$ the-wire · showcase
PostgREST filter serialization tightens, Studio webhooks go live
By RepoJournal · Filed · About Supabase · Composed from the cited sources · methodology
Three PostgREST fixes close gaps in how the Python client encodes filters and OAuth params, while Studio's Platform Webhooks UI moves off its mocks onto the real Management API.
feat(postgrest): return a select builder from insert, upsert, update and delete supabase/supabase-py
insert(), upsert(), update() and delete() previously returned builders lacking single(), maybe_single(), csv(), explain(), order(), limit() and range(), so chains that read naturally in JavaScript had no Python equivalent. They now return a select builder, and a value of nil (or a document that serialized to nil) can no longer push key evaluation into the for(;;) loop, which is what caused nil ...
feat(studio): wire Platform Webhooks UI to real backend API (#51352) supabase/supabase
The mocked Platform Webhooks UI now calls the real /v2/organizations/{slug}/webhooks/... and /v2/projects/{ref}/webhooks/... endpoints through new query and mutation hooks, with PlatformWebhooks.types.ts rewritten to match the actual contract. The create form gained a required signing secret field, so any hand-rolled form or test fixture missing it will fail against the new API shape.
feat(docs): Document TLS ciphers and upcoming CBC removal (#51390) supabase/supabase
New docs describe the TLS offering and the forthcoming removal of CBC-mode ciphers from the HTTP APIs for platform-hosted projects. If you terminate TLS against those endpoints with a client that negotiates CBC suites, the inventory of what stays available is now published.
fix(postgrest): serialize neq/gt/gte/lt/lte filter values like eq supabase/supabase-py
neq(), gt(), gte(), lt() and lte() passed raw values to filter(), so booleans, None and dicts/lists went out as Python str() (neq.False, lte.None, gt.{'n': 1}) and PostgREST rejected them; they now share the _serialize_filter_value() helper that .eq() has used since before, emitting false, null and compact JSON. Strings and numbers are unchanged, across both sync and async clients.
fix(auth): avoid mutating OAuth query params supabase/supabase-py
sign_in_with_oauth() used the caller's nested query_params dictionary as its working dictionary, so adding redirect_to or scopes to the authorization URL also mutated the caller's credentials and let stale OAuth parameters leak into a later reuse of that object. It now works on a shallow copy.
