RepoJournal
Supabase

@supabase

The open-source Firebase alternative powering thousands of startups

Keep up with Supabase in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

One email a day. Unsubscribe in one click.

Pick a date

  1. Fri 19 jun
  2. Sat 27 jun
  3. Sun 28 jun
  4. Mon 29 jun
  5. Tue 30 jun
  6. Wed 1 jul
  7. Thu 2 jul
  8. Fri 3 jul
  9. Sat 4 jul
  10. Sun 5 jul
  11. Mon 6 jul
  12. Tue 7 jul
  13. Wed 8 jul
  14. Thu 9 jul
  15. Fri 10 jul
  16. Sat 11 jul
  17. Sun 12 jul
  18. Mon 13 jul
  19. Tue 14 jul
  20. Wed 15 jul
  21. Thu 16 jul
  22. Sat 18 jul
  23. Sun 19 jul
  24. Mon 20 jul
  25. Tue 21 jul
  26. Wed 22 jul
  27. Thu 23 jul
  28. Fri 24 jul
  29. Sat 25 jul
  30. Mon 27 jul
Topics: JavaScript Full archive →

The Wire · Showcase

SUPABASE-JS HITS 2.110.1 AS SELF-HOSTED TIGHTENS SECURITY

By RepoJournal · Filed · About Supabase

aantti luizfelmach jeremenichelli NikAtVividata iambriccardo farazdagi
6 people shipped this
aantti @aantti 1 cited luizfelmach @luizfelmach 1 cited jeremenichelli @jeremenichelli 1 cited NikAtVividata @NikAtVividata 1 cited iambriccardo @iambriccardo 1 cited farazdagi @farazdagi 1 cited

The JavaScript SDK stack shipped a patch release while self-hosted Supabase closes critical OAuth and REST API exposure gaps that platform deployments have had for months.

Supabase-js, auth-js, realtime-js, and postgres-js all rolled to v2.110.1 [1], fixing deferred notification handling in the auth layer. The release is a routine patch but lands alongside two critical self-hosted hardening efforts: API_EXTERNAL_URL now defaults to include /auth/v1 [2], fixing out-of-box OAuth failures, and /rest/v1/ root access is now restricted to privileged keys [3], closing a gap where anon credentials could enumerate your entire OpenAPI spec. Self-hosted operators running exposed instances should treat both patches as priority. On the docs side, @supabase/server v1 reference docs went live [4], and framework quick starts got cleaned up for clarity [5]. The ETL pipeline is shipping hardening too: source migrations can now be gated behind a flag [6], letting you skip superuser-required event trigger creation, while text parsing and BigQuery encoding got tuned for CPU-heavy workloads [7]. Deferred streaming write durability landed in the ETL layer [8], giving you more granular control over replication durability semantics.

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] feat: update @supabase/*-js libraries to v2.110.1 (#47687) supabase/supabase
  2. [2] fix(self-hosted): change default api external url to contain /auth/v1 ↗ supabase/supabase
  3. [3] feat(self-hosted): restrict rest root anon ↗ supabase/supabase
  4. [4] docs: wire @supabase/server v1 into the reference pipeline (#47570) supabase/supabase
  5. [5] fix: Rephrasing and improved output for framework quick starts instructions ↗ supabase/supabase
  6. [6] feat(config): gate source migrations behind run_source_migrations flag ↗ supabase/etl
  7. [7] ref(perf): Improve text parsing, BigQuery encoding and logs ↗ supabase/etl
  8. [8] feat(etl): support deferred streaming write durability ↗ supabase/etl

Quick answers

What shipped in Supabase on July 8, 2026?
The JavaScript SDK stack shipped a patch release while self-hosted Supabase closes critical OAuth and REST API exposure gaps that platform deployments have had for months. In total, 36 commits, 37 pull requests, and 1 releases landed.
Who contributed to Supabase on July 8, 2026?
6 developers shipped this update, including aantti, luizfelmach, jeremenichelli, NikAtVividata, iambriccardo, and farazdagi.
What were the notable Supabase updates?
feat: update @supabase/*-js libraries to v2.110.1 (#47687), fix(self-hosted): change default api external url to contain /auth/v1, and feat(self-hosted): restrict rest root anon.

More from @supabase

Supabase @supabase

STUDIO SELF-IMPORT BUG FIXED, REALTIME SHIPS FANOUT METRICS

Supabase shipped a critical fix for TanStack Studio's local dev environment while Realtime v2.120.0 lands broadcast telemetry and cluster scaling improvements.

alaister joshenlim Hieu realtime-release-bot[bot] +3
javascript 13 shipped 1-min read
Supabase @supabase

POSTGRES 17.6.1.156 SHIPS WITH ORIOLEDB VARIANT, CLI PORTS NATIVE TYPESCRIPT START COMMAND

Supabase shipped five Postgres releases overnight across three build variants while the CLI ditched its Go binary proxy for native TypeScript in the local dev stack.

github-actions[bot] Coly010 7ttp
javascript 22 shipped 1-min read
Supabase @supabase

DOCS CONTENT API NOW PLUGGABLE, RLS LEAK PATCHED IN STUDIO

The MCP server can point at alternative GraphQL endpoints for docs testing, while a critical fix stops Studio from leaking RLS-protected values during cell loads.

barryroodt supabase-releaser supabase-releaser[bot] Alaister Young +7
javascript 80 shipped 2-min read
Supabase @supabase

CLICKHOUSE SCHEMA CORRUPTION FIX LANDS ACROSS ETL STACK

Supabase shipped a critical fix that prevents ClickHouse from destroying newer columns during CDC replay restarts, then propagated the same safety logic across Pulumi and Terraform tooling.

jmqd iambriccardo Hieu Ivan Vasilov +5
javascript 95 shipped 1-min read

Daily updates, in your inbox

Follow Supabase

Keep up with Supabase in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

langchain-oss-model-profiles langchain-oss-model-profiles[bot] saoudrizwan
ai-agents 16 shipped 2-min read
Local LLMs Local LLMs

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

github-actions[bot] dhiltgen timkhronos Pascal +10
llms 125 shipped 1-min read
CachyOS @CachyOS

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

Piotr Gorski github-actions Vladislav Nepogodin ptr1337 +7
infra 97 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.

Benjamin Milde Alexander Gubarev lukaszsamson makoto-developer
elixir 10 shipped 1-min read
Want every project, not just this one?

We use privacy-friendly analytics (Google Analytics, IP-anonymized) to see which pages help readers. No ads, and we never sell your data. See our Privacy Policy.