RepoJournal
Supabase

@supabase

The open-source Firebase alternative powering thousands of startups

Keep up with Supabase in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

One email a day. Unsubscribe in one click.

Pick a date

  1. Sun 28 jun
  2. Mon 29 jun
  3. Tue 30 jun
  4. Wed 1 jul
  5. Thu 2 jul
  6. Fri 3 jul
  7. Sat 4 jul
  8. Sun 5 jul
  9. Mon 6 jul
  10. Tue 7 jul
  11. Wed 8 jul
  12. Thu 9 jul
  13. Fri 10 jul
  14. Sat 11 jul
  15. Sun 12 jul
  16. Mon 13 jul
  17. Tue 14 jul
  18. Wed 15 jul
  19. Thu 16 jul
  20. Sat 18 jul
  21. Sun 19 jul
  22. Mon 20 jul
  23. Tue 21 jul
  24. Wed 22 jul
  25. Thu 23 jul
  26. Fri 24 jul
  27. Sat 25 jul
  28. Mon 27 jul
  29. Tue 28 jul
  30. Today 29 jul
Topics: JavaScript Full archive →

The Wire · Showcase

POSTGRES ACROSS VERSIONS SHIPS NOJIT BUILD; SUPABASE-JS FIXES OVERLAPPING OAUTH FLOWS

By RepoJournal · Filed · About Supabase

github-actions[bot] Colum Ferry Charis farazdagi supabase-releaser[bot] mandarini Vaibhav
12 people shipped this
github-actions[bot] @github-actions[bot] 5 cited Colum Ferry @Coly010 3 cited Charis @charislam 2 cited farazdagi @farazdagi 1 cited supabase-releaser[bot] @supabase-releaser[bot] 1 cited mandarini @mandarini 1 cited Vaibhav @7ttp 1 cited Cemal Kılıç @cemalkilic TheOtherBrian1 @TheOtherBrian1 Alaister Young @alaister supabase-releaser @supabase-releaser dependabot @dependabot

Supabase Postgres rolled out nojit builds across 15.14, 17.6, and the new 17.9 OrioleDB track overnight, while the JavaScript SDK's v2.111.0 solves a critical auth bug where simultaneous OAuth or password recovery flows would collide.

The Postgres desk shipped five coordinated releases [1][2][3][4][5] across three major versions, including the first production-ready OrioleDB variant, giving operators escape routes from JIT-related instability across the entire supported stack. Meanwhile, supabase-js v2.111.0 [6] attacks a real-world auth failure: overlapping flows like simultaneous social sign-in and password recovery now each get their own PKCE verifier slot (a ring of 5) instead of stomping on a single shared key [7], with `signInWithOAuth` returning the flow ID and `exchangeCodeForSession` accepting it as an optional selector. The CLI desk landed four fixes [8][9][10][11] that tighten error rendering for migration failures to match the Go CLI byte-for-byte, surface actionable diagnostics when Docker images won't run, revoke PUBLIC privileges correctly in schema diffs, and align SSO domain handling across the two implementations. Studio continued its SQL editor refactor with three stacked PRs [12][13] introducing discriminated union types for snippet sources and source-aware writes, while the ETL pipeline gained append observability metrics for Snowflake [14].

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] 15.14.1.157-nojit1 ↗ supabase/postgres
  2. [2] 17.6.1.157-nojit1 ↗ supabase/postgres
  3. [3] 17.9.0.010-orioledb-nojit1 ↗ supabase/postgres
  4. [4] 15.14.1.157-nojit1-x86 ↗ supabase/postgres
  5. [5] 17.6.1.157-nojit1-x86 ↗ supabase/postgres
  6. [6] v2.111.0 ↗ supabase/supabase-js
  7. [7] feat(auth): store PKCE verifiers in per-flow slots to survive overlapping flows ↗ supabase/supabase-js
  8. [8] fix(cli): render Go's caret, Detail, and 42704 hint in migration-apply errors (#5967) supabase/cli
  9. [9] fix(cli): diagnose unrunnable images (#5966) supabase/cli
  10. [10] fix(cli): bump default pg-delta version to pick up PUBLIC-privilege revoke fix (#5970) supabase/cli
  11. [11] fix(cli): always send domains in sso update PUT body to match Go (CLI-1981) (#5973) supabase/cli
  12. [12] feat(studio): log_sql content shape + remap content.sql to unchecked_sql (#48305) supabase/supabase
  13. [13] feat(studio): discriminated snippet union + source-aware writes (#48313) supabase/supabase
  14. [14] feat(snowflake): add append observability metrics ↗ supabase/etl

