PostgreSQL TOAST and decoding work, QEMU fixes

PostgreSQL hackers advanced patches for larger TOAST pointers and a logical decoding edge case, while QEMU developers posted security fixes for USB, block, and websocket paths along with a revised AI contribution policy. Partition attach performance in PostgreSQL 18 also drew attention.

PostgreSQL 8-byte TOAST pointer support

A patch series enabling 8-byte TOAST values continued through review on pgsql-hackers. Discussion noted compatibility effects on extensions that interact with TOAST pointers. The change matters for installations that store large values and for extension authors who must track the pointer format.

QEMU USB CCID out-of-bounds read fix

A patch for the USB smartcard reader device corrects an out-of-bounds read from the pending bulk-in ring, tracked as CVE-2026-18204. The fix moves slot release into ccid_bulk_in_release(). Hosts that expose the CCID device to guests gain a concrete memory-safety improvement.

QEMU preallocate filter data-loss fixes

A 13-patch series addresses data loss in the block preallocate filter caused by races under multi-AioContext writes and incorrect preallocation state. The changes close paths that could silently drop written data. Operators relying on the filter for thin provisioning or performance should track the series.

QEMU AI-generated contribution policy

QEMU developers circulated RFC v3 and then v4 of a new policy on AI-generated contributions, requiring metadata with DCO sign-off and attestation trailers while relaxing an earlier blanket ban and adding pre-approval for large submissions. Debate covered legal implications of the attestation approach. The outcome will shape how external and automated patches are accepted into the project.

QEMU websocket unbounded read mitigation

A patch prevents unbounded growth of the rawinput buffer in QIOChannelWebsock when reading client data. Without the limit a client can force resource exhaustion. The change hardens the websocket channel used by remote console and similar features.

PostgreSQL logical decoding DDL and subtransaction bug

Version 5 of a fix for bug 19555, an assertion failure in logical decoding when DDL mixes with subtransactions and tuplecid handling, remains under review with backport intent for all stable branches. The defect can interrupt logical replication. Users of logical decoding and replication slots have a direct interest in the backports.

PostgreSQL partition attach slowdown from pg_constraint

ATTACH PARTITION cost was observed to grow linearly with pg_constraint size because CloneFkReferenced performs a sequential scan, a regression worsened in PostgreSQL 18 after not-null constraints moved into that catalog. A proposed index on confrelid aims to restore acceptable performance. Large partitioned schemas are the main audience for the change.