RepoJournal

$ cat supabase/month/2026-10-01.log

Supabase

Supabase

the month in review · October 2026

Realtime patches cross-tenant private channel leak

By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology

♥

The October fix closes a delimiter injection path in Realtime 2.144.x; CLI 2.120.0 and MCP 0.14.0 carried the month's features.

1004 commits 996 PRs merged 215 releases 1 security advisories 31 briefings covered

all supabase reviews →

← previous month supabase wire →

Unsanitized delimiter injection enables cross-tenant access to private channels supabase/realtime

Unsanitized delimiter injection let a client reach private channels belonging to another tenant. If you run Realtime for more than one tenant, upgrade before the next deploy; the patch shipped inside the 2.144.x line and the release notes call it a fix, not a mitigation.

v2.120.0 supabase/cli

by github-actions[bot]

Service logs now persist to disk and ship to Analytics, and stack commands gained reusable status helpers. CLI runs can export OpenTelemetry traces to any OTLP endpoint, so a slow migration or start sequence shows up as spans instead of guesswork.

mcp-server-supabase: v0.14.0 supabase/mcp

by supabase-releaser[bot]

The MCP server can call health advisors, which puts the same database checks Studio surfaces in front of an agent before it writes. It pairs with mcp-utils 0.9.0, which adds bounded request lifecycle observations for tracing tool calls.

feat(self-hosted): add function runtime errors supabase/supabase

by luizfelmach

Self-hosted Edge Function routing and runtime failures now return structured errors, with error headers on 5xx responses (function runtime errors). Paired with API key handling on the /functions/v1/ route in both Kong and Envoy, self-hosted setups get typed failures instead of opaque bodies.

postgres 17.11.0.011-orioledb-r0 supabase/slim-services

by github-actions[bot]

Studio, storage, and Realtime republished as smoke-tested artifacts for linux/amd64, linux/arm64, and darwin/arm64, with postgres moving to 17.11.0.011-orioledb. If you pin slim-services images in a self-hosted compose file, the postgres patch bump is the one to schedule.

v2.147.0 supabase/realtime

by realtime-release-bot[bot]

The castore dependency bump exists because the previous one pulled in a compromised root CA, the same event that had etl evicting a root CA and dropping OpenSSL on 2026-10-22. Anything you build from source in that window should be rebuilt against the patched tree.

mcp-server-supabase: v0.15.0 supabase/mcp

by supabase-releaser[bot]

Adds submit_feedback and delete_feedback tools, but the notebook release shipped behind a release hold. Treat the new tools as available and the notebooks as still gated when you wire up an agent.

$ ls supabase/month/ # the briefings behind this review

Thu Oct 1 Self-hosted function errors get structured, gateways get key handling Fri Oct 2 Studio ships XSS fix for vulnerable TanStack package, CLI adds stack telemetry Sat Oct 3 Supabase CLI traces every run with opt-in OTLP export Sun Oct 4 Studio surfaces the compute waitlist, ETL buffers writes across keepalives Mon Oct 5 Loopback bind addresses for native CLI stacks, auto region selection experiment retired Tue Oct 6 supautils builds against PG19beta1, www stops cross-zone link prefetch Wed Oct 7 CLI 2.120.0 ships persisted logs and OTel traces Thu Oct 8 ClickHouse array replication unblocks, Snowflake CDC memory bounded Fri Oct 9 Realtime replay ordering reversed, Studio drops extension schema picker Sat Oct 10 PostgREST filter serialization tightens, Studio webhooks go live Sun Oct 11 Dependabot auto-merge restored in terraform-provider-supabase Mon Oct 12 C# SDK goes official, virtiofsd gains ACL create fallback Tue Oct 13 pg_net moves worker state out of shared memory, pgmq untangles drop_queue Wed Oct 14 Scoped OAuth reconsent in Studio, MCP drops double cost prompts Thu Oct 15 MCP server 0.14.0 adds health advisors, Supabase CLI routes every Management API call through the typed client Fri Oct 16 Realtime 2.144.0 patches a decimal CVE; realtime-csharp adds paged storage listing Sat Oct 17 Self-hosted stack bumps realtime and storage, Studio remembers your chart range Sun Oct 18 supautils fills the missing half of extension create hooks Mon Oct 19 Pipeline wizard validation closes gaps, Realtime stops unnecessary partition locks Tue Oct 20 Swift Realtime goes actor-per-client, temporary replication slots land Wed Oct 21 Realtime patches cross-tenant channel leak, CLI spells out the v3 local-default switch Thu Oct 22 etl evicts a compromised root CA and drops OpenSSL Fri Oct 23 Storage sidecars follow renamed files, command menu stops preloading Sat Oct 24 Redacted credentials in etl output, bounded shutdown drain Sun Oct 25 Eval results refreshed, Management API types regenerated Mon Oct 26 AWS Marketplace becomes a purchase path; supabase-csharp 8.5.1 revives heartbeat reconnect Tue Oct 27 Nightly benchmarks across three destinations, and undefined upload options stop leaking into Storage headers Wed Oct 28 Edge functions get unified Logs, Studio reloads once on chunk failures Thu Oct 29 Next 16.4.3 clears a critical advisory, and list_tables stops reordering columns Fri Oct 30 slim-services republishes postgres and realtime artifacts; MCP 0.15.0 gates notebooks behind a release hold Sat Oct 31 Edge function paths stop breaking MCP listing, evals move off Git

Keep up with Supabase in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

all supabase reviews →

← previous month supabase wire →