174 wires and counting

$ follow Supabase

Keep up with Supabase in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-10-27
stories 9

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

Nightly benchmarks across three destinations, and undefined upload options stop leaking into Storage headers

By RepoJournal · Filed · About Supabase · Composed from the cited sources · methodology

supabase/etl moves its benchmark suite from manual runs to a nightly null-ClickHouse-Snowflake matrix with per-run isolation, while supabase-js fixes Storage uploads that serialize undefined into cache-control and content-type.

feat(bench): Run benchmarks nightly supabase/etl

by jmqd

The Benchmark workflow now runs at 05:53 UTC as a matrix over null, clickhouse, and snowflake, one job per destination so a single failure does not take the others with it. Each job uploads a manifest.json (commit, trigger, runner) beside its reports, and benchmark-compare skips the manifest and accepts scheduled runs as baselines so nightly results can be compared against each other rather tha...

fix(bench): Use a fresh Snowflake schema per run supabase/etl

by jmqd

After the bench role was granted CREATE SCHEMA on ETL_BENCH, each Snowflake run gets its own <schema>_<pipeline_id> schema and drops it afterward, mirroring how ClickHouse gets its own database. That removes the shared-table reset and the drop_destination_table test helper, which existed only because runs previously shared one schema; a manual run on the branch passed.

fix(storage): ignore undefined upload options supabase/supabase-js

by pintu544

Spreading explicitly undefined FileOptions over the defaults was replacing those defaults, so raw uploads could send headers like cache-control: max-age=undefined and content-type: undefined, and multipart uploads could send cacheControl as the string "undefined". Undefined-valued options are now ignored before defaults apply in regular and signed uploads, with cacheControl, contentType, and up...

Bump dompurify to 3.4.17 in site lockfile (#1162) supabase/etl

by Jordan McQueen

The site lockfile moves dompurify to 3.4.17, covering GHSA-cg2g-xh64-v4q7, GHSA-mrv2-3pqr-j5jr, and GHSA-c6gr-qvv4-5v3f. Mermaid's ^3.4.12 range already allowed 3.4.17, so only the lockfile changes.

Quick answers

What shipped in Supabase on October 27, 2026?
supabase/etl moves its benchmark suite from manual runs to a nightly null-ClickHouse-Snowflake matrix with per-run isolation, while supabase-js fixes Storage uploads that serialize undefined into cache-control and content-type. In total, 4 commits, 4 pull requests, and 1 releases landed.
Who contributed to Supabase on October 27, 2026?
2 developers shipped this update, including jmqd and pintu544.
What were the notable Supabase updates?
feat(bench): Run benchmarks nightly, fix(bench): Use a fresh Snowflake schema per run, and fix(storage): ignore undefined upload options.