Who contributed to Supabase on May 30, 2026?

2 developers shipped this update, including 7ttp and Coly010.

What were the notable Supabase updates?

feat(ai): judge tool inputs, add storage guidance and permissive RLS evals (#46168), feat(logs): brand remaining analytics SQL callers with SafeLogSqlFragment (#46476), and feat(cli): migrate network bans (#5382).

@supabase

The open-source Firebase alternative powering thousands of startups

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

SUPABASE HARDENS AI STORAGE GUIDANCE, CLI SHEDS LAST GO BINARIES

By RepoJournal · Filed 06:02 UTC on May 30, 2026 · About Supabase

2 people shipped this

7ttp @7ttp 1 cited

Coly010 @Coly010 1 cited

The Assistant now blocks dangerous RLS patterns on public buckets while the CLI completes its TypeScript migration, eliminating the final Go proxy layer.

Supabase shipped a critical update to its AI Assistant that teaches it to recognize and block overly permissive RLS policies on storage buckets [1]. Public buckets with broad read access can accidentally expose sensitive data like profile pictures or private files; the new evals catch this before deployment and guide users toward restrictive patterns. This closes a gap where developers could unknowingly grant world-readable access to bucket contents. Meanwhile, the analytics SQL safety series crossed the finish line [2], with every analytics query now flowing through branded SafeLogSqlFragment inputs. On the CLI front, three major command families completed their TypeScript port: network-bans [3], vanity-subdomains [5], and snippets [6], eliminating the last Go proxy handlers that powered Phase 0 operations. Version 2.102.0 [4] also restored shell completion in legacy environments and silenced CI identity spam. The CLI is now native TypeScript end-to-end.

Action items

→ Update Supabase CLI to 2.102.0 to get native TypeScript commands and shell completion fixes supabase/cli [plan]
→ Review storage bucket RLS policies in production; check Assistant guidance for restrictive patterns supabase/supabase [plan]
→ Monitor Analytics logs for any queries; all paths now use SafeLogSqlFragment supabase/supabase [monitor]

References

[1] feat(ai): judge tool inputs, add storage guidance and permissive RLS evals (#46168) supabase/supabase
[2] feat(logs): brand remaining analytics SQL callers with SafeLogSqlFragment (#46476) supabase/supabase
[3] feat(cli): migrate network bans (#5382) supabase/cli
[4] v2.102.0 ↗ supabase/cli
[5] feat(cli): migrate vanity-subdomains ↗ supabase/cli
[6] feat(cli): port snippets commands to native TypeScript ↗ supabase/cli

Quick answers

What shipped in Supabase on May 30, 2026?: The Assistant now blocks dangerous RLS patterns on public buckets while the CLI completes its TypeScript migration, eliminating the final Go proxy layer. In total, 29 commits, 31 pull requests, and 6 releases landed.
Who contributed to Supabase on May 30, 2026?: 2 developers shipped this update, including 7ttp and Coly010.
What were the notable Supabase updates?: feat(ai): judge tool inputs, add storage guidance and permissive RLS evals (#46168), feat(logs): brand remaining analytics SQL callers with SafeLogSqlFragment (#46476), and feat(cli): migrate network bans (#5382).

POSTGRES 17.6.1.156 SHIPS WITH ORIOLEDB VARIANT, CLI PORTS NATIVE TYPESCRIPT START COMMAND

Supabase shipped five Postgres releases overnight across three build variants while the CLI ditched its Go binary proxy for native TypeScript in the local dev stack.

javascript 22 shipped 1-min read

@supabase 1 day ago

DOCS CONTENT API NOW PLUGGABLE, RLS LEAK PATCHED IN STUDIO

The MCP server can point at alternative GraphQL endpoints for docs testing, while a critical fix stops Studio from leaking RLS-protected values during cell loads.

javascript 80 shipped 2-min read

@supabase 2 days ago

CLICKHOUSE SCHEMA CORRUPTION FIX LANDS ACROSS ETL STACK

Supabase shipped a critical fix that prevents ClickHouse from destroying newer columns during CDC replay restarts, then propagated the same safety logic across Pulumi and Terraform tooling.

javascript 95 shipped 1-min read

@supabase 3 days ago

PIPELINES HITS PUBLIC ALPHA, REALTIME SQUASHES RACE CONDITION

Supabase Pipelines moves out of private alpha with full schema change support, while the realtime stack hardens against clustering edge cases.

javascript 104 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.