supabase-flutter v3 types queries, functions, realtime, and auth, and changes v2 behavior. Nothing changes until you upgrade. Follow the migration guide and check the changes the compiler misses.

Breaking Change: supabase-flutter v3 brings type safety to the whole API surface

Supabase CLI v3 targets your local stack by default, asks before it changes a hosted project, and removes deprecated commands. Update your CI before you upgrade, or pin v2.

Breaking Change: Supabase CLI v3 is local by default and confirms hosted changes

Older Supabase Postgres versions return wrong local times for America/Vancouver, America/Edmonton, and Africa/Casablanca. Upgrade to 15.19.0.003 or 17.11.0.003 or later to fix it.

Upgrade Postgres to fix local time for Vancouver, Edmonton, and Casablanca

The Supabase Knowledge Base is live in public beta at supabase.com/kb. It hosts troubleshooting and migration guides for developers and their agents.

[Public Beta] Supabase Knowledge Base

The .NET SDK now emits traces and metrics for Auth, Postgrest, Storage, and Functions. Collect them with OpenTelemetry and export to any observability backend.

OpenTelemetry traces and metrics in the Supabase .NET SDK

Supabase will be disabling a subset of TLS 1.2 ciphers on project HTTP APIs on November 10, 2026. Clients that don't support modern standards (<0.0001% of Supabase traffic) will fail to connect.

An outdated subset of TLS 1.2 ciphers will be disabled on project HTTP APIs

The .NET SDK now ships an ASP.NET Core dependency injection package. A single method registers the main client and all sub-clients, so you don't have to wire it up by hand.

ASP.NET Core dependency injection for the Supabase .NET SDK

The .NET SDK for Supabase is now officially supported. It's the recommended way to build on Supabase from any .NET platform: ASP.NET, Blazor, MAUI, Unity, Azure, and more.

The Supabase .NET SDK is now officially supported

status.supabase.com now runs on incident.io. Email subscribers carry over. SMS, Slack, webhook, and RSS subscribers must resubscribe; the new page supports only Email, RSS, and Slack.

Status page moves to incident.io

Scoped personal access tokens are now available to everyone. Limit a token to specific projects or organizations and grant only the permissions it needs on the Management API, MCP server, and CLI.

Scoped personal access tokens are now generally available

Organization invites on Team and Enterprise plans now support the No access role, so admins can default new members to zero project access instead of Read-only access to every project.

Organization invites support the No access role

The official Supabase Go SDK v0.1.0-alpha.1 is in public alpha. Its initial feature set lets your backend verify end-user access tokens and query your database as that user under Row Level Security.

[Public Alpha] Supabase Go SDK

The Hono, H3, Elysia, and NestJS adapters in @supabase/server are deprecated and will be removed on December 1, 2026. Move to the framework bridges in the frameworks guide.

Framework adapters in @supabase/server are deprecated

Run Supabase with multi-AZ high availability (HA), automatic failover, and scalable connection pooling. Multigres is now in Private Alpha for selected Pro, Team, and Enterprise organizations.

[Private Alpha] Multigres: operating system for Postgres

OrioleDB is now in Public Beta. Create OrioleDB projects on Free, Pro, Team, and Enterprise plans, with paid features and standard Postgres pricing. Existing alpha projects don't change.

OrioleDB is now in Public Beta with paid plans and paid features

@supabase/middleware 1.0.0 is stable: typed, composable middleware for fetch handlers. The engine runs wherever fetch runs, standalone or inside a framework through a short bridge you copy.

Supabase Middleware 1.0

Postgres minor upgrade to 15.19/17.11 fixes 44 CVEs.
ltree and btree_gist indexes may need reindexing, and pgcrypto data encrypted with legacy ciphers needs re-encryption.

PostgreSQL 15.19 / 17.11 minor release — action may be required for ltree, pgcrypto, btree_gist, and custom operators

Supabase Logs is moving to usage-based pricing. We're announcing early so you have time to adjust — 90%+ of projects are within the included limits, with a grace period through early 2027.

Logs usage-based pricing

Database > Replication is now Database > Pipelines. Existing Replication URLs redirect to the new location. No API or pipeline behavior has changed.

Database Replication is now Pipelines

Supabase Advisors now include service health checks: error rates across Auth, Storage, Edge Functions, and Data APIs, each with a severity level and a direct link to investigate.

Health Check Advisors

Hire an agent to watch your Supabase project. Prepared prompts for four monitoring roles, ready to run in Claude Routines, Codex, Cursor Automations, or any environment you choose.

