Who contributed to Supabase on May 2, 2026?

2 developers shipped this update, including pamelachia and dnywh.

What were the notable Supabase updates?

Shift auto enable rls to a minimisable banner instead (#45410), [FE-2075] feat(studio): bump graphiql to v5 and use prebuilt component (#45404), and feat(www): add JSON-LD structured data to homepage, products, and blog.

@supabase

The open-source Firebase alternative powering thousands of startups

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

SUPABASE TIGHTENS RLS SECURITY, SHIPS GRAPHIQL V5 OVERHAUL

By RepoJournal · Filed 06:02 UTC on May 2, 2026 · About Supabase

2 people shipped this

pamelachia @pamelachia 1 cited

dnywh @dnywh 1 cited

Supabase is forcing security-first UX by making the RLS enable banner impossible to dismiss without action, while simultaneously shipping a cleaner GraphQL IDE built on GraphiQL 5.

The RLS auto-enable prompt is no longer a throw-away toast [1] — it's now a persistent banner that users can minimize but never truly dismiss until they've explicitly handled row-level security. This is a deliberate friction point. You can't build an insecure database by accident anymore. That same security obsession shows up in the GraphQL Studio, where [2] GraphiQL got bumped to v5 with a simpler prebuilt component replacing the previous heavily-customized rebuild. You trade some layout flexibility for maintainability; role impersonation moved into the sidebar plugin system. The table editor header is getting a refresh [4] — components are breaking down into smaller, reusable pieces (`IndexAdvisorPopover`, `SecurityDefinerViewPopover`, `RealtimeToggle`) and the header is deprecating the older `useUrlState` hook in favor of `useQueryState`. On the marketing side, Supabase shipped zero JSON-LD structured data on supabase.com until now [3] — that's gone, with a new typed schema builder module that lets Google and AI assistants properly parse Supabase as a first-class entity across homepage, products, and blog. Finally, the design system got more flexible [5] with richer Admonition support — success states, description-only callouts, and cleaner title-only usage that stops floating headings from looking disconnected.

Action items

→ Review RLS implementation in existing projects — the banner won't let users skip it anymore supabase/supabase [plan]
→ Test GraphiQL v5 in your studio instance; role impersonation now lives in sidebar supabase/supabase [monitor]
→ Update internal links and documentation to reference new Admonition types supabase/supabase [plan]

References

[1] Shift auto enable rls to a minimisable banner instead (#45410) supabase/supabase
[2] [FE-2075] feat(studio): bump graphiql to v5 and use prebuilt component (#45404) supabase/supabase
[3] feat(www): add JSON-LD structured data to homepage, products, and blog ↗ supabase/supabase
[4] Clean up table editor header (#45452) supabase/supabase
[5] chore(studio + design-system): more flexible Admonition ↗ supabase/supabase

Quick answers

What shipped in Supabase on May 2, 2026?: Supabase is forcing security-first UX by making the RLS enable banner impossible to dismiss without action, while simultaneously shipping a cleaner GraphQL IDE built on GraphiQL 5. In total, 15 commits and 15 pull requests landed.
Who contributed to Supabase on May 2, 2026?: 2 developers shipped this update, including pamelachia and dnywh.
What were the notable Supabase updates?: Shift auto enable rls to a minimisable banner instead (#45410), [FE-2075] feat(studio): bump graphiql to v5 and use prebuilt component (#45404), and feat(www): add JSON-LD structured data to homepage, products, and blog.

POSTGRES 17.6.1.156 SHIPS WITH ORIOLEDB VARIANT, CLI PORTS NATIVE TYPESCRIPT START COMMAND

Supabase shipped five Postgres releases overnight across three build variants while the CLI ditched its Go binary proxy for native TypeScript in the local dev stack.

javascript 22 shipped 1-min read

@supabase 1 day ago

DOCS CONTENT API NOW PLUGGABLE, RLS LEAK PATCHED IN STUDIO

The MCP server can point at alternative GraphQL endpoints for docs testing, while a critical fix stops Studio from leaking RLS-protected values during cell loads.

javascript 80 shipped 2-min read

@supabase 2 days ago

CLICKHOUSE SCHEMA CORRUPTION FIX LANDS ACROSS ETL STACK

Supabase shipped a critical fix that prevents ClickHouse from destroying newer columns during CDC replay restarts, then propagated the same safety logic across Pulumi and Terraform tooling.

javascript 95 shipped 1-min read

@supabase 3 days ago

PIPELINES HITS PUBLIC ALPHA, REALTIME SQUASHES RACE CONDITION

Supabase Pipelines moves out of private alpha with full schema change support, while the realtime stack hardens against clustering edge cases.

javascript 104 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.