RepoJournal
Supabase

@supabase

The open-source Firebase alternative powering thousands of startups

What actually shipped in Supabase, written up every day — commits, pull requests, releases, and security advisories.

One email a day. Unsubscribe in one click.

Pick a date

  1. Tue 16 jun
  2. Wed 17 jun
  3. Thu 18 jun
  4. Fri 19 jun
  5. Sat 27 jun
  6. Sun 28 jun
  7. Mon 29 jun
  8. Tue 30 jun
  9. Wed 1 jul
  10. Thu 2 jul
  11. Fri 3 jul
  12. Sat 4 jul
  13. Sun 5 jul
  14. Mon 6 jul
  15. Tue 7 jul
  16. Wed 8 jul
  17. Thu 9 jul
  18. Fri 10 jul
  19. Sat 11 jul
  20. Sun 12 jul
  21. Mon 13 jul
  22. Tue 14 jul
  23. Wed 15 jul
  24. Thu 16 jul
  25. Sat 18 jul
  26. Sun 19 jul
  27. Mon 20 jul
  28. Tue 21 jul
  29. Wed 22 jul
  30. Today 23 jul
Topics: JavaScript Full archive →

The Wire · Showcase

CLICKHOUSE SCHEMA CORRUPTION FIX LANDS ACROSS ETL STACK

By RepoJournal · Filed · About Supabase

davidbirdsong jmqd iambriccardo Hieu Ivan Vasilov Miranda Limonczenko github-actions[bot]
9 people shipped this
davidbirdsong @davidbirdsong 7 cited jmqd @jmqd 3 cited iambriccardo @iambriccardo 1 cited Hieu @phamhieu 1 cited Ivan Vasilov @ivasilov 1 cited Miranda Limonczenko @czenko 1 cited github-actions[bot] @github-actions[bot] 1 cited claude[bot] @claude[bot] Charis @charislam

Supabase shipped a critical fix that prevents ClickHouse from destroying newer columns during CDC replay restarts, then propagated the same safety logic across Pulumi and Terraform tooling.

The ETL team closed a data loss vulnerability where replayed relation events with stale schema snapshots drove backwards DDL, dropping columns that had been added since the last snapshot [1]. This is a guard rail every data pipeline operator needs: reject any snapshot older than what's already applied, and tell the operator exactly what happened [3]. The fix shipped alongside BigQuery client updates [2] and error message improvements [4] to make recovery paths clearer when schema mismatches occur. Across infrastructure tooling, a coordinated wave landed Apache 2.0 license alignment [9], [10], [13], and a systematic propagation of tag prefix handling into actual measurement tags rather than just description prefixes [8], [11], [14], [15]. The terraform-provider-ripe-atlas shipped v0.1.3 [12] with all these fixes baked in. On the docs and platform side, FGA permissions now read from the proper OpenAPI extension field [5], vulnerable dependencies got bumped [6], and broken local links in documentation went through systematic repair [7].

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] clickhouse: Prevent unsafe schema rewind during CDC replay ↗ supabase/etl
  2. [2] feat(bigquery): Use updated BigQuery client ↗ supabase/etl
  3. [3] clickhouse: Prevent unsafe schema rewind during CDC replay (#925) supabase/etl
  4. [4] fix(clickhouse): Reword recovery snapshot error (#928) supabase/etl
  5. [5] fix: read FGA permissions from openapi spec x-fga-permissions extension (#48181) supabase/supabase
  6. [6] chore: Bump vulnerable deps (#48178) supabase/supabase
  7. [7] fix(docs) Fix local broken links (#48212) supabase/supabase
  8. [8] feat: add tagPrefix to measurement as a tag (#6) supabase/pulumi-atlas
  9. [9] fix: change to apache 2.0 license (#7) supabase/pulumi-atlas
  10. [10] fix: appropriate license ↗ supabase/terraform-provider-ripe-atlas
  11. [11] feat: plumb tag_prefix through to measurement tags (#9) supabase/terraform-provider-ripe-atlas
  12. [12] v0.1.3 ↗ supabase/terraform-provider-ripe-atlas
  13. [13] fix: switch to Apache 2.0 ↗ supabase/atlasctl
  14. [14] fix: tag -> namespace (#30) supabase/atlasctl
  15. [15] fix: store the tag prefix as a tag itself (#28) supabase/atlasctl

