Who contributed to Supabase on May 16, 2026?

4 developers shipped this update, including tomaspozo, itslenny, mandarini, and djhi.

What were the notable Supabase updates?

fix(auth): skip user mode when token has sb_ prefix, server-v1.1.0-rc.63, and fix: improve database error messages.

@supabase

The open-source Firebase alternative powering thousands of startups

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

SUPABASE SERVER RC.63 SHIPS AUTH FIX, STORAGE IMPROVES ERROR CLARITY

By RepoJournal · Filed 06:02 UTC on May 16, 2026 · About Supabase

4 people shipped this

tomaspozo @tomaspozo 1 cited

itslenny @itslenny 1 cited

mandarini @mandarini 1 cited

djhi @djhi 1 cited

Supabase shipped server-v1.1.0-rc.63 with a critical auth fix that unblocks the JS SDK's dual-mode token handling, while storage v1.58.20 cuts through database error noise to surface the real culprits.

The server auth layer was rejecting `sb_`-prefixed tokens in user mode before falling through to secret/publishable verification [1], a breaking change for any SDK using combined auth configs. RC.63 patches this by treating `sb_` tokens as not-applicable in user mode, letting the credential chain complete [2]. That fix ships alongside a pnpm 11.1.2 bump that resolves a critical missing-time dependency bug [5]. On the storage side, v1.58.20 [4] tackles an underreported problem: schema mismatch errors were all blamed on out-of-sync migrations, when user-created triggers and RLS policies were often the real culprits [3]. The new error handling surfaces trigger/RLS details so operators can actually debug instead of chasing false positives. The main supabase/supabase repo is in refactoring mode, finishing the Tailwind v4 migration by removing @radix-ui/colors and the shadcn component suffixes [6][7][8]. Meanwhile, supavisor's upgrade test script now captures BEAM PIDs directly instead of relying on fragile pgrep calls, making test infrastructure more reliable [9].

Action items

→ Deploy server-v1.1.0-rc.63 if you use combined auth modes (user + secret/publishable) supabase/server [immediate]
→ Upgrade to storage v1.58.20 to get accurate database error diagnostics in logs supabase/storage [plan]
→ Monitor main branch refactors for any broken component imports after shadcn suffix removal supabase/supabase [monitor]

References

[1] fix(auth): skip user mode when token has sb_ prefix ↗ supabase/server
[2] server-v1.1.0-rc.63 ↗ supabase/server
[3] fix: improve database error messages ↗ supabase/storage
[4] v1.58.20 ↗ supabase/storage
[5] chore: update pnpm to 11.1.2 ↗ supabase/server
[6] chore: remove shadcn suffix for `Input`, `Textarea`, `Alert` and `Collapsible` ↗ supabase/supabase
[7] chore: remove `<Toggle>` `_Shadcn_` suffix (#45970) supabase/supabase
[8] chore: Clean up remaining Tailwind code (#45925) supabase/supabase
[9] chore: improve process management in upgrade test script (#985) supabase/supavisor

Quick answers

What shipped in Supabase on May 16, 2026?: Supabase shipped server-v1.1.0-rc.63 with a critical auth fix that unblocks the JS SDK's dual-mode token handling, while storage v1.58.20 cuts through database error noise to surface the real culprits. In total, 40 commits, 41 pull requests, and 3 releases landed.
Who contributed to Supabase on May 16, 2026?: 4 developers shipped this update, including tomaspozo, itslenny, mandarini, and djhi.
What were the notable Supabase updates?: fix(auth): skip user mode when token has sb_ prefix, server-v1.1.0-rc.63, and fix: improve database error messages.

POSTGRES 17.6.1.156 SHIPS WITH ORIOLEDB VARIANT, CLI PORTS NATIVE TYPESCRIPT START COMMAND

Supabase shipped five Postgres releases overnight across three build variants while the CLI ditched its Go binary proxy for native TypeScript in the local dev stack.

javascript 22 shipped 1-min read

@supabase 1 day ago

DOCS CONTENT API NOW PLUGGABLE, RLS LEAK PATCHED IN STUDIO

The MCP server can point at alternative GraphQL endpoints for docs testing, while a critical fix stops Studio from leaking RLS-protected values during cell loads.

javascript 80 shipped 2-min read

@supabase 2 days ago

CLICKHOUSE SCHEMA CORRUPTION FIX LANDS ACROSS ETL STACK

Supabase shipped a critical fix that prevents ClickHouse from destroying newer columns during CDC replay restarts, then propagated the same safety logic across Pulumi and Terraform tooling.

javascript 95 shipped 1-min read

@supabase 3 days ago

PIPELINES HITS PUBLIC ALPHA, REALTIME SQUASHES RACE CONDITION

Supabase Pipelines moves out of private alpha with full schema change support, while the realtime stack hardens against clustering edge cases.

javascript 104 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.