$ cat supabase/week/2026-10-12.log
the week in review · Oct 12 – Oct 18, 2026
MCP server 0.14.0 adds health advisors
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
The .NET SDK lost its community badge and moved to official support, while realtime patched a decimal-parsing CVE.
mcp-server-supabase: v0.14.0 supabase/mcp
Version 0.14.0 ships health advisor support, so an MCP client can surface the same project health signals Studio shows rather than only raw schema and data tools. mcp-utils 0.9.0 landed alongside it with bounded request lifecycle observations.
docs: move C# SDK from community to official support (#51487) supabase/supabase
The C# SDK is now documented as officially supported, with the COMMUNITY badge removed from its reference and the links repointed away from `supabase community`. Teams that had been treating it as an unsupported side project can now plan against it as a first-class client.
fix: undefined behaviour in worker supabase/pg_net
`epfd` and `curl_mhandle` were living in shared memory, and a background worker that exited before initializing them left cleanup running against values from the last worker. They now stay out of shared memory, which closes the undefined behaviour in `net_on_exit`.
fix(pgmq): fix drop_queue overload ambiguity supabase/postgres
The previous attempt to merge the `drop_queue` overloads into one function broke `ALTER EXTENSION UPDATE` from 1.5.1 onward and was reverted. This version keeps the overloads distinct, so upgrade chains from 1.5.1 work without stepping through the reverted design.
passthrough: do not retry device node creates as the daemon supabase/virtiofsd
`--posix-acl-create-fallback` retries host-denied creates with the daemon's credentials, which for character and block devices also lends the caller the daemon's CAP_MKNOD. Device node creates no longer take that retry path; file, directory, and symlink creates do.
fix(stack): recreate containers whose published host port was taken before start (#7081) supabase/cli
When an engine-chosen host port is taken between container create and start, the container now gets recreated instead of failing. That is the local stack catching a race that previously showed up as a service that just would not come up.
feat(studio): scoped oauth apps reconsent UI supabase/supabase
Reconsent for OAuth apps with changed scopes now shows only the scope differences by default, rather than the full grant. Users approving an app they already added approve the change, not the whole permission set again.
fix(studio): polish extension installation dialogs supabase/supabase
Alongside: extension install dialogs got clearer copy and a consistent disclosure for custom-schema guidance, Studio limited managed DuckLake setup to the current project, storage added a data layer for archived objects and versions, and the CLI named the failing engine operation (create, start, inspect, remove, wait) in local stack telemetry.
$ ls supabase/week/ # the briefings behind this review
Keep up with Supabase in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.