RepoJournal
Supabase @supabase
124 wires and counting

$ follow Supabase

Keep up with Supabase in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-06-27
stories 82
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

FLUTTER SIGNS OUT SMARTER, CLI TESTS GO LIVE, STUDIO WARNINGS CATCH CREDENTIAL LEAKS

By RepoJournal · Filed · About Supabase · Composed from the cited sources · methodology

spydon 7ttp avallete alaister
4 people shipped this
spydon @spydon 3 cited 7ttp @7ttp 2 cited avallete @avallete 1 cited alaister @alaister 1 cited

Supabase Flutter now tells you why users signed out, the CLI can test against real infrastructure in CI, and Studio is screaming louder about Vercel preview leaks that push production credentials.

The Flutter SDK shipped typed sign-out reasons [1] [2], so your app knows if a user explicitly logged out, hit a session expiration, or lost a corrupted session. That's the signal listeners have been asking for to rebuild auth flows correctly. Meanwhile, the CLI got a live test harness [3] [4] that spins up real Supabase infrastructure in CI and exercises the built binary against it, catching integration gaps that unit tests miss. On the Studio side, the Vercel env-sync warning [5] is now impossible to miss. Users kept syncing their production credentials into preview deployments without realizing it, and the new alert makes that risk visceral. Flutter also fixed the long-standing Sentry spam where recovering a session with a dead refresh token would surface as an uncaught error [6], and updated `httpSend` to match supabase-js with per-event broadcast URLs and binary support [7]. On the CLI, the `serve` command had a regression where the Edge Runtime bootstrap script was embedding the full bundled template into the Docker entrypoint, causing spawn failures on long paths. That's fixed [8]. The `db diff` command was failing on empty glob matches in `schema_paths`. That's fixed too [9]. Flutter security: you now have a security policy [10].

Action items

References

  1. [1] feat(gotrue): surface the sign-out reason on the signedOut event ↗ supabase/supabase-flutter
  2. [2] feat(gotrue): surface the sign-out reason on the signedOut event (#1453) ↗ supabase/supabase-flutter
  3. [3] test(cli): supabox-backed live test suite + cli-e2e-ci dispatch (#5699) ↗ supabase/cli
  4. [4] test(cli): supabox-backed live test suite + cli-e2e-ci dispatch ↗ supabase/cli
  5. [5] [FE-3682] feat(studio): warn on Vercel preview/dev env var sync ↗ supabase/supabase
  6. [6] fix(gotrue): avoid duplicate auth error on recoverSession with invalid refresh token ↗ supabase/supabase-flutter
  7. [7] feat(realtime): update httpSend to per-event broadcast URL with binary support ↗ supabase/supabase-flutter
  8. [8] fix(cli): shorten serve argv ↗ supabase/cli
  9. [9] fix(cli): skip empty schema_paths globs in db diff ↗ supabase/cli
  10. [10] docs: add SECURITY.md (#1473) ↗ supabase/supabase-flutter

$ ls supabase/reviews/ # the step-back reads

the week in review Studio moves to Nitro, CLI stack goes flag-gated the month in review Supabase ships CLI v2, Postgres middleware, and safety rails across Studio
Topics: JavaScript Full archive → Weekly reviews →

Quick answers

What shipped in Supabase on June 27, 2026?
Supabase Flutter now tells you why users signed out, the CLI can test against real infrastructure in CI, and Studio is screaming louder about Vercel preview leaks that push production credentials. In total, 37 commits, 41 pull requests, and 4 releases landed.
Who contributed to Supabase on June 27, 2026?
4 developers shipped this update, including spydon, avallete, alaister, and 7ttp.
What were the notable Supabase updates?
feat(gotrue): surface the sign-out reason on the signedOut event, feat(gotrue): surface the sign-out reason on the signedOut event (#1453), and test(cli): supabox-backed live test suite + cli-e2e-ci dispatch (#5699).
♥

$ log @supabase --recent

Turbopack build cache disabled, eval results refreshed 4 shipped CLI config push stops ignoring a piped "no"; storage and realtime artifacts refresh 70 shipped MCP v0.13.0 gates destructive SQL, CLI stops deleting vector buckets 113 shipped Replicator health probes land, Studio pipeline overview rebuilt 135 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.