Who contributed to Supabase on May 27, 2026?

4 developers shipped this update, including iambriccardo, mandarini, awaseem, and stylessh.

What were the notable Supabase updates?

fix(bigquery): Recreate view on schema change in BigQuery, docs: add guide for securing npm installs against supply-chain attacks, and docs(repo): move npm security guide to supabase.com/docs.

@supabase

The open-source Firebase alternative powering thousands of startups

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

BIGQUERY VIEW LOGIC FIXED, NPM SECURITY GUIDE GOES LIVE, CLI GAINS TABLE EXPOSURE CONTROL

By RepoJournal · Filed 06:03 UTC on May 27, 2026 · About Supabase

4 people shipped this

mandarini @mandarini 2 cited

iambriccardo @iambriccardo 1 cited

awaseem @awaseem 1 cited

stylessh @stylessh 1 cited

Supabase shipped fixes across three critical surfaces: ETL now properly recreates BigQuery views on schema changes, a comprehensive npm supply-chain hardening guide hits docs, and the CLI gains granular control over Data API table exposure.

The ETL team closed a BigQuery logic gap where views weren't being recreated after schema DDL, even when pointing to the same sequenced physical table [1]. This matters because downstream analytics pipelines depend on view consistency after schema evolution. In parallel, the security desk published a comprehensive guide for hardening npm installs of @supabase/* packages, covering lockfile hygiene, minimum-release-age quarantine across all package managers, provenance verification, and lifecycle script controls [2]. This guide shipped to supabase.com/docs after being drafted in supabase-js [3], and the SDK repo now redirects to the canonical URL [3]. On the CLI front, a new `[api].auto_expose_new_tables` configuration option lets teams control whether newly-created tables, views, sequences, and functions in the public schema are automatically reachable through Data API roles [6]. This aligns with Cloud's new toggle for granular default privileges. The studio team also wired keyboard shortcuts into the Integrations Marketplace [4], shipped the State of Startups 2026 results page with live survey data [5], and the CLI backfilled legacy telemetry payloads to match the Go CLI implementation [7]. Infrastructure-side, a flaky functions dev watcher test got stabilized with an in-memory fake watcher layer [8], and the Docker mirror image workflow was repaired to work without a checked-out apps/cli-go directory [9].

Action items

→ Review the new npm security guide if you manage supply-chain risk for @supabase/* dependencies supabase/supabase [plan]
→ Evaluate auto_expose_new_tables config for local development and staging environments supabase/cli [plan]
→ Update any external links pointing to the old npm security guide to supabase.com/docs/guides/security/npm-security supabase/supabase-js [monitor]

References

[1] fix(bigquery): Recreate view on schema change in BigQuery ↗ supabase/etl
[2] docs: add guide for securing npm installs against supply-chain attacks ↗ supabase/supabase
[3] docs(repo): move npm security guide to supabase.com/docs ↗ supabase/supabase-js
[4] feat(studio): keyboard shortcuts for integrations ↗ supabase/supabase
[5] feat(www): wire up State of Startups 2026 results page ↗ supabase/supabase
[6] feat(config,stack): add auto_expose_new_tables configuration option (#5239) supabase/cli
[7] feat(cli): align legacy telemetry payload with Go CLI (#5359) supabase/cli
[8] test(cli): stabilize functions dev watcher test (#5358) supabase/cli
[9] fix(docker): repair mirror image workflow dispatch (#5363) supabase/cli

Quick answers

What shipped in Supabase on May 27, 2026?: Supabase shipped fixes across three critical surfaces: ETL now properly recreates BigQuery views on schema changes, a comprehensive npm supply-chain hardening guide hits docs, and the CLI gains granular control over Data API table exposure. In total, 48 commits, 49 pull requests, and 7 releases landed.
Who contributed to Supabase on May 27, 2026?: 4 developers shipped this update, including iambriccardo, mandarini, awaseem, and stylessh.
What were the notable Supabase updates?: fix(bigquery): Recreate view on schema change in BigQuery, docs: add guide for securing npm installs against supply-chain attacks, and docs(repo): move npm security guide to supabase.com/docs.

POSTGRES 17.6.1.156 SHIPS WITH ORIOLEDB VARIANT, CLI PORTS NATIVE TYPESCRIPT START COMMAND

Supabase shipped five Postgres releases overnight across three build variants while the CLI ditched its Go binary proxy for native TypeScript in the local dev stack.

javascript 22 shipped 1-min read

@supabase 1 day ago

DOCS CONTENT API NOW PLUGGABLE, RLS LEAK PATCHED IN STUDIO

The MCP server can point at alternative GraphQL endpoints for docs testing, while a critical fix stops Studio from leaking RLS-protected values during cell loads.

javascript 80 shipped 2-min read

@supabase 2 days ago

CLICKHOUSE SCHEMA CORRUPTION FIX LANDS ACROSS ETL STACK

Supabase shipped a critical fix that prevents ClickHouse from destroying newer columns during CDC replay restarts, then propagated the same safety logic across Pulumi and Terraform tooling.

javascript 95 shipped 1-min read

@supabase 3 days ago

PIPELINES HITS PUBLIC ALPHA, REALTIME SQUASHES RACE CONDITION

Supabase Pipelines moves out of private alpha with full schema change support, while the realtime stack hardens against clustering edge cases.

javascript 104 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.