Supabase Release Notes

Multigres Operator is now open source

The Multigres Operator is now open source, with direct pod management, zero-downtime rolling upgrades, pgBackRest PITR backups, and OTel tracing.

GitHub integration on all plans

GitHub integration is now available on all plans. Connect your repo on the free tier to deploy migrations from your main branch via CI/CD, no branching required.

Supabase joins the Stripe Projects developer preview

Supabase is a co-design partner in Stripe Projects, a new CLI tool that provisions and connects services like Supabase, Vercel, and Clerk from your terminal, with credentials synced to your .env automatically.

Supabase docs over SSH

Browse all Supabase docs with standard Unix tools, or pipe them directly into Claude Code:
ssh supabase.sh setup | claude.

Supabase Security Newsletter

Subscribe to the Supabase security newsletter, sent only when there are important security updates.

Quick Product Announcements

Studio now has "Fix with Assistant" buttons across touchpoints, with a dropdown to send the prompt to Claude or ChatGPT.

Browser tabs now show your exact navigation path so you can tell your tabs apart at a glance.

Supabase secret keys now have Push Protection on GitHub, blocking accidental commits before they land.

Schema Visualiser: relation lines are now clickable, tables and columns have context actions, and popovers appear between connected tables.

Made with Supabase

Menugo - AI-powered QR code menu generator for restaurants

Gasindex - AI voice agents call thousands of businesses to track real-time gas prices in America, with Vision AI and crowdsourced submissions keeping data fresh

Guinndex - AI voice agents call thousands of businesses to track real-time Guinness prices in Ireland with Vision AI and crowdsourced submissions keeping data fresh

Festie - The unofficial Coachella 2026 companion

burn0 - Track Supabase costs per-request in real time

Community Highlights

I Dare You to Fact-Check Me: You Need Supabase Before You Build Anything Else with AI

Supabase in Production: What I Actually Learned Building Real Features

I Got Surprised By A GitHub Actions Quota. Built A Tool To Make Sure It Never Happens Again

The Solo Dev Cheat Code: Building Fast with Next.js, Supabase, and Vercel in 2026

Original source Report a problem

What gets rate-limited?

Rate limiting applies to outbound fetch() calls made by your Edge Functions to other Edge Functions within your project. This includes:

• Direct recursion: A function calling itself
• Function chaining: Function A calling Function B
• Circular calls: Function A calling Function B, which calls Function A
• Fan-out patterns: A function calling multiple other functions concurrently

NOTE: Inbound requests to your Edge Functions and requests to external APIs (e.g., Stripe, OpenAI) are not subject to this rate limit. Only outbound calls from one Edge Function to another Edge Function are counted.

Rate limit budget

Each request chain has a minimum budget of 5,000 requests per minute. In busier regions, this budget may be higher. All function-to-function calls within the same request chain share this budget.

Why was this introduced now?

Over the last few weeks, we observed increased response times for Edge Functions across multiple regions. Upon analysing traffic, we noticed that a small number of projects that do recursive/nested function calls are adding significant strain on our servers. In particular, the incident we had on Feb 28th was caused by recursive function calls. We had to put this in as a safeguard to ensure reasonable performance for all projects hosted on the platform.

Based on our metrics, the rate limit has so far affected only 0.4% of projects. If you were affected, we apologize for the inconvenience.

How can you avoid being rate-limited?

It's still possible to follow recursive/nested patterns within the rate-limit. We've published a guide that provides several examples of how you can avoid rate limits.

Please contact support if you have any further questions about these rate limits.

Original source Report a problem

Here’s everything that happened with Supabase in the last month:

Webinar: Ship Fast, Stay Safe

Learn how top agencies balance velocity with control when using AI coding tools to build production applications on Supabase.

Register

Logs Drains on Pro

Log Drains are now available on Pro. Send your Postgres, Auth, Storage, Edge Functions, and Realtime logs to Datadog, Grafana Loki, Sentry, Axiom, S3, or your own endpoint.

Blog Post

Docs now export to Markdown for AI tools

Every guide on

docs.supabase.com

now has a "Copy as Markdown" option, plus direct links to ask ChatGPT and Claude. Copy any page into your agent or tool of choice with one click.

Docs

Storage: major performance and security overhaul

Object listing is up to 14.8x faster on 60M+ row datasets. The prefixes table and its 6 triggers are gone, replaced with a hybrid skip-scan algorithm and cursor-based pagination. Security fixes close a path traversal vulnerability and prevent orphan objects from direct SQL deletes.

