RepoJournal
Supabase

@supabase

The open-source Firebase alternative powering thousands of startups

Keep up with Supabase in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

One email a day. Unsubscribe in one click.

Pick a date

  1. Fri 24 jul
  2. Sat 25 jul
  3. Mon 27 jul
  4. Tue 28 jul
  5. Wed 29 jul
  6. Thu 30 jul
  7. Fri 31 jul
  8. Sat 1 aug
  9. Sun 2 aug
  10. Mon 3 aug
  11. Tue 4 aug
  12. Wed 5 aug
  13. Thu 6 aug
  14. Fri 7 aug
  15. Sat 8 aug
  16. Sun 9 aug
  17. Mon 10 aug
  18. Tue 11 aug
  19. Wed 12 aug
  20. Thu 13 aug
  21. Fri 14 aug
  22. Sat 15 aug
  23. Sun 16 aug
  24. Mon 17 aug
  25. Tue 18 aug
  26. Wed 19 aug
  27. Thu 20 aug
  28. Fri 21 aug
  29. Sat 22 aug
  30. Today 23 aug
Topics: JavaScript Full archive →

The Wire · Showcase

Supabase Guards QueryEditor Against Destructive Queries

By RepoJournal · Filed · About Supabase

supabase-evals-releaser supabase-evals-releaser[bot] github-actions[bot] dependabot joshenlim
5 people shipped this
supabase-evals-releaser @supabase-evals-releaser 1 cited supabase-evals-releaser[bot] @supabase-evals-releaser[bot] 1 cited github-actions[bot] @github-actions[bot] 1 cited dependabot @dependabot 1 cited joshenlim @joshenlim 1 cited

Supabase's QueryEditor now enforces SQL editor safety checks, blocking destructive operations without a WHERE clause.

Supabase's QueryEditor now enforces the same safety validations as the SQL editor, blocking destructive queries like UPDATEs without a WHERE clause in both notebook cells and the query tab [1]. This closes a dangerous gap where users could accidentally wipe tables from the explorer interface. Meanwhile, the storage service bumped to v1.70.7, shipping smoke-tested artifacts across linux/amd64, linux/arm64, and darwin/arm64 with an immutable image reference [2]. On the CLI front, dependabot nudged two npm dependencies, including a patch to jose that "reject[s] a JWE whose generated Key Management Parameters collide" [3], a quiet but worthwhile security hardening. The only other activity was routine eval-result refreshes [4] and a matching PR [5], both low-impact housekeeping. Overall, this is a quiet day with one meaningful product safety win and a minor dependency bump.

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] QueryEditor to have the same validations as per SQL editor ↗ supabase/supabase
  2. [2] storage v1.70.7 ↗ supabase/slim-services
  3. [3] fix(deps): bump the npm-major group with 2 updates ↗ supabase/cli
  4. [4] chore: refresh eval results ↗ supabase/evals
  5. [5] chore: refresh eval results (#226) supabase/evals

Quick answers

What shipped in Supabase on August 23, 2026?
Supabase's QueryEditor now enforces SQL editor safety checks, blocking destructive operations without a WHERE clause. In total, 2 commits, 3 pull requests, and 1 releases landed.
Who contributed to Supabase on August 23, 2026?
5 developers shipped this update, including supabase-evals-releaser, supabase-evals-releaser[bot], github-actions[bot], dependabot, and joshenlim.
What were the notable Supabase updates?
QueryEditor to have the same validations as per SQL editor, storage v1.70.7, and fix(deps): bump the npm-major group with 2 updates.

More from @supabase

Supabase @supabase

JUDGE UPGRADE: evals now reasons at medium effort

Supabase's eval judge is getting smarter, but the RLS guide fix is the one that will keep your docs green.

Miranda Limonczenko supabase-evals-releaser claude[bot] charislam +8
javascript 92 shipped
Supabase @supabase

MCP SERVERS MOVE TO SDK V2

Supabase's MCP packages cut over to the v2 wire protocol today, and if you consume them, the next upgrade is not optional.

Joshen Lim charislam jordienr awaseem +11
javascript 126 shipped
Supabase @supabase

ROW LEVEL SECURITY DOCS GET A REWRITE

Supabase restructured its RLS documentation overnight, splitting the guide into clear sections so developers can find what they need without wading through reference material.

Miranda Limonczenko kanad claude[bot] Saxon Fletcher
javascript 56 shipped
Supabase @supabase

SUPABASE CLI v2.115.0 BREAKS YOUR CI

If you run schema diffing or supabase test db in CI, this release is about to change what those commands do.

github-actions[bot] Vaibhav Andrew Valleteau Cemal Kılıç +4
javascript 79 shipped

Daily updates, in your inbox

Follow Supabase

Keep up with Supabase in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

Cline hubs now drain without dropping work

Cline's new hub drain and upgrade flow means you can restart a hub mid-session and lose nothing, thanks to durable event replay.

ump45nose neubig Krishna github-actions[bot] +1
ai-agents 18 shipped
Local LLMs Local LLMs

SGLang Fixes Pixtral 500s as vLLM Cuts TTFT 25%

The biggest news overnight: SGLang is patching a production-breaking Pixtral bug, and vLLM engineers found a way to shave up to 25% off time-to-first-token on Mamba models.

CISC ngxson Kartik Sirohi superm1 +7
llms 134 shipped
CachyOS @CachyOS

AIRE: ANANICY RULES FIX SESSION LAUNCHER SCHEDULING

ly-dm was being pinned to the idle scheduler, killing your login session's responsiveness.

github-actions Matias alexsmolya Peter Jung +2
infra 74 shipped
Elixir & Phoenix Elixir & Phoenix

JOSE VALIM FIXES THE CLASUE BUG

Jose Valim shipped two refactors plus the actual fix for that `none` clause compiler issue, and a UTC fast path in DateTime could save you a TZ DB lookup.

josevalim reisub
elixir 6 shipped
Want every project, not just this one?