Observability on Auto-Pilot

Read replicas now live under Project Settings → Infrastructure. Database → Replication is for Pipelines destinations only. No API changes.

Read replicas moved to Project Settings → Infrastructure

A timing issue could cause daily backups to be silently skipped for every project due in a 10-minute scheduling window. Backup scheduling now retries and recovers automatically.

Fixed daily backups occasionally skipped due to a scheduling timeout

A physical restore could leave a project with stale database credentials, causing authentication failures. Restores now reapply current credentials afterward.

Fixed stale database credentials left behind after a restore

A metrics endpoint could panic under concurrent requests, intermittently stopping metrics from being collected and pushed for a project.

Fixed a panic in project metrics collection that could drop metrics

The Supabase Management API `logs.all` endpoint is removed on 2026-09-23. Scripts calling it must migrate to the new ClickHouse-backed `logs` endpoint, which accepts ClickHouse SQL only.

Migration of Supabase Management API `logs.all` analytics endpoint to `logs` endpoint

Specifying an explicit version in CREATE or ALTER EXTENSION is deprecated. From 2026-08-05 the version clause is ignored and the extension's default version is installed, with a warning.

Extension version pinning is deprecated in favor of default versions

Stream Postgres changes to BigQuery in near real time with Supabase Pipelines, a managed CDC service configured right in the Dashboard. Now in public alpha on all paid plans.

[Public Alpha] Supabase Pipelines

Self-hosted Supabase makes Envoy the default API gateway, replacing Kong, the week of 2026-08-09. Opt back into Kong if you rely on its HTTPS listener, a custom `kong.yml`, or the kong service name.

Self-hosted Supabase: Envoy becomes the default API gateway (breaking change)

Supabase now blocks all changes to the `realtime` schema: creating, altering, or dropping objects fails with a permission error. RLS policies on `realtime.messages` still work.

Realtime schema is now fully locked down against modifications

`@supabase/supabase-js` will require TypeScript 5.0 starting January 31, 2027, dropping support for TypeScript 4.7 to 4.9. Upgrade to 5.0 or later before then.

Deprecation notice: `@supabase/supabase-js` will require TypeScript 5.0+

Supabase Developer Update for July 2026: Realtime Broadcast now supports binary payloads, Wrappers v0.6.2 adds a MongoDB foreign data wrapper, and OpenCode integrates with Supabase.

Developer Update - July 2026

Postgres `log_connections` defaults to off for new projects and existing Free and Pro projects from 2026-07-09, cutting log noise. Re-enable it via the dashboard or Management API.

log_connections is to be turned off by default for new projects and existing Free/Pro projects

Self-hosted Supabase's default `API_EXTERNAL_URL` now includes `/auth/v1` from the week of 2026-07-06. SAML SSO users must repoint their IdP to the new `/auth/v1/sso/saml/*` endpoints.

Self-hosted Supabase: API_EXTERNAL_URL to include /auth/v1

Supabase Realtime Broadcast now sends and receives binary payloads (bytea) over WebSockets, the REST API, and the database, cutting JSON overhead for sensor streams and image frames.

Realtime Broadcast now supports binary payloads

Supabase's June developer update: $500M Series F led by GIC, Auth passkeys in beta, the Supabase ChatGPT app, the Supabase plugin for AI coding agents, and Multigres 0.1 alpha released.

Developer Update - June 2026

From 2026-06-03, new Free plan projects using Supabase's default SMTP cannot customize auth email templates. Existing projects keep theirs. Configure a custom SMTP provider to customize.

Changes to Email Template Customisation on Free Tier

Supabase Auth now supports passkeys (Beta): passwordless, phishing-resistant sign-in built on WebAuthn using biometrics, a device PIN, or a hardware security key. No action required.

Passkeys for Supabase Auth (Beta)

pg_graphql 1.6.0 disables GraphQL introspection by default for new projects created on or after 2026-06-29. Re-enable it by adding a comment on the schema.

Breaking change in pg_graphql 1.6.0 — GraphQL introspection disabled by default

Supabase project owners and admins can grant temporary database access via Personal Access Tokens (Feature Preview), scoped by role with expiry up to 90 days. No password disclosure.

Feature Preview: Temporary token-based database access

Self-hosted Supabase makes `analytics` and `vector` opt-in on 2026-06-03. Logs Explorer users must include `docker-compose.logs.yml` in their `docker compose` invocation.

Self-hosted Supabase: making Analytics and Vector opt-in

Self-hosted Supabase switches Studio and postgres-meta from `supabase_admin` to `postgres` on 2026-06-17. Existing instances must run `utils/reassign-owner.sh` to migrate ownership in `public`.

