pg_ash v1.3 cuts the cord to pg_cron

Active Session History for Postgres now runs anywhere you can schedule a job — systemd timer, system cron, or a psql \watch loop.

pg_ash v1.3 landed on March 11 with 32 commits. The headline feature: pg_cron is now officially optional. Call ash.start() without it and the extension prints NOTICE instructions for external scheduling; ash.status() reports accordingly. Azure Flexible Server users get a fix too — pg_ash now uses cron.alter_job() instead of direct UPDATE on cron.job, which Azure locks as read-only. A new set_debug_logging() function lets operators trace sampled backends to the server log, handy for diagnosing connection pooler behavior. Functions that depend on pg_stat_statements now fail fast with a clear EXCEPTION and HINT instead of silently returning NULLs, while optional-dependency functions emit a WARNING. Minute and hour intervals also work properly now — ash.start('5 minutes') no longer chokes. Ten merged PRs drove the release, including #7 Make pg_cron officially optional, #14 error when pgss-dependent functions called without pg_stat_statements, and #17 WARNING when pgss-optional functions run without pg_stat_statements.

rpg burns through 100 commits but ships nothing — on purpose

The Rust-based psql replacement is deep in construction; the issue tracker hints at what is coming.

@NikolayS pushed 100 commits to rpg this week with no release and no merged PRs. The issue tracker tells the story: a query formatter via \reformat, fuzzy and AI-powered command history, terminal charts and graphs for query results, WASI target for browser embedding via WSS proxy, and shell script support in the prompt. All filed, none shipped. This is scaffolding season.

AI agent leaks pgMustard API key in a PR comment

An automated test run for rpg's \explain share pgmustard feature posted raw output — secret included — to a public GitHub thread.

During development of rpg v0.8.0's pgMustard integration, an AI agent dutifully posted its testing output to a GitHub PR comment. The output included a pgMustard API key. @NikolayS spotted the leak quickly and rotated the key. No damage done, but the lesson is evergreen: AI agents do not distinguish secrets from stdout. If your workflow posts tool output to public threads, treat every run as a potential disclosure event.