{"collection":{"slug":"serverless-postgres","name":"Serverless Postgres"},"digest":{"id":"cwd_hEWiw5557Qdwez7rA8di8","weekStart":"2026-07-20","title":"Observability, security, and diagnostics across the Postgres ecosystem","intro":"PlanetScale fixes critical OAuth and SQL injection vulnerabilities in its CLI, Supabase launches one-click Grafana Cloud observability and moves Pipelines to public alpha, and both Neon and PlanetScale ship new CLI diagnostic commands for Postgres databases.","body":"### Security first: PlanetScale patches critical vulnerabilities\n\n[PlanetScale CLI v0.306.0](/release/rel_q04JbB-CzBdyouw-SfX9N-planetscale-cli-v0-306-0-fixes-oauth-token-leak-and-sql-injection) led the week with a security-focused release that fixed several critical issues. The most concerning vulnerabilities included OAuth token leaks on sibling-subdomain and cross-host redirects, a Windows command injection vulnerability in the auth login URL handler, and a destructive SQL gate bypass via MySQL executable comments. The release also patched credential header leaks on cross-domain API redirects and sanitized connection observability output. An allowlist for project `.pscale.yml` keys was added to block credential exfiltration. This was a must-patch release for any team using the PlanetScale CLI, especially in CI/CD pipelines.\n\n### Observability goes mainstream: Supabase adds Grafana Cloud and Pipelines Alpha\n\n[Supabase's one-click Grafana Cloud integration](/release/rel_wJb29l3vYDaTEu-3U348b-supabase-adds-one-click-grafana-cloud-observability-for-all-projects) was the week's most impactful observability story. Every Supabase project, including those on free plans, can now connect to Grafana Cloud with a single click, getting a pre-built dashboard with alerting and metrics. This dramatically lowers the barrier to production-grade monitoring for teams that previously had to piece together their own observability stack.\n\nEqually significant, [Supabase Pipelines moved to Public Alpha](/release/rel_ORP6JK7_8hhUbCDNYdrGx-supabase-pipelines-moves-to-public-alpha-with-schema-change-replication) with BigQuery support and a critical new capability: automatic schema change replication. Pipelines can now detect schema changes in source tables—adding, removing, and renaming columns—and apply them to destinations automatically. The release also includes a faster parallelized initial sync and a new destination request form for ClickHouse, Snowflake, and DuckLake. For teams replicating Postgres data to analytical systems, this removes a major operational headache.\n\n### Diagnostic commands arrive across CLI tooling\n\nThree platforms shipped new CLI diagnostic commands this week, reflecting a growing emphasis on developer tooling for Postgres health. [Neon's `neon inspect db`](/release/rel_FIURTE5Rq-EEebExQtv49-neon-cli-adds-inspect-db-for-postgres-diagnostics-and-backend-log-querying) provides 14 read-only, curated diagnostic queries against Postgres catalog views, covering table and index sizes, bloat, unused indexes, sequential scans, long-running queries, locks, query statistics, vacuum status, and more. Results can be output as table, JSON, or YAML, making them scriptable for monitoring pipelines.\n\n[PlanetScale followed with v0.307.0](/release/rel_6Su3sI5CGBQVFIqD3rzOy-planetscale-cli-v0-307-0-adds-insights-and-inspect-commands-for-database), adding `insights` and `inspect` commands for database diagnostics with improved accuracy and agent discoverability supporting Vitess shard targeting. The day prior, [PlanetScale had also added Postgres cluster parameter management](/release/rel_ZYqsA4wqViDgBfpSenqXX-planetscale-cli-now-manages-postgres-cluster-parameters) via `pscale branch parameters list` and `pscale branch resize --parameters`, allowing combined parameter, cluster size, and replica changes in a single request.