RepoJournal

$ cat supabase/month/2026-08-01.log

Supabase

Supabase

the month in review · August 2026

Supabase ships CLI v2, Postgres middleware, and safety rails across Studio

♥

August 2026 saw Supabase mature its tooling with a stable CLI release, new Postgres middleware pair, and a suite of safety features in Studio, while evals, Realtime, and the Python toolbelt made quieter but solid progress.

812 commits 796 PRs merged 162 releases 31 briefings covered
supabase wire →

The CLI reached a milestone with v2.111.0 [1], which bundled fixes that kept bulk function deploys going and always synced metadata [2], reloaded Kong after DB resets [3], and started secrets with SELinux support [4]. Later, v2.115.0 introduced a breaking change that will affect CI pipelines , so teams should review their automation before upgrading. The CLI also completed its Go-to-TypeScript migration [8], marking a significant shift in the codebase's maintenance trajectory.

Studio shipped a number of user-safety features: it now confirms before discarding dirty replication destination forms [5], warns on OAuth impersonation [6], shows API and AWS authorization errors inline [15], and protects against sheets stealing focus [8]. Database connections entered feature preview [9] and the redirect to the preview route after enabling was fixed [10]. Studio's CI now gates on dead code via Knip , reinforcing code quality.

Postgres shipped fresh builds across three versions [11], and added site-env packages for rolling instance updates [12]. As a counterpart to the earlier release, the Python toolbelt's pg-topo now slices statements by byte offsets so non-ASCII SQL is carried verbatim [13], ensuring proper handling of UTF-8.

Supabase's evals pipeline matured with a focus on AI safety and benchmarking: they added prompt-injection evaluations , moved to Vercel sandboxes [13], and upgraded the judge to reason at medium effort . The CI AI review pipeline now uses parallel passes and a judge . These steps reflect a broader effort to harden AI-assisted coding workflows.

For developers using Realtime, v2.122.0 shipped [14] and included a fix for a Prometheus counter bug . The SDK also dropped legacy API fallbacks for Gotrue in Flutter [15], which is a breaking change for Flutter consumers. On the security and compliance front, the security guide now includes GDPR, ISO 27001, and DDoS coverage [16].

References

  1. [1] v2.111.0 ↗ supabase/cli
  2. [2] fix(cli): keep bulk function deploys going and always sync metadata (INC-699) ↗ supabase/cli
  3. [3] fix(cli): reload kong after db reset ↗ supabase/cli
  4. [4] fix(cli): start secrets selinux ↗ supabase/cli
  5. [5] fix(studio): confirm before discarding dirty replication destination forms ↗ supabase/supabase
  6. [6] feat(studio): oauth impersonation warning on authorize ↗ supabase/supabase
  7. [7] show API and AWS authorization errors inline ↗ supabase/supabase
  8. [8] fix sheets stealing focus (#48521) supabase/supabase
  9. [9] Bring database connections to feature preview (#48638) supabase/supabase
  10. [10] fix(studio): redirect to feature preview route after enabling (#48637) supabase/supabase
  11. [11] feat(nix): add site-env packages for rolling instance updates (#2283) ↗ supabase/postgres
  12. [12] feat(nix): add site-env packages for rolling instance updates ↗ supabase/postgres
  13. [13] fix(pg-topo): slice statements by byte offsets so non-ASCII SQL is carried verbatim ↗ supabase/pg-toolbelt
  14. [14] v2.122.0 ↗ supabase/realtime
  15. [15] show API and AWS authorization errors inline ↗ supabase/supabase
  16. [16] docs(security): add GDPR, ISO 27001, and DDoS coverage to security guide (#48449) supabase/supabase

$ ls supabase/month/ # the briefings behind this review

Sat Aug 1 CLI FIXES FUNCTION DEPLOY FAILURES AND DB RESET 502S Sun Aug 2 SUPABASE POSTGRES HARDENS NIX BUILDS FOR ROLLING INSTANCE UPDATES Mon Aug 3 STUDIO SHIPPING SAFETY RAILS AS REALTIME HITS 2.122.0 Tue Aug 4 STUDIO REDIRECTS FIXED, DATABASE CONNECTIONS ENTER PREVIEW, PG-TOOLBELT HANDLES UTF-8 Wed Aug 5 CLI STABILIZES, STUDIO SHIPS MANUAL SAVES AND PRIVATELINK READ REPLICAS Thu Aug 6 POSTGRES CHANGES NOW FILTER AND SELECT COLUMNS, CLI HARDENS SERVICE LIFECYCLE Fri Aug 7 CLI COMPLETES GO-TO-TYPESCRIPT MIGRATION, EVALS ADD SUPABASE-JS COVERAGE Sat Aug 8 POSTGRES SHIPS FRESH BUILDS ACROSS THREE VERSIONS, SUPABASE STUDIO HARDENS SCOPED TOKEN CONTROLS Sun Aug 9 CLI FIXES TIMESTAMP BUG BLOCKING EVERY PROJECT LINK Mon Aug 10 SUPABASE EVALS PIPELINE REFRESHED WITH LATEST BENCHMARK RESULTS Tue Aug 11 NOTEBOOKS DATA LAYER SHIPS; CLI COMPLETES GO MIGRATION Wed Aug 12 FLUTTER SDK BREAKS: DATETIME EVERYWHERE, GOTRUE DROPS LEGACY API FALLBACKS Thu Aug 13 SUPABASE SHIPS MCP DEBUGGING TOOLS AND PORTS CLI TO TYPESCRIPT Fri Aug 14 EXPLORER GETS NOTEBOOK CELLS AND ROUTED CHAT TABS Sat Aug 15 CLI UNLOCKS ORIOLEDB PROJECTS, EVALS MOVES TO VERCEL SANDBOXES Sun Aug 16 SUPABASE CLI FIXES MEMORY BLOWUP ON LARGE DB DUMPS Mon Aug 17 SUPABASE STUDIO TIGHTENS PRIVATELINK UX ACROSS FOUR COMMITS Tue Aug 18 SUPABASE HARDENS CORS AND SHIPS PROMPT-INJECTION EVALS Wed Aug 19 SUPABASE CLI v2.115.0 BREAKS YOUR CI Thu Aug 20 ROW LEVEL SECURITY DOCS GET A REWRITE Fri Aug 21 MCP SERVERS MOVE TO SDK V2 Sat Aug 22 JUDGE UPGRADE: evals now reasons at medium effort Sun Aug 23 Supabase Guards QueryEditor Against Destructive Queries Mon Aug 24 SUPABASE TURNS NOTEBOOK RUNS INTO A MUTATION SAFETY NET Tue Aug 25 SUPABASE SHIPS POSTGRES MIDDLEWARE PAIR AND FAST SHADOW BASELINE Wed Aug 26 REALTIME FIXES PROMETHEUS COUNTER BUG Thu Aug 27 FIVE REALTIME RELEASES, ZERO PUBLIC BREAKING CHANGES Fri Aug 28 SLIM POSTGRES NOW BUILDS FROM REAL CONFIG, CLI REMOVES NX, SUPAVISOR SPLITS METRICS Sat Aug 29 CI AI review pipeline matures with parallel passes and judge Sun Aug 30 Slim images get busybox probes; bench releases land Mon Aug 31 Knip gates Studio CI against dead code
supabase wire →