151 wires and counting

$ follow Supabase

Keep up with Supabase in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-10-09
stories 98

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

Realtime replay ordering reversed, Studio drops extension schema picker

By RepoJournal · Filed · About Supabase · Composed from the cited sources · methodology

Realtime fixes a message replay bug that reversed send order inside a single transaction, while Studio removes the schema selector from the extension enable dialog to stop installs into `public` that break RLS.

fix: replay messages sent in one transaction in send order supabase/realtime

by hsusul

Because `realtime.send` and `realtime.send_binary` omit `inserted_at`, the column default `now()` stamps every message in a transaction with the same timestamp; `Realtime.Messages.replay/5` then orders by `inserted_at DESC`, applies the limit, and reverses, so tied rows come back flipped. Messages sent `1..5` in one transaction used to replay in the wrong order and now replay in send order.

Remove schema selector in DB extensions enable dialog (#51440) supabase/supabase

by Joshen Lim

Installing an extension into a schema other than `extensions` left it owned by `supabase_admin`, which blocked enabling RLS, made the extension immovable, and kept the security advisor flagging it. The dialog no longer offers the choice, so users can't pick `public` in the first place.

feat(stack): allow repeatable --stack-id in stack destroy (#6964) supabase/cli

by tirthraj01

`stack destroy` accepts `--stack-id` more than once and tears down every listed stack after a single confirmation. All ids resolve before the prompt, so a typo destroys nothing; one failure doesn't halt the rest, and the command still exits 1 with an error naming the failed ids and a retry command.

fix: improve authorize function for read checks supabase/realtime

by edgurgel

Read authorization checks now look up by the primary key instead of the bare `id`, reaching for `id` plus `inserted_at` which are already known. Avoiding the scan across all partition indices is the stated reason, so authorize calls should get cheaper.

fix(cli): classify new local stack failures in telemetry (#7044) supabase/cli

by Andrew Valleteau

Failures from the new local stack (`supabase stack *` and stack-backed `db reset`, `db dump`, `db diff`, `test db`, `functions serve`) previously landed in telemetry as category `unknown`, with start and destroy failures sharing a fingerprint. They now carry a cause, and a port conflict counts as user-actionable only when the user pinned the port.

chore: e2e tests on all the PGs supabase/realtime

by edgurgel

Elsewhere in realtime: e2e tests now run against all supported Postgres versions, minus pg14 for now, with the PG client swapped because Bun didn't handle `sslnegotiation=direct`. Slim-services published realtime v2.143.3-r0, analytics v1.53.0-r0, and storage v1.80.1-r0 as multi-platform images, and the CLI's OpenAPI sync and a tinypool bump to 2.2.0 were the rest of the day.

Quick answers

What shipped in Supabase on October 9, 2026?
Realtime fixes a message replay bug that reversed send order inside a single transaction, while Studio removes the schema selector from the extension enable dialog to stop installs into `public` that break RLS. In total, 43 commits, 41 pull requests, and 14 releases landed.
Who contributed to Supabase on October 9, 2026?
11 developers shipped this update, including supabase-cli-releaser, tirthraj01, Andrew Valleteau, Joshen Lim, Danny White, Saxon Fletcher, github-actions[bot], and hsusul, and 3 more.
What were the notable Supabase updates?
fix: replay messages sent in one transaction in send order, Remove schema selector in DB extensions enable dialog (#51440), and feat(stack): allow repeatable --stack-id in stack destroy (#6964).