RepoJournal
Supabase @supabase
124 wires and counting

$ follow Supabase

Keep up with Supabase in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-06-16
stories 64
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

GRPC PATCHES AUTHORIZATION BYPASS AS SUPABASE MODERNIZES REALTIME STACK

By RepoJournal · Filed · About Supabase · Composed from the cited sources · methodology

dependabot[bot] edgurgel supabase-libs-pr-manager[bot] iambriccardo kallebysantos ivasilov
6 people shipped this
dependabot[bot] @dependabot[bot] 3 cited edgurgel @edgurgel 1 cited supabase-libs-pr-manager[bot] @supabase-libs-pr-manager[bot] 1 cited iambriccardo @iambriccardo 1 cited kallebysantos @kallebysantos 1 cited ivasilov @ivasilov 1 cited

A critical authorization bypass in gRPC 1.56 to 1.79.2 could let attackers bypass request validation, and Supabase is patching across benchmarks while shipping realtime improvements.

The grpc-go team fixed a server-side authorization bypass where malformed :path headers missing the leading slash could bypass authorization checks [1]. Supabase's benchmarks repo jumped from gRPC 1.56.3 to 1.79.3 to close this gap [1]. On the realtime front, the team is dropping its fork of gen_rpc now that all upstream PRs hit the original EMQX repository [2], reducing maintenance burden. Svelte got two separate bumps in benchmarks: a major jump from 4.2.19 to 5.51.5 [3] followed by patch updates to 5.55.7 addressing XSS on hydration [4]. The supabase-js client in realtime bumped to v2.108.2, fixing auth session refresh failures and clarifying httpSend() errors [5]. On the docs side, external replication (ETL) terminology is now standardized across the platform [6], Edge Functions got a new error codes reference guide [7], and High Availability projects on Multigres now show which features (Realtime, Replication, PITR) are unavailable [8].

Action items

References

  1. [1] build(deps): bump google.golang.org/grpc from 1.56.3 to 1.79.3 in the go_modules group across 1 directory ↗ supabase/benchmarks
  2. [2] fix: update gen_rpc to original fork ↗ supabase/realtime
  3. [3] build(deps-dev): bump svelte from 4.2.19 to 5.51.5 in /web in the npm_and_yarn group across 1 directory ↗ supabase/benchmarks
  4. [4] build(deps): bump the npm_and_yarn group across 1 directory with 6 updates ↗ supabase/benchmarks
  5. [5] chore: update @supabase/supabase-js to v2.108.2 ↗ supabase/realtime
  6. [6] Standardize external replication (ETL) docs ↗ supabase/supabase
  7. [7] docs(functions): add error codes page ↗ supabase/supabase
  8. [8] chore: Disable some of the Studio features on Multigres projects ↗ supabase/supabase

$ ls supabase/reviews/ # the step-back reads

the week in review Studio moves to Nitro, CLI stack goes flag-gated the month in review Supabase ships CLI v2, Postgres middleware, and safety rails across Studio
Topics: JavaScript Full archive → Weekly reviews →

Quick answers

What shipped in Supabase on June 16, 2026?
A critical authorization bypass in gRPC 1.56 to 1.79.2 could let attackers bypass request validation, and Supabase is patching across benchmarks while shipping realtime improvements. In total, 30 commits, 33 pull requests, and 1 releases landed.
Who contributed to Supabase on June 16, 2026?
6 developers shipped this update, including dependabot[bot], edgurgel, supabase-libs-pr-manager[bot], iambriccardo, kallebysantos, and ivasilov.
What were the notable Supabase updates?
build(deps): bump google.golang.org/grpc from 1.56.3 to 1.79.3 in the go_modules group across 1 directory, fix: update gen_rpc to original fork, and build(deps-dev): bump svelte from 4.2.19 to 5.51.5 in /web in the npm_and_yarn group across 1 directory.
♥

$ log @supabase --recent

Turbopack build cache disabled, eval results refreshed 4 shipped CLI config push stops ignoring a piped "no"; storage and realtime artifacts refresh 70 shipped MCP v0.13.0 gates destructive SQL, CLI stops deleting vector buckets 113 shipped Replicator health probes land, Studio pipeline overview rebuilt 135 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.