Hybrid Manager 1.4.2 release notes v1.4.2 (LTS)

Release date: August 6, 2026

Hybrid Manager (HM) 1.4.2 is a maintenance release that includes bug fixes and improvements.

HM platform

• Fixed an issue whereby creating primary and replica clusters with Transparent Data Encryption (TDE) enabled on a multi-region deployment failed with an internal server error when retrieving the customer key data for the TDE configuration.
• Fixed an issue whereby the customer-managed encryption key from the source cluster remained selected when restoring a TDE-encrypted, multi-group Distributed High Availability (PGD) cluster to a different location, causing the restore to fail because that key didn't exist at the target location. The encryption key field now clears the stale source key and requires selection of a valid key from the target location before a cross-location restore can be submitted.
• Fixed an issue whereby a restore operation could use a backup belonging to the wrong cluster or the wrong Primary/Standby Replica (PSR) replica, causing the restore to fail or the restored replica to become stuck. Restore requests referencing a mismatched backup are now rejected with a validation error, and the restore interface no longer displays backups from unrelated clusters or replicas as selectable options.
• Fixed an issue whereby a Postgres major version upgrade from version 16 to 17 could fail with an error about a missing extension library, such as pg_tokenizer, when a target-only preload library was written into the old data directory before the source postmaster could start in binary-upgrade mode.
• Fixed an issue whereby BackupWrapper resources remained in the system after their underlying backups were removed from object storage. Expired backup wrappers are now automatically cleaned up based on the object store's earliest recoverability point, so deleted or expired backups no longer appear as available for cluster restoration.
• Fixed an issue whereby the cluster backup schedule field accepted both 5-element and 6-element cron formats, which could cause confusion. The field now only accepts the 6-element cron format expected by CloudNativePG (CNPG).
• The app marketplace (kapp-controller and Marketplace) is no longer force-installed as part of the core scenario. It's now available as an optional, independent scenario that you can enable or disable at install time, consistent with other capability sets such as AI, analytics, and Database as a Service (DBaaS). Existing installs that already have Marketplace enabled continue to work without disruption.
• Added --source-registry and --source-images-list-url flags to the edbctl image sync-to-local-registry and edbctl image export-to-archive commands. These flags let you redirect the source registry and image list away from the default EDB registry and downloads host, enabling syncing or exporting from a mirror, pull-through cache, or air-gapped staging registry. These overrides can't be combined with the --staging flag. A companion edbctl image import-from-archive command is also available to load an exported archive back into a local registry, completing the air-gapped transfer.
• Approvers can now cancel a pending task that's waiting on an unsatisfied maintenance-window gate directly from the task manager UI. Canceling the task moves it to a terminal canceled state and releases the parent automation so a new task can be triggered when eligible.
• Added support for configuring a custom Certificate Authority (CA) bundle for Image Library registry connections. Previously, connecting to a registry secured with a certificate signed by a private or internal CA required enabling insecure registry mode, which downgraded connections from HTTPS to HTTP. You can now supply a custom CA bundle so that image discovery can connect to such registries over HTTPS with TLS 1.2 or later, without disabling certificate verification.
• Added a Duplicate button for Physical Streaming Replication (PSR) clusters, allowing you to duplicate a replica cluster from its primary directly from the cluster form.
• Fixed an issue whereby marketplace app deployments that use persistent storage, such as pgAdmin, pgBadger, and HammerDB, created their persistent volume claims (PVCs) without an explicit storage class, causing them to inherit the cluster's default storage class. On some environments, the default storage class had capacity only on nodes the marketplace app pods couldn't schedule on, leaving the pod stuck in a Pending state indefinitely. Storage class is now a user-configurable field when deploying these marketplace apps.