Blog Post

Edge Functions dashboard for self-hosted and CLI

List and search your functions, view details, test directly from the dashboard, and download as

.zip

. No longer cloud-only.

Twitter

Multigres Postgres parser: 2.5x faster than the cgo alternative

Built in 8 weeks using Claude Code. A comparable MySQL parser took over a year.

Blog Post

Twitter

Quick Product Announcements

⚠️ Action Required: OpenAPI spec access via anon key deprecated March 11. The

/rest/v1/

schema endpoint will only be accessible via service role or secret API keys after this date. Existing data API usage is unaffected.

GitHub

Observability Overview page is rolling out.

Twitter

Table filters now use AI. Describe what you want to find and the dashboard applies the right Postgres filters. Available under Feature Previews.

Twitter

Queue table operations in the Table Editor. Stage inserts, edits, and deletes, review in Diff View, then commit with

cmd + s

.

Twitter

Supabase plugin for Cursor is live.

Twitter

Copy AI prompts from the dashboard. The same prompts powering the Supabase AI Assistant are now exportable for use in your local agent or tool of choice.

Twitter

Inline SQL Editor saves SQL Snippets. Create and update snippets from Studio. Share via git in the

supabase/snippets

folder.

GitHub

Command Menu gets Create and Search shortcuts. Hit

cmd + k

to create tables, RLS policies, Edge Functions, and Storage buckets — or jump directly to an existing one.

Twitter

Read replicas now managed from the database replication page. Rolling out gradually — if you manage read replicas, look in Database settings.

Receipt downloads now available. Download receipts from the Invoices section in your org billing page.

Made with Supabase

A purpose-built tool for running powerful affiliate and referral campaigns.

Website

Supabase x YCombinator Hackathon winner: An AI Agent Personal Trainer

Website

AI video production for professionals

Website

Generate APA citation-ready references from a URL or DOI in seconds

Website

SupaClaw - A basic version of OpenClaw but built entirely on Supabase built-in features

GitHub

Community Highlights

Supabase is sponsoring Postgres Conference 2026. Deepthi and Sugu are speaking on Multigres: horizontal scalability and intelligent sharding for Postgres. April 21-23 in San Jose. Use code

2026_SUPABASE20

for 20% off.

Register

Codepup AI launched Supabase integration. Build a complete web app with a real Supabase backend — auto-generated, tested, and fixed by AI in under 30 minutes.

Blog Post

BKND joins Supabase. Dennis Senn, creator of BKND, is joining to build a Lite offering for agentic workloads. BKND stays open source.

Blog Post

Hydra joins Supabase. Joe Sciarrino, co-creator of Hydra, is joining to build Supabase Warehouse: an open data warehouse architecture for developers. Hydra co-developed

pg_duckdb

, which accelerates analytics queries on Postgres by over 600x.

Blog Post

Getting Started with Supabase - Official Guide

YouTube

Supabase on Observable Flutter - Episode

YouTube

Inside Supabase Edge Functions: How Serverless Magic Actually Works

Blog

Unlocking Scalable Backend Development: Why Supabase and Node.js are Revolutionizing Modern Applications in 2026

Blog

Adding GitHub, Google, and X Login to Next.js 15 with Supabase Auth

Blog

Original source Report a problem

What’s Changing?

The Data API returns the full OpenAPI spec for any schema exposed to the Data API at the root path:
https://[projectref].supabase.co/rest/v1/

Starting March 11, we will begin deprecating support for accessing this endpoint via the anon key. You will get the following error message if this endpoint is accessed via the anon key

{"message":"Access to schema is forbidden","hint":"Accessing the schema via the Data API is only allowed using a secret API key."}

The endpoint remains accessible and the behaviour doesn't change if you are using the service role keys or the new secret API keys.

This does not affect normal Data API usage. Accessing data via
/rest/v1/your_table
or any client library will continue to work exactly as they do today.

Why?

Today, the endpoint returns schema details (tables, columns, and types of an exposed schema) to anyone with the anon key. While this does not expose actual row data, it provides more information about your schema than most production applications need.

As part of an ongoing effort to tighten default security across Supabase, we are removing this exposure. In practice, the schema spec is mostly useful during development, where you can use the service_role key. There are few cases where you would need it client-side in production (less than 0.1% of our projects have made a request to this endpoint using the anon key in the last 24 hours), and we do not think supporting those use cases is worth the security tradeoff.

Am I Affected?

You are affected if your app currently uses the anon key to fetch the Swagger spec.
You can check by reviewing requests to the /rest/v1/ endpoint via this log query.
If you see requests:

• Click into the event.
• Check whether the request is coming from the anon role.

