Database Lab Engine v4.2.1: Safer Clone Upgrades and Hardened Defaults

Database Lab Engine v4.2.1 shipped on October 8, 2026. It is a patch release focused on correctness and hardening: clone upgrades no longer fail on TLS mounted instances, the engine’s state file is written atomically, and a background panic no longer kills the whole process. Not a prerelease.

The full release notes and downloads are on the GitHub release page.

Clone upgrades and provisioning fixes

Three fixes matter if you run clones in production:

  • Clone upgrades used to fail at the check stage on instances that mount TLS certificates or other files into clones. The upgrade container now receives volumes from databaseContainer.containerConfig, so those instances can upgrade again (!1206).
  • Creating a clone from a snapshot with a pending DETACH PARTITION ... CONCURRENTLY no longer fails with cannot alter partition ... with an incomplete detach. The engine finalizes the detach in the clone (!1208).
  • The “Upgrade clone” button stays visible even when upgrade is unavailable, for example when provision.pgUpgradeImage is not set. It shows the engine’s reason in a tooltip instead of disappearing (!1205).

Stability: panics, races, and state writes

The big reliability item: sessions.json is now written atomically. Before this release, a crash in the middle of a write could make the engine destroy every clone on the next start. The engine now also refuses to start on an unreadable state file (!1198).

Panics in background jobs or HTTP handlers no longer terminate the engine. Config reload is synchronized across services, two concurrent full refreshes cannot both start, and a clone keeps its database config across a reload (!1202). A rotated verificationToken now takes effect on reload instead of needing a restart.

On the CLI side, --extra-config and --tags values without = return a proper error instead of a panic.

Security changes, including a breaking default

Read this section before upgrading:

  • An empty provision.upgradeImageAllowList now restricts clone upgrades to images from the repository of the clone image, not any repository. This is a breaking change of the default. Set ["*"] in provision.upgradeImageAllowList to restore the old behavior (!1200).
  • Host, user, database and table names are shell quoted in logical dump and restore commands.
  • WAL-G and pgBackRest credentials in physical mode are masked in the config view and in GET /admin/config.
  • The HTTP server now has read and idle timeouts and a 1 MiB request body limit, returning 413 beyond that.

Dependencies were bumped too: binaries are built with Go 1.26.8, golang.org/x/crypto is at v0.57.0, and the UI picked up moment 2.31.0 (CVE-2026-17495) and dompurify 3.4.16 (!1201, !1210).

API and UI cleanups

Not found and bad request errors return 404 and 400 instead of 500. The OpenAPI spec now matches the actual routes, including 7 previously documented operations that were missing. A Postgres start timeout is reported as an error rather than success, and POST /observation/stop no longer hangs after a failed observation session (!1197, !1199).

The Logs tab stopped leaking WebSocket connections and auto scrolls again. The internal section of the notes is mostly CI work: release tags are gated on the e2e matrix for PG 10 through 18, and ESLint plus unit tests run for every UI package.

Where to get it

← All updates