[dependabot]

Bumps supabase from 2.121.0 to 3.1.0.

Release notes

Sourced from supabase's releases.

v3.1.0

Supabase CLI v3.1.0 — 2026-11-09

This release adds inspect db diagnostics, a config.jsonc option, and an API retry cap for CI. Most of the rest is fixes for start, link, and db connections, plus a few local-stack behaviors that now match the hosted platform. One gotcha: local CORS on /functions/v1 changed (see Improvements).

Highlights

• Pinned Supabase CA on every linked database connection — db push/pull/dump/diff/reset/lint/advisors/query, migration *, and inspect * now verify the hosted server certificate. Previously only gen types did. (#7518)
• TypeScript types for linked projects come from your local config.toml — gen types --lang typescript respects [api].extra_search_path and falls back to the Management API when needed. Remote output now matches local output. (#7520)
• config.jsonc support — comments and trailing commas work, and the CLI keeps them when it writes the file. (#7488)
• inspect db gets three new commands — xid-age, toast-sizes, and collation-drift, which reports indexes whose collation version has drifted and prints the fix steps. (#6527, #6528, #7460)

New features

• SUPABASE_API_MAX_RETRIES caps Management API retries — set 0 in CI to send each request once. It applies to every API client, including login and services, and functions deploy respects it while still honouring rate limits. (#7394)
• inspect db xid-age — lists user tables by transaction ID age, oldest first. Useful for spotting wraparound risk. (#6527)
• inspect db toast-sizes — lists tables by TOAST storage, largest first. (#6528)
• inspect db collation-drift — read-only check for btree indexes affected by OS collation changes. Run it, then follow the printed amcheck → REINDEX INDEX CONCURRENTLY → REFRESH VERSION steps. (#7460)
• Logs commands unified — supabase logs is a single entry point for local and hosted logs, with an interactive explorer and structured output for scripts. (#7437)
• config.jsonc and commented JSON configs — the loader reads config.json, config.jsonc, and config.toml from supabase/. Edits from the CLI preserve your comments. (#7488)
• Config schema version is declared and checked — add $schema to config.json/config.jsonc, or #:schema at the top of config.toml. No declaration means v1. (#7514)
• init writes a schema directive — new config.toml files start with #:schema https://supabase.com/schemas/config/v1.json, so Taplo, Tombi, and VS Code get autocomplete and validation. (#7464)
• [auth.email] require_current_password — set it in config.toml to require the current password for password changes. config push/pull/diff support it too. (#7458)
• Local stack serves auth email templates from content_path — templates are read on every fetch, so edits show up without a restart. (#7527)
• Config-load telemetry records the failing key — config_key is added to cli_command_executed events. (#7468)

Improvements

• Stack CORS now matches the hosted platform — preflights return 200 instead of 204, with a wider method list. A live parity test keeps them aligned. (#7485)
• Gotcha: CORS on /functions/v1 is now handled by your function — the gateway no longer adds Access-Control-Allow-Origin: *, so a function that sends no CORS headers will be blocked by browsers. Add the headers in the function, or check your function's CORS handling if you call it from a browser. (#7472)
• Linked sso list and sso show fail faster — each attempt is capped at 10s instead of 60s. When an SSO call fails, the CLI also warns if the project isn't ACTIVE_HEALTHY. (#7491)
• supabase start skips Docker's first health-check wait — when services are already up, startup no longer waits about 10s on that check. (#7430)
• supabase stop no longer shows an error for functions serve — stopping the stack while functions serve runs is treated as a normal stop, not a crash. (#7463)
• Clearer migration errors for LOCK TABLE — a migration that fails with SQLSTATE 25P01 now explains the fix. Wrap the lock in BEGIN/COMMIT. (#7487)
• Clearer Docker-down detection — newer Docker daemon-down messages, including the Windows form, are recognised. (#7505)

