$ the-wire · showcase
Realtime 2.144.0 patches a decimal CVE; realtime-csharp adds paged storage listing
By RepoJournal · Filed · About Supabase · Composed from the cited sources · methodology
14 people shipped this
fresh55
@fresh55
2 cited
Coly010
@Coly010
1 cited
Tobias Pfeiffer
@PragTob
1 cited
monicakh
@monicakh
1 cited
ivasilov
@ivasilov
1 cited
Tr00d
@Tr00d
supabase-evals-releaser
@supabase-evals-releaser
supabase-evals-releaser[bot]
@supabase-evals-releaser[bot]
Eduardo Gurgel
@edgurgel
jvoegele
@jvoegele
realtime-release-bot[bot]
@realtime-release-bot[bot]
alexisintech
@alexisintech
charislam
@charislam
raulb
@raulb
A security-motivated dependency upgrade lands in realtime 2.144.0 while the C# client gains the paged object listing the JS and Python libraries already have.
feat(deps): Upgrade decimal (#2394) supabase/realtime
supabase/realtime upgraded the decimal library to pick up EEF-CVE-2026-97853. Tobias Pfeiffer wrote that it "shouldn't affect us, as I don't believe we allow control over the places part of round anywhere," but bumped anyway in the name of being safe; it ships in v2.144.0 as the release's only feature.
feat(storage): add ListV2Async for paged listing supabase/supabase-csharp
ListV2Async wraps POST /object/list-v2/{bucket}: without a delimiter it returns every object under a prefix with its full name, with WithDelimiter = true it lists sub-folders separately, and pages continue through NextCursor. Options and results match storage-js listV2 and supabase-py list_v2, minus the versioning filters.
feat(postgrest): report a 414 as UriTooLong (#513) supabase/supabase-csharp
The postgrest client now surfaces HTTP 414 as UriTooLong instead of lumping it into a generic error. Code that branches on PostgrestException types can handle over-long query URLs explicitly.
feat(sandbox): add per-experiment env to localStackRuntime (AI-1296) supabase/evals
localStackRuntime({ env }) sets environment variables for every process in an experiment's local-stack sandbox, so CLI evals can exercise feature-flagged behaviour without inlining SUPABASE_EXPERIMENTAL_STACK=1 into their own commands and checks. Landed via #396 and #398.
fix: consolidate SMTP minimum interval into Rate Limits page supabase/supabase
SMTP_MAX_FREQUENCY moves from the Custom SMTP page to the Rate Limits page in Studio, always visible there and disabled with a tooltip linking back to SMTP settings when Custom SMTP isn't configured. The minimum interval per user could trigger over_email_send_rate_limit even when every setting on the Rate Limits page allowed more traffic.
fix(studio): load all org projects in UpdateRolesPanel supabase/supabase
UpdateRolesPanel was loading only the first page (96) of org projects; team settings no longer need the full list, so toggling "Apply to all projects" off starts from a clean selection instead of one built from partially loaded data. Elsewhere this cycle: realtime dropped the muster and per-tenant track fanout metric flags while keeping the global fanout metric, BroadcastHandler got a with/else...
Action items
- → Upgrade realtime to 2.144.0 to pick up the decimal CVE fix supabase/realtime [plan]
