Datenbanken: Release Notes

Changes:

• 245d4284a5018b7f446b5eac4d3add1fa5547229 .NET: Restore source-only release solution filter (#9140) [ #8537 ]
• d0ccaa62761ec36c59c139940797978623fb630a .NET: Preserve explicit null session state across roundtrips (#9012)
• 279d97f75cb2e7eee885dcdc2c741ef7361ee903 .NET: Honor disabled recent search memory (#9013)
• 41e785fb9a3c853272ce0fbd2eb93364e9d1de13 .NET: Preserve lazy request messages through agent invocation (#9017)
• 9251bc9911d30f5035b4a75cd1c61f96c90f38a6 .NET: Update version for 1.24.0 release (#9120)
• 73a96cb1a90213dfc2b1d36e7c7250559fb28d5d .NET: Stabilize Anthropic agent package (#9111) [ #9110 ]
• 0774607d8d3fa8a3f50cd5bda7b4c7ad400403f3 .NET: Reject sensitive declarative identifiers (#9071)
• 41c4f1c9b0242cfc3f2567db9f9c9a462982a4e7 .NET: Harden LocalCodeAct capability validation (#9057)

<details><summary><b>See More</b></summary>

• b9d24c8fb484c8330abe8bb9e7500ca3c3bbf46c .NET: test: add loopback destination regression coverage (#9064)
• bd5ab48cfdebb49b9223de0fc75c7141641927f3 .NET: Validate handoff request lifecycle before routing (#8855)
• 636e8562d1db4e678e0bb88f602e0bbc7318f6a4 .NET: Synchronize background task metadata and defer publication until session creation (#8933)
• 6ef0b73ed8ee5ae9a5cdc709edc5bfc9443d91cb .NET: Isolate GitHub Copilot attachment staging (#8846)
• 52fed574f05aa4c22ae4cc024679d501ec5f327a .NET: Preserve atomic cache creation across factory failures (#8931) …

PGX Inc. has released version 1.0 of pgx-bm25, an extension that adds Okapi BM25 ranked full-text search to PostgreSQL as a native index access method. It supports PostgreSQL 17 and 18, and installs as bm25_native.

CREATE EXTENSION bm25_native;
CREATE INDEX docs_bm25 ON docs USING bm25_native (body);

SELECT id, bm25_score(ctid) AS score
FROM   docs
WHERE  body @@@ 'quick fox'
ORDER  BY body &@@ 'quick fox'
LIMIT  10;

@@@ selects the matching rows and &@@ orders them by relevance. The query runs as an ordered index scan; there is no Sort node.

It is a PostgreSQL index

The whole index lives in the index relation's own pages, so it gets WAL logging, crash recovery, and physical replication from core. VACUUM maintains it. There is no external search engine and no separate runtime to operate. The extension is written in C against the stock server headers and builds with PGXS; a C compiler and pg_config are the whole toolchain.

Text is analyzed with PostgreSQL's own Snowball dictionaries, with the language set per index, so a search for negligent finds negligence. Ranked top-N queries use block-max WAND, so a typical LIMIT 10 search does not have to score every matching document.

Query features …

pg_plan_filter version 1.0.0 has been released.

This loadable module test sstatements against specific configured criteria before execution, raising an error if the criteria are violated. This allows administrators to prevent execution of certain queries on production databases.

The criteria are based on the planner's estimated cost. pg_plan_filter can refuse an individual statement whose plan is too expensive (statement_cost_limit), cap the combined cost of all the statements run in one transaction (transaction_cost_limit), and optionally apply the filter to SELECT statements only (filter_select_only). The module could be extended to support further kinds of filters.

It supports PostgreSQL versions 14 through 18.

For more information, see Identity inventory integration.

August 2026

Unified RBAC is enabled by default for new Defender for Cloud Apps customers

Starting in August 2026, Microsoft Defender unified role-based access control (RBAC) is automatically enabled for new Defender for Cloud Apps customers. No manual workload activation is required.

Unified RBAC provides a centralized experience for managing roles and permissions across Microsoft Defender products. For more information, see Microsoft Defender unified role-based access control and Configure admin access in Defender for Cloud Apps.

June 2026

Salesforce connector enhancements (Preview)

Modern Salesforce attacks increasingly abuse OAuth tokens, connected apps, sessions, and APIs, often bypassing MFA and traditional controls. The Salesforce connector for Microsoft Defender for Cloud Apps is now better equipped to detect these attacks. The connector ingests Salesforce Real-Time Event Monitoring data for near real-time detection of identity and OAuth threats with richer investigation context, and adds OAuth app governance for Salesforce Connected Apps and External Client Apps (ECAs).

We recommend that Salesforce administrators enable Real-Time Event Monitoring in the Salesforce console for the best detection coverage. Enabling it gives you better latency and more robust detections.

• Real-time event monitoring: When a Salesforce administrator enables Storing data for the relevant events in Salesforce Event Manager, the Salesforce connector ingests Salesforce Real-Time Event Monitoring data within minutes. This improves detection coverage for OAuth abuse, session hijacking, credential stuffing, and anomalous API activity, and the OAuth apps inventory includes Salesforce Connected Apps and External Client Apps (ECAs). For more information, see Enable Salesforce real-time event monitoring. …