chore: production deploy by supabase-cli-releaser[bot] · Pull Request #6416 · supabase/cli

supabase-cli-releaser · 2026-09-01T02:26:05Z

feat(cli): add supabase workers new (feat(cli): add supabase workers new #6261)
feat(cli): add supabase workers push (feat(cli): add supabase workers push #6262)
chore(deps): bump the go-minor group across 2 directories with 1 update (chore(deps): bump the go-minor group across 2 directories with 1 update #6350)
chore: sync API types from infrastructure (chore: sync API types from infrastructure #6352)
feat(stack): replace remote runtime protocol with Effect RPC (feat(stack): replace remote runtime protocol with Effect RPC #6303)
chore(repo): remove Nx (chore(repo): remove Nx #6344)
chore(api): sync Management API OpenAPI spec (chore(api): sync Management API OpenAPI spec #6338)
fix(docker): bump the docker-minor group across 1 directory with 5 updates (fix(docker): bump the docker-minor group across 1 directory with 5 updates #6320)
chore(api): sync Management API OpenAPI spec (chore(api): sync Management API OpenAPI spec #6356)
chore: sync API types from infrastructure (chore: sync API types from infrastructure #6359)
chore(release): harden release-notes prompt against injection (chore(release): harden release-notes prompt against injection #6361)
feat(config): add toProjectConfig and the ProjectConfig hosted subset (CLI-2230) (feat(config): add toProjectConfig and the ProjectConfig hosted subset (CLI-2230) #6339)
ci(repo): add one-shot two-model AI review pipeline (ci(repo): add one-shot two-model AI review pipeline #6358)
ci(repo): fix ai-review gh repo inference and scripts-ci timeout (ci(repo): fix ai-review gh repo inference and scripts-ci timeout #6363)
feat(cli): add supabase workers list, status and delete (feat(cli): add supabase workers list, status and delete #6263)
chore(lint): scope Effect checks to stack packages (chore(lint): scope Effect checks to stack packages #6357)
chore: sync API types from infrastructure (chore: sync API types from infrastructure #6373)
ci(repo): parallel AI review passes with a Codex adjudicator, no size cap (ci(repo): parallel AI review passes with a Codex adjudicator, no size cap #6365)
ci(repo): fix codex-action v1.12 hang (downgrade to v1.11), adjudicate on >=1 review (ci(repo): fix codex-action v1.12 hang (downgrade to v1.11), adjudicate on >=1 review #6380)
fix(stack): prepare slim postgres socket directory (fix(stack): prepare slim postgres socket directory #6401)
chore: sync API types from infrastructure (chore: sync API types from infrastructure #6399)
test(stack): qualify complete slim Docker service graph (test(stack): qualify complete slim Docker service graph #6374)
fix(cli): accept sbp_v0 tokens (CLI-2262) (fix(cli): accept sbp_v0 tokens (CLI-2262) #6360)
test(stack): qualify native Postgres, Auth, and PostgREST core (test(stack): qualify native Postgres, Auth, and PostgREST core #6379)
fix(cli): stop skipping colliding schemas (CLI-2272) (fix(cli): stop skipping colliding schemas (CLI-2272) #6394)
docs(repo): add public-surfaces rule to agent instructions (docs(repo): add public-surfaces rule to agent instructions #6400)
test(cli): cover services and storage mv (test(cli): cover services and storage mv #6362)
test(cli): cover migration up and repair (CLI-2269) (test(cli): cover migration up and repair (CLI-2269) #6376)
chore: sync API types from infrastructure (chore: sync API types from infrastructure #6402)
feat(cli): add SUPABASE_USE_SLIM_IMAGES flag for slim ghcr images (feat(cli): add SUPABASE_USE_SLIM_IMAGES flag for slim ghcr images #6382)
docs(cli): document SUPABASE_USE_SLIM_IMAGES side effects (docs(cli): document SUPABASE_USE_SLIM_IMAGES side effects #6383)
perf(cli): strategy-driven parallel provisioning for pg-delta next plan shadows (perf(cli): strategy-driven parallel provisioning for pg-delta next plan shadows #6215)
chore: bump postgres-meta to v0.99.0 (chore: bump postgres-meta to v0.99.0 #6405)
chore(api): sync Management API OpenAPI spec (chore(api): sync Management API OpenAPI spec #6377)
feat(cli): make shadow baseline cache opt-out (default ON) (feat(cli): make shadow baseline cache opt-out (default ON) #6403)
test(stack): derive image assertions from the service catalog (test(stack): derive image assertions from the service catalog #6406)
feat(cli): move workers commands under experimental parent (feat(cli): move workers commands under experimental parent #6409)
fix(deps): bump github.com/posthog/posthog-go from 1.23.1 to 1.24.0 in /apps/cli-go in the go-minor group across 1 directory (fix(deps): bump github.com/posthog/posthog-go from 1.23.1 to 1.24.0 in /apps/cli-go in the go-minor group across 1 directory #6412)

