What changed in the Supabase API

The official Supabase Go SDK v0.1.0-alpha.1 is in public alpha. Its initial feature set lets your backend verify end-user access tokens and query your database as that user under Row Level Security.

[Public Alpha] Supabase Go SDK
The official Supabase Go SDK v0.1.0-alpha.1 is in public alpha. Its initial feature set lets your backend verify end-user access tokens and query your database as that user under Row Level Security.

You get the SDK's calls in the same traces as the rest of your app: which ran, how long they took, whether they failed.

OpenTelemetry traces and metrics in the Supabase .NET SDK
 emit traces and metrics through 
. Each client exposes its own 
, so you subscribe to them the same way you subscribe to any other .NET instrumentation. The SDK takes no dependency on the OpenTelemetry packages, and the clients stay silent until something subscribes, so there is no overhead when you are not collecting.
This covers the Auth, Postgrest, Storage, and Functions clients. Realtime is not yet instrumented. URLs are recorded with the query string stripped, and no token, credential, or payload is placed in a tag.
) to tell apart operations that share an HTTP verb
supabase.postgrest.http.request.duration
, …), with a child span for the HTTP call
supabase.gotrue.http.request.duration
storage.transfer.direction
 tag on uploads and downloads; a resumable (TUS) upload is a single span for the whole transfer
supabase.storage.http.request.duration
supabase.storage.transfer.duration
supabase.storage.transfer.size
One per invocation, with a 
 tag; a relay error is a failed span even when the HTTP status succeeds
supabase.functions.invoke.duration
Add the OpenTelemetry hosting package and an exporter alongside the SDK:
<Packa

In the past 30 days, fewer than 0.0001% of connections to Supabase projects negotiated these ciphers, so we expect little to no impact.

An outdated subset of TLS 1.2 ciphers will be disabled on project HTTP APIs
Most users won't notice any change. Starting November 10, 2026 at the earliest, Supabase will stop offering some outdated TLS configurations on project HTTP APIs (
 and custom domains). Users on old, unsupported operating systems, or embedded devices that haven't been updated, may lose access if their device only supports the configurations being removed.
The configurations being removed are four CBC-mode TLS 1.2 cipher suites. Cipher suites determine how a connection is encrypted. These older suites have known security weaknesses and often trigger warnings in security scans. We plan to stop offering these ciphers on TLS 1.2:
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
ECDHE-ECDSA-AES128-SHA256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
ECDHE-ECDSA-AES256-SHA384
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
Supabase has only supported TLS 1.2 and 1.3 for several years. There is no change for TLS 1.3.
Auth, the Data API, Storage, Realtime, and Edge Functions are all sub-routes of the Supabase HTTP API, so all five are affected. Direct Postgres connections, pooler connections, and the M

Scoped personal access tokens are now available to everyone. Limit a token to specific projects or organizations and grant only the permissions it needs on the Management API, MCP server, and CLI.

ASP.NET Core dependency injection for the Supabase .NET SDK
Supabase.Extensions.DependencyInjection
 is a new package that provides an easier way to plug the Supabase .NET SDK into your application. It exposes a new method on 
 which registers the main client and all sub-clients:
builder.Services.AddSupabase(
 supabaseUrl: "https://xyz.supabase.co",
 supabaseKey: builder.Configuration["Supabase:Key"]!,
 configureOptions: options =>
 options.AutoConnectRealtime = true;
 options.PostgrestRetry = new RetryOptions { MaxRetries = 3 };
It registers all clients (
) with a scoped lifecycle, so you can resolve them wherever you need them:
app.MapGet("/movies", async (IPostgrestClient postgrest) =>
 await postgrest.Table<Movie>().Get());
The package is available on 
dotnet add package Supabase.Extensions.DependencyInjection
You can always register all the required clients in 
 yourself. This package simply does it all for you and removes boilerplate from your codebase.
The Supabase .NET SDK is now officially supported
 is now a first-party, officially supported SDK. It started as a community project, went through a period of low activity, and is now maintained by Supabase with a team behind 

The Hono, H3, Elysia, and NestJS adapters in @supabase/server are deprecated and will be removed on December 1, 2026. Move to the framework bridges in the frameworks guide.

Status page moves to incident.io
status.supabase.com now runs on incident.io's status page. The URL is unchanged.
Email subscribers were resubscribed automatically. If you subscribed through SMS, Slack, webhook, or RSS, those subscriptions did not carry over. Resubscribe at 
. The new platform supports only Email, RSS, and Slack, so SMS and webhook notifications are no longer available.
Email subscribers can now subscribe to the specific Products and Regions that matter most to them, so they only hear about incidents that affect them.
The Hono, H3, Elysia, and NestJS adapters in @supabase/server are deprecated and will be removed on December 1, 2026. Move to the framework bridges in the frameworks guide.