Quick answers

What shipped in Supabase on July 29, 2026?
Supabase Postgres rolled out nojit builds across 15.14, 17.6, and the new 17.9 OrioleDB track overnight, while the JavaScript SDK's v2.111.0 solves a critical auth bug where simultaneous OAuth or password recovery flows would collide. In total, 27 commits, 31 pull requests, and 18 releases landed.
Who contributed to Supabase on July 29, 2026?
12 developers shipped this update, including github-actions[bot], Cemal Kılıç, Charis, TheOtherBrian1, Alaister Young, farazdagi, supabase-releaser[bot], and mandarini, and 4 more.
What were the notable Supabase updates?
15.14.1.157-nojit1, 17.6.1.157-nojit1, and 17.9.0.010-orioledb-nojit1.

More from @supabase

Supabase @supabase

SUPABASE STUDIO FIXES 403 LOOPS, AUTH TOKEN EXPIRY NOW CONFIGURABLE

A critical UI bug that hammered the platform API into rate limiting has been squashed, while the auth team surfaces JWT expiration controls where developers can actually find them.

fadymak Pamela Chia Alaister Young claude[bot] +5
javascript 62 shipped 1-min read
Supabase @supabase

STUDIO SELF-IMPORT BUG FIXED, REALTIME SHIPS FANOUT METRICS

Supabase shipped a critical fix for TanStack Studio's local dev environment while Realtime v2.120.0 lands broadcast telemetry and cluster scaling improvements.

alaister joshenlim Hieu realtime-release-bot[bot] +3
javascript 13 shipped 1-min read
Supabase @supabase

POSTGRES 17.6.1.156 SHIPS WITH ORIOLEDB VARIANT, CLI PORTS NATIVE TYPESCRIPT START COMMAND

Supabase shipped five Postgres releases overnight across three build variants while the CLI ditched its Go binary proxy for native TypeScript in the local dev stack.

github-actions[bot] Coly010 7ttp
javascript 22 shipped 1-min read
Supabase @supabase

DOCS CONTENT API NOW PLUGGABLE, RLS LEAK PATCHED IN STUDIO

The MCP server can point at alternative GraphQL endpoints for docs testing, while a critical fix stops Studio from leaking RLS-protected values during cell loads.

barryroodt supabase-releaser supabase-releaser[bot] Alaister Young +7
javascript 80 shipped 2-min read

Daily updates, in your inbox

Follow Supabase

Keep up with Supabase in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

LANGCHAIN CORES SHIP, ANTHROPIC THINKING BLOCKS FIXED, OPENHANDS TIGHTENS WEBSOCKET AUTH

LangChain released two core packages with critical fixes for streaming stability and environment variable handling, while OpenHands closed a security gap that left WebSocket connections unprotected.

github-actions[bot] langchain-oss-model-profiles[bot] Functionhx ccurme +9
ai-agents 119 shipped 1-min read
Local LLMs Local LLMs

OLLAMA RIPS OUT IMAGE GENERATION, LLAMA.CPP SHIPS SPECULATIVE DECODING

Ollama removed its entire MLX image generation pipeline overnight, while llama.cpp landed DSpark speculative decoding and fixed a critical SYCL memory bug affecting Arc GPUs.

jmorganca 王金旭 Daniel Bevenius meatposes +11
llms 239 shipped 2-min read
CachyOS @CachyOS

KERNEL SCHEDULER UPDATES ACROSS BORE AND SCX TOOLING

CachyOS shipped BORE 6.8.0 patches across two kernel series while upgrading its sched-ext ecosystem in parallel, signaling major tuning work ahead.

Piotr Gorski Vladislav Nepogodin witchlliee Eric Naim +1
infra 83 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

ELIXIR TIGHTENS ERROR HANDLING ACROSS DATE, ECTO, AND IEXHELPERS

Date.range now surfaces ArgumentError instead of Protocol.UndefinedError when passed invalid step values, catching a class of bugs that silently fail in production code.

Alexander Gubarev Steffen Deusch lukaszsamson José Valim
elixir 14 shipped 1-min read
Want every project, not just this one?