Who contributed to Supabase on July 19, 2026?

5 developers shipped this update, including samrose, github-actions[bot], dependabot, Raminder Singh, and Jordi Enric.

What were the notable Supabase updates?

feat: mitigation of CVE-2026-31431 (#2186), v17.6.1.150-cli, and 17.6.1.150.

@supabase

The open-source Firebase alternative powering thousands of startups

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

POSTGRES SECURITY PATCH SHIPS ACROSS ALL VERSIONS

By RepoJournal · Filed 06:57 UTC on July 19, 2026 · About Supabase

5 people shipped this

github-actions[bot] @github-actions[bot] 4 cited

dependabot @dependabot 3 cited

Raminder Singh @imor 2 cited

samrose @samrose 1 cited

Jordi Enric @jordienr 1 cited

Supabase dropped CVE-2026-31431 mitigation across Postgres 15, 17, and OrioledB variants overnight, closing a critical vulnerability that could affect every deployment.

The security fix landed in v17.6.1.150-cli [2] and propagated to all supported versions [3] [4], with OrioledB getting its own hardened release [5]. This wasn't a minor patch: the CVE-2026-31431 mitigation [1] represents the kind of vulnerability that demands immediate attention across your entire fleet. In parallel, dbdev CLI picked up dependency updates to regex 1.13.0 [6] for improved compilation performance and uuid 1.23.5 [7] for hex parsing optimization, both landing cleanly without breaking changes [8] [9]. Studio shipped a critical fix [10] for API observability: DELETE request filtering was silently failing because the report builder was lowercasing method names when edge_logs stores them uppercase, making your observability blind to certain traffic patterns. Meanwhile, CLI is cycling through major dependency bumps including PostHog updates [11], standard housekeeping but worth validating in your CI pipeline.

Action items

→ Upgrade Postgres to v17.6.1.150 or v15.14.1.150-x86 immediately supabase/postgres [immediate]
→ Redeploy Studio to pick up DELETE method filtering fix supabase/supabase [immediate]
→ Test dbdev CLI updates in staging before rolling to production supabase/dbdev [plan]
→ Monitor CLI dependency upgrades for compatibility in your build pipeline supabase/cli [monitor]

References

[1] feat: mitigation of CVE-2026-31431 (#2186) supabase/postgres
[2] v17.6.1.150-cli ↗ supabase/postgres
[3] 17.6.1.150 ↗ supabase/postgres
[4] 15.14.1.150-x86 ↗ supabase/postgres
[5] 17.9.0.003-orioledb ↗ supabase/postgres
[6] chore(deps): bump regex from 1.12.4 to 1.13.0 in /cli ↗ supabase/dbdev
[7] chore(deps): bump uuid from 1.23.4 to 1.23.5 in /cli ↗ supabase/dbdev
[8] Merge pull request #502 from supabase/dependabot/cargo/cli/master/regex-1.13.0 supabase/dbdev
[9] Merge pull request #501 from supabase/dependabot/cargo/cli/master/uuid-1.23.5 supabase/dbdev
[10] fix(studio): preserve API report filter value casing so method filters match ↗ supabase/supabase
[11] chore(deps): bump the npm-major group with 3 updates ↗ supabase/cli

Quick answers

What shipped in Supabase on July 19, 2026?: Supabase dropped CVE-2026-31431 mitigation across Postgres 15, 17, and OrioledB variants overnight, closing a critical vulnerability that could affect every deployment. In total, 5 commits, 6 pull requests, and 6 releases landed.
Who contributed to Supabase on July 19, 2026?: 5 developers shipped this update, including samrose, github-actions[bot], dependabot, Raminder Singh, and Jordi Enric.
What were the notable Supabase updates?: feat: mitigation of CVE-2026-31431 (#2186), v17.6.1.150-cli, and 17.6.1.150.

MCP SERVER SUPABASE SHIPS EDGE FUNCTION LOGS, POSTGRES BUMPS TO v17.6.1.149, REALTIME SLASHES TENANT CREATION OVERHEAD

The MCP server gains edge function runtime visibility while infrastructure rolls forward across three major subsystems overnight.

+11

javascript 76 shipped 2-min read

@supabase 3 days ago

STUDIO UI FIXES SHIP; ETL GAINS RESTART AND RESOURCE CONTROLS

Supabase shipped three critical studio UI repairs and overhauled ETL's shutdown handling, resource management, and operational tooling in a single push across the platform.

+10

javascript 102 shipped 2-min read

@supabase 4 days ago

SUPABASE TIGHTENS FORK INDEPENDENCE, SHIPS SERVER CORS OVERHAUL

The go-tpc fork is severing its last ties to upstream PingCAP while the server runtime gains explicit CORS configuration control.

javascript 88 shipped 2-min read

@supabase 5 days ago

FLUTTER SDK GAINS TIMEOUT CONTROL, REALTIME SHIPS PERCENTAGE-BASED FLAGS

The Flutter PostgREST client now lets you configure retry behavior and set per-request timeouts that actually work, while Realtime v2.113.0 adds percentage-bucketed feature flags with tenant isolation.

javascript 70 shipped 1-min read

— or follow the whole beat:

Elsewhere on the wire

@cachyos about 10 hours ago

CACHYOS LINUX 7.1.4 SHIPS WITH SCHEDULER REVERT AND AMD AUDIO FIXES

The kernel bumped to 7.1.4 overnight with a critical scheduler revert and targeted audio driver fixes for AMD systems.

infra 57 shipped 1-min read

Elixir & Phoenix about 10 hours ago

ECTO FIXES SILENT DATA CORRUPTION IN MAP UPDATES AND BELONGS_TO LOOKUPS

Two critical Ecto bugs that silently corrupt changeset data are now fixed, and you should merge these immediately if you're using map or association updates.

elixir 10 shipped 1-min read

Mobile platforms about 10 hours ago

SWIFT COMPILER DROPS DECADE-OLD INTEROP WORKAROUND, REIMPLEMENTS CORE OPTIMIZER IN PURE SWIFT

Swift's ClangImporter finally stopped stripping type aliases that have been unnecessary since 2014, while the compiler's foundational SSAUpdater moved entirely off C++ dependencies.

mobile 28 shipped 1-min read

@dotnet about 10 hours ago

SOURCE.DOT.NET PROXY LAYER BROKEN, SOURCEBROWSER GETS MAJOR OVERHAUL

source.dot.net is serving HTTP 500s and stale assets because the proxy layer exposes bugs that local-disk deployments never catch, and SourceBrowser just got a significant upgrade that's likely its last.

dotnet 12 shipped 1-min read