Postgres 19 slips because AI finds its bugs, Astra fixes Qwen by editing its weights, and Ubuntu waits on a 9.8

On Monday's HN front page, Postgres committer Robert Haas explains why Postgres 19 will probably ship in November, a month after its usual window, and maybe later. Three big features came out late in the beta, between late August and mid-September: temporal updates and deletes, SQL property graph queries, and merging and splitting partitions. If you were planning around any of them, they won't be in 19.

New work on the main branch held steady this year. Fixes back-ported into the release branch rose from about 720 to nearly 1,200, and fixes reaching last year's release rose by three quarters. Far more people now run language models over the Postgres code and report what they find. A model can draft a patch, but a committer still has to review it, and that time came out of checking what was going into 19.

In the thread, tibbar describes a summer of AI-assisted bug hunting in Postgres: serialization anomalies, foreign key integrity bugs and planner errors. They reported a dozen or two out of hundreds of candidates. droppedasbaby names the cost. Discovery isn't the bottleneck anymore, and the same small group of maintainers still has to check every report and review every fix.

GPT-6 Astra can read a small model's raw weights and repair them. Handed the weights of Qwen 3.5, a 0.8 billion parameter model, with no training and no gradients, Astra traced the model's endless thinking loops to one direction in two layers, and subtracted it. The model went from solving about one math problem in thirteen to about half, and its instruction following roughly tripled. On Gemma 3, a model that rarely loops, it found nothing to fix. In the thread, GodelNumbering tried it on a small model that writes bash commands. The edit fixed some grep mistakes and broke other commands.

If you run background jobs on Trigger.dev, check your inbox. An attacker got into the environment variables of a subset of customer organizations, which is where most teams keep their API keys and database passwords. The exploit is blocked, and affected owners got an email with steps to take. The incident went up already marked resolved. corvad asked how a leak of customer secrets counts as resolved, and CharlieDigital would call it mitigated until customers confirm they've seen the email. Rotating every key you keep there is the safe move either way.

A use-after-free in the Linux kernel's TCP code, rated 9.8 out of 10, can be hit over the network and dates back about ten years. Debian, Arch and Alpine have shipped the fix. Ubuntu rates it High rather than Critical, and every supported release, LTS included, still shows as vulnerable. strenholme moved to Rocky Linux in about four hours. throw0101c points to fixed kernels already in Ubuntu's proposed repository. For a server facing the internet, I'd install that kernel now and test it, rather than wait.