## Summary Adds `supabase workers new`, plus the project layout and `config.toml` editing the whole command family builds on: - `shared/workers/` — worker path resolution, `config.toml` section reading and patching (`toml-section.ts` preserves surrounding formatting), the runtime/size envelope, and the starter files. - Starter files live as ordinary files under `shared/workers/stacks/<runtime>/` rather than string literals, and are embedded into the compiled binary through a Bun macro — the directory is expanded at transpile time and inlined. A completeness check inside the macro fails the build if `WORKER_RUNTIMES` and the directory drift apart. **Stack 2 of 4**, on top of the config schema (#6260). Reviewer note: the third commit is where the embedding mechanism is explained; the starters are deliberately kept out of the type program (a `deno` starter is not valid under this workspace's Bun types), which is why `tsconfig.json` excludes the directory and nothing imports the files. ## Linked issue FUNC-753 (Linear). Supabase maintainer, exempt from the `open-for-contribution` flow. ## Checklist - [x] The PR title follows [Conventional Commits](https://www.conventionalcommits.org/) --------- Co-authored-by: Kanad Gupta <git@kanad.dev>

## Summary Adds `supabase workers push` (aliased `deploy`) and the machinery it needs: - `workers-api.ts` — the typed Workers Management API client. - `tar.ts` / `worker-package.ts` — packaging a worker directory into the build context that gets uploaded. - `worker-classify.ts` — best-effort runtime detection from marker files, so a directory with no `[workers.<name>] runtime` can still deploy. The guess is always reported with a nudge to pin it down, never applied silently. **Stack 3 of 4**, on top of `workers new` (#6261). ## Linked issue FUNC-753 (Linear). Supabase maintainer, exempt from the `open-for-contribution` flow. ## Checklist - [x] The PR title follows [Conventional Commits](https://www.conventionalcommits.org/)