HM console

• Fixed an issue whereby some icon-only buttons and menu controls in the console, including the chat assistant trigger and monitoring gauge charts, didn't expose an accessible name for screen readers and other assistive technologies.
• Fixed an accessibility issue whereby links inside inactive carousel slides on the estate page's Active Alerts card remained focusable and reachable by keyboard navigation, despite the slides being hidden from assistive technologies.
• Fixed an accessibility issue whereby the slider handle in the automations edit sidebar had no accessible name, causing screen readers to announce it without a label.
• Fixed an issue whereby several text and background color combinations in the high-contrast theme didn't meet Web Content Accessibility Guidelines (WCAG) 2.1 AA color-contrast requirements, improving readability for users relying on high-contrast mode.
• Fixed an issue whereby several dropdown menus, filters, pickers, and navigation menus in the console could only be opened using a mouse hover, preventing keyboard-only users from accessing them. These controls can now be opened and operated using the keyboard.
• Fixed an issue whereby custom dropdown menus with non-standard overlay content didn't support keyboard-only operation. Focus now moves into the popup when it opens, keyboard users can navigate and activate items, and pressing Escape closes the popup and returns focus to the triggering element.
• Fixed multiple accessibility issues in shared UI components used throughout the HM console, including missing accessible names on icon-only buttons and toggle switches, improved form control labeling, and better keyboard operability for interactive components.
• Added a High Contrast option to My Account > Preferences, alongside other personal settings such as time zone. This setting is synchronized with the existing high-contrast toggle in the footer, so changing it in either location updates the theme in both places.
• Improved keyboard accessibility for the cluster wizard used to create, edit, restore, and template clusters (single, HA/PSR, PGD, and analytics cluster types). All tabs, controls, and the final submit action are now reachable and operable using only the keyboard, with a logical focus order and correct focus handling on validation errors.
• Improved keyboard accessibility for the migration application wizard. You can now navigate the Create and Edit Application steps, operate Next/Back and form controls, add or select databases, and submit the wizard entirely using a keyboard, with focus moving appropriately between steps and to validation errors.
• Improved keyboard accessibility for the Create Migration Project modal wizard. You can now complete the entire Details and Schemas workflow, including step navigation, form fields, schema selection, validation, and final submission, using the keyboard only.
• Improved keyboard accessibility for the Asset Library sidebar wizards (Deploy Package, Deploy Published Flow, Add Published Flow, and Edit Published Flow). All steps, controls, and navigation actions (Next, Back, Review, Submit) in these wizards can now be operated using the keyboard alone, with focus moving correctly between steps and to the first invalid field on failed validation.
• The Add New User (machine user) flow in the Quick Actions menu is now fully operable using the keyboard, including opening the menu, completing the form, submitting, and copying the generated access key. On validation failure, focus now moves to the first invalid field.
• Standardized dropdown and menu interactions across the console to open on click only. Dropdowns that previously opened on hover now require a click (or Enter/Space when using a keyboard), providing more consistent and accessible behavior across all flows.
• Fixed an issue whereby the Marketplace Asset Library's Latest version badge could point to an older release, because package versions were sorted lexicographically instead of by semantic version. Package versions are now returned in correct semantic-version order (newest first), so Latest reflects the actual newest release.
• Fixed an issue whereby the name-column link on the activity log page failed to open for system task entries with no associated project, resulting in a broken link. The task name is now displayed as plain text for these entries, while project-scoped tasks continue to link to the project task manager as before.
• Fixed an issue whereby the TDE customer key selection list showed keys from all locations instead of only the keys associated with the location selected for cluster deployment.
• Fixed an issue whereby the Topology section was displayed for single-node clusters regardless of the Postgres flavor or management type. The Topology section is now hidden for all single-node clusters.
• Fixed an issue whereby the chatbot continued to re-ask a stale project-disambiguation question after the user pivoted to a different request, instead of dropping the pending question and responding to the new request.
• Fixed an issue whereby logging out from the role management page could time out instead of navigating to the logout page.
• When a replica promotion fails, the console now displays the detailed error message returned by the backend API, making it easier to understand the cause of the failure.
• Simplified the delete-project dialog to a single step. The dialog now shows a clear warning listing everything that will be deleted, along with an explanation if the deletion fails.
• Project deletion now also checks for maintenance windows, Transparent Data Encryption (TDE) keys, cluster templates, migration credentials, migration applications, in-progress migrations, and self-managed and cloud-hosted PG clusters before allowing a project to be deleted, in addition to the existing checks for PG clusters, catalogs, deployed flows, marketplace apps, and knowledge bases.
• Fixed an issue whereby activity log entries for image repository rule events displayed the resource type as unknown instead of the correct resource-type label.
• Fixed an issue whereby the cluster status chart displayed a pointer cursor on hover even though the bars weren't clickable.
• The cluster status chart labels on the estate overview page are now clickable, linking to a filtered view of the estate that shows only clusters of the selected type.
• The Assign Roles dialog now opens as a drawer instead of a modal, providing more space to complete the task.
• The Create Storage Location dialog now opens as a drawer instead of a modal, providing a more consistent experience within the console.

