RepoJournal
Supabase @supabase
124 wires and counting

$ follow Supabase

Keep up with Supabase in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-07-15
stories 88
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

SUPABASE TIGHTENS FORK INDEPENDENCE, SHIPS SERVER CORS OVERHAUL

By RepoJournal · Filed · About Supabase · Composed from the cited sources · methodology

Daniel Mitterdorfer FrancoKaddour Charis Jordi Enric Andrew Valleteau Joshen Lim supabase-releaser[bot]
10 people shipped this
Daniel Mitterdorfer @danielmitterdorfer 4 cited FrancoKaddour @FrancoKaddour 2 cited Charis @charislam 1 cited Jordi Enric @jordienr 1 cited Andrew Valleteau @avallete 1 cited Joshen Lim @joshenlim 1 cited supabase-releaser[bot] @supabase-releaser[bot] 1 cited mandarini @mandarini 1 cited dependabot @dependabot supabase-releaser @supabase-releaser

The go-tpc fork is severing its last ties to upstream PingCAP while the server runtime gains explicit CORS configuration control.

Supabase is consolidating ownership of its TPC benchmark fork by removing all remaining references to the original PingCAP repository [1] [2], a necessary step as the codebase diverges. The same project is now enforcing daily Dependabot updates [3] instead of weekly cadence and shipping a stable release tag [4] that replaces SHA-based versioning, making the fork dramatically easier to consume in automation. Over on the server runtime, v1.4.0 [5] ships explicit CORS configuration options ('default', 'disabled', or custom headers), giving teams fine-grained control over cross-origin request handling. On the JavaScript client side, a critical PostgREST typing bug [6] is fixed where self-referencing embeds were incorrectly typed as single objects when they should always resolve as arrays at runtime, and a Realtime channel bug [7] [8] ensures that caller-provided timeout options actually propagate to the underlying send() method instead of being silently dropped. Studio's introspection queries [9] now scope to specific table OIDs to prevent O(catalog) performance degradation on large databases, while the UI gets faster home page loading [10] and corrected chart y-axis labels [11]. The SQL editor refactoring continues with extraction of execution and explain hooks [12], keeping decomposition on track.

Action items

References

  1. [1] chore: Remove refs to upstream (#7) ↗ supabase/go-tpc
  2. [2] chore: Remove refs to upstream ↗ supabase/go-tpc
  3. [3] chore: Switch to daily update cadence ↗ supabase/go-tpc
  4. [4] feat: Use a stable dev release tag ↗ supabase/go-tpc
  5. [5] server: v1.4.0 ↗ supabase/server
  6. [6] fix(postgrest): type hinted self-referencing embeds as arrays ↗ supabase/supabase-js
  7. [7] fix(realtime): forward opts to send() in track() ↗ supabase/supabase-js
  8. [8] fix(realtime): forward opts to send() in track() (#2490) ↗ supabase/supabase-js
  9. [9] fix(studio): scope table editor introspection CTEs to target table OID (#47894) supabase/supabase ↗
  10. [10] Remove home page skeleton loader, improve base loading behaviour (#47903) supabase/supabase ↗
  11. [11] fix(ui-patterns): fix chart y-axis label clipping (#47890) supabase/supabase ↗
  12. [12] refactor(sql-editor): extract execution + explain hooks (decompose 4/6) (#47923) supabase/supabase ↗

$ ls supabase/reviews/ # the step-back reads

the week in review Studio moves to Nitro, CLI stack goes flag-gated the month in review Supabase ships CLI v2, Postgres middleware, and safety rails across Studio
Topics: JavaScript Full archive → Weekly reviews →

Quick answers

What shipped in Supabase on July 15, 2026?
The go-tpc fork is severing its last ties to upstream PingCAP while the server runtime gains explicit CORS configuration control. In total, 35 commits, 47 pull requests, and 6 releases landed.
Who contributed to Supabase on July 15, 2026?
10 developers shipped this update, including Daniel Mitterdorfer, Charis, Jordi Enric, Andrew Valleteau, Joshen Lim, dependabot, supabase-releaser[bot], and supabase-releaser, and 2 more.
What were the notable Supabase updates?
chore: Remove refs to upstream (#7), chore: Remove refs to upstream, and chore: Switch to daily update cadence.
♥

$ log @supabase --recent

Turbopack build cache disabled, eval results refreshed 4 shipped CLI config push stops ignoring a piped "no"; storage and realtime artifacts refresh 70 shipped MCP v0.13.0 gates destructive SQL, CLI stops deleting vector buckets 113 shipped Replicator health probes land, Studio pipeline overview rebuilt 135 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.