Observability, security, and diagnostics across the Postgres ecosystem

Security first: PlanetScale patches critical vulnerabilities

PlanetScale CLI v0.306.0 led the week with a security-focused release that fixed several critical issues. The most concerning vulnerabilities included OAuth token leaks on sibling-subdomain and cross-host redirects, a Windows command injection vulnerability in the auth login URL handler, and a destructive SQL gate bypass via MySQL executable comments. The release also patched credential header leaks on cross-domain API redirects and sanitized connection observability output. An allowlist for project .pscale.yml keys was added to block credential exfiltration. This was a must-patch release for any team using the PlanetScale CLI, especially in CI/CD pipelines.

Observability goes mainstream: Supabase adds Grafana Cloud and Pipelines Alpha

Supabase's one-click Grafana Cloud integration was the week's most impactful observability story. Every Supabase project, including those on free plans, can now connect to Grafana Cloud with a single click, getting a pre-built dashboard with alerting and metrics. This dramatically lowers the barrier to production-grade monitoring for teams that previously had to piece together their own observability stack.

Equally significant, Supabase Pipelines moved to Public Alpha with BigQuery support and a critical new capability: automatic schema change replication. Pipelines can now detect schema changes in source tables—adding, removing, and renaming columns—and apply them to destinations automatically. The release also includes a faster parallelized initial sync and a new destination request form for ClickHouse, Snowflake, and DuckLake. For teams replicating Postgres data to analytical systems, this removes a major operational headache.

Diagnostic commands arrive across CLI tooling

Three platforms shipped new CLI diagnostic commands this week, reflecting a growing emphasis on developer tooling for Postgres health. Neon's neon inspect db provides 14 read-only, curated diagnostic queries against Postgres catalog views, covering table and index sizes, bloat, unused indexes, sequential scans, long-running queries, locks, query statistics, vacuum status, and more. Results can be output as table, JSON, or YAML, making them scriptable for monitoring pipelines.

PlanetScale followed with v0.307.0, adding insights and inspect commands for database diagnostics with improved accuracy and agent discoverability supporting Vitess shard targeting. The day prior, PlanetScale had also added Postgres cluster parameter management via pscale branch parameters list and pscale branch resize --parameters, allowing combined parameter, cluster size, and replica changes in a single request.

Surrounding the ecosystem

Prisma's 7.9.0 release brought shell tab completions for bash, zsh, fish, and PowerShell—a quality-of-life improvement that covers commands, subcommands, options, and even option values. Supabase Auth v2.193.1 fixed legacy refresh token revocation on rotation and prevented an OAuth authorization-code replay race, while the Supabase CLI continued its beta cadence with fixes for Windows logout credentials, auth template preservation, and remote db pull reliability. The Supabase JS client also reduced noise by downgrading aborted auth fetch failures from error to warn level, and fixed URL encoding for CDN purge methods.

Across the collection, the theme was clear: making Postgres databases more observable, more secure, and more debuggable from the command line.