$ the-wire · showcase
Eval sandboxes lose real provider keys, Flutter fixes multi-column embeds
By RepoJournal · Filed · About Supabase · Composed from the cited sources · methodology
![supabase-releaser[bot]](https://avatars.githubusercontent.com/u/54469796?v=4)
13 people shipped this
spydon
@spydon
2 cited
mattrossman
@mattrossman
1 cited
edgurgel
@edgurgel
1 cited
leandrocp
@leandrocp
1 cited
supabase-releaser[bot]
@supabase-releaser[bot]
1 cited
supabase-evals-releaser
@supabase-evals-releaser
supabase-evals-releaser[bot]
@supabase-evals-releaser[bot]
mandarini
@mandarini
dnywh
@dnywh
seangeo
@seangeo
antlio
@antlio
Charis
@charislam
realtime-release-bot[bot]
@realtime-release-bot[bot]
A day of plumbing: Supabase's eval harness stops leaking provider credentials into public artifacts, and the Flutter PostgREST typed surface stops generating SQL that Postgres rejects.
fix(ci): keep provider API keys out of eval sandboxes supabase/evals
Eval sandboxes now receive placeholder provider keys in `.env`, and the Vercel Sandbox firewall injects the real keys into outbound requests instead. An agent that dumps its environment can therefore only leak the placeholder into the public `raw-results` artifact.
feat(postgrest): select several columns of an embed supabase/supabase-flutter
`select([Books.author(Authors.id), Books.author(Authors.name)])` used to emit `author(id),author(name)`, which made PostgREST join the relation twice and Postgres reject the request with error 42803; only one column per relation ever worked. The typed surface now merges entries of the same relation into a single embed and can select an embed as a whole.
fix(migrations): ensure base grants on realtime.messages supabase/realtime
A migration ensures the base grants on `realtime.messages` are present in existing tenants. New projects were never affected; the fix is for tenants that predate the grants.
feat: measure presence replication data supabase/realtime
Realtime v2.139.0 adds the `realtime_presence_replication_received_bytes` metric to measure data exchanged for presence replication, giving operators a direct number for what presence traffic costs.
feat(capability-matrix): let an implemented entry declare it has no public symbols supabase/sdk
The capability matrix gains an option for implemented entries to declare they have no public symbols, aimed at cases like `client.observability.diagnostic_logging` in supabase-flutter, which runs through `package:logging`. Previously the drift check warned on every pull request and the only workarounds were padding `symbols` or downgrading status, both ruled out by the docs.
typegen: v0.2.1 supabase/sdk
The long tail: typegen v0.2.1 and postgrest-typegen v0.3.1 both ship the fix where generators emit the final newline themselves while the registry passes it through, studio's pipeline creation copy and action menus get a consistency pass, and the server reference gains a Usage examples partial between Installing and the generated API reference.
