Who contributed to Supabase on July 20, 2026?

6 developers shipped this update, including SaxonF, jmqd, Joshen Lim, danielmitterdorfer, github-actions[bot], and Eduardo Gurgel.

What were the notable Supabase updates?

feat(studio): add ClickHouse replication destination, Add support for multiple custom auth providers in custom-content (#48030), and Propagate errors to top-level for TPCC.

@supabase

The open-source Firebase alternative powering thousands of startups

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

SUPABASE SHIPS CLICKHOUSE REPLICATION AND HARDENS CUSTOM AUTH

By RepoJournal · Filed 06:57 UTC on July 20, 2026 · About Supabase

6 people shipped this

jmqd @jmqd 1 cited

Joshen Lim @joshenlim 1 cited

danielmitterdorfer @danielmitterdorfer 1 cited

Eduardo Gurgel @edgurgel 1 cited

SaxonF @SaxonF

github-actions[bot] @github-actions[bot]

ClickHouse is now a first-class replication destination in Studio, gated behind a private alpha flag and built with client-side validation that blocks insecure and internal URLs.

The big move today is ClickHouse integration [1]. Studio now renders a full configuration form for ClickHouse destinations with URL, user, password, and database fields. The implementation includes client-side validation that rejects any target pointing to loopback addresses, RFC 1918 ranges, link-local ranges, CGNAT blocks, or IPv6 ULA space. This is security by default, not an afterthought. The flag is off by default, so you won't see this in production orgs yet. In parallel, the auth layer shipped support for multiple custom sign-in providers [2]. The UI now renders all configured custom providers on the sign-in page while staying backward compatible with the legacy single-provider setup. Over in go-tpc, error propagation got fixed [3]. TPCC subcommands were exiting with code 0 even on failure, masking preparation errors upstream. That's now corrected. The realtime team squashed a flaky reconnector test [4] that was making local development harder. Small fix, high signal-to-noise on CI runs.

Action items

→ If running ClickHouse replication, reach out to sales to enable the private alpha flag supabase/supabase [plan]
→ Review custom auth provider config if you're using multiple sign-in options - migration is backward compatible supabase/supabase [monitor]
→ Upgrade go-tpc if you're running TPCC benchmarks - error handling is now reliable supabase/go-tpc [plan]

References

[1] feat(studio): add ClickHouse replication destination ↗ supabase/supabase
[2] Add support for multiple custom auth providers in custom-content (#48030) supabase/supabase
[3] Propagate errors to top-level for TPCC ↗ supabase/go-tpc
[4] chore: fix reconnector flaky test ↗ supabase/realtime

Quick answers

What shipped in Supabase on July 20, 2026?: ClickHouse is now a first-class replication destination in Studio, gated behind a private alpha flag and built with client-side validation that blocks insecure and internal URLs. In total, 5 commits, 5 pull requests, and 1 releases landed.
Who contributed to Supabase on July 20, 2026?: 6 developers shipped this update, including SaxonF, jmqd, Joshen Lim, danielmitterdorfer, github-actions[bot], and Eduardo Gurgel.
What were the notable Supabase updates?: feat(studio): add ClickHouse replication destination, Add support for multiple custom auth providers in custom-content (#48030), and Propagate errors to top-level for TPCC.

POSTGRES SECURITY PATCH SHIPS ACROSS ALL VERSIONS

Supabase dropped CVE-2026-31431 mitigation across Postgres 15, 17, and OrioledB variants overnight, closing a critical vulnerability that could affect every deployment.

javascript 17 shipped 1-min read

@supabase 3 days ago

MCP SERVER SUPABASE SHIPS EDGE FUNCTION LOGS, POSTGRES BUMPS TO v17.6.1.149, REALTIME SLASHES TENANT CREATION OVERHEAD

The MCP server gains edge function runtime visibility while infrastructure rolls forward across three major subsystems overnight.

+11

javascript 76 shipped 2-min read

@supabase 5 days ago

STUDIO UI FIXES SHIP; ETL GAINS RESTART AND RESOURCE CONTROLS

Supabase shipped three critical studio UI repairs and overhauled ETL's shutdown handling, resource management, and operational tooling in a single push across the platform.

+10

javascript 102 shipped 2-min read

@supabase 6 days ago

SUPABASE TIGHTENS FORK INDEPENDENCE, SHIPS SERVER CORS OVERHAUL

The go-tpc fork is severing its last ties to upstream PingCAP while the server runtime gains explicit CORS configuration control.

javascript 88 shipped 2-min read

Elsewhere on the wire

@cachyos about 18 hours ago

LINUX 7.2-RC4 LANDS WITH GAMING SCHEDULER, ANANICY OVERHAULS PROCESS TUNING

CachyOS shipped kernel 7.2-rc4 with a new gaming-optimized scheduler branch and AMD display fixes, while ananicy-rules yanked normal scheduling from most process types in a major behavioral shift.

infra 56 shipped 1-min read

Elixir & Phoenix about 18 hours ago

ELIXIR COMPILER GETS 20% FASTER TYPE CHECKING

Multi-clause function analysis now runs significantly faster after the core team eliminated unnecessary list allocations in disjoint argument checking.

elixir 6 shipped 1-min read

@dotnet about 18 hours ago

MACIOS FIXES SYMBOL UPLOAD GAP, MSBUILD PULLS ARCADE UPDATES

Apple's App Store Connect will finally see proper crash symbolication for .NET iOS apps after macios shipped a fix that embeds symbol files directly in the .ipa.

dotnet 21 shipped 1-min read

FastAPI & Pydantic about 18 hours ago

PYDANTIC DOCS GET GRAMMAR CLEANUP

Pydantic merged a four-typo fix across docs and skill definitions that slipped past CI.

python 2 shipped 1-min read

Want every project, not just this one?

Follow @supabase