proomt

Search

Search posts, papers, and topics

All posts

PostgreSQLpgAdmin Development Team4 min readrelease notesintermediate

pgAdmin 4 v9.18 Released

Read on postgresql.org

Summary

pgAdmin 4 v9.18 adds a VS‑Code‑style Object Explorer toggle, tightens CSP defaults, and patches five CVEs (auth bypass, argument/connection‑string injection, TOCTOU file write, LLM redirect, empty username import). It also fixes numerous UI bugs, schema‑diff regressions, and updates dependencies. Windows/macOS installers, Docker, RPM/DEB, and a Python wheel are shipped.

  • Object Explorer can now be collapsed/expanded via the workspace icon or Ctrl+Alt+B; the state persists across refreshes.
  • Default Content‑Security‑Policy now uses per‑request nonces and drops unsafe‑eval, reducing XSS surface.
  • Security fixes:
  • • CVE‑2026‑86863: Webserver auth bypass fixed by making header‑based identity opt‑in and limited to trusted proxies.

The release hardens pgAdmin’s attack surface—critical for any organization exposing the web UI—while improving developer ergonomics (Object Explorer toggle) and fixing regressions that could break migration or schema‑diff workflows. The detailed CVE mitigations illustrate concrete patterns (header‑…

5/10
devopssecuritypythonuipostgrespgadmin

Related reading

  1. pgAssistant 3.8.0 : continuous improvement loop for Postgres

    pgAssistant 3.8.0 expands from a tuning advisor to a continuous PostgreSQL improvement platform, adding a Collector that records historical workload and environment data. It lets teams run an Observe‑Diagnose‑Prioritize‑Plan‑Implement‑Measure loop, compare consecutive snapshots, and measure the impact of applied recommendations.

    PostgreSQLpostgresql.org1 minrelease

  3. The Road to Better Performance Profiles – Part 2

    Mozilla’s Automation Team added native system‑wide profiling to their CI pipelines for Speedometer 3 on Windows, macOS, Linux, and Android, using xperf, perf, and simpleperf together with the samply toolchain, and modernized the mozgeckoprofiler symbolication stack by replacing the legacy Eliot service with samply and profiler‑edit.

    Mozilla Automation Teammozilla.org5 min

  5. datasette-auth-github 1.0

    The datasette-auth-github plugin now reaches 1.0, fixing a bug where cookies lacked a Max‑Age attribute and thus expired at session end. The fix ensures longer‑lasting sessions and the release is tested against recent Datasette versions.

    Simon Willisonsimonwillison.net1 minrelease