RepoJournal
Supabase

@supabase

The open-source Firebase alternative powering thousands of startups

Keep up with Supabase in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

One email a day. Unsubscribe in one click.

Pick a date

  1. Fri 19 jun
  2. Sat 27 jun
  3. Sun 28 jun
  4. Mon 29 jun
  5. Tue 30 jun
  6. Wed 1 jul
  7. Thu 2 jul
  8. Fri 3 jul
  9. Sat 4 jul
  10. Sun 5 jul
  11. Mon 6 jul
  12. Tue 7 jul
  13. Wed 8 jul
  14. Thu 9 jul
  15. Fri 10 jul
  16. Sat 11 jul
  17. Sun 12 jul
  18. Mon 13 jul
  19. Tue 14 jul
  20. Wed 15 jul
  21. Thu 16 jul
  22. Sat 18 jul
  23. Sun 19 jul
  24. Mon 20 jul
  25. Tue 21 jul
  26. Wed 22 jul
  27. Thu 23 jul
  28. Fri 24 jul
  29. Sat 25 jul
  30. Mon 27 jul
Topics: JavaScript Full archive →

The Wire · Showcase

FLUTTER SIGNS OUT SMARTER, CLI TESTS GO LIVE, STUDIO WARNINGS CATCH CREDENTIAL LEAKS

By RepoJournal · Filed · About Supabase

spydon 7ttp avallete alaister
4 people shipped this
spydon @spydon 3 cited 7ttp @7ttp 2 cited avallete @avallete 1 cited alaister @alaister 1 cited

Supabase Flutter now tells you why users signed out, the CLI can test against real infrastructure in CI, and Studio is screaming louder about Vercel preview leaks that push production credentials.

The Flutter SDK shipped typed sign-out reasons [1] [2], so your app knows if a user explicitly logged out, hit a session expiration, or lost a corrupted session. That's the signal listeners have been asking for to rebuild auth flows correctly. Meanwhile, the CLI got a live test harness [3] [4] that spins up real Supabase infrastructure in CI and exercises the built binary against it, catching integration gaps that unit tests miss. On the Studio side, the Vercel env-sync warning [5] is now impossible to miss. Users kept syncing their production credentials into preview deployments without realizing it, and the new alert makes that risk visceral. Flutter also fixed the long-standing Sentry spam where recovering a session with a dead refresh token would surface as an uncaught error [6], and updated `httpSend` to match supabase-js with per-event broadcast URLs and binary support [7]. On the CLI, the `serve` command had a regression where the Edge Runtime bootstrap script was embedding the full bundled template into the Docker entrypoint, causing spawn failures on long paths. That's fixed [8]. The `db diff` command was failing on empty glob matches in `schema_paths`. That's fixed too [9]. Flutter security: you now have a security policy [10].

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] feat(gotrue): surface the sign-out reason on the signedOut event ↗ supabase/supabase-flutter
  2. [2] feat(gotrue): surface the sign-out reason on the signedOut event (#1453) supabase/supabase-flutter
  3. [3] test(cli): supabox-backed live test suite + cli-e2e-ci dispatch (#5699) supabase/cli
  4. [4] test(cli): supabox-backed live test suite + cli-e2e-ci dispatch ↗ supabase/cli
  5. [5] [FE-3682] feat(studio): warn on Vercel preview/dev env var sync ↗ supabase/supabase
  6. [6] fix(gotrue): avoid duplicate auth error on recoverSession with invalid refresh token ↗ supabase/supabase-flutter
  7. [7] feat(realtime): update httpSend to per-event broadcast URL with binary support ↗ supabase/supabase-flutter
  8. [8] fix(cli): shorten serve argv ↗ supabase/cli
  9. [9] fix(cli): skip empty schema_paths globs in db diff ↗ supabase/cli
  10. [10] docs: add SECURITY.md (#1473) supabase/supabase-flutter

Quick answers

What shipped in Supabase on June 27, 2026?
Supabase Flutter now tells you why users signed out, the CLI can test against real infrastructure in CI, and Studio is screaming louder about Vercel preview leaks that push production credentials. In total, 37 commits, 41 pull requests, and 4 releases landed.
Who contributed to Supabase on June 27, 2026?
4 developers shipped this update, including spydon, avallete, alaister, and 7ttp.
What were the notable Supabase updates?
feat(gotrue): surface the sign-out reason on the signedOut event, feat(gotrue): surface the sign-out reason on the signedOut event (#1453), and test(cli): supabox-backed live test suite + cli-e2e-ci dispatch (#5699).

More from @supabase

Supabase @supabase

STUDIO SELF-IMPORT BUG FIXED, REALTIME SHIPS FANOUT METRICS

Supabase shipped a critical fix for TanStack Studio's local dev environment while Realtime v2.120.0 lands broadcast telemetry and cluster scaling improvements.

alaister joshenlim Hieu realtime-release-bot[bot] +3
javascript 13 shipped 1-min read
Supabase @supabase

POSTGRES 17.6.1.156 SHIPS WITH ORIOLEDB VARIANT, CLI PORTS NATIVE TYPESCRIPT START COMMAND

Supabase shipped five Postgres releases overnight across three build variants while the CLI ditched its Go binary proxy for native TypeScript in the local dev stack.

github-actions[bot] Coly010 7ttp
javascript 22 shipped 1-min read
Supabase @supabase

DOCS CONTENT API NOW PLUGGABLE, RLS LEAK PATCHED IN STUDIO

The MCP server can point at alternative GraphQL endpoints for docs testing, while a critical fix stops Studio from leaking RLS-protected values during cell loads.

barryroodt supabase-releaser supabase-releaser[bot] Alaister Young +7
javascript 80 shipped 2-min read
Supabase @supabase

CLICKHOUSE SCHEMA CORRUPTION FIX LANDS ACROSS ETL STACK

Supabase shipped a critical fix that prevents ClickHouse from destroying newer columns during CDC replay restarts, then propagated the same safety logic across Pulumi and Terraform tooling.

jmqd iambriccardo Hieu Ivan Vasilov +5
javascript 95 shipped 1-min read

Daily updates, in your inbox

Follow Supabase

Keep up with Supabase in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

langchain-oss-model-profiles langchain-oss-model-profiles[bot] saoudrizwan
ai-agents 16 shipped 2-min read
Local LLMs Local LLMs

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

github-actions[bot] dhiltgen timkhronos Pascal +10
llms 125 shipped 1-min read
CachyOS @CachyOS

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

Piotr Gorski github-actions Vladislav Nepogodin ptr1337 +7
infra 97 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.

Benjamin Milde Alexander Gubarev lukaszsamson makoto-developer
elixir 10 shipped 1-min read
Want every project, not just this one?

We use privacy-friendly analytics (Google Analytics, IP-anonymized) to see which pages help readers. No ads, and we never sell your data. See our Privacy Policy.