RepoJournal
Supabase @supabase
124 wires and counting

$ follow Supabase

Keep up with Supabase in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-06-17
stories 20
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

SUPABASE PATCHES CRITICAL VITEST RCE, SHIPS SCHEMA DEFAULT EXPRESSIONS

By RepoJournal · Filed · About Supabase · Composed from the cited sources · methodology

mandarini farazdagi dependabot[bot] iambriccardo
4 people shipped this
mandarini @mandarini 2 cited farazdagi @farazdagi 2 cited dependabot[bot] @dependabot[bot] 2 cited iambriccardo @iambriccardo 1 cited

A critical arbitrary file read vulnerability in Vitest's UI server forced an emergency bump across the server stack, while ETL gains deterministic column defaults and safer SQL identifier handling.

The Vitest RCE [1] is the headline: CVE-2026-47429 allows remote code execution through the test UI server. Supabase locked it down by bumping to vitest ^4.1.0 with new `allowWrite` and `allowExec` defaults already correct for the codebase. A second vulnerability in esbuild's binary integrity check [2] required a surgical override via pnpm.overrides since esbuild is transitive through vite. Both fixes ship in server-v1.2.0-rc.73 [3]. On the ETL front, schema evolution now carries forward column default expressions [4], solving a critical gap in deterministic migrations. Table sync gains test coverage for the critical post-copy-to-streaming handoff [5], with failpoints around state boundaries to catch race conditions. SQL identifier quoting in xtask now uses `pg_escape` [6], eliminating a class of injection bugs in seed and formatting operations. CLI lands eight dependency updates including anthropic-ai SDK bumps [7] rolling into v2.107.0-beta.22 [8], while docker images for realtime and storage-api tick up to latest [9].

Action items

References

  1. [1] chore(deps): bump vitest to ^4.1.0 (CVE-2026-47429) ↗ supabase/server
  2. [2] chore(deps): override esbuild ^0.28.1 (Dependabot GHSA missing binary integrity check) ↗ supabase/server
  3. [3] server-v1.2.0-rc.73 ↗ supabase/server
  4. [4] feat(ddl): Add support for default expressions ↗ supabase/etl
  5. [5] test: table sync streaming handoff ↗ supabase/etl
  6. [6] fix(xtask): better quote identifiers ↗ supabase/etl
  7. [7] fix(deps): bump the npm-major group with 8 updates ↗ supabase/cli
  8. [8] v2.107.0-beta.22 ↗ supabase/cli
  9. [9] fix(docker): bump the docker-minor group in /apps/cli-go/pkg/config/templates with 2 updates ↗ supabase/cli

$ ls supabase/reviews/ # the step-back reads

the week in review Studio moves to Nitro, CLI stack goes flag-gated the month in review Supabase ships CLI v2, Postgres middleware, and safety rails across Studio
Topics: JavaScript Full archive → Weekly reviews →

Quick answers

What shipped in Supabase on June 17, 2026?
A critical arbitrary file read vulnerability in Vitest's UI server forced an emergency bump across the server stack, while ETL gains deterministic column defaults and safer SQL identifier handling. In total, 6 commits, 11 pull requests, and 3 releases landed.
Who contributed to Supabase on June 17, 2026?
4 developers shipped this update, including mandarini, iambriccardo, farazdagi, and dependabot[bot].
What were the notable Supabase updates?
chore(deps): bump vitest to ^4.1.0 (CVE-2026-47429), chore(deps): override esbuild ^0.28.1 (Dependabot GHSA missing binary integrity check), and server-v1.2.0-rc.73.
♥

$ log @supabase --recent

Turbopack build cache disabled, eval results refreshed 4 shipped CLI config push stops ignoring a piped "no"; storage and realtime artifacts refresh 70 shipped MCP v0.13.0 gates destructive SQL, CLI stops deleting vector buckets 113 shipped Replicator health probes land, Studio pipeline overview rebuilt 135 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.