RepoJournal
Supabase @supabase
151 wires and counting

$ follow Supabase

Keep up with Supabase in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-08-18
stories 85
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

SUPABASE HARDENS CORS AND SHIPS PROMPT-INJECTION EVALS

By RepoJournal · Filed · About Supabase · Composed from the cited sources · methodology

github-actions[bot] Etienne Stalmans Jordi Enric 7ttp Pedro Rodrigues Miranda Limonczenko dnywh
13 people shipped this
github-actions[bot] @github-actions[bot] 2 cited Etienne Stalmans @staaldraad 1 cited Jordi Enric @jordienr 1 cited 7ttp @7ttp 1 cited Pedro Rodrigues @Rodriguespn 1 cited Miranda Limonczenko @czenko dnywh @dnywh dependabot @dependabot jgoux @jgoux supabase-cli-releaser @supabase-cli-releaser imor @imor supabase-evals-releaser @supabase-evals-releaser supabase-evals-releaser[bot] @supabase-evals-releaser[bot]

A config hardening for self-hosted envoy plus four new security evals signal Supabase is closing attack surfaces on both the infrastructure and AI agent fronts.

Supabase shipped a CORS hardening for self-hosted deployments, restricting access to `/pg` routes to the studio dashboard instead of the permissive global mode [1]. Meanwhile, four new regression evals, mirroring the AgentDojo benchmark, now test agent robustness against prompt injection through the MCP server's free-text tools like `execute_sql` and `query_logs` [2]. These evals reflect a growing focus on AI security, especially as MCP debugging tools and the Supabase agent skill are now documented [3]. On the CLI side, a migration ordering fix addresses inconsistent behavior across `db pull`, `migration list`, and shadow db replays, which could cause false conflicts and reversed migrations [4]. Storage v1.70.0 and postgres 17.6.1.163 released as portable, smoke-tested runtime artifacts, keeping the local stack current [5][6].

Action items

References

  1. [1] chore: update cors for pg routes (#49136) ↗ supabase/supabase
  2. [2] feat(evals): prompt-injection security scenarios (AgentDojo-style) (#202) ↗ supabase/evals
  3. [3] docs: mention MCP debugging tools and Supabase agent skill in debugging docs (#48978) supabase/supabase ↗
  4. [4] fix(cli): order migrations consistently ↗ supabase/cli
  5. [5] storage v1.70.0 ↗ supabase/slim-services
  6. [6] postgres 17.6.1.163 ↗ supabase/slim-services

$ ls supabase/reviews/ # the step-back reads

the week in review CLI 2.120.0 adds persisted logs and OTel traces the month in review MCP v0.12.0 groups advisor lints, adds cost elicitation
Full archive → Weekly reviews →

Quick answers

What shipped in Supabase on August 18, 2026?
A config hardening for self-hosted envoy plus four new security evals signal Supabase is closing attack surfaces on both the infrastructure and AI agent fronts. In total, 38 commits, 40 pull requests, and 7 releases landed.
Who contributed to Supabase on August 18, 2026?
13 developers shipped this update, including Miranda Limonczenko, Etienne Stalmans, Jordi Enric, dnywh, dependabot, jgoux, supabase-cli-releaser, and 7ttp, and 5 more.
What were the notable Supabase updates?
chore: update cors for pg routes (#49136), feat(evals): prompt-injection security scenarios (AgentDojo-style) (#202), and docs: mention MCP debugging tools and Supabase agent skill in debugging docs (#48978).
♥

$ log @supabase --recent

Self-hosted stack bumps realtime and storage, Studio remembers your chart range 72 shipped Realtime 2.144.0 patches a decimal CVE; realtime-csharp adds paged storage listing 151 shipped MCP server 0.14.0 adds health advisors, Supabase CLI routes every Management API call through the typed client 123 shipped Scoped OAuth reconsent in Studio, MCP drops double cost prompts 139 shipped

$ log --all # elsewhere on the wire

Alignment & Post-training verl rejects conflicting vLLM engine_kwargs, open-instruct adds MILES OPD behind a Megatron learner Interpretability nnsight 0.8.0 cuts import time from 7.6s to 1.6s

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.