Who contributed to Supabase on June 16, 2026?

6 developers shipped this update, including dependabot[bot], edgurgel, supabase-libs-pr-manager[bot], iambriccardo, kallebysantos, and ivasilov.

What were the notable Supabase updates?

build(deps): bump google.golang.org/grpc from 1.56.3 to 1.79.3 in the go_modules group across 1 directory, fix: update gen_rpc to original fork, and build(deps-dev): bump svelte from 4.2.19 to 5.51.5 in /web in the npm_and_yarn group across 1 directory.

@supabase

The open-source Firebase alternative powering thousands of startups

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

GRPC PATCHES AUTHORIZATION BYPASS AS SUPABASE MODERNIZES REALTIME STACK

By RepoJournal · Filed 06:05 UTC on June 16, 2026 · About Supabase

6 people shipped this

dependabot[bot] @dependabot[bot] 3 cited

edgurgel @edgurgel 1 cited

supabase-libs-pr-manager[bot] @supabase-libs-pr-manager[bot] 1 cited

iambriccardo @iambriccardo 1 cited

kallebysantos @kallebysantos 1 cited

ivasilov @ivasilov 1 cited

A critical authorization bypass in gRPC 1.56 to 1.79.2 could let attackers bypass request validation, and Supabase is patching across benchmarks while shipping realtime improvements.

The grpc-go team fixed a server-side authorization bypass where malformed :path headers missing the leading slash could bypass authorization checks [1]. Supabase's benchmarks repo jumped from gRPC 1.56.3 to 1.79.3 to close this gap [1]. On the realtime front, the team is dropping its fork of gen_rpc now that all upstream PRs hit the original EMQX repository [2], reducing maintenance burden. Svelte got two separate bumps in benchmarks: a major jump from 4.2.19 to 5.51.5 [3] followed by patch updates to 5.55.7 addressing XSS on hydration [4]. The supabase-js client in realtime bumped to v2.108.2, fixing auth session refresh failures and clarifying httpSend() errors [5]. On the docs side, external replication (ETL) terminology is now standardized across the platform [6], Edge Functions got a new error codes reference guide [7], and High Availability projects on Multigres now show which features (Realtime, Replication, PITR) are unavailable [8].

Action items

→ Verify benchmarks repo runs gRPC 1.79.3 or later in your local environment supabase/benchmarks [immediate]
→ Review Multigres HA feature restrictions in Studio to prevent user confusion supabase/supabase [plan]
→ Monitor realtime stability after gen_rpc fork consolidation in next release supabase/realtime [monitor]

References

[1] build(deps): bump google.golang.org/grpc from 1.56.3 to 1.79.3 in the go_modules group across 1 directory ↗ supabase/benchmarks
[2] fix: update gen_rpc to original fork ↗ supabase/realtime
[3] build(deps-dev): bump svelte from 4.2.19 to 5.51.5 in /web in the npm_and_yarn group across 1 directory ↗ supabase/benchmarks
[4] build(deps): bump the npm_and_yarn group across 1 directory with 6 updates ↗ supabase/benchmarks
[5] chore: update @supabase/supabase-js to v2.108.2 ↗ supabase/realtime
[6] Standardize external replication (ETL) docs ↗ supabase/supabase
[7] docs(functions): add error codes page ↗ supabase/supabase
[8] chore: Disable some of the Studio features on Multigres projects ↗ supabase/supabase

Quick answers

What shipped in Supabase on June 16, 2026?: A critical authorization bypass in gRPC 1.56 to 1.79.2 could let attackers bypass request validation, and Supabase is patching across benchmarks while shipping realtime improvements. In total, 30 commits, 33 pull requests, and 1 releases landed.
Who contributed to Supabase on June 16, 2026?: 6 developers shipped this update, including dependabot[bot], edgurgel, supabase-libs-pr-manager[bot], iambriccardo, kallebysantos, and ivasilov.
What were the notable Supabase updates?: build(deps): bump google.golang.org/grpc from 1.56.3 to 1.79.3 in the go_modules group across 1 directory, fix: update gen_rpc to original fork, and build(deps-dev): bump svelte from 4.2.19 to 5.51.5 in /web in the npm_and_yarn group across 1 directory.

STUDIO SELF-IMPORT BUG FIXED, REALTIME SHIPS FANOUT METRICS

Supabase shipped a critical fix for TanStack Studio's local dev environment while Realtime v2.120.0 lands broadcast telemetry and cluster scaling improvements.

javascript 13 shipped 1-min read

@supabase 3 days ago

POSTGRES 17.6.1.156 SHIPS WITH ORIOLEDB VARIANT, CLI PORTS NATIVE TYPESCRIPT START COMMAND

Supabase shipped five Postgres releases overnight across three build variants while the CLI ditched its Go binary proxy for native TypeScript in the local dev stack.

javascript 22 shipped 1-min read

@supabase 4 days ago

DOCS CONTENT API NOW PLUGGABLE, RLS LEAK PATCHED IN STUDIO

The MCP server can point at alternative GraphQL endpoints for docs testing, while a critical fix stops Studio from leaking RLS-protected values during cell loads.

javascript 80 shipped 2-min read

@supabase 5 days ago

CLICKHOUSE SCHEMA CORRUPTION FIX LANDS ACROSS ETL STACK

Supabase shipped a critical fix that prevents ClickHouse from destroying newer columns during CDC replay restarts, then propagated the same safety logic across Pulumi and Terraform tooling.

javascript 95 shipped 1-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.