The Wire · Showcase
SUPABASE HARDENS ANALYTICS SQL AGAINST INJECTION ATTACKS
By RepoJournal · Filed · About Supabase
A three-part security refactor shipped overnight to prevent SQL injection in BigQuery and ClickHouse analytics queries, closing a compile-time safety gap across the entire logs pipeline.
Supabase landed the final piece of its safe-analytics-sql series, with all three PRs now merged [1] [2] [3]. The work introduces a compile-time safety model for analytics queries that previously lacked protection against untrusted input from URL parameters and other sources. ServiceFlow.sql.ts got branded with SafeLogSqlFragment [3], completing the wire-boundary wrapper that now shields all five unified-logs query hooks [2] from direct interpolation risks. On the UI side, the team finished migrating deprecated Modal components out of Organization settings [4], swapping them for Dialog across subscription downgrade flows, OAuth app management, and member limit alerts. A smaller type-safety win landed in core: removing any-type annotations to let ratchet rules pass [5]. Over in realtime, supabase-js bumped to v2.106.2 [6], restoring signup user response and adding Hermes-safe React Native exports. Dashboard also got an IPv6 DNS connection fix [7] for tenant migrations, addressing a timing issue on disconnect [8], with the realtime service now at v2.98.3 [9].
Action items
- → Review the safe-analytics-sql refactor series if you maintain analytics queries or custom logging supabase/supabase [monitor]
- → Update supabase-js to v2.106.2 if you're on React Native with Hermes supabase/realtime [plan]
- → Bump realtime to v2.98.3 for IPv6 DNS and disconnect fixes in self-hosted deployments supabase/realtime [plan]
References
- [1] feat: add safe SQL execution for analytics queries (BigQuery/ClickHouse) (#46287) supabase/supabase
- [2] feat(logs): route unified-logs hooks through executeAnalyticsSql (#46333) supabase/supabase
- [3] feat(logs): brand ServiceFlow.sql.ts with SafeLogSqlFragment (#46336) supabase/supabase
- [4] chore: migrate Organization settings `Modal` to `Dialog` (#46332) supabase/supabase
- [5] chore: remove any type to let ratchet rules pass (#46349) supabase/supabase
- [6] chore: update @supabase/supabase-js to v2.106.2 ↗ supabase/realtime
- [7] fix(dashboard): tenant db connect dns ipv6 (#1910) supabase/realtime
- [8] fix: timing issue on connection disconnect (#1908) supabase/realtime
- [9] v2.98.3 ↗ supabase/realtime
FAQ
- What changed in Supabase on May 26, 2026?
- A three-part security refactor shipped overnight to prevent SQL injection in BigQuery and ClickHouse analytics queries, closing a compile-time safety gap across the entire logs pipeline.
- What should Supabase teams do about it?
- Review the safe-analytics-sql refactor series if you maintain analytics queries or custom logging • Update supabase-js to v2.106.2 if you're on React Native with Hermes • Bump realtime to v2.98.3 for IPv6 DNS and disconnect fixes in self-hosted deployments
- Which Supabase repositories shipped on May 26, 2026?
- supabase/supabase, supabase/realtime