September 2025

Sparse attention in V3.2-Exp brought long-context serving costs down and DeepSeek passed it straight through, landing input around $0.28/M and output around $0.42/M. Every budget provider on this page re-priced within the quarter.

A third-party npm package impersonating an official Postmark MCP server was found silently BCC-ing every message it sent to an attacker-controlled address. Postmark did not publish the package. It is the cleanest available demonstration that an MCP server holding your sending credentials is a supply-chain dependency, and should be pinned and audited like one.

An asynchronous I/O subsystem, uuidv7() in core, skip scan for multi-column B-tree indexes, virtual generated columns, and — quietly the most useful item — planner statistics that survive pg_upgrade, removing the post-upgrade ANALYZE window during which a freshly migrated cluster plans badly.

DuckDB adopts a long-term-support line and adds database encryption and MERGE INTO. The LTS commitment is the more consequential half: it is the point at which running DuckDB as durable infrastructure, rather than as a notebook tool, stops being reckless.

Verisign applied one of its contractually permitted annual .com wholesale increases. At-cost registrars such as Cloudflare passed it through within days and their retail prices moved in lockstep. The retail tier mostly absorbed it into a larger scheduled rise, which is why the gap between the cheap and expensive registrars widened in dollars while narrowing in percentage terms.

A second seven per cent increase in as many years took .com wholesale to roughly US$10.98 before the ICANN transaction fee. Providers passed it through at different speeds — the wholesale platforms almost immediately, several retail registrars a quarter later while absorbing the difference.