Who contributed to Supabase on May 14, 2026?

3 developers shipped this update, including iambriccardo, jgoux, and edgurgel.

What were the notable Supabase updates?

fix: escape quotes (#45848), fix: search on the partners/integrations page was still using misc db (#45866), and fix: prevent non-superuser roles from dropping supabase_privileged_role (#2150).

@supabase

The open-source Firebase alternative powering thousands of startups

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

SUPABASE PATCHES SEARCH AND SECURITY GAPS ACROSS PLATFORM

By RepoJournal · Filed 06:02 UTC on May 14, 2026 · About Supabase

3 people shipped this

iambriccardo @iambriccardo 1 cited

jgoux @jgoux 1 cited

edgurgel @edgurgel 1 cited

Quote escaping fix closes critical search vulnerabilities while ETL and Realtime ship performance improvements that ripple across the stack.

The main event: a quote escaping patch [1] resolves two separate search regressions in the dashboard, paired with a fix ensuring the integrations marketplace actually searches the right database [2]. On the infrastructure side, Postgres tightened role privilege handling on PG 15 to prevent non-superusers from dropping critical system roles [3], addressing a gap that PG 16 closed natively. Realtime shipped v2.94.1 [7] with a 2.3x replication poller optimization [6] that cuts memory garbage and response latency—meaningful for any app pushing high-frequency updates. ETL improved replica identity handling [4] to ensure identity masks align with what PostgreSQL actually streams, fixing edge cases in initial copy operations. CLI v2.99.0-beta.7 now runs compiled-next e2e tests against the actual binary users run [5], catching Bun blockers before release. Web tier also consolidated its Collapsible component to shadcn and bumped vulnerable dependencies across nitropack, mermaid, and hono.

Action items

→ Deploy quote escaping fix to dashboard before next release supabase/supabase [immediate]
→ Upgrade Realtime to v2.94.1 to cut replication memory overhead supabase/realtime [plan]
→ Review ETL replica identity handling if you use REPLICA IDENTITY FULL supabase/etl [monitor]
→ Test CLI v2.99.0-beta.7 in your CI/CD before stable release supabase/cli [monitor]

References

[1] fix: escape quotes (#45848) supabase/supabase
[2] fix: search on the partners/integrations page was still using misc db (#45866) supabase/supabase
[3] fix: prevent non-superuser roles from dropping supabase_privileged_role (#2150) supabase/postgres
[4] ref(core): Improve replica identity handling ↗ supabase/etl
[5] fix(cli): support compiled next cli e2e runtime ↗ supabase/cli
[6] fix: optimise replication poller ↗ supabase/realtime
[7] v2.94.1 ↗ supabase/realtime

Quick answers

What shipped in Supabase on May 14, 2026?: Quote escaping fix closes critical search vulnerabilities while ETL and Realtime ship performance improvements that ripple across the stack. In total, 36 commits, 35 pull requests, and 2 releases landed.
Who contributed to Supabase on May 14, 2026?: 3 developers shipped this update, including iambriccardo, jgoux, and edgurgel.
What were the notable Supabase updates?: fix: escape quotes (#45848), fix: search on the partners/integrations page was still using misc db (#45866), and fix: prevent non-superuser roles from dropping supabase_privileged_role (#2150).

POSTGRES 17.6.1.156 SHIPS WITH ORIOLEDB VARIANT, CLI PORTS NATIVE TYPESCRIPT START COMMAND

Supabase shipped five Postgres releases overnight across three build variants while the CLI ditched its Go binary proxy for native TypeScript in the local dev stack.

javascript 22 shipped 1-min read

@supabase 1 day ago

DOCS CONTENT API NOW PLUGGABLE, RLS LEAK PATCHED IN STUDIO

The MCP server can point at alternative GraphQL endpoints for docs testing, while a critical fix stops Studio from leaking RLS-protected values during cell loads.

javascript 80 shipped 2-min read

@supabase 2 days ago

CLICKHOUSE SCHEMA CORRUPTION FIX LANDS ACROSS ETL STACK

Supabase shipped a critical fix that prevents ClickHouse from destroying newer columns during CDC replay restarts, then propagated the same safety logic across Pulumi and Terraform tooling.

javascript 95 shipped 1-min read

@supabase 3 days ago

PIPELINES HITS PUBLIC ALPHA, REALTIME SQUASHES RACE CONDITION

Supabase Pipelines moves out of private alpha with full schema change support, while the realtime stack hardens against clustering edge cases.

javascript 104 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.