Who contributed to Supabase on July 28, 2026?

9 developers shipped this update, including fadymak, Pamela Chia, Alaister Young, claude[bot], realtime-release-bot[bot], edgurgel, Leandro Pereira, and github-actions[bot], and 1 more.

What were the notable Supabase updates?

feat(auth): expose access token expiry under auth settings (#48236), fix(studio): stop 403'd integration queries from looping on remount (#48350), and fix(studio): keep organization_slug in oauth signup redirect (#48352).

@supabase

The open-source Firebase alternative powering thousands of startups

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

SUPABASE STUDIO FIXES 403 LOOPS, AUTH TOKEN EXPIRY NOW CONFIGURABLE

By RepoJournal · Filed 06:58 UTC on July 28, 2026 · About Supabase

9 people shipped this

Leandro Pereira @leandrocp 2 cited

fadymak @fadymak 1 cited

Pamela Chia @pamelachia 1 cited

Alaister Young @alaister 1 cited

claude[bot] @claude[bot] 1 cited

realtime-release-bot[bot] @realtime-release-bot[bot] 1 cited

edgurgel @edgurgel 1 cited

github-actions[bot] @github-actions[bot]

dependabot @dependabot

A critical UI bug that hammered the platform API into rate limiting has been squashed, while the auth team surfaces JWT expiration controls where developers can actually find them.

The integration overview page was trapped in an unbounded request loop for users with project-scoped roles, firing 403s repeatedly on every component remount until the API rate limited the session [2]. That's now fixed by passing `retryOnMount: false` to halt the retry cycle on terminal errors. Meanwhile, the auth layer is exposing access token expiry (`JWT_EXP`) directly under Auth > Sessions settings instead of buried in legacy JWT config [1], making token lifetime tuning accessible without digging through deprecated panels. Two OAuth signup flows also got patched: one now preserves `organization_slug` through the post-confirmation redirect so multi-org users don't land on an empty org picker [3], and another split the cron cleanup dialog state from the enable button to stop double-counting telemetry [4]. On the realtime desk, v2.121.0 shipped with observability improvements, including a new admin dashboard and muster scope status gauge [5], plus a fix ensuring fanout metrics collect on the sending node [6]. The migration layer also tightened UUID not-null constraints [7] and improved JWT error mapping [8].

Action items

→ Deploy the 403 loop fix before next maintenance window if you're on a recent build supabase/supabase [immediate]
→ Update realtime to v2.121.0 to unlock the admin dashboard and o11y improvements supabase/realtime [plan]
→ Test OAuth signup flows with multi-org accounts after the organization_slug fix deploys supabase/supabase [monitor]

References

[1] feat(auth): expose access token expiry under auth settings (#48236) supabase/supabase
[2] fix(studio): stop 403'd integration queries from looping on remount (#48350) supabase/supabase
[3] fix(studio): keep organization_slug in oauth signup redirect (#48352) supabase/supabase
[4] fix(studio): split cron_job_cleanup dialog-open from enable to stop double-counting (#48348) supabase/supabase
[5] v2.121.0 ↗ supabase/realtime
[6] fix: ensure fanout metric is collected on the sending node ↗ supabase/realtime
[7] fix: migration realtime.uuid not null (#2047) supabase/realtime
[8] fix: map jwt errors (#2048) supabase/realtime

Quick answers

What shipped in Supabase on July 28, 2026?: A critical UI bug that hammered the platform API into rate limiting has been squashed, while the auth team surfaces JWT expiration controls where developers can actually find them. In total, 30 commits, 27 pull requests, and 5 releases landed.
Who contributed to Supabase on July 28, 2026?: 9 developers shipped this update, including fadymak, Pamela Chia, Alaister Young, claude[bot], realtime-release-bot[bot], edgurgel, Leandro Pereira, and github-actions[bot], and 1 more.
What were the notable Supabase updates?: feat(auth): expose access token expiry under auth settings (#48236), fix(studio): stop 403'd integration queries from looping on remount (#48350), and fix(studio): keep organization_slug in oauth signup redirect (#48352).

POSTGRES ACROSS VERSIONS SHIPS NOJIT BUILD; SUPABASE-JS FIXES OVERLAPPING OAUTH FLOWS

Supabase Postgres rolled out nojit builds across 15.14, 17.6, and the new 17.9 OrioleDB track overnight, while the JavaScript SDK's v2.111.0 solves a critical auth bug where simultaneous OAuth or password recovery flows would collide.

javascript 76 shipped 1-min read

@supabase 2 days ago

STUDIO SELF-IMPORT BUG FIXED, REALTIME SHIPS FANOUT METRICS

Supabase shipped a critical fix for TanStack Studio's local dev environment while Realtime v2.120.0 lands broadcast telemetry and cluster scaling improvements.

javascript 13 shipped 1-min read

@supabase 4 days ago

POSTGRES 17.6.1.156 SHIPS WITH ORIOLEDB VARIANT, CLI PORTS NATIVE TYPESCRIPT START COMMAND

Supabase shipped five Postgres releases overnight across three build variants while the CLI ditched its Go binary proxy for native TypeScript in the local dev stack.

javascript 22 shipped 1-min read

@supabase 5 days ago

DOCS CONTENT API NOW PLUGGABLE, RLS LEAK PATCHED IN STUDIO

The MCP server can point at alternative GraphQL endpoints for docs testing, while a critical fix stops Studio from leaking RLS-protected values during cell loads.

javascript 80 shipped 2-min read

Elsewhere on the wire

AI Agents about 3 hours ago

LANGCHAIN CORES SHIP, ANTHROPIC THINKING BLOCKS FIXED, OPENHANDS TIGHTENS WEBSOCKET AUTH

LangChain released two core packages with critical fixes for streaming stability and environment variable handling, while OpenHands closed a security gap that left WebSocket connections unprotected.

ai-agents 119 shipped 1-min read

Local LLMs about 3 hours ago

OLLAMA RIPS OUT IMAGE GENERATION, LLAMA.CPP SHIPS SPECULATIVE DECODING

Ollama removed its entire MLX image generation pipeline overnight, while llama.cpp landed DSpark speculative decoding and fixed a critical SYCL memory bug affecting Arc GPUs.

+11

llms 239 shipped 2-min read

@CachyOS about 3 hours ago

KERNEL SCHEDULER UPDATES ACROSS BORE AND SCX TOOLING

CachyOS shipped BORE 6.8.0 patches across two kernel series while upgrading its sched-ext ecosystem in parallel, signaling major tuning work ahead.

infra 83 shipped 1-min read

Elixir & Phoenix about 3 hours ago

ELIXIR TIGHTENS ERROR HANDLING ACROSS DATE, ECTO, AND IEXHELPERS

Date.range now surfaces ArgumentError instead of Protocol.UndefinedError when passed invalid step values, catching a class of bugs that silently fail in production code.