherDuck speaks Postgres wire protocol</h2>
<p>MotherDuck added a Postgres wire protocol endpoint, which means JDBC, node-postgres, rust-postgres, and most BI tools connect out of the box without a DuckDB library. Queries still run in DuckDB’s SQL dialect, which tracks Postgres conventions closely enough that most things just work. The endpoint supports connection poolers like Cloudflare Hyperdrive, making it practical for serverless deployments on Workers or Lambda where you can’t maintain persistent connections. This removes the biggest adoption friction for teams that want DuckDB’s analytical performance but live inside Postgres-shaped tooling.</p>
<h2>Debezium 3.5.0 released</h2>
<p>The headline additions are parallel multithreaded chunk-based snapshots for faster initial loads and roughly 50% memory reduction in Oracle bookkeeping. LogMiner performance also improved, and Oracle 26ai is now supported. CockroachDB gets initial snapshot support, multi-table concurrent streaming, and incremental snapshots in this release. On the roadmap for 3.6: decoupling from Kafka, pluggable schema management, and built-in observability. 216 issues resolved total.</p>
<h2>MongoBleed: unauthenticated memory disclosure in MongoDB (CVE-2025-14847)</h2>
<p>An unauthenticated attacker can send crafted compressed payloads to trigger MongoDB’s zlib decompression layer and read uninitialized heap memory before authentication completes. Every MongoDB version from 4.4 through 8.2 is affected when zlib compression is enabled and the port is network-accessible. Patched versions are out across all supported branches (4.4.30, 5.0.32, 6.0.27, 7.0.28, 8.0.17, 8.2.3). MongoDB 4.2 and older have no fix available. If you can’t patch immediately, disable zlib compression and restrict network access.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Apache Iceberg practical limits:</strong> A detailed breakdown of where Iceberg breaks down in 2025 — metadata overhead for high-frequency writes, Python/Rust/Go ports lagging the Java reference implementation, incomplete write support in ClickHouse and DuckDB, and a hard write concurrency ceiling around 15 transactions/minute that Adobe hit in production.</li>
<li><strong>Informatica CDI at scale:</strong> Shivangi Srivastava explains how Cloud Data Integration evolved to run 250,000 daily pipelines for 5,500 enterprise customers on Spark-on-Kubernetes, with a FinOps automation layer (Cluster Lifecycle Manager, Cluster Tuner, Job Tuner) that cuts infrastructure costs by roughly 1.65x.</li>
<li><strong>Apache Kafka 4.2 share groups:</strong> KIP-932 adds queue-like consumption semantics via share groups, letting consumers scale beyond partition count with message-level acknowledgement (ACCEPT, RELEASE, REJECT, RENEW) — at the cost of partition-level ordering guarantees.</li>
<li><strong>Harness Release Orchestration:</strong> New AI-enabled verification and automatic rollback decisions, plus Database DevOps support for Snowflake baked directly into the delivery pipeline; Harness’s own 2026 State of DevOps report found nearly a quarter of deployments require remediation with average remediation times over 7.5 hours.</li>
<li><strong>LangChain + MongoDB partnership:</strong> Atlas Vector Search becomes a drop-in LangChain retriever supporting semantic, hybrid, and GraphRAG queries; a MongoDB Checkpointer handles agent state persistence for crash recovery and time-travel debugging.</li>
<li><strong>Great Expectations for API validation:</strong> Practical walkthrough of a three-stage gate sequence (HTTP status, empty organic check, GX validation) that routes failed batches to a quarantine table in DuckDB, with specific guidance on ordering null checks before regex gates and using ephemeral GX context for performance.</li>
<li><strong>TeamPCP supply chain attack:</strong> Between February and March 2026, attackers compromised GitHub Actions workflows and PyPI tokens to inject infostealers into Aqua Trivy, Checkmarx KICS, LiteLLM, and the Telnyx Python SDK, ultimately infecting 48 additional npm packages in under 60 seconds and exfiltrating credentials from an estimated 500,000 machines.</li>
<li><strong>Joins are not expensive:</strong> Benchmarks on DuckDB and PostgreSQL show that dimensional models with joins outperform pre-joined One Big Table designs in columnar stores, and match or beat OBT in row-store Postgres — the “joins are expensive” assumption driving flat Data Lake schemas doesn’t hold up under measurement.</li>
<li><strong>Redpanda Cloud Topics GA:</strong> The architecture separates metadata (Raft logs) from data (S3/GCS object storage), eliminating cross-AZ replication overhead; a background Reconciler reorganizes L0 files into partition-sorted L1 files for efficient historical reads.</li>
<li><strong>Vercel Marketplace resource transfers:</strong> Teams can now transfer Neon, Supabase, and Prisma database resources between Vercel teams directly from the dashboard without touching the API.</li>
</ul>


Query optimization, schema design, and data store coverage across PostgreSQL, MongoDB, Redis, and more.

Databases Digest

A roundup of major database ecosystem news: Timescale released pg_textsearch v1.0.0, a production-ready BM25 full-text search extension for Postgres using Block-Max WAND optimization with known gaps like no phrase queries. MotherDuck added a Postgres wire protocol endpoint so any JDBC driver or BI tool can connect to DuckDB without extra libraries. Debezium 3.5.0 brings parallel chunk-based snapshots, 50% Oracle memory reduction, and initial CockroachDB support. A critical unauthenticated memory disclosure vulnerability (CVE-2025-14847) affects MongoDB versions 4.4–8.2 via the zlib decompression layer — patched versions are available and immediate action is recommended. Additional items cover Apache Iceberg practical limits, Kafka 4.2 share groups, a supply chain attack affecting Aqua Trivy and other tools, and benchmarks showing joins are not expensive in columnar stores.

Timescale ships BM25 for Postgres, MotherDuck adds Postgres wire protocol