@supabase

The open-source Firebase alternative powering thousands of startups

github ↗

Pick a date

The Wire · Showcase

CLI GLOB PARSER FIXED, SWIFT REALTIME AND STORAGE GET STABILITY PATCHES

By RepoJournal · Filed 06:57 UTC on July 11, 2026 · About Supabase

8 people shipped this

Supabase CLI shipped a breaking glob-matching fix that aligns legacy seed patterns with Go's path.Match behavior, while Swift clients gain critical resilience improvements for realtime subscriptions and storage operations.

The CLI's character-class negation bug [1] was causing `[!a].sql` patterns to behave differently in the legacy TypeScript port than in the Go implementation - a mismatch that could silently include or exclude seed files during migrations. This ships alongside two other CLI fixes: global choice flags now report their actual values in telemetry [2] instead of being redacted, and the vendored effect CLI no longer double-prints errors on parse failures [3]. On the Swift side, realtime channels now properly reset their state when receiving a `phx_error` frame [4], fixing a critical bug where dead channels would stay marked as `.subscribed` and observers would hang indefinitely waiting for events. Storage got its own fix [5]: leading slashes in object paths are now stripped before building request URLs, eliminating the double-slash bug that broke operations like `download(path: "/a.png")`. Studio added comprehensive MSW tests for the project creation flow [6], surfacing and fixing an empty-region submit bug in the process. All three repos also picked up dependency bumps and Sentry instrumentation hardening [7] to improve production visibility.

Action items

→ Deploy CLI 1.x immediately if using db.seed glob patterns or db reset with glob filtering supabase/cli [immediate]
→ Update supabase-swift to latest if relying on realtime subscriptions or storage downloads with paths supabase/supabase-swift [plan]
→ Review seed migration patterns for any `[!...]` character classes after upgrading CLI supabase/cli [plan]
→ Monitor Sentry for API errors now being captured upstream in Studio supabase/supabase [monitor]

References

[1] fix(cli): match Go path.Match character-class negation in legacy seed globbing (#5856) supabase/cli
[2] fix(cli): exempt global choice flags from telemetry redaction (Go isEnumFlag parity) (#5855) supabase/cli
[3] fix(cli): suppress vendored effect CLI's stdout help-dump and duplicate error on parse failures (CLI-1901) (#5844) supabase/cli
[4] fix(realtime): reset channel state on phx_error ↗ supabase/supabase-swift
[5] fix(storage): strip leading slash from object paths ↗ supabase/supabase-swift
[6] test(studio): add MSW tests for project creation flow (#47790) supabase/supabase
[7] Add sentry capture exception to apiWrapper ↗ supabase/supabase

FLUTTER REALTIME FIX STOPS SILENT RLS FAILURES, TYPESCRIPT 7 CUTS TYPECHECK TIME 66%

Supabase Flutter just patched a critical realtime bug where async access tokens never made it into join payloads, leaving RLS unable to evaluate permissions on incoming subscriptions.

javascript 94 shipped 1-min read

@supabase 2 days ago

SWIFT SDK HARDENS CRYPTO, ETL OVERHAULS REPLICATOR RESOURCES, STUDIO SHIPS AI SUPPORT SYNC

Swift 2.51.0 tightens RSA JWK verification while the ETL API reworks its Kubernetes resource model for cleaner config and guaranteed QoS qualification.

javascript 70 shipped 2-min read

@supabase 3 days ago

SUPABASE-JS HITS 2.110.1 AS SELF-HOSTED TIGHTENS SECURITY

The JavaScript SDK stack shipped a patch release while self-hosted Supabase closes critical OAuth and REST API exposure gaps that platform deployments have had for months.

javascript 74 shipped 1-min read

@supabase 4 days ago

STUDIO LOCKS DOWN SHARED REPORTS, CLI GATES EXPERIMENTAL COMMANDS, REALTIME PATCHES MIGRATION GAPS

Supabase Studio now forces private SQL snippets public before adding them to team reports, closing a hole where collaborators saw broken states.

javascript 90 shipped 1-min read

— or follow the whole beat:

Elsewhere on the wire

Elixir & Phoenix about 6 hours ago

ELIXIR FIXES TIME MATH BUG THAT ROUNDS THE WRONG WAY

NaiveDateTime.diff/3 has been silently rounding elapsed time up instead of down, breaking its documented contract and potentially causing logic errors in any code relying on time-based calculations.

elixir 35 shipped 1-min read

@dotnet about 6 hours ago

OPERATOR SDK 13.0 BREAKS CONTROLLER ARCHITECTURE, ANDROID TESTS GO LOCAL

The dotnet-operator-sdk ships a major breaking change that fundamentally rewrites how multiple controllers target the same entity, while the Android team closes external test dependencies to fix certificate export failures on macOS.

dotnet 40 shipped 2-min read

@spring-projects about 6 hours ago

SPRING INTEGRATION FIXES CRITICAL LOCK REGISTRY BUG BLOCKING DISTRIBUTED SYSTEMS

Spring Integration shipped an emergency fix for JdbcLockRegistry that was causing false application hangs when different keys collided on shared locks.

java 10 shipped 1-min read

FastAPI & Pydantic about 6 hours ago

PYDANTIC ADDS VALIDATION ERROR TROUBLESHOOTING GUIDE

Pydantic just shipped a troubleshooting guide that walks you through reading validation failures in Logfire traces, cutting your debugging time in half.

python 2 shipped 1-min read