…te (#6350) Bumps the go-minor group with 1 update in the /apps/cli-go directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go). Bumps the go-minor group with 1 update in the /apps/cli-go/pkg directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go). Updates `google.golang.org/grpc` from 1.83.0 to 1.83.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's releases</a>.</em></p> <blockquote> <h2>Release 1.83.1</h2> <h1>Security</h1> <ul> <li>xds/rbac: Fix a bug where nested <code>Principal</code> or <code>Permission</code> rules with <code>:scheme</code> or <code>grpc-</code> prefixed header matchers were not rejected, which could cause DENY rules to fail open. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9258">#9258</a>) <ul> <li>Special Thanks: <a href="https://github.com/nvxbug"><code>@nvxbug</code></a></li> </ul> </li> <li>xds/rbac: Fix a bug where the <code>host</code> header matcher was not being replaced with <code>:authority</code> in nested <code>Principal</code> or <code>Permission</code> rules. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9258">#9258</a>) <ul> <li>Special Thanks: <a href="https://github.com/nvxbug"><code>@nvxbug</code></a></li> </ul> </li> <li>xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as <code>X-Role</code>, matched no header, which could cause DENY rules to fail open. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9332">#9332</a>) <ul> <li>Special Thanks: <a href="https://github.com/alimony"><code>@alimony</code></a></li> </ul> </li> <li>xds/rbac: Fix a bug where a <code>:scheme</code> or <code>grpc-</code> prefixed header matcher was accepted when its name was not lowercase. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9332">#9332</a>) <ul> <li>Special Thanks: <a href="https://github.com/alimony"><code>@alimony</code></a></li> </ul> </li> <li>xds/rbac: Fix a bug where a <code>Host</code> header matcher was not replaced with <code>:authority</code>. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9332">#9332</a>) <ul> <li>Special Thanks: <a href="https://github.com/alimony"><code>@alimony</code></a></li> </ul> </li> </ul> <h1>Performance</h1> <ul> <li>transport: Restrict memory overhead of buffering small data frames. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9331">#9331</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/grpc/grpc-go/commit/1550d9e0cddb30ce99e61a2102e8294a49461e5e"><code>1550d9e</code></a> Change version to 1.83.1 (<a href="https://redirect.github.com/grpc/grpc-go/issues/9336">#9336</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/ebba6f3f1b206e2b4dc4d1d5a96d18430302c2fe"><code>ebba6f3</code></a> Cherry-pick <a href="https://redirect.github.com/grpc/grpc-go/issues/9258">#9258</a> and <a href="https://redirect.github.com/grpc/grpc-go/issues/9332">#9332</a> into v1.83.x (<a href="https://redirect.github.com/grpc/grpc-go/issues/9335">#9335</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77"><code>8cfeca0</code></a> Cherry-pick <a href="https://redirect.github.com/grpc/grpc-go/issues/9331">#9331</a> to v1.83.x (<a href="https://redirect.github.com/grpc/grpc-go/issues/9333">#9333</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/dec6951305e88906696f1d0a00dd2439363bc708"><code>dec6951</code></a> Change version to 1.83.1-dev (<a href="https://redirect.github.com/grpc/grpc-go/issues/9229">#9229</a>)</li> <li>See full diff in <a href="https://github.com/grpc/grpc-go/compare/v1.83.0...v1.83.1">compare view</a></li> </ul> </details> <br /> Updates `google.golang.org/grpc` from 1.83.0 to 1.83.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's releases</a>.</em></p> <blockquote> <h2>Release 1.83.1</h2> <h1>Security</h1> <ul> <li>xds/rbac: Fix a bug where nested <code>Principal</code> or <code>Permission</code> rules with <code>:scheme</code> or <code>grpc-</code> prefixed header matchers were not rejected, which could cause DENY rules to fail open. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9258">#9258</a>) <ul> <li>Special Thanks: <a href="https://github.com/nvxbug"><code>@nvxbug</code></a></li> </ul> </li> <li>xds/rbac: Fix a bug where the <code>host</code> header matcher was not being replaced with <code>:authority</code> in nested <code>Principal</code> or <code>Permission</code> rules. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9258">#9258</a>) <ul> <li>Special Thanks: <a href="https://github.com/nvxbug"><code>@nvxbug</code></a></li> </ul> </li> <li>xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as <code>X-Role</code>, matched no header, which could cause DENY rules to fail open. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9332">#9332</a>) <ul> <li>Special Thanks: <a href="https://github.com/alimony"><code>@alimony</code></a></li> </ul> </li> <li>xds/rbac: Fix a bug where a <code>:scheme</code> or <code>grpc-</code> prefixed header matcher was accepted when its name was not lowercase. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9332">#9332</a>) <ul> <li>Special Thanks: <a href="https://github.com/alimony"><code>@alimony</code></a></li> </ul> </li> <li>xds/rbac: Fix a bug where a <code>Host</code> header matcher was not replaced with <code>:authority</code>. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9332">#9332</a>) <ul> <li>Special Thanks: <a href="https://github.com/alimony"><code>@alimony</code></a></li> </ul> </li> </ul> <h1>Performance</h1> <ul> <li>transport: Restrict memory overhead of buffering small data frames. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9331">#9331</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/grpc/grpc-go/commit/1550d9e0cddb30ce99e61a2102e8294a49461e5e"><code>1550d9e</code></a> Change version to 1.83.1 (<a href="https://redirect.github.com/grpc/grpc-go/issues/9336">#9336</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/ebba6f3f1b206e2b4dc4d1d5a96d18430302c2fe"><code>ebba6f3</code></a> Cherry-pick <a href="https://redirect.github.com/grpc/grpc-go/issues/9258">#9258</a> and <a href="https://redirect.github.com/grpc/grpc-go/issues/9332">#9332</a> into v1.83.x (<a href="https://redirect.github.com/grpc/grpc-go/issues/9335">#9335</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77"><code>8cfeca0</code></a> Cherry-pick <a href="https://redirect.github.com/grpc/grpc-go/issues/9331">#9331</a> to v1.83.x (<a href="https://redirect.github.com/grpc/grpc-go/issues/9333">#9333</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/dec6951305e88906696f1d0a00dd2439363bc708"><code>dec6951</code></a> Change version to 1.83.1-dev (<a href="https://redirect.github.com/grpc/grpc-go/issues/9229">#9229</a>)</li> <li>See full diff in <a href="https://github.com/grpc/grpc-go/compare/v1.83.0...v1.83.1">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

