$ cat supabase/week/2026-09-28.log
the week in review · Sep 28 – Oct 4, 2026
Realtime patches HIGH CVE-2026-91043 in mint
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Realtime 2.140.0 splits tenant and cluster metrics endpoints, while Realtime also fixed dropped RLS-authorized inserts and two reconnect edge cases.
fix: bump mint (#2299) supabase/realtime
The dependency on mint 1.10.1 lands a HIGH-severity fix for HPACK-indexed cookie fields in HTTP/2 responses, which bypass max_header_list_size and exhaust client memory. The dashboard, if left unpatched, leaves HTTP/2 clients reading headers without a size ceiling.
fix: pg changes committed behind a synchronous standby supabase/realtime
PG Changes could drop an RLS authorized INSERT whose COMMIT was waiting on a synchronous standby, based on findings reported by @kabochya. If you run synchronous_standby_names with Postgres Changes, replication was not a reliable record of those rows.
clickhouse: stop dropped and resurrected inserts supabase/etl
ClickHouse treats a second insert with identical content as a retry and may skip it, and can queue an insert to write later, so initial copy and replication were both able to drop or reorder rows. The ETL pipeline now stops that behavior, which means existing replication may need a resync.
clickhouse: resync error on column type changes supabase/etl
A Postgres column type change previously only logged a warning while RowBinary rows kept going positionally into the old ClickHouse column: bigint to double precision stored reinterpreted bits and integer to bigint failed outright. Replication now errors and resyncs instead of silently corrupting data.
fix(stack): start auth with zero session limits (CLI-2506) (#6848) supabase/cli
The CLI stack forwarded zero session limits straight through to auth, which rejects a zero duration and exited on boot, so a local stack with timebox or inactivity_timeout set to 0s never came up. This fixes it for local development.
fix(ci): keep provider API keys out of eval sandboxes supabase/evals
Eval sandboxes now hold only placeholder provider keys in .env, with real keys injected into outbound requests by the Vercel Sandbox firewall. An agent that dumps its environment exposes the placeholder, not your credentials.
feat(postgrest): select several columns of an embed supabase/supabase-flutter
Selecting two columns from the same relation on the typed surface, as in select([Books.author(Authors.id), Books.author(Authors.name)]), sent author(id),author(name) and PostgREST failed the query with 42803. Flutter apps with multi-column embeds need the upgraded package.
feat(self-hosted): add function runtime errors supabase/supabase
Self-hosted Edge Functions now return structured errors for routing and runtime failures and attach error headers to 5xx responses, so gateway-level failures are finally distinguishable from application ones.
$ ls supabase/week/ # the briefings behind this review
Keep up with Supabase in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.