RepoJournal
Supabase @supabase
151 wires and counting

$ follow Supabase

Keep up with Supabase in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-05-09
stories 32
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

SUPABASE-JS BREAKS IN SANDBOXED BROWSERS — PATCH NOW

By RepoJournal · Filed · About Supabase · Composed from the cited sources · methodology

mandarini ferhatelmas
2 people shipped this
mandarini @mandarini 1 cited ferhatelmas @ferhatelmas 1 cited

createClient crashed in restricted-storage environments (sandboxed iframes, in-app webviews, privacy modes) due to unsafe sessionStorage access in the realtime layer [ref:8].

The supabase-js client was throwing synchronously with SecurityError when initialized in browsers that restrict storage access—Facebook Messenger, Instagram, Google Performance Max webviews, and sandboxed iframes without same-origin flags all hit this wall [1]. This is live: v2.105.4 ships the fix [2], and v3.0.0-next.27 guards the same vulnerability in the next-generation client [5]. Both releases also patch separate auth and postgrest issues: v2.105.4 hardens JSON parse error handling in getItemAsync and restores abort detection in fetch catches [2]. Storage layer shipped v1.58.11 with a critical range-read fix for file backend uploads [3]—the parser now handles optional range headers correctly and eliminates an off-by-one error in part copy operations [4]. Postgres images across versions (15.14.1, 17.6.0, and 17.6.0-orioledb) are staged and ready .

$ ls supabase/reviews/ # the step-back reads

the week in review CLI 2.120.0 adds persisted logs and OTel traces the month in review MCP v0.12.0 groups advisor lints, adds cost elicitation
Full archive → Weekly reviews →

Quick answers

What shipped in Supabase on May 9, 2026?
createClient crashed in restricted-storage environments (sandboxed iframes, in-app webviews, privacy modes) due to unsafe sessionStorage access in the realtime layer [ref:8]. In total, 6 commits, 9 pull requests, and 17 releases landed.
Who contributed to Supabase on May 9, 2026?
2 developers shipped this update, including mandarini and ferhatelmas.
What were the notable Supabase updates?
fix(realtime): guard sessionStorage access in restricted-storage browsers, v2.105.4, and v1.58.11.
♥

$ log @supabase --recent

Self-hosted stack bumps realtime and storage, Studio remembers your chart range 72 shipped Realtime 2.144.0 patches a decimal CVE; realtime-csharp adds paged storage listing 151 shipped MCP server 0.14.0 adds health advisors, Supabase CLI routes every Management API call through the typed client 123 shipped Scoped OAuth reconsent in Studio, MCP drops double cost prompts 139 shipped

$ log --all # elsewhere on the wire

Alignment & Post-training verl rejects conflicting vLLM engine_kwargs, open-instruct adds MILES OPD behind a Megatron learner Interpretability nnsight 0.8.0 cuts import time from 7.6s to 1.6s

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.