This PR was automatically created to sync API types from the infrastructure repository. Changes were detected in the generated API code after syncing with the latest spec from infrastructure. Co-authored-by: supabase-cli-releaser[bot] <246109035+supabase-cli-releaser[bot]@users.noreply.github.com>

## Summary - Replace the runtime REST and SSE daemon protocol with a static control plane exposing owner discovery, session-fenced shutdown, and same-version Effect RPC over HTTP and NDJSON. - Use the immutable, unique CLI version as the sole runtime compatibility identity; source execution uses the explicit 0.0.0-dev development sentinel. - Make an incompatible CLI version an explicit parent-owned full stack stop/start authorized only by supabase start; connect-only and ordinary child paths report the typed upgrade requirement without restarting the live owner. - Preserve managed data, document and launch metadata, runtime selection, pinned service versions, raw exclusions, and sticky ports across the upgrade restart. - Serialize startup, runtime scope ownership, terminal persistence, and shutdown through one Effect Queue-backed SupervisorSession actor, releasing the control listener last across Node, Bun, and compiled Bun runtimes. - Update CLI consumers, error reporting, integration helpers, targeted process coverage, and durable architecture documentation for the single-protocol cutover. ## Linked issue None. ## Reviewer context This intentionally has no legacy protocol window, compatibility adapter, adoption path, or in-place supervisor swap. Runtime RPC is a same-version boundary; owner discovery and session-fenced shutdown remain the stable cross-build protocol. Upgrading through supabase start restarts the complete stack, so active application connections and tooling streams disconnect briefly while durable state and launch selections remain intact.

## Summary - remove the remaining Nx configuration, package metadata, inference plugin workspace, dependencies, cache ignores, and lockfile graph - update current contributor guidance to use package scripts and root-owned Turbo tasks for execution and dependency inspection - preserve the build, generation, quality, live, auxiliary, and test graphs established by the preceding Turborepo migrations ## Context PR #6343 merged while this change was in progress, so this branch was rebased onto the updated `develop` branch containing its final live and auxiliary task migration. Task execution is now owned entirely by package scripts and Turbo. Affected execution, persistent cache storage, and remote caching remain separate follow-up optimizations.

This PR was automatically created to sync the generated `@supabase/api` package with the latest Management API OpenAPI document. Changes were detected in the upstream OpenAPI documents exposed by `https://api.supabase.com/api/v1-json` and `https://api.supabase.com/api/v2-json`. Co-authored-by: jgoux <1443499+jgoux@users.noreply.github.com>

…dates (#6320) Bumps the docker-minor group with 5 updates in the /apps/cli-go/pkg/config/templates directory: | Package | From | To | | --- | --- | --- | | postgrest/postgrest | `v16.1` | `v16.2` | | supabase/studio | `2026.08.17-sha-0c1da8f` | `2026.08.24-sha-8ec45b2` | | supabase/realtime | `v2.129.3` | `v2.129.9` | | supabase/storage-api | `v1.70.3` | `v1.71.0` | | supabase/logflare | `1.50.4` | `1.50.6` | Updates `postgrest/postgrest` from v16.1 to v16.2 Updates `supabase/studio` from 2026.08.17-sha-0c1da8f to 2026.08.24-sha-8ec45b2 Updates `supabase/realtime` from v2.129.3 to v2.129.9 Updates `supabase/storage-api` from v1.70.3 to v1.71.0 Updates `supabase/logflare` from 1.50.4 to 1.50.6 Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Julien Goux <hi@jgoux.dev>

This PR was automatically created to sync the generated `@supabase/api` package with the latest Management API OpenAPI document. Changes were detected in the upstream OpenAPI documents exposed by `https://api.supabase.com/api/v1-json` and `https://api.supabase.com/api/v2-json`. Co-authored-by: jgoux <1443499+jgoux@users.noreply.github.com>

This PR was automatically created to sync API types from the infrastructure repository. Changes were detected in the generated API code after syncing with the latest spec from infrastructure. Co-authored-by: supabase-cli-releaser[bot] <246109035+supabase-cli-releaser[bot]@users.noreply.github.com>

