$ cat supabase/week/2026-11-02.log
the week in review · Nov 2 – Nov 8, 2026
Realtime 2.151 begins capping joins per socket
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Behind a socket_join_limit flag, one socket can no longer join unlimited channels, and a high-severity follow-redirects advisory got patched.
feat: reject too many joins on a single socket supabase/realtime
The bucket holds the tenant's max_channels_per_client and refills at CLIENT_JOINS_PER_SECOND (default 1), with the feature flag socket_join_limit gating the whole thing. If your clients open one socket and fan out across many channels, check the default before enabling it.
v2.151.0 supabase/realtime
2.151.0 adds per-client join-per-second measurement, the instrumentation that makes the join budget observable. Realtime v2.151.3-r0 is what the CLI's local stack now pins, so a `supabase start` pulls the new behaviour.
v8.8.0 supabase/supabase-csharp
8.8.0 lands the full passkey and MFA recovery code surface in the C# client, including generating the signed-in user's recovery codes. C# apps can now enrol and recover MFA without dropping to the Auth REST endpoints.
feat: record broadcast request outcomes over HTTP supabase/realtime
Broadcast outcomes sent over HTTP now land in realtime_client_requests_total, which previously only covered WebSocket sends. HTTP broadcasters get the same metrics coverage as socket clients.
fix(realtime): guard socket handler lists against concurrent changes supabase/supabase-csharp
RealtimeSocket kept state, message, heartbeat and error handlers in plain List<T> fields mutated by Add/Remove/Clear while Notify copied them with ToArray, with no synchronization; push replies and timeouts registered and removed message handlers concurrently. 8.8.0 guards those lists.
mcp-server-supabase: v0.16.1 supabase/mcp
0.16.1 adds a url to the notebook create, get and list outputs, so an agent that creates a notebook can hand back a link instead of a bare id. It came the same week create_notebook and run_notebook became reachable without the internal unreleasedNotebookTools option.
fix(studio): attribute storage policies to every bucket they reference (#52692) supabase/supabase
The storage policy parser returned only the first quoted string near bucket_id and ignored the operator, so policies covering several buckets or a non-equality operator were attributed to one bucket. Studio's per-bucket counts were wrong for exactly those policies; they now attribute to every bucket referenced.
fix(defaults): keep string defaults that look like SQL supabase/etl
Alongside: ETL stopped dropping text defaults that look like SQL and now renders emoji-bearing defaults as GoogleSQL Unicode escapes for BigQuery, DBDev's website moved to Next 16.4.1, and 0.16.1 lands the URL fields.
$ ls supabase/week/ # the briefings behind this review
Keep up with Supabase in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.