Realtime patches cross-tenant channel leak, CLI spells out the v3 local-default switch

Unsanitized delimiter injection enables cross-tenant access to private channels supabase/realtime

Unsanitized delimiter injection allows cross-tenant access to private channels, so private channel isolation on a shared Realtime instance could be bypassed. No fixed version is named in the input; confirm your deployed Realtime build against the advisory.

feat(cli): warn before the v3 switch to a local default target (#7186) supabase/cli

by Colum Ferry

The CLI now prints that `supabase db push` will target the local database by default in the next major version, and that `--linked` is the escape hatch. Nothing changes yet: v3 (CLI-2695) lands on `next`, and develop only warns.

feat(cli): honor `PGSSL*` env on `db push --linked` (CLI-2753) supabase/cli

by 7ttp

`db push --linked` and other CLI-connecting commands used to drop `PGSSLMODE` and `PGSSLROOTCERT` when the direct host answered; they now read `PGSSLMODE`, `PGSSLROOTCERT`, `PGSSLCERT` and `PGSSLKEY` from the shell, matching what the pooler fallback already did. The `pg_dump` steps in `db dump`, `db pull` and `migration squash` still do not forward them.

fix(mcp): don't split an UPDATE on a semicolon inside a quoted value supabase/mcp

by kevin9327

`isUpdateWithoutWhere` split statements on every `;` before looking for `WHERE`, so a semicolon inside a string value cut a normal update in two and `execute_sql` demanded destructive-SQL confirmation. The check now respects quoted values; this covers the `UPDATE ... WHERE` half of #457.

feat(cli): lock and override service versions in stack mode (#7195) supabase/cli

by Julien Goux

Stack mode service versions were compiled into the CLI; they now lock to and override from `supabase/supabase.lock`, can run any version slim-services has published, and can match the hosted project after `supabase link`.

fix: replace tracker with a Socket level check supabase/realtime

by edgurgel

Realtime replaced the `Tracker` join/leave hack with a Socket-level check, aimed at issue #2332. The maintainer notes the clean fix needs a Phoenix callback for the channels map.