Scoped personal access tokens (PATs) are now available to everyone. You can limit a token to specific projects or organizations and grant only the permissions it needs.

Scoped personal access tokens are now generally available
Scoped personal access tokens (PATs) are now available to everyone. You can limit a token to specific projects or organizations and grant only the permissions it needs.
You pick a token's access when you create it
Resources: selected projects in one organization, or all projects in selected organizations.
Permissions: read or read-write per capability, such as projects, database, auth, or storage.
Expiry: a preset or a custom date up to one year out.
A review step shows the access you're granting and a risk level. You see the token value only when you create it.
You can't change a token's access later. To change it, delete the token and create a new one.
A token never has more access than you do. Every request checks your current role. When you lose access, so does the token.
Scoped tokens work with the Management API, MCP server, and CLI
 endpoints. A 403 lists the permissions the token lacks in a 
Supabase MCP server: each tool checks the token's permissions. The token's detail view in the dashboard lists the tools it can call.
Supabase CLI: pass the token with 
 still creates an account-level token. 
 doesn't work with pr

They still work today. They will be removed from the package on December 1, 2026. No new adapters are accepted.

Framework adapters in @supabase/server are deprecated
The four framework adapters that ship inside 
@supabase/server/adapters/hono
@supabase/server/adapters/h3
@supabase/server/adapters/elysia
@supabase/server/adapters/nestjs
They still work today. They will be removed from the package on December 1, 2026. No new adapters are accepted.
 is not deprecated. Neither is its entry form, 
Each adapter wrapped one call, 
, for one framework. That meant a published entry point, a peer dependency range, and a release cycle per framework. 
 engine since 1.5.1, and the engine replaced the model. A middleware is an entry you compose. The piece that is framework-specific is a short bridge, and that file belongs in your project, not in a package that has to track your framework's major versions.
 README has carried the deprecation warning since 1.9.0. From 1.9.1, every adapter export carries an 
 tag and each adapter doc opens with the same warning. The adapters are removed on December 1, 2026.
A bridge: one file you copy into your project. It runs a 
 entry array inside your framework's own middleware slot. Your route handlers then read 
, and any other key the entries contribute from where you

In a benchmark derived from TPC-C on an 8XL compute instance (32 vCPU, 128 GiB RAM), with a data set larger than memory, OrioleDB completed about 1.8x more transactions per minute than heap storage.

Local development (CLI) and standalone OrioleDB images
These changes come from the 
 and later. They apply to:
Local projects created with 
 v2.119.0 or later. The CLI sets 
experimental.orioledb_version
Anyone running the standalone 
What changed in the image:
Your project is still Postgres. You keep the same SQL, the same connection string, and the same Auth, Row Level Security, and client libraries.
In a benchmark derived from TPC-C on an 8XL compute instance (32 vCPU, 128 GiB RAM), with a data set larger than memory, OrioleDB completed about 1.8x more transactions per minute than heap storage. 
. Clients connect directly over TLS on Postgres 17 with platform defaults and no think time. Results depend on the workload, so benchmark your own. Read the full 
This workload is derived from the TPC-C Benchmark and is not comparable to published TPC-C Benchmark results, as this implementation does not comply with all requirements of the TPC-C Benchmark.

The Supabase CLI no longer requires

OrioleDB is now in Public Beta with paid plans and paid features
OrioleDB is now in Public Beta. You can create OrioleDB projects on the Pro, Team, and Enterprise plans, not only Free. These projects get the same paid features as other Supabase projects, with the exceptions listed below. OrioleDB projects are billed the same as standard Postgres projects.
Public Beta is for testing. We don't recommend OrioleDB for production workloads yet, and it has no SLA.
You can create OrioleDB projects in organizations on paid plans, and upgrade an organization that has OrioleDB projects to a paid plan.
OrioleDB projects support compute and disk resizing, pause and restore, Postgres version upgrades, read replicas, and scheduled backups.
New OrioleDB projects run 
The dashboard labels OrioleDB as Public Beta.
The Supabase CLI no longer requires 
 to start a local project with OrioleDB.
You choose OrioleDB when you create a project. You can't add OrioleDB to an existing project or remove it later.
Create a new Supabase project
Finish creating the project.
For local development, run:
supabase init --use-orioledb
Limitations in Public Beta
Point-in-Time Recovery (PITR) isn't available for OrioleD

From 1.0 the package follows semantic versioning: breaking changes ship only in a new major.

