$ cat supabase/week/2026-10-19.log
the week in review · Oct 19 – Oct 25, 2026
Realtime patches cross-tenant channel leak via delimiter injection
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
etl separately drops a compromised eMudhra root CA and OpenSSL, moving its images to Debian 13; the CLI warns ahead of the v3 local-target default.
Unsanitized delimiter injection enables cross-tenant access to private channels supabase/realtime
Unsanitized delimiters let a crafted request reach private channels belonging to another tenant. Audit any deployment where clients control channel names or broadcast payloads before assuming channel isolation holds.
v2.147.0 supabase/realtime
The 2.147.0 release also updates castore so realtime is not affected by the compromised root, alongside the presence latency metric from 2.145.0. Both are patch-level pulls.
Drop OpenSSL and move images to Debian 13 (#1145) supabase/etl
The image moves to Debian 13 with no OpenSSL dependency, paired with a webpki-roots bump to 1.0.10 and rustls-webpki 0.103.16. That bump removes emSign ECC Root CA - G3 and rejects the eight compromised eMudhra intermediate keys, tracked as RUSTSEC-2026-0381/0382/0383 and CVE-2026-111943; the release is marked breaking.
feat(replication): Add support for TEMPORARY replication slots (#1084) supabase/etl
ReplicationSlotConfig gains a persistence field, and PgReplicationClient::create_slot and create_slot_with_transaction now take a &ReplicationSlotConfig. Downstream callers need to update call sites; the change ships as breaking.
feat(realtime)!: collapse RealtimeClient and RealtimeChannel into actors on one executor supabase/supabase-swift
The Swift client collapses RealtimeClient and RealtimeChannel onto a single executor, one isolation domain per client, as step two of the Realtime v3 concurrency rewrite. Client code holding both types across actor boundaries will need to re-check its concurrency annotations.
feat(cli): warn before the v3 switch to a local default target (#7186) supabase/cli
v3, landing on next, makes the local stack the default target for every command that can run against either surface, with a single --remote flag to reach a hosted project. The warning lands first so scripts that assume a hosted target can be found before the default flips.
feat(cli): lock and override service versions in stack mode (#7195) supabase/cli
Stack mode can now pin or override any service version slim-services has published, match a hosted project's versions after supabase link, and reproduce the whole stack from one committed file. That makes local environments reproducible across a team, not hand-configured per machine.
fix(mcp): don't split an UPDATE on a semicolon inside a quoted value supabase/mcp
Alongside: the MCP UPDATE guard now ignores semicolons inside quoted values, studio's pipeline wizard validates destination credentials and publication settings and confirms before navigating away from unsaved work, realtime re-owns only new partitions, and etl added fuzz targets and property tests for its decode and sink paths.
$ ls supabase/week/ # the briefings behind this review
Keep up with Supabase in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.