Who contributed to Supabase on June 19, 2026?

4 developers shipped this update, including i-anubhav-anand, edgurgel, leandrocp, and avallete.

What were the notable Supabase updates?

feat: allow to filter function by code (#46743), Improve UI for org invites if MFA is enforced (#47067), and fix(storage): keep sortBy defaults when list() is given a partial sortBy.

@supabase

The open-source Firebase alternative powering thousands of startups

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

REALTIME TIGHTENS SECURITY WITH LEAST-PRIVILEGE USER, CLI FIXES CONFIG PUSH REGRESSION

By RepoJournal · Filed 06:02 UTC on June 19, 2026 · About Supabase

4 people shipped this

i-anubhav-anand @i-anubhav-anand 2 cited

edgurgel @edgurgel 1 cited

leandrocp @leandrocp 1 cited

avallete @avallete 1 cited

Supabase Realtime v2.109.0 ships a major security hardening feature that lets the service run as a constrained database role instead of superuser, while the CLI ports critical Go behavior that was lost in the TypeScript rewrite.

The Realtime release introduces a least-privilege database user [6], letting Realtime connect as a controlled role post-migration instead of requiring full superuser access throughout runtime. That same release bumps the replication connection timeout from 30 seconds to 4 minutes [5], giving busy databases breathing room to establish replication slots without choking. Over in the CLI, v2.106.0's native TypeScript port broke `config push` by rejecting `[remotes.*]` blocks that target your project [7]. The fix restores Go's merge behavior, letting remote configs layer over the base without aborting. The team also shipped live e2e testing for the CLI [8], eliminating the replay-server bottleneck for real-world command validation. Across the dashboard, function search got its own dedicated content filter [1] so you're not wading through every SQL keyword match, and MFA-enforced org invites now show clear setup prompts instead of cryptic errors [2].

Action items

→ Pull Realtime v2.109.0 and test the least-privilege user setup in staging before prod supabase/realtime [plan]
→ Upgrade supabase-js to pick up storage sortBy and functions Content-Type fixes [ref:7][ref:8] supabase/supabase-js [plan]
→ Update CLI if you use config push with remote blocks supabase/cli [immediate]
→ Review dashboard MFA invite flow in staging if your org enforces MFA supabase/supabase [monitor]

References

[1] feat: allow to filter function by code (#46743) supabase/supabase
[2] Improve UI for org invites if MFA is enforced (#47067) supabase/supabase
[3] fix(storage): keep sortBy defaults when list() is given a partial sortBy ↗ supabase/supabase-js
[4] fix(functions): honor a caller's Content-Type override regardless of casing ↗ supabase/supabase-js
[5] fix: replication connection increase timeout ↗ supabase/realtime
[6] feat: introduce least-privilege realtime user ↗ supabase/realtime
[7] fix(cli): merge matching [remotes.*] block on config push (#5618) supabase/cli
[8] test(cli-e2e): add live e2e suite covering the CLI command matrix ↗ supabase/cli

Quick answers

What shipped in Supabase on June 19, 2026?: Supabase Realtime v2.109.0 ships a major security hardening feature that lets the service run as a constrained database role instead of superuser, while the CLI ports critical Go behavior that was lost in the TypeScript rewrite. In total, 43 commits, 46 pull requests, and 8 releases landed.
Who contributed to Supabase on June 19, 2026?: 4 developers shipped this update, including i-anubhav-anand, edgurgel, leandrocp, and avallete.
What were the notable Supabase updates?: feat: allow to filter function by code (#46743), Improve UI for org invites if MFA is enforced (#47067), and fix(storage): keep sortBy defaults when list() is given a partial sortBy.

STUDIO SELF-IMPORT BUG FIXED, REALTIME SHIPS FANOUT METRICS

Supabase shipped a critical fix for TanStack Studio's local dev environment while Realtime v2.120.0 lands broadcast telemetry and cluster scaling improvements.

javascript 13 shipped 1-min read

@supabase 3 days ago

POSTGRES 17.6.1.156 SHIPS WITH ORIOLEDB VARIANT, CLI PORTS NATIVE TYPESCRIPT START COMMAND

Supabase shipped five Postgres releases overnight across three build variants while the CLI ditched its Go binary proxy for native TypeScript in the local dev stack.

javascript 22 shipped 1-min read

@supabase 4 days ago

DOCS CONTENT API NOW PLUGGABLE, RLS LEAK PATCHED IN STUDIO

The MCP server can point at alternative GraphQL endpoints for docs testing, while a critical fix stops Studio from leaking RLS-protected values during cell loads.

javascript 80 shipped 2-min read

@supabase 5 days ago

CLICKHOUSE SCHEMA CORRUPTION FIX LANDS ACROSS ETL STACK

Supabase shipped a critical fix that prevents ClickHouse from destroying newer columns during CDC replay restarts, then propagated the same safety logic across Pulumi and Terraform tooling.

javascript 95 shipped 1-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.