Self-hosted Supabase: switching Studio from supabase_admin to postgres (breaking change)

Self-hosted Supabase's default db image moves from Postgres 15 to Postgres 17 on 2026-06-17. PG 15 data does not auto-upgrade; run the upgrade script, or pin `supabase/postgres:15.x` to stay.

Self-hosted Supabase: upgrading from PG 15 to 17 (breaking change)

Supabase support for Postgres 14 ends on 2026-07-01. Projects still on Postgres 14 will be upgraded automatically; projects using removed extensions (timescaledb, plv8, pgjwt) will be paused.

Deprecation Notice: Support for Postgres 14 ending on 1st July 2026

Supabase client libraries (supabase-js, auth-js, realtime-js, functions-js, storage-js, postgrest-js) drop Node.js 20 support on 2026-06-30. Upgrade to Node.js 22 or later before that date.

Deprecation Notice: Dropping Support for Node.js 20

Supabase's May developer update: custom OAuth/OIDC providers for Auth, ISO 27001 certification, @supabase/server SDK, branching without Git by default, plus Data API auto-exposure changes.

Developer Update - May 2026

Supabase's OAuth token endpoint `/v1/oauth/token` returns HTTP 200 instead of 201 starting 1 June 2026. Check for any 2XX status (`response.ok`), not a hardcoded 201.

Breaking Change: OAuth token endpoint will return HTTP 200 instead of 201

New tables in the public schema will no longer be exposed to the Supabase Data API by default. Opt-in today, default for new projects on 2026-05-30, enforced on all projects on 2026-10-30.

Breaking Change: Tables not exposed to Data and GraphQL API automatically

The Supabase Dashboard adds an RLS Tester (Feature Preview): run SELECT queries as any role, see which RLS policies fire, and debug policies. Enable it from your profile menu.

Feature Preview: RLS Tester

Supabase client libraries (supabase-js, swift, flutter, py) now automatically retry GET and HEAD requests to PostgREST on transient 520, 503, and network errors. Enabled by default, opt-out per call.

Automatic PostgREST retries for transient errors

Supabase will add applicable taxes (VAT, GST, sales tax) to invoices based on each organization's billing address, rolling out from 1 May to 30 June 2026. Review your billing address and Tax ID.

Upcoming: Tax Collection on Supabase Invoices

The Supabase CLI now ships pg-delta (Public Alpha): a Postgres 15+ schema diffing engine and declarative SQL workflow. Edit `.sql` files, run `supabase db schema declarative sync`.

[Public Alpha] Declarative Schema Management with pg-delta

Supabase's April developer update: GitHub integration on all plans, Multigres Operator open-sourced, Supabase joins the Stripe Projects developer preview, and Supabase docs available over SSH.

Developer Update - April 2026

Supabase Edge Functions now rate-limit recursive and nested function-to-function calls at a minimum of 5,000 requests per minute per chain. Inbound and external requests are unaffected.

Edge Functions rate limits on recursive/nested Edge Functions calls

Supabase's March developer update: Log Drains on Pro, Storage performance and security overhaul, docs export as Markdown for AI tools, and Edge Functions dashboard for self-hosted and CLI.

Developer Update - March 2026

The Supabase Data API stops returning the OpenAPI spec to anon-key requests on 11 March 2026 for new projects and 8 April 2026 for all projects. Use a service role or secret API key instead.

Breaking Change: Removing access to OpenAPI spec via the anon key

Supabase's February developer update: PrivateLink GA, Supabase as an official Claude connector, Postgres best practices for AI agents, and a heads-up that pg_graphql is becoming opt-in.

Developer Update - February 2026

The Supabase Table Editor now batches inserts, edits, and deletes into a single transaction with a diff preview. Enable it under Feature Previews > Queue table operations.

Queue table Inserts, edits and deletes on the table editor

pg_graphql will be disabled by default on new Supabase projects, and on existing projects older than 30 days with zero GraphQL traffic. Re-enable it via Database Extensions if needed.

Breaking Change: pg_graphql no longer enabled automatically (within approx 3 weeks from today)

Saving SQL snippets now works in local Studio via the CLI. Snippets are stored in `supabase/snippets`, ready to commit alongside your code. Requires CLI v2.72.7 or later.

SQL snippets can now be saved in local Studio

Supabase's January developer update: Stripe Sync Engine integration in the Dashboard, Index Advisor in the Table Editor, PostgREST v14 on the Data API, and the 2026 security roadmap.

Developer Update - January 2026

The Data API is upgrading to PostgREST v14 worldwide, starting in `ap-northeast-1`. GET throughput rises ~20% via a JWT cache, and schema cache loading is faster. No breaking changes.

