Who contributed to Supabase on May 13, 2026?

2 developers shipped this update, including iambriccardo and dnywh.

What were the notable Supabase updates?

fix: update `Decimal` and `Postgrex` due to published CVE (#1862), feat(studio): move CLI login to connect interstitial (#45814), and fix(types): Improve handling of data types.

@supabase

The open-source Firebase alternative powering thousands of startups

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

REALTIME PATCHES CVE, STUDIO CONSOLIDATES LOGIN FLOWS

By RepoJournal · Filed 06:02 UTC on May 13, 2026 · About Supabase

2 people shipped this

iambriccardo @iambriccardo 1 cited

dnywh @dnywh 1 cited

Supabase Realtime shipped a security update addressing published CVE vulnerabilities in Decimal and Postgrex dependencies, while the Studio team unified CLI authentication onto a shared interstitial pattern.

The Realtime team [1] moved fast on dependency updates to close the CVE exposure, bundled into v2.94.0 [4] which also ships improved error tagging for metric pusher failures. This follows the pattern of the last 48 hours: small, focused security and observability wins stacking across the platform. On the frontend, Studio's CLI login route [2] now uses the shared connect interstitial layout instead of the legacy API auth pattern—a cleanup that mirrors the organisation invite refactoring work completed earlier this week [5]. The ETL pipeline tightened numeric type handling [3] to respect Postgres storage limits while preserving special values like `money` arrays, solving a class of silent data corruption bugs on BigQuery and ClickHouse syncs. Across all desks, the pattern is consistent: less UI debt, tighter type safety, faster security responses.

Action items

→ Deploy Realtime v2.94.0 to close CVE in Decimal and Postgrex supabase/realtime [immediate]
→ Verify ETL pipelines with updated numeric type handling before next sync supabase/etl [plan]
→ Monitor Realtime migration reconciliation for FunctionClauseError on tenant removal supabase/realtime [monitor]

References

[1] fix: update `Decimal` and `Postgrex` due to published CVE (#1862) supabase/realtime
[2] feat(studio): move CLI login to connect interstitial (#45814) supabase/supabase
[3] fix(types): Improve handling of data types ↗ supabase/etl
[4] v2.94.0 ↗ supabase/realtime
[5] refine organisation invite state helpers ↗ supabase/supabase

Quick answers

What shipped in Supabase on May 13, 2026?: Supabase Realtime shipped a security update addressing published CVE vulnerabilities in Decimal and Postgrex dependencies, while the Studio team unified CLI authentication onto a shared interstitial pattern. In total, 31 commits, 28 pull requests, and 3 releases landed.
Who contributed to Supabase on May 13, 2026?: 2 developers shipped this update, including iambriccardo and dnywh.
What were the notable Supabase updates?: fix: update `Decimal` and `Postgrex` due to published CVE (#1862), feat(studio): move CLI login to connect interstitial (#45814), and fix(types): Improve handling of data types.

POSTGRES 17.6.1.156 SHIPS WITH ORIOLEDB VARIANT, CLI PORTS NATIVE TYPESCRIPT START COMMAND

Supabase shipped five Postgres releases overnight across three build variants while the CLI ditched its Go binary proxy for native TypeScript in the local dev stack.

javascript 22 shipped 1-min read

@supabase 1 day ago

DOCS CONTENT API NOW PLUGGABLE, RLS LEAK PATCHED IN STUDIO

The MCP server can point at alternative GraphQL endpoints for docs testing, while a critical fix stops Studio from leaking RLS-protected values during cell loads.

javascript 80 shipped 2-min read

@supabase 2 days ago

CLICKHOUSE SCHEMA CORRUPTION FIX LANDS ACROSS ETL STACK

Supabase shipped a critical fix that prevents ClickHouse from destroying newer columns during CDC replay restarts, then propagated the same safety logic across Pulumi and Terraform tooling.

javascript 95 shipped 1-min read

@supabase 3 days ago

PIPELINES HITS PUBLIC ALPHA, REALTIME SQUASHES RACE CONDITION

Supabase Pipelines moves out of private alpha with full schema change support, while the realtime stack hardens against clustering edge cases.

javascript 104 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.