What Should I Do?

• Check your logs. Use the log query above to see if any of your application traffic relies on this endpoint with the anon key.
• Move affected calls server-side If your application fetches the schema spec, move that call to a server-side context like Edge Functions where you can safely use the service_role or the new secret API keys.

Rollout and Communications Timeline

Date Change

• 17 Feb Changelog published
• 4 March Change announced in monthly newsletter
• 6 March Email notification to customers observed using this endpoint
• 11 March Newly created projects cannot access endpoint with anon key
• 24 March Final email notification to customers observed using this endpoint
• 8 April All existing projects cannot access endpoint with anon key

We may push these dates back based on customer feedback, but we will not move them forward.

What’s Next?

This is the first in a series of changes we are making to tighten default security settings across Supabase. Stay tuned for improvements to RLS usability, default table grants, and additional security features.

Original source Report a problem

Here’s everything that happened with Supabase in the last month:

Supabase PrivateLink is now available

Connect your database to AWS resources over private networks. No public internet exposure. Traffic stays within AWS infrastructure using VPC Lattice.
Blog Post

Postgres Best Practices for AI Agents

30 rules across 8 categories teaching AI agents to write correct Postgres code. Works with Claude Code, Cursor, GitHub Copilot, and other tools.
Blog Post

Query Ethereum directly from Postgres

Use SQL to query real-time Ethereum blockchain data with the Infura wrapper.
View docs

Supabase is now an official Claude connector

Connect your Supabase projects to Claude and manage your database by telling Claude what you need.
Blog Post

Vibe coding, done right

Join us for a 45 minute online workshop with Bolt where we’ll walk through several success stories and best practices for introducing vibe coding safely into your company
Register now

Free eBook: Using Postgres to its full extent

Manning Publications and Supabase created a free eBook on using Postgres to its full extent—contemporary SQL techniques, full-text search, data types, and avoiding design mistakes that cost performance.
Download

Quick Product Announcements

• Action Required: pg_graphql disabled by default on new projects. Ships mid-February. New projects won't have pg_graphql enabled automatically. Existing projects with zero GraphQL requests will also have it disabled. If you use GraphQL, manually enable the extension. GitHub
• TRAE SOLO integration with Supabase. Manage your database, storage, and auth inside ByteDance's AI IDE. Blog Post
• Edge Functions now support drag-and-drop zip files. Upload entire function bundles to migrate between projects. Docs
• SQL snippets save locally in Studio. Share queries via git with your team in supabase/snippets folder. GitHub
• Supabase Assistant helps with database query performance. Get optimization suggestions directly in the dashboard. Twitter
• postgrest-js hits 9M weekly downloads. Twitter

Made with Supabase

• Fanakin - Organize movies, shows, books, games, and more in one place. Create lists, share your profile, and get AI-powered recommendations based on your taste. Website
• PolicyCheck - Free client-side security analysis for your Supabase project. See what's exposed through your public API with just your anon key or user authenticated mode. Website
• Renamify - AI-powered bulk file renaming with 99% accuracy. Rename hundreds of photos instantly with intelligent, descriptive names. Built to make the web more accessible. Website

Community Highlights

• Supabase becomes a Tailwind partner. Announcement
• New contributor site launched at supabase.com/contribute. Search issues across GitHub, Reddit, and Discord filtered by technology. Visit Site
• SupaSquad community program now open. Join as a Contributor, Content Creator, Trusted Host, or Event Speaker. Get early access to features, partner deals, and direct team access. Apply Now

Original source Report a problem

In a forthcoming release within approximately 3 weeks, pg_graphql will be disabled by default on new Supabase projects.
This change aligns pg_graphql with our security-first approach of minimizing exposed API surface area by default. Services and extensions that expose schema metadata are now opt-in rather than opt-out, reducing the default attack surface for new projects.

Who is affected

• New projects will no longer have pg_graphql enabled automatically
• Existing projects older than 30 days with zero graphql requests will also have the extension disabled (where previously it was enabled by default). Existing projects with requests will be unaffected.

Action required

• If your application relies on GraphQL, you can enable pg_graphql manually via the Database Extensions page in your dashboard. You can also add create extension pg_graphql to your migrations as well if you wish to keep using pg_graphql.

We continue to fully support pg_graphql for projects that need it. This change simply ensures it's an intentional choice rather than a default.

We'll follow up on this thread with links to relevant documents for actions required.

Original source Report a problem

Saving SQL snippets in local Studio

Saving SQL snippets now works in the local Studio! This has been a top community request for a long time, and we’re happy to finally release it.