Data API upgrade to PostgREST v14

Developer Update for December 2025: Supabase ETL, Analytics and Vector Buckets, iceberg-js, Supabase Platform, OAuth 2.1 provider, Kiro integration, and AWS Marketplace listing.

Developer Update - December 2025

Supabase Vector Buckets (Public Alpha) can now be managed from the dashboard. Store, index, and query vector embeddings at scale alongside your project's other storage.

[Public Alpha] Manage Vector Buckets from the dashboard

Dashboard updates for 10 Nov to 25 Nov 2025: refreshed Storage UI ahead of Analytics and Vector buckets, and per-template toggles for the new security-sensitive Auth emails.

Dashboard Updates (101125 - 251125)

Supabase Auth adds email templates for security-sensitive account changes: password, email, phone, identity link or unlink, and MFA enrollment. Enable via Feature previews.

Notify users about security-sensitive actions on their accounts

Supabase Analytics Buckets (Public Alpha) can now be managed from the dashboard. Store large datasets for analytics and reporting alongside your project's other storage.

[Public Alpha] Manage Analytics Buckets from the dashboard

Dashboard updates for 20 Oct to 3 Nov 2025: refreshed Storage UI ahead of new bucket types, split Auth Reports, Sentry Log Drains support, and three new Realtime configuration settings.

Dashboard Updates (201025 - 031125)

supabase-js 2.75.1 and CLI 2.53.1+ infer `SETOF` functions as embedded relationships in `.select()` queries and raise compile-time errors for invalid rpc calls. Regenerate types to adopt.

Enhanced Type Inference for Embedded Functions (Computed Relationships)

Dashboard updates for 6 Oct to 20 Oct 2025: a faster Auth Users page with URL-persisted search, model switching for the Assistant, and a max events per second setting for Realtime.

Dashboard Updates (061025 - 201025)

The Supabase MCP server is now hosted at `https://mcp.supabase.com/mcp`. Connect via browser-based OAuth 2 from clients like ChatGPT, no `npx` or personal access token required.

Supabase Remote MCP server

New projects on Postgres 17.6.1.016 and later ship pgmq 1.5.1, which changes `delay` parameter behavior. Upgrades for existing projects are paused until an upstream fix lands.

Potential breaking change in pgmq from 1.4.4 to 1.5.1 and temporary halt on upgrade for existing projects

Dashboard updates for 22 Sep to 6 Oct 2025: Assistant response speed and quality improvements, contextual error handling in the Table Editor, and a wrap on Supabase Select.

Dashboard Updates (220925 - 061025)

The Supabase JS client libraries (supabase-js, auth-js, postgrest-js, realtime-js, storage-js, functions-js) now live in a single monorepo. No action required for package users.

Supabase JS Client Libs: Migration to Monorepo

Dashboard updates for 8 Sep to 22 Sep 2025: Query Performance Advisor refinements and a new Auth Audit Logs setting to stop writing audit logs to the project database.

Dashboard Updates (080925 - 220925)

Data API v13 (PostgREST) tightened JWT validation on 2025-07-24 and broke some custom JWT setups. Re-importing the custom signing key per the updated docs resolves the issue.

Changes to Custom JWT and Signing Keys issue resolution

Dashboard updates for 18 Aug to 1 Sep 2025: expiration dates for Personal Access Tokens, synced report tooltips, refreshed Auth Policies and Integrations pages, and Assistant refinements.

Dashboard Updates (180825 - 010925)

Personal Access Tokens now support expiration dates (preset, custom up to one year, or never) and usage tracking updated every 15 minutes to help identify unused tokens.

Personal Access Tokens: Expiration & Usage Tracking

Supabase Storage splits egress into cached and origin tiers with separate quotas. Cached egress is now $0.03 per GB, three times cheaper than origin egress, on Free and paid plans.

3x cheaper egress for cache hits

Supabase Auth gains OAuth 2.1 authorization server capabilities (Public Beta), turning your project into an identity provider for third-party apps and MCP clients.

OAuth 2.1 Server Capabilities for Supabase Auth

Edge Functions now run Deno 2.1 in every region. No action required; fall back to Deno 1.45 via the `forceDenoVersion=1` query parameter if you hit compatibility issues.

All regions now run Deno 2.1 compatible release

realtime-js 2.15.1 and supabase-js 2.55.0 require Node.js < 22 users to install `ws` and pass it as the `realtime.transport` option. Node.js 22+ and browsers need no change.

