Who contributed to Supabase on August 18, 2026?

13 developers shipped this update, including Miranda Limonczenko, Etienne Stalmans, Jordi Enric, dnywh, dependabot, jgoux, supabase-cli-releaser, and 7ttp, and 5 more.

What were the notable Supabase updates?

chore: update cors for pg routes (#49136), feat(evals): prompt-injection security scenarios (AgentDojo-style) (#202), and docs: mention MCP debugging tools and Supabase agent skill in debugging docs (#48978).

@supabase

The open-source Firebase alternative powering thousands of startups

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

SUPABASE HARDENS CORS AND SHIPS PROMPT-INJECTION EVALS

By RepoJournal · Filed 06:57 UTC on August 18, 2026 · About Supabase

13 people shipped this

github-actions[bot] @github-actions[bot] 2 cited

Etienne Stalmans @staaldraad 1 cited

Jordi Enric @jordienr 1 cited

7ttp @7ttp 1 cited

Pedro Rodrigues @Rodriguespn 1 cited

Miranda Limonczenko @czenko

dnywh @dnywh

dependabot @dependabot

jgoux @jgoux

supabase-cli-releaser @supabase-cli-releaser

imor @imor

supabase-evals-releaser @supabase-evals-releaser

supabase-evals-releaser[bot] @supabase-evals-releaser[bot]

A config hardening for self-hosted envoy plus four new security evals signal Supabase is closing attack surfaces on both the infrastructure and AI agent fronts.

Supabase shipped a CORS hardening for self-hosted deployments, restricting access to `/pg` routes to the studio dashboard instead of the permissive global mode [1]. Meanwhile, four new regression evals, mirroring the AgentDojo benchmark, now test agent robustness against prompt injection through the MCP server's free-text tools like `execute_sql` and `query_logs` [2]. These evals reflect a growing focus on AI security, especially as MCP debugging tools and the Supabase agent skill are now documented [3]. On the CLI side, a migration ordering fix addresses inconsistent behavior across `db pull`, `migration list`, and shadow db replays, which could cause false conflicts and reversed migrations [4]. Storage v1.70.0 and postgres 17.6.1.163 released as portable, smoke-tested runtime artifacts, keeping the local stack current [ref:16, ref:17].

Action items

→ Review the CORS hardening for self-hosted envoy and update your config before next deploy supabase/supabase [immediate]
→ Upgrade to supabase CLI that includes migration ordering fix to avoid false conflicts and reversed replays supabase/cli [immediate]
→ Pin storage to v1.70.0 and postgres to 17.6.1.163 for consistent local runtime supabase/slim-services [plan]
→ Run the new prompt-injection evals against your agents supabase/evals [monitor]

References

[1] chore: update cors for pg routes (#49136) supabase/supabase
[2] feat(evals): prompt-injection security scenarios (AgentDojo-style) (#202) supabase/evals
[3] docs: mention MCP debugging tools and Supabase agent skill in debugging docs (#48978) supabase/supabase
[4] fix(cli): order migrations consistently ↗ supabase/cli
[5] storage v1.70.0 ↗ supabase/slim-services
[6] postgres 17.6.1.163 ↗ supabase/slim-services

Quick answers

What shipped in Supabase on August 18, 2026?: A config hardening for self-hosted envoy plus four new security evals signal Supabase is closing attack surfaces on both the infrastructure and AI agent fronts. In total, 38 commits, 40 pull requests, and 7 releases landed.
Who contributed to Supabase on August 18, 2026?: 13 developers shipped this update, including Miranda Limonczenko, Etienne Stalmans, Jordi Enric, dnywh, dependabot, jgoux, supabase-cli-releaser, and 7ttp, and 5 more.
What were the notable Supabase updates?: chore: update cors for pg routes (#49136), feat(evals): prompt-injection security scenarios (AgentDojo-style) (#202), and docs: mention MCP debugging tools and Supabase agent skill in debugging docs (#48978).

SUPABASE CLI v2.115.0 BREAKS YOUR CI

If you run schema diffing or supabase test db in CI, this release is about to change what those commands do.

javascript 79 shipped

@supabase Aug 17

SUPABASE STUDIO TIGHTENS PRIVATELINK UX ACROSS FOUR COMMITS

Four linked PRs ship clarity to PrivateLink configuration and MFA backup flows, replacing ambiguous copy with resource IDs and clearer field ordering.

javascript 24 shipped

@supabase Aug 16

SUPABASE CLI FIXES MEMORY BLOWUP ON LARGE DB DUMPS

The CLI was buffering entire piped outputs in memory instead of respecting backpressure, turning a routine `supabase db dump` into an OOM killer on large databases.

javascript 8 shipped

@supabase Aug 15

CLI UNLOCKS ORIOLEDB PROJECTS, EVALS MOVES TO VERCEL SANDBOXES

Supabase CLI now exposes the experimental flags needed to spin up OrioleDB managed projects, while the evals system abandons GitHub Actions for faster, sandboxed test execution.

javascript 30 shipped

Elsewhere on the wire

AI Agents Aug 19

CLINE DESKTOP GOES NATIVE WITH BACKGROUND ALERTS

Cline's desktop app just became a tool you can leave running while you grab coffee, and LangChain is quietly fixing the token math that makes DeepSeek caching actually count.

ai-agents 97 shipped

@CachyOS Aug 19

CACHYOS PUSHES KERNEL 7.1.8 AND SCHEDULER FIXES ACROSS THE STACK

CachyOS is shipping a new kernel meanwhile patching its scheduler stack, and that combination is exactly what you want before your next deploy.

infra 58 shipped

Elixir & Phoenix Aug 19

LiveView memory leak fix leads overnight Elixir cleanup

A handful of pull requests across Elixir and Phoenix are quietly fixing leaks and edge cases that have been nagging at production apps.

elixir 19 shipped

@dotnet Aug 19

MAUI Overhauls NuGet Publishing as FSharp Preps for VS 18.11

MAUI is replacing its custom NuGet publishing with Microsoft's 1ES.PublishNuget, and FSharp is rolling Microsoft.Build deps forward to VS 18.11, two moves that reshape release engineering across the .NET ecosystem.