$ the-wire · showcase
Studio ships XSS fix for vulnerable TanStack package, CLI adds stack telemetry
By RepoJournal · Filed · About Supabase · Composed from the cited sources · methodology
12 people shipped this
Kody Jackson
@kodster28
1 cited
w3b6x9
@w3b6x9
1 cited
Julien Goux
@jgoux
1 cited
Coly010
@Coly010
1 cited
avallete
@avallete
1 cited
Steven Eubank
@smeubank
dnywh
@dnywh
supabase-evals-releaser
@supabase-evals-releaser
Matt Rossman
@mattrossman
kanadgupta
@kanadgupta
7ttp
@7ttp
github-actions[bot]
@github-actions[bot]
Supabase Studio now pins a patched @tanstack/react-start after a lockfile refresh surfaced a blocked build, while the CLI starts tagging every command with the backend and runtime it ran on ahead of the new stack becoming the default.
fix(studio / ui) - update xss vuln version of tanstack (#51141) supabase/supabase
Studio's pnpm lockfile refresh pulled in a vulnerable @tanstack/react-start and started failing builds against GHSA-qx66-fv34-fjm8, so Studio UI now moves to the patched version. If you build Studio from source, your lockfile carries the same advisory pin until you update.
feat(cli): tag command telemetry with stack backend and OrioleDB supabase/cli
cli_command_executed now records stack_backend (legacy or stack), stack_runtime (docker, podman, or native), and whether the project selects an OrioleDB image, which the CLI team says lets error rates be compared per command "between the legacy and new stack backends" before the new stack becomes the default.
docs(cli): document experimental supabase stack commands and native runtime supabase/supabase
Two new Local Development guides cover the experimental supabase stack commands, including one local project per app, git worktree, branch, or named environment on a single machine via automatic port assignment instead of fixed ports in config.toml. The pages are wired into the docs nav, CLI reference, and the port-conflict troubleshooting path.
docs(cli): document OrioleDB initialization and db.orioledb_version (#50908) supabase/supabase
supabase init --use-orioledb is now documented in the CLI reference, with db.orioledb_version added to the CLI config reference and experimental.orioledb_version marked deprecated. The companion CLI support landed in v2.119.0, so existing configs using the experimental key have a replacement to migrate to.
fix(sandbox): resolve shims in login shells supabase/evals
The eval sandbox placed its supabase and no-daemon docker shims at /usr/local/sbin and relied on SANDBOX_PATH resolving first, which held under bash -c but not in login shells; Codex's /bin/bash -lc exec_command sourced /etc/profile and reset PATH. The long tail: realtime v2.140.7-r0, storage v1.79.30-r0, and edge-runtime v1.77.4-r0 landed as smoke-tested slim-service artifacts on linux/amd64, ...