\n\n### Surrounding the ecosystem\n\nPrisma's [7.9.0 release](/release/rel_vZv6YhuM-DtZ3lxuUUazm-7-9-0) brought shell tab completions for bash, zsh, fish, and PowerShell—a quality-of-life improvement that covers commands, subcommands, options, and even option values. [Supabase Auth v2.193.1](/release/rel_8qQeAMjPIqMqAZFpTXxWV-supabase-auth-v2-193-1-revokes-legacy-refresh-tokens-and-fixes-oauth-replay-race) fixed legacy refresh token revocation on rotation and prevented an OAuth authorization-code replay race, while the Supabase CLI continued its beta cadence with fixes for Windows logout credentials, auth template preservation, and remote db pull reliability. The [Supabase JS client](/release/rel_uZzppYSV3dHqdCTpyXrHA-supabase-js-v2-110-8-fixes-cdn-purge-url-encoding-and-reduces-auth-fetch-noise) also reduced noise by downgrading aborted auth fetch failures from error to warn level, and fixed URL encoding for CDN purge methods.\n\nAcross the collection, the theme was clear: making Postgres databases more observable, more secure, and more debuggable from the command line.","releaseIds":["rel_q04JbB-CzBdyouw-SfX9N","rel_wJb29l3vYDaTEu-3U348b","rel_ORP6JK7_8hhUbCDNYdrGx","rel_FIURTE5Rq-EEebExQtv49","rel_6Su3sI5CGBQVFIqD3rzOy","rel_ZYqsA4wqViDgBfpSenqXX","rel_vZv6YhuM-DtZ3lxuUUazm","rel_8qQeAMjPIqMqAZFpTXxWV","rel_uZzppYSV3dHqdCTpyXrHA"],"releaseCount":33,"generatedAt":"2026-07-27T06:16:29.706Z","releases":[{"id":"rel_q04JbB-CzBdyouw-SfX9N","title":"PlanetScale CLI v0.306.0 fixes OAuth token leak and SQL injection vulnerabilities","path":"/release/rel_q04JbB-CzBdyouw-SfX9N-oauth-token-leak-fixed-sql-injection-vulnerabilities-patched","org":{"slug":"planetscale","name":"PlanetScale"},"importance":4},{"id":"rel_wJb29l3vYDaTEu-3U348b","title":"Supabase adds one-click Grafana Cloud observability for all projects","path":"/release/rel_wJb29l3vYDaTEu-3U348b-one-click-grafana-cloud-integration-for-every-project","org":{"slug":"supabase","name":"Supabase"},"importance":4},{"id":"rel_ORP6JK7_8hhUbCDNYdrGx","title":"Supabase Pipelines moves to Public Alpha with schema change replication","path":"/release/rel_ORP6JK7_8hhUbCDNYdrGx-schema-changes-now-replicate-automatically-in-public-alpha","org":{"slug":"supabase","name":"Supabase"},"importance":4},{"id":"rel_FIURTE5Rq-EEebExQtv49","title":"Neon CLI adds inspect db for Postgres diagnostics and backend log querying","path":"/release/rel_FIURTE5Rq-EEebExQtv49-postgres-diagnostics-via-cli-backend-log-querying","org":{"slug":"neon","name":"Neon"},"importance":3},{"id":"rel_6Su3sI5CGBQVFIqD3rzOy","title":"PlanetScale CLI v0.307.0 adds insights and inspect commands for database diagnostics","path":"/release/rel_6Su3sI5CGBQVFIqD3rzOy-insights-and-inspect-commands-for-database-diagnostics","org":{"slug":"planetscale","name":"PlanetScale"},"importance":3},{"id":"rel_ZYqsA4wqViDgBfpSenqXX","title":"PlanetScale CLI now manages Postgres cluster parameters","path":"/release/rel_ZYqsA4wqViDgBfpSenqXX-postgres-cluster-parameters-managed-from-pscale-cli","org":{"slug":"planetscale","name":"PlanetScale"},"importance":3},{"id":"rel_vZv6YhuM-DtZ3lxuUUazm","title":"7.9.0","path":"/release/rel_vZv6YhuM-DtZ3lxuUUazm-7-9-0","org":{"slug":"prisma","name":"Prisma"},"importance":null},{"id":"rel_8qQeAMjPIqMqAZFpTXxWV","title":"Supabase Auth v2.193.1 revokes legacy refresh tokens and fixes OAuth replay race","path":"/release/rel_8qQeAMjPIqMqAZFpTXxWV-legacy-refresh-tokens-revoked-oauth-replay-race-fixed","org":{"slug":"supabase","name":"Supabase"},"importance":3},{"id":"rel_uZzppYSV3dHqdCTpyXrHA","title":"Supabase JS v2.110.8 fixes CDN purge URL encoding and reduces auth fetch noise","path":"/release/rel_uZzppYSV3dHqdCTpyXrHA-cdn-purge-url-encodes-keys-auth-fetch-errors-downgraded-to-warn","org":{"slug":"supabase","name":"Supabase"},"importance":2}]}}