$ the-wire · showcase
etl evicts a compromised root CA and drops OpenSSL
By RepoJournal · Filed · About Supabase · Composed from the cited sources · methodology
![realtime-release-bot[bot]](https://avatars.githubusercontent.com/u/54469796?v=4)
12 people shipped this
Jordan McQueen
@jmqd
3 cited
SaxonF
@SaxonF
1 cited
realtime-release-bot[bot]
@realtime-release-bot[bot]
1 cited
Danny White
@dnywh
Ping-Min Lin
@kabochya
jeremenichelli
@jeremenichelli
kodster28
@kodster28
barryroodt
@barryroodt
github-actions[bot]
@github-actions[bot]
seangeo
@seangeo
Eduardo Gurgel
@edgurgel
hsusul
@hsusul
supabase/etl moved its TLS trust path off OpenSSL and onto webpki roots, removing emSign root CA - G3 and the eight compromised eMudhra intermediates, while RealTime shipped the same class of fix in v2.147.0.
Bump webpki roots to drop emSign root (#1144) supabase/etl
webpki-roots and webpki-root-certs go 1.0.7 to 1.0.10 and rustls-webpki 0.103.15 to 0.103.16 for RUSTSEC-2026-0381/0382/0383 (CVE-2026-111943). The commit removes emSign ECC Root CA - G3 and rejects the eight compromised eMudhra intermediate keys on rustls paths.
Drop OpenSSL and move images to Debian 13 (#1145) supabase/etl
Sentry's default native-tls feature had switched reqwest's default backend to OpenSSL, which trusts the intermediate, so the roots bump alone wasn't enough for those paths. The images also move to Debian 13. This is a breaking change to the build: anything pinned to the old base or relying on the OpenSSL backend needs to move.
fix(ducklake): cast float literals to their type (#1138) supabase/etl
DuckLake wrote floats as bare decimal text, which DuckDB typed as DECIMAL before casting, so 1e-30 came back as 9.999999999999999e-31, -0.0 became 0.0, and a full identity delete could miss its row. Writes now send CAST('1e-30' AS DOUBLE) or AS FLOAT, which also fixes float-array inserts that previously failed.
v2.147.0 supabase/realtime
RealTime v2.147.0 bumps castore so the service is not affected by the compromised root, and adds a join-to-sync latency metric. The other dependency-level fix that matters if you run Realtime yourself.
feat: add run_notebook with destructive SQL confirmation supabase/mcp
The MCP server gained create_notebook and run_notebook, so an agent can save and execute a whole saved notebook in one call instead of one execute_sql per cell, with database and log cells run in order and a confirmation path for destructive SQL. Observation facts for those runs landed separately under a new notebook feature, with notebooks that have nothing to confirm getting a not_mutating by...
Action items
