New Features
- UI: snapshot, clone and branch pages show a
Data lagrow in the Summary section, e.g.2 hours 3 minutes(!1227, #805)
Improvements and Fixes
- Creating a clone with
"restricted": trueno longer fails when a database name needs quoting, such asapp.24,APP_24_12or a name with spaces (!1233, #816) - Physical mode: when Postgres in the sync instance stops responding for 30 seconds, the engine saves diagnostics and restarts the sync container instead of snapshotting stale data indefinitely (!1218, #799)
- After a config reload, scheduled snapshots and logical refreshes update
dataStateAtin/statusagain instead of leaving it frozen until a restart (!1229, #813) - A config reload during a logical refresh on a multi-pool instance no longer leaves the refreshed pool marked
emptywith its snapshots hidden; pool state is guarded against concurrent reloads (!1230, #814) - A panic in a background goroutine no longer terminates the engine, and a clone caught mid-operation gets a final status instead of staying in a transient one (!1231)
- Logical restore with
skipPolicies: trueworks for explicitdatabases:entries, root-level directory dumps, custom-format files and a single-filedumpLocation(!1211, #797) - Logical restore discovers plain-text SQL dumps, and an explicit
databases: {postgres: {}}entry no longer adds--create(!1213, #798) - With
backupName: LATEST, WAL-G errors such as missing credentials or unreachable storage are reported instead of a generic failure, and an empty backup list says so (!1223, #802) - A failed clone upgrade keeps
pg_upgradeoutput inupgrade/logs/pg_upgrade_output.dand reports the postmaster error on undo (!1207, #793)
Security
/admin/*routes accept only the sharedverificationToken; personal tokens (platform.enablePersonalTokens) keep working on all other routes but no longer grant admin access (breaking change for clients that called admin routes with a personal token) (!1226, #806)- Binaries are built with the latest Go 1.27 patch release (up from 1.26.8), fixing CVE-2026-78667, CVE-2026-97031, CVE-2026-111943 and other standard library CVEs;
klauspost/compressis bumped to 1.18.7 and OpenTelemetry modules to 1.45.0 (!1212, !1224, #803) - The UI and Swagger UI images run on nginx 1.30.6 (up from 1.29), which fixes 17 nginx advisories from 2026 (!1228, #807)
dompurifyis bumped to 3.4.17, and the UI dev dependenciesvite,vitestandhappy-domare bumped to clearpnpm auditfindings (!1225)
Internal
- The e2e suite rebuilds source clusters per job, no longer hangs on failure and runs on a dedicated runner (!1214, !1217)
- The Trivy scan of feature-branch images no longer blocks feature pipelines; the master scan still does (!1212)