Who contributed to Supabase on May 26, 2026?

1 developer shipped this update, including supabase-libs-pr-manager[bot].

What were the notable Supabase updates?

feat: add safe SQL execution for analytics queries (BigQuery/ClickHouse) (#46287), feat(logs): route unified-logs hooks through executeAnalyticsSql (#46333), and feat(logs): brand ServiceFlow.sql.ts with SafeLogSqlFragment (#46336).

@supabase

The open-source Firebase alternative powering thousands of startups

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

SUPABASE HARDENS ANALYTICS SQL AGAINST INJECTION ATTACKS

By RepoJournal · Filed 06:02 UTC on May 26, 2026 · About Supabase

1 person shipped this

supabase-libs-pr-manager[bot] @supabase-libs-pr-manager[bot] 1 cited

A three-part security refactor shipped overnight to prevent SQL injection in BigQuery and ClickHouse analytics queries, closing a compile-time safety gap across the entire logs pipeline.

Supabase landed the final piece of its safe-analytics-sql series, with all three PRs now merged [1] [2] [3]. The work introduces a compile-time safety model for analytics queries that previously lacked protection against untrusted input from URL parameters and other sources. ServiceFlow.sql.ts got branded with SafeLogSqlFragment [3], completing the wire-boundary wrapper that now shields all five unified-logs query hooks [2] from direct interpolation risks. On the UI side, the team finished migrating deprecated Modal components out of Organization settings [4], swapping them for Dialog across subscription downgrade flows, OAuth app management, and member limit alerts. A smaller type-safety win landed in core: removing any-type annotations to let ratchet rules pass [5]. Over in realtime, supabase-js bumped to v2.106.2 [6], restoring signup user response and adding Hermes-safe React Native exports. Dashboard also got an IPv6 DNS connection fix [7] for tenant migrations, addressing a timing issue on disconnect [8], with the realtime service now at v2.98.3 [9].

Action items

→ Review the safe-analytics-sql refactor series if you maintain analytics queries or custom logging supabase/supabase [monitor]
→ Update supabase-js to v2.106.2 if you're on React Native with Hermes supabase/realtime [plan]
→ Bump realtime to v2.98.3 for IPv6 DNS and disconnect fixes in self-hosted deployments supabase/realtime [plan]

References

[1] feat: add safe SQL execution for analytics queries (BigQuery/ClickHouse) (#46287) supabase/supabase
[2] feat(logs): route unified-logs hooks through executeAnalyticsSql (#46333) supabase/supabase
[3] feat(logs): brand ServiceFlow.sql.ts with SafeLogSqlFragment (#46336) supabase/supabase
[4] chore: migrate Organization settings `Modal` to `Dialog` (#46332) supabase/supabase
[5] chore: remove any type to let ratchet rules pass (#46349) supabase/supabase
[6] chore: update @supabase/supabase-js to v2.106.2 ↗ supabase/realtime
[7] fix(dashboard): tenant db connect dns ipv6 (#1910) supabase/realtime
[8] fix: timing issue on connection disconnect (#1908) supabase/realtime
[9] v2.98.3 ↗ supabase/realtime

Quick answers

What shipped in Supabase on May 26, 2026?: A three-part security refactor shipped overnight to prevent SQL injection in BigQuery and ClickHouse analytics queries, closing a compile-time safety gap across the entire logs pipeline. In total, 30 commits, 28 pull requests, and 2 releases landed.
Who contributed to Supabase on May 26, 2026?: 1 developer shipped this update, including supabase-libs-pr-manager[bot].
What were the notable Supabase updates?: feat: add safe SQL execution for analytics queries (BigQuery/ClickHouse) (#46287), feat(logs): route unified-logs hooks through executeAnalyticsSql (#46333), and feat(logs): brand ServiceFlow.sql.ts with SafeLogSqlFragment (#46336).

POSTGRES 17.6.1.156 SHIPS WITH ORIOLEDB VARIANT, CLI PORTS NATIVE TYPESCRIPT START COMMAND

Supabase shipped five Postgres releases overnight across three build variants while the CLI ditched its Go binary proxy for native TypeScript in the local dev stack.

javascript 22 shipped 1-min read

@supabase 1 day ago

DOCS CONTENT API NOW PLUGGABLE, RLS LEAK PATCHED IN STUDIO

The MCP server can point at alternative GraphQL endpoints for docs testing, while a critical fix stops Studio from leaking RLS-protected values during cell loads.

javascript 80 shipped 2-min read

@supabase 2 days ago

CLICKHOUSE SCHEMA CORRUPTION FIX LANDS ACROSS ETL STACK

Supabase shipped a critical fix that prevents ClickHouse from destroying newer columns during CDC replay restarts, then propagated the same safety logic across Pulumi and Terraform tooling.

javascript 95 shipped 1-min read

@supabase 3 days ago

PIPELINES HITS PUBLIC ALPHA, REALTIME SQUASHES RACE CONDITION

Supabase Pipelines moves out of private alpha with full schema change support, while the realtime stack hardens against clustering edge cases.

javascript 104 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.