Observability and monitoring

• Fixed an issue whereby a stricter host-header validation change in the Grafana Model Context Protocol (MCP) server caused authentication between the internal proxy and Grafana MCP to fail with a 403 Forbidden error, breaking all grafana_-prefixed MCP tool calls.
• Fixed an issue whereby the first-seen time for a query was shared across different Postgres clusters. Because query tracking was scoped globally instead of per cluster, a query's first-seen time could reflect when it was first observed on any cluster, including dates that predate the cluster's own creation. Query first-seen times are now tracked per cluster, so the reported value accurately reflects when the query was first observed on that specific cluster.
• Fixed an issue whereby PromQL queries didn't filter by the provided project IDs when using the beacon_estate query variant, causing the Resource Usage card to display metrics for all projects instead of the selected ones.
• The table-schema streaming interval used by the beacon agent now aligns with, and is configurable alongside, the schema collection interval, instead of running on a separate, fixed one-minute cadence. Poll and force-update intervals for schema collection can now be configured through the control-plane resource.
• Fixed an issue whereby notification emails weren't delivered or were rendered incorrectly due to a duplicate Content-Type header. Strict SMTP servers, such as AWS SES, rejected these messages outright, while other mail providers displayed the raw HTML markup instead of a properly rendered email.
• Fixed an issue whereby an internal metrics query on the system database failed with a column deleted_at does not exist error, generating a high volume of recurring error logs after related database columns were removed in a schema update. The broken metrics query has been removed.
• Fixed an issue whereby the valid limits for the Notify After field weren't shown when configuring an alert, making it unclear what values were acceptable before entering one. Validation and limit information is now displayed for this field.
• Fixed an issue whereby the alert configuration UI didn't enforce a maximum limit for threshold values, causing a server error when saving an alert configuration with an excessively large threshold.
• Fixed an issue whereby alert rule groups were incorrectly configured with a 0-second evaluation interval instead of the intended default interval, causing an excessive volume of requests against the metrics query engine that could lead to performance degradation or crashes. Rule-group evaluation intervals are now correctly set from the configured default when alert rules are reconciled.

Agent Factory

• Improved keyboard accessibility for the local and external inference service configuration forms. You can now navigate all sections and controls, including inputs, dropdowns, radio buttons, and checkboxes, using only the keyboard, with validation errors focusing the error summary or first invalid field on submission.
• Improved keyboard accessibility for the AI Pipeline Designer's create-pipeline workflow. You can now navigate and operate all step controls, including adding and removing custom steps and submitting the form, using the keyboard alone.
• Added support for the gpt-5.6 family of models, including gpt-5.6-luna, gpt-5.6-sol, and gpt-5.6-terra.
• Marketplace apps and the published-flow deploy action are now gated behind a dedicated marketplace scenario instead of being available by default under the core scenario. Publishing and managing flows remain available under the AI scenario, but deploying a published flow now requires the marketplace scenario to be enabled.