Quick answers

What shipped in Supabase on July 23, 2026?
Supabase shipped a critical fix that prevents ClickHouse from destroying newer columns during CDC replay restarts, then propagated the same safety logic across Pulumi and Terraform tooling. In total, 47 commits, 47 pull requests, and 1 releases landed.
Who contributed to Supabase on July 23, 2026?
9 developers shipped this update, including jmqd, iambriccardo, Hieu, Ivan Vasilov, Miranda Limonczenko, claude[bot], Charis, and davidbirdsong, and 1 more.
What were the notable Supabase updates?
clickhouse: Prevent unsafe schema rewind during CDC replay, feat(bigquery): Use updated BigQuery client, and clickhouse: Prevent unsafe schema rewind during CDC replay (#925).

More from @supabase

Supabase @supabase

PIPELINES HITS PUBLIC ALPHA, REALTIME SQUASHES RACE CONDITION

Supabase Pipelines moves out of private alpha with full schema change support, while the realtime stack hardens against clustering edge cases.

Leandro Pereira ivasilov Ana joshenlim +7
javascript 104 shipped 1-min read
Supabase @supabase

STUDIO ACCESSIBILITY DEBT CLEARED, REALTIME INSPECTOR LEVELED UP

Supabase shipped a coordinated push across Studio UI polish, accessibility compliance, and Realtime observability tooling overnight.

Danny White joshenlim spydon bnjjj +5
javascript 46 shipped 1-min read
Supabase @supabase

SUPABASE SHIPS CLICKHOUSE REPLICATION AND HARDENS CUSTOM AUTH

ClickHouse is now a first-class replication destination in Studio, gated behind a private alpha flag and built with client-side validation that blocks insecure and internal URLs.

SaxonF jmqd Joshen Lim danielmitterdorfer +2
javascript 11 shipped 1-min read
Supabase @supabase

POSTGRES SECURITY PATCH SHIPS ACROSS ALL VERSIONS

Supabase dropped CVE-2026-31431 mitigation across Postgres 15, 17, and OrioledB variants overnight, closing a critical vulnerability that could affect every deployment.

samrose github-actions[bot] dependabot Raminder Singh +1
javascript 17 shipped 1-min read

Daily updates, in your inbox

Follow Supabase

What actually shipped in Supabase, written up every day — commits, pull requests, releases, and security advisories.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

LANGCHAIN REFRESHES MODEL PROFILES, OPENROUTER 0.2.7 SHIPS

OpenRouter integration lands with updated model profiles including Google's Gemini 3.5 Flash Lite, while core token counting gets a performance fix for multi-tool agents.

github-actions[bot] langchain-oss-model-profiles langchain-oss-model-profiles[bot] imnishitha +6
ai-agents 29 shipped 1-min read
Local LLMs Local LLMs

OLLAMA AGENTS NOW IMPORT SKILLS FROM CODEX AND CLAUDE

Ollama shipped a skills import system that lets coding agents pull validated skill directories from external sources, while simultaneous fixes to GLM tool-call parsing and Laguna model alignment prevent agents from silently failing.

ParthSareen dhiltgen m1el rankaiyx +10
llms 212 shipped 2-min read
CachyOS @CachyOS

BRAVE BROWSER SOURCES SHIFT TO APT, GAME RULES SURGE, GERMAN WIKI TRANSLATIONS ACCELERATE

CachyOS is consolidating Brave packaging around apt sources while ananicy-rules absorbs a massive gaming ruleset expansion and the wiki team pushes German localization across multiple docs.

Vladislav Nepogodin Piotr Gorski lukaogadze Matias +1
infra 81 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

ELIXIR FIXES CALENDAR AND COMPILER EDGE CASES ACROSS FIVE PATCHES

Alexander Gubarev landed five targeted fixes to Calendar.ISO and ParallelCompiler that close gaps in time parsing, validation guards, and documentation.

Alexander Gubarev
elixir 15 shipped 1-min read
Want every project, not just this one?