RepoJournal
Supabase @supabase
174 wires and counting

$ follow Supabase

Keep up with Supabase in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-10-29
stories 108
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

Next 16.4.3 clears a critical advisory, and list_tables stops reordering columns

By RepoJournal · Filed · About Supabase · Composed from the cited sources · methodology

supabase-vercel-tedd[bot] github-actions[bot] mattrossman janakmandavgade Tr00d supabase-evals-releaser supabase-evals-releaser[bot]
10 people shipped this
supabase-vercel-tedd[bot] @supabase-vercel-tedd[bot] 2 cited github-actions[bot] @github-actions[bot] 1 cited mattrossman @mattrossman 1 cited janakmandavgade @janakmandavgade 1 cited Tr00d @Tr00d 1 cited supabase-evals-releaser @supabase-evals-releaser supabase-evals-releaser[bot] @supabase-evals-releaser[bot] Miranda Limonczenko @czenko supabase-supabase-autofixer @supabase-supabase-autofixer Isaac Dawson @idawson-sb

Supabase's main repo bumped next to 16.4.3 to clear a critical pnpm audit advisory, the MCP server fixed a real correctness bug in list_tables, and slim-services republished the postgres, realtime, storage and analytics runtime images.

chore: Bump nextjs to 16.4.3 (#52438) supabase/supabase

by supabase-vercel-tedd[bot]

The lockfile bump from next 16.3.6 to 16.4.3 was applied with pnpm tsx scripts/fix-audit-vulnerability.ts next and re-audited to confirm the critical advisory is gone, with no permanent override left behind. Package manifests are unchanged; the other lockfile deltas are transitive @next/* and sharp 0.35.5.

fix(pg-meta): order list_tables columns by ordinal position supabase/mcp

by janakmandavgade

array_agg in coalesceRowsToArray followed heap scan order, so an ALTER COLUMN, which moves a column's pg_attribute row to the end of the heap, could make list_tables return columns out of order. The fix adds an optional orderBy argument and sorts by columns.ordinal_position, with a test that alters columns and checks the order holds.

postgres 17.11.0.008-orioledb-r0 supabase/slim-services

by github-actions[bot]

slim-services published portable, smoke-tested runtime artifacts for postgres 17.11.0.008-orioledb-r0 across linux/amd64, linux/arm64 and darwin/arm64, available as an immutable image reference under ghcr.io/supabase/cli/postgres for reproducible pulls.

fix(core): report Unity version, platform and runtime in X-Client-Info supabase/supabase-csharp

by Tr00d

The X-Client-Info header used to report platform as Unix 5.15.189.13 and runtime as dotnet on Unity Android IL2CPP builds; it now reports Android, il2cpp or mono, and a framework-version read from UnityEngine.Application, e.g. 6000.3.21f1. Anyone segmenting analytics or support triage by client platform should expect the new values.

chore: Bump `launch-editor` to fix a vulnerability (#52442) supabase/supabase

by supabase-vercel-tedd[bot]

Also in the same audit sweep: launch-editor went from 2.14.1 to 2.14.2 in pnpm-lock.yaml to pick up the patch for a high-severity advisory, applied via the same fix-audit-vulnerability.ts script with no package.json edits.

fix: keep experiment names separate from suites supabase/evals

by mattrossman

Quieter elsewhere: the evals hotfix restores bare experiment names while leaving result paths suite-qualified, correction the metadata regression from the earlier suite-prefixed naming, and mcp, evals, and the docs navigation work (a new nav-check test, Option 1 IA behind the docs-ia-mvp-v1 flag) rounded out the day.

$ ls supabase/reviews/ # the step-back reads

the week in review Realtime 2.151 begins capping joins per socket the month in review Realtime patches cross-tenant private channel leak
Full archive → Weekly reviews →

Quick answers

What shipped in Supabase on October 29, 2026?
Supabase's main repo bumped next to 16.4.3 to clear a critical pnpm audit advisory, the MCP server fixed a real correctness bug in list_tables, and slim-services republished the postgres, realtime, storage and analytics runtime images. In total, 49 commits, 49 pull requests, and 10 releases landed.
Who contributed to Supabase on October 29, 2026?
10 developers shipped this update, including github-actions[bot], supabase-evals-releaser, mattrossman, supabase-evals-releaser[bot], supabase-vercel-tedd[bot], Miranda Limonczenko, supabase-supabase-autofixer, and Isaac Dawson, and 2 more.
What were the notable Supabase updates?
chore: Bump nextjs to 16.4.3 (#52438), fix(pg-meta): order list_tables columns by ordinal position, and postgres 17.11.0.008-orioledb-r0.
♥

$ log @supabase --recent

Studio tightens the MFA removal path; realtime preps a presence swap 34 shipped Eval results refreshed from the latest automated run 2 shipped Studio stops mangling column comments, eval version encoding fixed 76 shipped MCP stops prompting on read-only EXPLAIN, bounds notebook cost 157 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.