Who contributed to Supabase on July 15, 2026?

10 developers shipped this update, including Daniel Mitterdorfer, Charis, Jordi Enric, Andrew Valleteau, Joshen Lim, dependabot, supabase-releaser[bot], and supabase-releaser, and 2 more.

What were the notable Supabase updates?

chore: Remove refs to upstream (#7), chore: Remove refs to upstream, and chore: Switch to daily update cadence.

SUPABASE TIGHTENS FORK INDEPENDENCE, SHIPS SERVER CORS OVERHAUL

The go-tpc fork is severing its last ties to upstream PingCAP while the server runtime gains explicit CORS configuration control.

Supabase is consolidating ownership of its TPC benchmark fork by removing all remaining references to the original PingCAP repository [1] [2], a necessary step as the codebase diverges. The same project is now enforcing daily Dependabot updates [3] instead of weekly cadence and shipping a stable release tag [4] that replaces SHA-based versioning, making the fork dramatically easier to consume in automation. Over on the server runtime, v1.4.0 [5] ships explicit CORS configuration options ('default', 'disabled', or custom headers), giving teams fine-grained control over cross-origin request handling. On the JavaScript client side, a critical PostgREST typing bug [6] is fixed where self-referencing embeds were incorrectly typed as single objects when they should always resolve as arrays at runtime, and a Realtime channel bug [7] [8] ensures that caller-provided timeout options actually propagate to the underlying send() method instead of being silently dropped. Studio's introspection queries [9] now scope to specific table OIDs to prevent O(catalog) performance degradation on large databases, while the UI gets faster home page loading [10] and corrected chart y-axis labels [11]. The SQL editor refactoring continues with extraction of execution and explain hooks [12], keeping decomposition on track.