## Summary Defense-in-depth hardening for the automated release-notes generator (`propose-release-notes.yml` → `apps/cli/scripts/propose-release-notes.ts`), which runs the Claude Agent SDK with `Bash` + `WebFetch`/`WebSearch` and feeds it the semantic-release changelog block (built from contributor commit subjects / PR titles) plus PR bodies and linked issues it fetches at runtime — all attacker-influenceable content, previously with no injection guard. This PR adds an explicit **trust boundary** to `tools/release/release-notes-prompt.md`: - A top-of-file section establishing that the changelog block and all fetched PR/issue/web content are **untrusted data to be summarized, never instructions to obey**. - Rules that override embedded instructions: don't act on injected commands; never disclose env vars / secrets / tokens; restrict `Bash` to read-only `gh` GETs on `supabase/cli`; restrict `WebFetch`/`WebSearch` to `github.com/supabase/cli`; produce only the release-notes markdown. - Inline reminders at the two points where untrusted content enters (the changelog block and the PR-investigation step). The `{{PASTE_SEMANTIC_RELEASE_BLOCK_HERE}}` placeholder is unchanged, so the generator's template check and output contract are unaffected. ## Scope / follow-up This is **defense-in-depth only** — prompt guards are best-effort against a determined injection. The stronger, structural containment is deliberately **left for a follow-up**: 1. Separate the write-capable GitHub App token (`GH_TOKEN`, `contents`/`pull-requests: write` on the protected default branch) from the agent's process — generate notes in an agent-only step with no GH token, then push/open the PR in a separate step that runs no model. 2. Drop `Bash` (and ideally `WebFetch`) from the agent's `allowedTools`, pre-fetching the PR/issue data with trusted code instead — removing the shell/network exfiltration primitive. Context: surfaced during the security review of the AI-review pipeline (#6358); the release-notes workflow shares the "untrusted content + secrets in an agentic CI job" class of exposure, gated behind a maintainer-cut stable release rather than per-PR.

