RepoJournal
Supabase @supabase
151 wires and counting

$ follow Supabase

Keep up with Supabase in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-07-10
stories 94
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

FLUTTER REALTIME FIX STOPS SILENT RLS FAILURES, TYPESCRIPT 7 CUTS TYPECHECK TIME 66%

By RepoJournal · Filed · About Supabase · Composed from the cited sources · methodology

farazdagi
1 person shipped this
farazdagi @farazdagi 1 cited

Supabase Flutter just patched a critical realtime bug where async access tokens never made it into join payloads, leaving RLS unable to evaluate permissions on incoming subscriptions.

The fix [1] buffers the phx_join until the token resolves, then patches it into the payload before flush - a one-line change with major implications for React Native and Expo apps relying on async storage. On the supabase-js side, v2.110.2 [7] landed with a fix for session state leaking on signout failures [8], so auth state doesn't ghost your next sign-in. The Flutter SDK also closed parity gaps: `mfa.challenge()` now accepts a `channel` parameter [2] for phone-based MFA (SMS/WhatsApp), matching supabase-js, and OAuth signin is now fully documented with the URL-without-launch path [3]. Over in the monorepo, TypeScript 7 [5] shipped with the native Go compiler, cutting full turbo typecheck from 56s to 19s locally - a 66% win that pays off on every type-check cycle. Sentry error reporting on the TanStack build [4] was a silent no-op because `Sentry.init` never ran; that's fixed. ETL streaming to Snowflake now uses deferred durability [6] with proper channel lifecycle handling and replay filtering, so your pipelines survive restarts cleanly.

Action items

References

  1. [1] fix(realtime): patch channel join payloads with access token before flushing (#1553) ↗ supabase/supabase-flutter
  2. [2] feat(gotrue): add channel parameter to mfa.challenge() (#1547) ↗ supabase/supabase-flutter
  3. [3] docs(auth): document getOAuthSignInUrl for URL-without-launch, mark oauth parity implemented (#1548) ↗ supabase/supabase-flutter
  4. [4] fix(studio): initialize Sentry on the TanStack build (captures were silent no-ops) (#47666) ↗ supabase/supabase
  5. [5] chore(deps): upgrade to TypeScript 7 (native compiler) (#47757) ↗ supabase/supabase
  6. [6] fix(destinations): streaming uses deferred durability in Snowflake ↗ supabase/etl
  7. [7] v2.110.2 ↗ supabase/supabase-js
  8. [8] chore(release): version 2.110.2 changelogs (#2506) ↗ supabase/supabase-js

$ ls supabase/reviews/ # the step-back reads

the week in review CLI 2.120.0 adds persisted logs and OTel traces the month in review MCP v0.12.0 groups advisor lints, adds cost elicitation
Full archive → Weekly reviews →

Quick answers

What shipped in Supabase on July 10, 2026?
Supabase Flutter just patched a critical realtime bug where async access tokens never made it into join payloads, leaving RLS unable to evaluate permissions on incoming subscriptions. In total, 46 commits, 46 pull requests, and 2 releases landed.
Who contributed to Supabase on July 10, 2026?
1 developer shipped this update, including farazdagi.
What were the notable Supabase updates?
fix(realtime): patch channel join payloads with access token before flushing (#1553), feat(gotrue): add channel parameter to mfa.challenge() (#1547), and docs(auth): document getOAuthSignInUrl for URL-without-launch, mark oauth parity implemented (#1548).
♥

$ log @supabase --recent

Self-hosted stack bumps realtime and storage, Studio remembers your chart range 72 shipped Realtime 2.144.0 patches a decimal CVE; realtime-csharp adds paged storage listing 151 shipped MCP server 0.14.0 adds health advisors, Supabase CLI routes every Management API call through the typed client 123 shipped Scoped OAuth reconsent in Studio, MCP drops double cost prompts 139 shipped

$ log --all # elsewhere on the wire

Alignment & Post-training verl rejects conflicting vLLM engine_kwargs, open-instruct adds MILES OPD behind a Megatron learner Interpretability nnsight 0.8.0 cuts import time from 7.6s to 1.6s

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.