Change in `realtime-js` affecting Node.js < 22

The Python `gotrue` and `supafunc` packages are deprecated in favor of `supabase_auth` and `supabase_functions`. Update imports; `supabase-py 2.18.1` drops the old packages.

Deprecation Notice: Dropping support for python's gotrue and supafunc

Dashboard service settings (Database, Data API, Auth, Storage, Edge Functions, Log Drains) now live in their own sections. Old URLs redirect; Project Settings keeps shortcuts for now.

Dashboard Navigation Updates: Project Settings

Supabase Postgres image 17.4.1.062 was withdrawn after an issue was found. New projects use an earlier release; existing projects on this version should upgrade once a fix ships.

supabase v17.4.1.062 was withdrawn

A unified Logs view in the Supabase dashboard is coming soon, combining logs across all services with improved filtering and real-time updates. Sign up for early access.

Coming Soon: Combined View for Logs

Supabase JS libraries (supabase-js, auth-js, realtime-js, functions-js, storage-js, postgrest-js) drop Node.js 18 support on 2025-10-31. Upgrade to Node.js 20 or later.

Deprecation Notice: Dropping Support for Node.js 18

A Realtime Settings screen in the dashboard lets you configure channel restrictions, database connection pool size, and max concurrent clients per project.

Realtime Settings

Edge Functions now accept a `forceFunctionRegion` query parameter to pin invocations to a specific region, useful when request headers cannot be controlled (CORS, webhooks).

Update to Edge Functions Regional Invocations

Edge Functions now offer a Deno 2.1 preview on the hosted platform. Opt in via the `forceDenoVersion=2` query parameter or `x-deno-version: 2` header to test compatibility.

Deno 2.1 Preview - Hosted Environment

The upcoming Supabase Postgres 17 bundle drops `timescaledb`, `plv8`, `plls`, `plcoffee`, and `pgjwt`. Postgres 15 keeps the extensions until end of life around May 2026; drop them before upgrading.

Forthcoming Postgres 17 Release Notes

Supabase Studio brings back tabs in the Table Editor and SQL Editor, letting you switch between tables across schemas or between snippets without navigating the list. Now fully rolled out.

Feature Preview: Tabs for Table and SQL Editor

Supabase developer update for April 2025: project-scoped roles on Team plans, the MCP server works with VS Code and deploys Edge Functions, plus Infinite Query and Social Auth in the UI Library.

Developer Update - April 2025

Supabase Studio dashboard updates from 21 Apr to 5 May 2025: sort columns from the Table Editor column header, set a billing address and billing name when creating or upgrading an organization.

Dashboard Updates [210425 - 050525]

Supabase Studio dashboard updates from 7 to 21 Apr 2025: revamped organization layout (Feature Preview), redesigned billing breakdown, database upgrade logs, and Feature Previews on self-hosted.

Dashboard Updates [070425 - 210425]

Supabase project-scoped roles are now available on Team plans. Restrict an organization member to specific projects with per-project permissions, useful for security boundaries and HIPAA compliance.

Project scoped roles now available in Team plans

Supabase developer update for March 2025 and Launch Week 14: the official Supabase MCP server, the Supabase UI Library on shadcn, Realtime Broadcast from Database, and declarative schemas.

Developer Update - March 2025

Supabase Studio dashboard updates from 24 Feb to 7 Apr 2025 covering Launch Week 14: create, edit, test, and deploy Edge Functions in the dashboard, plus Table Editor and SQL Editor tabs.

Dashboard Updates [240225 - 070425]

On 2025-04-02 the Supabase Management API `GET /projects/{ref}/analytics/endpoints/logs.all` defaults to a one-minute window and caps explicit ranges at 24 hours. Update clients querying wider ranges.

Supabase Management API `GET` Logs Restrictions

On 2025-04-04 the Supabase Data API switches experimental routing for GET requests from round-robin across all replicas to geo-routing that targets the nearest available database, lowering latency.

Upcoming Change: Improved Experimental Routing for Read Replica Load Balancers

- [What you get](#what-you-get)
- [Why v3 breaks v2 code](#why-v3-breaks-v2-code)
- [Who is affected](#who-is-affected)
- [What happens if you take no action](#what-happens-if-you-take-no-action)
- [Changes the compiler will not catch](#changes-the-compiler-will-not-catch)
- [Migration steps](#migration-steps)
- [Rollout timeline](#rollout-timeline)

Changelog

Breaking Change: supabase-flutter v3 brings type safety to the whole API surface

Automatic PostgREST retries for transient errors

August Beta 2021

July Beta 2021

Platform updates: October 2022

Build in a weekend, scale to millions