Changelog
New updates and product improvements
28 results
The Supabase Management API logs.all endpoint is removed on 2026-09-23. Scripts calling it must migrate to the new ClickHouse-backed logs endpoint, which accepts ClickHouse SQL only.
Specifying an explicit version in CREATE or ALTER EXTENSION is deprecated. From 2026-08-05 the version clause is ignored and the extension's default version is installed, with a warning.
Self-hosted Supabase makes Envoy the default API gateway, replacing Kong, the week of 2026-08-09. Opt back into Kong if you rely on its HTTPS listener, a custom kong.yml, or the kong service name.
Self-hosted Supabase's default API_EXTERNAL_URL now includes /auth/v1 from the week of 2026-07-06. SAML SSO users must repoint their IdP to the new /auth/v1/sso/saml/* endpoints.
From 2026-06-03, new Free plan projects using Supabase's default SMTP cannot customize auth email templates. Existing projects keep theirs. Configure a custom SMTP provider to customize.
pg_graphql 1.6.0 disables GraphQL introspection by default for new projects created on or after 2026-06-29. Re-enable it by adding a comment on the schema.
Self-hosted Supabase makes analytics and vector opt-in on 2026-06-03. Logs Explorer users must include docker-compose.logs.yml in their docker compose invocation.
Self-hosted Supabase switches Studio and postgres-meta from supabase_admin to postgres on 2026-06-17. Existing instances must run utils/reassign-owner.sh to migrate ownership in public.
Self-hosted Supabase's default db image moves from Postgres 15 to Postgres 17 on 2026-06-17. PG 15 data does not auto-upgrade; run the upgrade script, or pin supabase/postgres:15.x to stay.
Supabase's OAuth token endpoint /v1/oauth/token returns HTTP 200 instead of 201 starting 1 June 2026. Check for any 2XX status (response.ok), not a hardcoded 201.
New tables in the public schema will no longer be exposed to the Supabase Data API by default. Opt-in today, default for new projects on 2026-05-30, enforced on all projects on 2026-10-30.
The Supabase Data API stops returning the OpenAPI spec to anon-key requests on 11 March 2026 for new projects and 8 April 2026 for all projects. Use a service role or secret API key instead.
pg_graphql will be disabled by default on new Supabase projects, and on existing projects older than 30 days with zero GraphQL traffic. Re-enable it via Database Extensions if needed.
New projects on Postgres 17.6.1.016 and later ship pgmq 1.5.1, which changes delay parameter behavior. Upgrades for existing projects are paused until an upstream fix lands.
realtime-js 2.15.1 and supabase-js 2.55.0 require Node.js < 22 users to install ws and pass it as the realtime.transport option. Node.js 22+ and browsers need no change.
On 2025-04-02 the Supabase Management API GET /projects/{ref}/analytics/endpoints/logs.all defaults to a one-minute window and caps explicit ranges at 24 hours. Update clients querying wider ranges.
On 2025-04-21 Supabase restricts SQL on the auth, storage, and realtime schemas: no creating or dropping tables or functions, no writes to migration tables. Move custom objects elsewhere.
On 2024-11-22, Supabase removes app.settings.jwt_secret from the postgres database. SQL functions calling current_setting('app.settings.jwt_secret') must migrate to Vault.
The Supabase Data API and Edge Functions no longer return XHTML on shared domains. Projects that need XHTML responses must enable the Custom Domain add-on. Affected projects notified.
On 2024-10-15, Enterprise organizations lose Developer role write access to project API, Auth, Storage, Edge Functions, and Logs configuration. Read-Only role is unchanged.
Custom Domain endpoints move from the Let's Encrypt cross-signed chain to the self-signed chain on 2024-09-09. Very old clients such as Android 7.0 and below may lose trust.
Supabase HTTP APIs no longer use DigiCert as the root CA. Clients that trust only DigiCert must update their trust store to include the Cloudflare CAs Supabase now uses.
On 2024-07-26, Supabase removes Developer and Read-Only role access to GitHub and Vercel integration management at the organization level. Existing integrations keep working.
Supabase Database no longer allows direct inserts or updates on the pg_cron cron.job table. Schedule and modify jobs via the pg_cron functions documented in the guides.
Supabase Auth deprecates the LinkedIn OAuth provider in favor of LinkedIn (OIDC). Projects using a pre-1 Aug 2023 LinkedIn app must migrate credentials by 4 Jan 2024.
Supabase Studio no longer offers Transparent Column Encryption in the Table Editor UI. Existing TCE columns keep working; new encryption must be managed via SQL and pgsodium.
Databases over 100GB now use physical daily backups. Restores work as before, but these backups can no longer be downloaded from the dashboard.