Migrations

• Improved keyboard accessibility for the Create OLTP Migration wizard. All controls in the Get Started and Tables steps, including table selection, filtering, and form validation, are now reachable and operable using the keyboard alone, with focus moving correctly between tabs and to validation errors.
• Fixed an issue in the change data capture (CDC) agent whereby the record verifier incorrectly rejected records for destination tables containing nullable columns that had no explicit default value and were absent from the filtered source record. The verifier now permits omission of nullable columns without a default, allowing NULL to be inserted, which is required when reader-side column filtering excludes columns that are still present at the destination.
• The CDC agent now supports generating a Debezium column.include.list from selected column mappings, allowing migrations to replicate only a specific subset of columns per table. When all columns or no columns are explicitly selected, no column filter is applied and existing migrations continue to replicate all columns as before.
• Added create-time validation for column selection during migration setup. An empty column selection is now rejected with a clear error, and a warning is now surfaced when the selection appears to exclude primary key columns.
• Column selection in the migration schema mapping UI now guarantees that deselected columns are excluded from the generated payload. All columns are selected by default, deselecting all columns isn't allowed, and key columns must remain selected.
• Data migrations now honor column-subset selections made when configuring a migration. Previously, deselected columns were still captured at the source and written to the destination, which could cause migrations to stall with missing-column errors or silently migrate columns that were meant to be excluded. The reader now only captures selected columns, and the writer allows nullable destination columns that aren't part of the selection to be skipped.
• Fixed an issue whereby a version mismatch between the CDC agent and the HM backend caused migrations to stall silently, with no error shown in the Sources view or the Error History tab. The HM console now detects incompatible agent versions at registration and surfaces a clear compatibility error on the migration page.
• Fixed an issue whereby schema assessment failed with a Cycle detected error when cyclic dependencies existed between database objects in a Postgres-to-Postgres (PG2PG) migration scenario. Assessment now completes successfully, logging a warning and ordering the cyclic objects deterministically instead of aborting.
• You can now download the EDB Query Extractor script directly from HM. Previously, this script (used to extract queries from Oracle's unified audit trail for migration assessment) was only available on request from EDB Support. A new download link is now provided in the SQL file upload dialog on the Migration Application details page.
• Fixed an issue whereby projects could get stuck in a DDL file is being uploaded state with no way to delete them. When a project failed to be created in the database after being created in memory, Migration Portal didn't gracefully handle the exception, leaving the project in a limbo state that blocked users from creating new projects.
• Fixed an issue whereby tables containing Postgres composite (user-defined row) type columns were silently excluded from replication during migration. Composite-typed columns are now discovered and replicated end to end, for both snapshot and CDC (streaming) migration modes.
• Fixed an issue whereby cluster-scoped objects, such as roles, extensions, grants, and default privileges, were omitted from schema export results when requested by object type, because their associated global objects weren't automatically included in the resolved schema list. Requests for these object types now correctly return the associated Data Definition Language (DDL).
• Fixed an issue whereby a Debezium snapshot or CDC session over a TLS 1.3 connection could hang indefinitely after transferring a large volume of data on a single connection, caused by a JVM TLS 1.3 key-update behavior that could deadlock the connection between the CDC agent and the source Postgres database. The TLS key usage limit is now set to a much higher threshold, preventing the deadlock while continuing to support TLS 1.3 connections.
• Fixed an issue whereby a race condition in the internal buffer used to stream extracted schema DDL to object storage could intermittently duplicate or drop a chunk of the streamed data, which could cause schema assessment to incorrectly report dependency cycles between tables, views, and constraints that didn't actually exist.
• Fixed an issue whereby concurrent schema finalization failed for partitioned tables, because the CONCURRENTLY keyword was incorrectly added to CREATE INDEX statements targeting partitioned parent tables using ON ONLY syntax, which Postgres doesn't support. Index creation on partitioned tables now completes successfully during concurrent schema finalization.
• Fixed an issue whereby automatic Migration Portal project creation failed when the source resource ID or database name contained special characters, such as hyphens or non-Latin characters. Special characters are now sanitized when generating the Migration Portal project name, preventing project creation failures.
• Fixed an issue whereby Migration Portal schema assessment failed with a Cycle detected error when the schema contained overloaded functions, procedures, or other DDL objects that share the same name but have different signatures. Overloaded object names are now correctly distinguished during dependency ordering, allowing assessment to complete successfully.