Who contributed to Supabase on June 17, 2026?

4 developers shipped this update, including mandarini, iambriccardo, farazdagi, and dependabot[bot].

What were the notable Supabase updates?

chore(deps): bump vitest to ^4.1.0 (CVE-2026-47429), chore(deps): override esbuild ^0.28.1 (Dependabot GHSA missing binary integrity check), and server-v1.2.0-rc.73.

@supabase

The open-source Firebase alternative powering thousands of startups

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

SUPABASE PATCHES CRITICAL VITEST RCE, SHIPS SCHEMA DEFAULT EXPRESSIONS

By RepoJournal · Filed 06:02 UTC on June 17, 2026 · About Supabase

4 people shipped this

mandarini @mandarini 2 cited

farazdagi @farazdagi 2 cited

dependabot[bot] @dependabot[bot] 2 cited

iambriccardo @iambriccardo 1 cited

A critical arbitrary file read vulnerability in Vitest's UI server forced an emergency bump across the server stack, while ETL gains deterministic column defaults and safer SQL identifier handling.

The Vitest RCE [1] is the headline: CVE-2026-47429 allows remote code execution through the test UI server. Supabase locked it down by bumping to vitest ^4.1.0 with new `allowWrite` and `allowExec` defaults already correct for the codebase. A second vulnerability in esbuild's binary integrity check [2] required a surgical override via pnpm.overrides since esbuild is transitive through vite. Both fixes ship in server-v1.2.0-rc.73 [3]. On the ETL front, schema evolution now carries forward column default expressions [4], solving a critical gap in deterministic migrations. Table sync gains test coverage for the critical post-copy-to-streaming handoff [5], with failpoints around state boundaries to catch race conditions. SQL identifier quoting in xtask now uses `pg_escape` [6], eliminating a class of injection bugs in seed and formatting operations. CLI lands eight dependency updates including anthropic-ai SDK bumps [7] rolling into v2.107.0-beta.22 [8], while docker images for realtime and storage-api tick up to latest [9].

Action items

→ Upgrade supabase/server to v1.2.0-rc.73 immediately - patches critical Vitest RCE supabase/server [immediate]
→ Review ETL column default handling in schema migrations before next production sync supabase/etl [plan]
→ Update CLI to v2.107.0-beta.22 for dependency security fixes supabase/cli [plan]

References

[1] chore(deps): bump vitest to ^4.1.0 (CVE-2026-47429) ↗ supabase/server
[2] chore(deps): override esbuild ^0.28.1 (Dependabot GHSA missing binary integrity check) ↗ supabase/server
[3] server-v1.2.0-rc.73 ↗ supabase/server
[4] feat(ddl): Add support for default expressions ↗ supabase/etl
[5] test: table sync streaming handoff ↗ supabase/etl
[6] fix(xtask): better quote identifiers ↗ supabase/etl
[7] fix(deps): bump the npm-major group with 8 updates ↗ supabase/cli
[8] v2.107.0-beta.22 ↗ supabase/cli
[9] fix(docker): bump the docker-minor group in /apps/cli-go/pkg/config/templates with 2 updates ↗ supabase/cli

Quick answers

What shipped in Supabase on June 17, 2026?: A critical arbitrary file read vulnerability in Vitest's UI server forced an emergency bump across the server stack, while ETL gains deterministic column defaults and safer SQL identifier handling. In total, 6 commits, 11 pull requests, and 3 releases landed.
Who contributed to Supabase on June 17, 2026?: 4 developers shipped this update, including mandarini, iambriccardo, farazdagi, and dependabot[bot].
What were the notable Supabase updates?: chore(deps): bump vitest to ^4.1.0 (CVE-2026-47429), chore(deps): override esbuild ^0.28.1 (Dependabot GHSA missing binary integrity check), and server-v1.2.0-rc.73.

STUDIO SELF-IMPORT BUG FIXED, REALTIME SHIPS FANOUT METRICS

Supabase shipped a critical fix for TanStack Studio's local dev environment while Realtime v2.120.0 lands broadcast telemetry and cluster scaling improvements.

javascript 13 shipped 1-min read

@supabase 3 days ago

POSTGRES 17.6.1.156 SHIPS WITH ORIOLEDB VARIANT, CLI PORTS NATIVE TYPESCRIPT START COMMAND

Supabase shipped five Postgres releases overnight across three build variants while the CLI ditched its Go binary proxy for native TypeScript in the local dev stack.

javascript 22 shipped 1-min read

@supabase 4 days ago

DOCS CONTENT API NOW PLUGGABLE, RLS LEAK PATCHED IN STUDIO

The MCP server can point at alternative GraphQL endpoints for docs testing, while a critical fix stops Studio from leaking RLS-protected values during cell loads.

javascript 80 shipped 2-min read

@supabase 5 days ago

CLICKHOUSE SCHEMA CORRUPTION FIX LANDS ACROSS ETL STACK

Supabase shipped a critical fix that prevents ClickHouse from destroying newer columns during CDC replay restarts, then propagated the same safety logic across Pulumi and Terraform tooling.

javascript 95 shipped 1-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.