Bug fixes

• supabase start no longer hangs after the output pipe closes — piping into a reader that exits early, like projects list | true, now ends the command. (#7469)
• db push works against a remote Postgres without TLS — an unset or sslmode=prefer URL falls back to plaintext, like psql. (#7509)
• db start --from-backup works on Windows — the drive letter is kept in the backup bind path. (#7498)
• link no longer carries the old project's service versions — relinking to a new project no longer runs the old Auth, PostgREST, or Storage versions. (#7476)
• gen types includes views from db-extra-search-path schemas — embeds that work at runtime are no longer rejected by the generated types. (#7515)
• Studio's Logs pages are hidden when Logflare is off — with [analytics] enabled = false, Studio no longer shows Logs pages that fail with a 500. (#7530)
• Functions get [edge_runtime.secrets] as written — secret names keep their case, and supabase/functions/<slug>/.env is read. (#7481, #7499)
• Stack image transforms match the legacy backend — imgproxy gets the same tuning, so browsers that accept WebP get WebP. (#7483)
• Studio can create vector buckets on the stack — the local S3 keys are passed through. (#7486)
• Binary request bodies type-check correctly in the Management API client — Uint8Array, ArrayBuffer, and Blob uploads to the update-function body are accepted again. (#7443)
• Linked project health is surfaced on SSO failures — the warning above appears when a project isn't healthy. (#7491)
• Docker start no longer leaves containers with a ~1B open-file limit — supabase start caps Erlang port tables for realtime, analytics, and the pooler. (#7512)

... (truncated)

Changelog

Sourced from supabase's changelog.

Release Process

This document is the operational playbook for releasing the Supabase CLI TypeScript build. It covers three environments ("rings"):

1. Ring 1 — Local Verdaccio. Fastest feedback loop. Build and install the CLI from a local npm registry on your own machine. No network side-effects; no repo pushes.
2. Ring 2 — User-owned PoC repos. End-to-end validation through the exact same Homebrew / Scoop / GitHub-Release code paths production uses, but pointed at a reviewer's own GitHub account and a non-supabase artifact name. This is how ADR 0011 gates 2 and 3 are validated without risking the real production channels.
3. Ring 3 — Production. The real supabase npm package + supabase/homebrew-tap + supabase/scoop-bucket + GitHub Releases on supabase/cli. Driven by GitHub Actions (release.yml, which dispatches four channels — beta, stable, next, maintenance — into the shared release-shared.yml).

flowchart LR
    local["Ring 1: Local Verdaccio<br/>pnpm cli-release"]
    poc["Ring 2: User-owned PoC repos<br/>avallete/supabase-cli-release-poc<br/>avallete/homebrew-supabase-shim-poc<br/>avallete/scoop-bucket<br/>--name supabase-shim-poc"]
    prod["Ring 3: Production<br/>supabase/cli<br/>supabase/homebrew-tap<br/>supabase/scoop-bucket<br/>(default name: supabase)"]
local --&gt; poc --&gt; prod

Loading

Move outward one ring at a time. Only promote to production after Ring 2 has exercised the full channel end-to-end on a fresh machine.

See ADR 0011 for the decision record behind this process (why Bun SFE, why npm optionalDependencies, why nfpm, why no hosted apt/rpm repo, why unsigned).

---

Ring 1 — Local Verdaccio

Use this loop while iterating on build scripts, the Node shim, or anything that changes what gets packed into supabase or @supabase/cli-<platform>. It installs the CLI into a local npm registry and lets you npx --registry http://localhost:4873 supabase as if you'd installed from npm.

Start the registry in one terminal:

pnpm local-registry

Publish the CLI into it from another terminal (current platform only, faster than a cross-platform build):

pnpm cli-release

Test it:

npx --registry http://localhost:4873 supabase@<printed-version> --version

[tools/release/local-release.ts](https://github.com/supabase/cli/blob/develop/tools/release/local-release.ts) does the heavy lifting: it builds the platform SFE and the umbrella supabase package, materialises them in a tmp dir (so no workspace package.json is modified), and publishes both to Verdaccio. The cleanup is automatic even on failure.

This is the right ring for:

• Debugging the Node shim ([apps/cli/src/shared/cli/bin.ts](https://github.com/supabase/cli/blob/develop/apps/cli/src/shared/cli/bin.ts)) — which platform package gets resolved, execFileSync behaviour.

... (truncated)

Commits

• d4fc0e5 chore(stack): bump realtime to v2.154.0-r0 (#7534)
• 6433146 feat(stack): serve auth email templates from content_path (CLI-2583, CLI-27...
• 96efdbd fix(cli): hide Studio's Logs pages when Logflare isn't running (CLI-2949) (#7...
• 811909a chore(stack): bump studio to 2026.11.09-sha-1567384-r0 (#7536)
• 34d2512 feat(config): read the declared config schema version (CLI-2862) (#7514)
• 141d792 chore(stack): bump storage to v1.90.1-r0 (#7538)
• fe9c9e9 chore(stack): bump pooler to v2.10.0-r0 (#7537)
• e874787 chore(stack): bump edge-runtime to v1.78.1-r0 (#7535)
• 072fa64 chore(stack): bump storage to v1.90.0-r0 (#7533)
• b5530dd feat(cli): unify logs commands DEBUG-261 (#7437)
• Additional commits viewable in compare view