You can save SQL snippets directly while working in the local Studio via the CLI. Snippets are stored in

supabase/snippets

making them easy to commit to Git and share with your team working in the same repo—or ignore entirely with .gitignore if you prefer.

Your saved snippets automatically appear in Studio, just like they do in the hosted Dashboard.

This feature is available since CLI v2.72.7. You can check the version by running

supabase -v

Original source Report a problem

Here’s everything that happened with Supabase in the last month:

Update on security progress and roadmap

Learn about all the security features we added last year and our 2026 roadmap.

• [Blog Post]

• Stripe Sync Engine in the Supabase Dashboard
  One-click integration for the Stripe Sync Engine directly in the Supabase dashboard. Query your customers, subscriptions, invoices, and payments using standard SQL.

• [Blog Post]

• Enhanced docs for the Metrics API
  Better guidance on how to stream Supabase database telemetry into any Prometheus-compatible observability stack.

• [Blog Post]

• Build ChatGPT apps with Supabase and mcp-use
  Learn how to build ChatGPT apps that connect to your Supabase database. Use mcp-use, an open source SDK that makes it easy to deploy MCP Servers on Supabase Edge Functions.

• [Blog Post]

• Index Advisor in Table Editor
  It’s now much easier to detect missing indexes in your database.

• [Twitter]

Quick Product Announcements

• Supabase is now in the top-100 repos on GitHub. [Twitter]
• Data API upgraded to PostgREST v14. [GitHub]
• Python Type Generation in the CLI. [Twitter]
• Three new quick starts in docs for Expo React Native, TanStack Start, and Flask. [Twitter]
• Explain/Analyze diagrams are now available in the Supabase Dashboard. [Twitter]

Original source Report a problem

Hey everyone, PostgREST v14 is now available for new projects on the ap-northeast-1 region. Please try it out and give us your feedback!

v14 will be available for other regions over the next week.

Notable Features

JWT cache

This increases throughput of all requests (~20% more RPS for GET requests according to our benchmarks). It's enabled by default.
This comes at the expense of a bit more memory usage, if you see any problems you can disable the JWT cache with:

ALTER ROLE authenticator SET pgrst.jwt_cache_max_entries TO 0; -- this is 1000 by default

Faster schema cache loading

For complex databases, we've improved the schema cache loading time (from 7 minutes to 2 seconds on a complex real-world database). No configuration knob needed for this, it's done by default.

Breaking Changes

No breaking changes expected for Supabase users.

Full Changelog

You can see the full changelog at https://github.com/PostgREST/postgrest/releases/tag/v14.0.

Original source Report a problem

Here’s everything that happened with Supabase in the last month. Be sure to keep reading for a special gift:

Supabase ETL

A change-data-capture pipeline that continuously replicates data from Supabase Postgres to external destinations, starting with Iceberg. Available in private alpha now.

Analytics Buckets

Specialized storage buckets built on Apache Iceberg and AWS S3 Tables that provide columnar storage for analytical workloads while maintaining compatibility with the Postgres interface. Available in public alpha now.

Vector Buckets

Vector Buckets are a specialized bucket type built on Amazon S3 Vectors. They are cold storage for your embeddings, with a query engine attached. Available in public alpha now.

iceberg-js

A minimal, vendor-agnostic JavaScript client for the Apache Iceberg REST Catalog API.

Supabase Platform

A white-label offering that lets platforms provision and manage fully managed backends on behalf of their users

New Auth Templates

We now include more email templates to handle security-sensitive changes to you app, including password changed, email changed, phone number changed, identity linked or unlinked, multi-factor authentication enrolled or unenrolled, and more.

Sign in with [Your App]

You can now turn your project into a full-fledged identity provider. You’ve heard about “Sign in With Google,” now you can build “Sign in With [Your App].” The immediate catalyst for this is that soon you can build MCP servers that use Supabase Auth in your app to authenticate the user.

Supabase power for Amazon Kiro

With these powers for Amazon’s Kiro IDE, you can build full-stack applications faster by giving Kiro deep knowledge of your Supabase project, best practices for database migrations, edge functions, and security policies.

Supabase in the AWS Marketplace

You can now purchase Supabase through the AWS Marketplace, which means that if your company has an AWS spend-commit you can use it to purchase Supabase.

Quick Product Announcements

• We’ve added asynchronous streaming to Postgres Foreign Data Wrappers.
• We now support deploying legacy NodeJS applications as Edge Functions.
• You can now download Edge Functions from the Supabase CLI without Docker.
• You can now bulk paste and edit individual secrets for Edge Functions.

Original source Report a problem