 1.0.0 is on npm and JSR under the 
 tag. From 1.0 the package follows semantic versioning: breaking changes ship only in a new major.
It is a small, MIT-licensed engine for per-request logic on Web Fetch handlers:
 writes one piece of per-request logic. It contributes one typed key to a shared 
 runs several in order and returns the fetch handler. Middleware also nest directly, so 
The handler sees every upstream key, correctly typed. Duplicate keys fail to compile, and so does a middleware placed before its prerequisite.
Any middleware can return a 
 and stop the chain, or read and change the response on the way out.
Two middleware ship with the engine: 
. Everything else is yours, or comes from a package.
The engine runs wherever fetch runs: Supabase Edge Functions, Vercel Functions, Cloudflare Workers, Deno, Bun, and Node 22 or newer. Inside Hono, H3, Elysia, NestJS, or TanStack Start, the same middleware runs through a short, typechecked bridge you copy into your app. No adapter package, no new dependency. See the 
 is built on the engine and ships the Supabase middleware. 
withSupabase(config, handler)
 wraps a single handler. Entries before it in the array run ahead of the a

That said, there are workloads where logs will scale with usage — and at platform scale, that needs to be priced fairly.

PostgreSQL 15.19 / 17.11 minor release — action may be required for ltree, pgcrypto, btree_gist, and custom operators
We are rolling out the PostgreSQL 
 minor release (from 15.14 / 17.6).
It bundles five upstream security cycles and closes 
Four changes may require action, depending on how you use your database:
ltree indexes may need reindexing
 — a case-folding fix on multibyte/ICU databases, plus an integer-overflow fix for very deep 
pgcrypto stops decrypting legacy-cipher PGP data
 (CVE-2026-14663) — data encrypted with 
 was effectively stored unencrypted and fails to decrypt by default after the upgrade.
btree_gist indexes on float columns
Custom operators with non-built-in selectivity estimators
 (CVE-2026-2004) — recreating them (dump/restore, branching) now requires superuser.
If none of the detection queries below return rows for your project, no action is needed.
This is an upstream PostgreSQL minor release.
Staying current closes 44 CVEs (including several rated High) and picks up correctness fixes in the 
Case-folding (multibyte/ICU)
After upgrading, indexes on 
 columns built under the previous version can silently return incomplete results on databases using a mult

Read replicas now live under Project Settings → Infrastructure. Database → Replication is for Pipelines destinations only. No API changes.

Database Replication is now Pipelines
Pipelines destinations now live at 
 in the Supabase Dashboard. This makes the page's purpose clearer now that read replicas are managed in Project Settings > Infrastructure.
Existing bookmarks and pipeline detail URLs under 
 redirect to the matching Pipelines page
Pipelines destinations, configuration, and behavior
Management API and database APIs
Replication logs and Postgres replication terminology
 for setup and monitoring instructions.
Read replicas now live under Project Settings → Infrastructure. Database → Replication is for Pipelines destinations only. No API changes.

Error rate checks are designed to be a broad net. A single elevated result tells you where to look; from there you can drill into logs, query connection stats, or trigger your own deeper checks.

Supabase Advisors already surface security misconfigurations and performance issues. They now also monitor service health, starting with error rates — the broadest early-warning signal across your stack.
Service error rate checks
 — read from log data, one per service:
log_data_api_error_rate_high
 — PostgREST 5xx rate is elevated
 — Auth service error rate is elevated
log_storage_error_rate_high
 — Storage service error rate is elevated
log_edge_function_error_rate_high
 — Edge Functions error rate is elevated
Error rate checks are designed to be a broad net. A single elevated result tells you where to look; from there you can drill into logs, query connection stats, or trigger your own deeper checks. This makes them particularly useful as a signal source for agents — an elevated rate check is a reliable catalyst for automated investigation flows.
An empty result means all checks ran and found nothing. 
advisor_check_unavailable
 means a check could not run — so you can distinguish between healthy and unchecked.
 — a Health tab appears in the Advisors section of your project, above Security in the navigation. Each check result links directly to the relevant logs, connection stats,

Most attempts to use agents for monitoring fail for the same reason: the brief is too vague. "Monitor and fix" is not a job description.

Observability on Auto-Pilot
Most attempts to use agents for monitoring fail for the same reason: the brief is too vague. "Monitor and fix" is not a job description. An expert needs a defined scope, the right data sources, and a clear format for what they report back.
We shipped a few things to make this even more powerful with Supabase's AI tooling.
 guide defines four roles, each with a prepared prompt and setup instructions for Claude Routines, Codex scheduled tasks, or Cursor Automations:
 — API and Auth error rates, connection pressure, instance state
 — Security Advisor findings, RLS gaps, Auth 4xx patterns
 — slow queries, lock waits, long-running sessions, Performance Advisor
 — request, error, storage, and connection growth against baselines
Each prompt scopes the agent to a specific job, runs across a fresh context, and routes findings through your existing integrations — Linear, Slack, wherever your team tracks work. Copy the prompt as-is or adapt it. It runs in any environment that supports MCP, not just the ones listed.
 already covers a broad range of Supabase tooling — database management, debugging, Edge Functions, branching, and more. A new 
 tool extends that with