Recovery-code MFA sign-in ships as Classic Dark retires

By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology

♥

Realtime also stops refreshing tokens on every request, and ETL removes etl-api while SCRAM channel binding returns over TLS.

218 commits 212 PRs merged 54 releases 7 briefings covered

all supabase reviews →

← previous week supabase wire → next week →

fix: throttle access token refreshing supabase/realtime

by edgurgel

Realtime no longer refreshes access tokens on every connection attempt, cutting the refresh churn that showed up as repeated auth traffic from long-lived clients. If your Realtime client depended on that eager refresh, expect tokens to be refreshed less often and check your expiry handling.

ref(core): Improve shutdown handling supabase/etl

by iambriccardo

Shutdown ownership in the ETL pipeline is now explicit: a shutdown request stops new replication intake, and each owner completes or cancels its work and joins the tasks it holds. Long-running replication deployments get predictable stops instead of work left in flight.

Recovery codes: allow users to use recovery codes to access their account (#50569) supabase/supabase

by Gildas Garcia

After being redirected to the MFA verification page, users can now sign in with a recovery code instead of the authenticator app. Any code path that assumes MFA verification always completes on the second factor needs updating.

chore(ui): remove the Classic Dark theme supabase/supabase

by dnywh

System, Dark, and Light are now the only theme modes Studio supports; the Classic Dark compatibility paths across the shared theme library are gone. Apps still setting Classic Dark silently fall back, so audit your theme config before upgrading.

fix(postgres): restore SCRAM channel binding over TLS supabase/etl

by farazdagi

The TLS adapter was parsing complete certificates as TbsCertificate, which silently disabled SCRAM channel binding. Parsing Certificate and hashing the original DER with its signature algorithm restores the binding, and the unsupported Ed25519 digest assumption is removed while the existing fallback policy stays.

feat(cli): opt supabase init into the experimental stack via env supabase/cli

by avallete

`SUPABASE_EXPERIMENTAL_STACK=1 supabase init` writes `[experimental] stack = true` and omits Docker-era default ports, so local config is not pinned to legacy listeners. Unset or `0` keeps the existing template, and invalid values fail closed.

fix(cli): fail `storage rm` without confirmation (CLI-2464) supabase/cli

by 7ttp

In `json` and `stream-json` output, `storage rm` reported success while deleting nothing when `--yes` was absent, because the confirmation helper could not prompt and returned its default. This hit coding agents, which get those formats by default, so automated storage cleanup could be doing nothing.

fix(realtime): parse postgres array literals instead of splitting on commas supabase/supabase-csharp

by fresh55

The C# client had been splitting Postgres array literals on commas, so a quoted comma produced extra elements, `NULL` came back as text, and nested arrays were dropped. Documents with array columns read in C# will see corrected values after upgrading.

$ ls supabase/week/ # the briefings behind this review

Mon Sep 21 Realtime throttles token refreshes, ETL makes shutdown explicit Tue Sep 22 Supabase ships recovery-code MFA sign-in, new stack init flag Wed Sep 23 Evals move to GPT-6 and Opus 5.5, CLI functions go full effect lint Thu Sep 24 SCRAM channel binding restored over TLS, C# array parsing fixed Fri Sep 25 Typegen language registry lands; postgres images roll Sat Sep 26 Foreign server deletes stop cascading, Studio logs get range selection Sun Sep 27 Supabase evals refreshed from the latest automated run

all supabase reviews →

← previous week supabase wire → next week →