… (CLI-2230) (#6339) ## What changed Implements [CLI-2230](https://linear.app/supabase/issue/CLI-2230/create-a-toprojectconfig-function-that-is-exported-from-the-config): the hosted-project subset type `ProjectConfig` and its normalizers, exported from `@supabase/config`'s pure (browser-safe) entrypoint so the CLI and Studio share one mapper. - **`fromConfigDocument(config)`** — projection of a `CliConfig` document (or any `EffectiveConfig`) down to the hosted sections (`api`, `auth`, `db`, `realtime`, `storage`, `workers`, `experimental`). - **`fromApiProjectConfig(input)`** — translation of a Management API v2 project-config response (full envelope, `data` object, or bare `data.attributes`). Registry-driven: 233 mapping rows mined from the legacy `config push` sync mappers (`config-sync/*.sync.ts`), covering renames (`rate_limit_otp` → `sign_in_sign_ups`), boolean inversions (`disable_signup`, `mailer_autoconfirm`), unit conversions (seconds/hours → Go duration strings, int64 bytes → BytesSize), the GoTrue key table (19 OAuth providers, 6 hooks, 5 SMS providers), and `x-secret` omission (the API only reports HMAC digests). Decode is lenient per ADR 0019 — unknown/API-ahead keys never fail; the raw attributes ride along as a **non-enumerable `_apiResponse`** (invisible to encodes, spreads, and structural walks; never persisted), with a registry-derived `unmappedApiFields()` reader. - **`toProjectConfig(source)`** — thin dispatcher over both (`{ cliConfig }` / `{ apiResponse }`). ### Operand widening (ruling on CLI-2230) `ProjectConfig` is deliberately **sparse** — an API response never mentions sections it doesn't manage, and flooding in schema defaults would fabricate drift. To make it a first-class operand of the comparison core, `BaseCliConfig` is replaced by the family-neutral `EffectiveConfig = DeepPartial<Omit<CliConfig, "remotes">>` on `subtractCliConfig`/`omitDefaultValues`. No runtime change — the subtraction walk already had the right absence semantics. Recorded in ADR 0018's 2026-08-26 addendum; the naming-rule generalization lands separately with CLI-2238 (#6335). ### apps/cli - A type-drift guard (`project-config-api-drift.unit.test.ts`) pins the generated `V2GetProjectConfigOutput` attributes against the package's lenient input schema: assignability (catches type widening) plus per-section key-set assertions (catch added/removed/renamed fields) — so OpenAPI drift fails compile before it can silently break the mapping. No runtime dependency on `packages/api` was added. - `ProjectConfigParseError` registered in the error-actionability table as `apiStatus` (a malformed platform response, not a user config mistake). ### Reviewer notes - Deliberate divergences from the legacy apply semantics are documented inline where they occur: API `null` → omit (sparse output has no local document to fall back to), `uri_allow_list` trimming, `smtp_host: ""` treated as disabled, `sms_autoconfirm` **not** inverted (matches `auth.sync.ts:1677/:2485` — only the mailer counterpart inverts). - An explicit `db_schema: ""` maps to `{ api: { enabled: false } }` only, mirroring `applyRemoteApiConfig`'s early return; an *absent* `db_schema` doesn't gate the sibling fields. - Follow-up candidate deliberately not in this PR: a parity test pinning the replicated legacy helpers (duration/BytesSize/parseUint16/envToMap/password charsets) against their `apps/cli` originals. (ADR 0019's attach helper *did* land in the second round below, as `attachApiResponse`.) ### Second review round (commit 93b4679) — adjudication record A two-set review (architect/engineer/security/DX + adversarial execution) ran against bdd607f. The registry mapping itself survived three independent verification passes with zero defects; every accepted finding about the surrounding surface is fixed in 93b4679: - **Secrets**: `fromConfigDocument` now deep-copies and omits every `x-secret` leaf (schema-derived, `lib/secret-paths.ts`) — decoded documents hold plaintext credentials, and the subtract composition rendered them as drift. - **Spelling convergence**: new registry `normalizeDocument` column canonicalizes document-side duration and byte-size spellings so both normalizers emit one form for one logical value. - **Leniency**: the mirror schema types every never-mapped field `Schema.Unknown`, so a platform type change on a field nothing reads can no longer fail every decode. - **Errors**: `ProjectConfigParseError` gained `message`/`detail`/`suggestion` (upgrade-then-report), schema-issue paths lift into `apiPath`, telemetry adds `fingerprint_suffix: "api_response"` + `has_suggestion`. - **Type-mismatch unification**: string rows, `smtp_host`/`smtp_port`, and CIDR entries now throw typed errors instead of fabricating values (`enabled: false`), vanishing silently, or partially filtering a security allowlist; `expectNumber` rejects non-finite. - **`_apiResponse`**: cloned + deep-frozen at attach (no caller aliasing); `attachApiResponse` export restores it across spread/clone round-trips; invisibility claim narrowed (serializers and walks — debug inspectors like Bun's `console.log` still print it; never log an API-sourced config). - **`unmappedApiFields`**: recursion depth cap; `unmappedSecretApiPaths` deny list (`external_figma_secret` — the one genuine orphan digest; the review's other two candidates don't exist in the legacy source). - **New guards/exports**: `registry-integrity.unit.test.ts` (all 233 rows' paths resolve against the schema ASTs, 470 generated cases); drift-guard key-set levels completed; `comparableProjectConfigPaths`/`isComparableProjectConfigPath` so diff consumers never hand-maintain field lists; `inverse` implementations dropped until the push mapper derives them. **Explicit rejections** (reviewed, not silently deferred): 1. *`alsoConsumes` static consumed-set*: "consumed" means known-to-this-registry-version, not mapped-on-this-run — an `alsoConsumes` sibling whose anchor didn't run stays suppressed by design and remains in `_apiResponse`. Documented in `walkUnmapped`. 2. *WeakMap sidecar for `_apiResponse`*: deferred — clone+freeze resolves the aliasing hazard and the narrowed docstring is honest; revisit if CLI-2156 consumption shows inspectors bite (ADR 0019 records the alternative). 3. *`fromCliConfig`/`fromApiResponse` renaming*: the shipped names are already recorded in ADR 0020 (#6335), Linear, and coordinated docs — symmetry isn't worth re-coordinating three artifacts. 4. *Branding `EffectiveConfig`*: took the ADR 0018 consequence note instead (widening removes the static every-section guarantee; callers own operand completeness). 5. *`ProjectConfigApiAttributes` placement* and *`"sideEffects": false`*: deferred to their owning issues with notes filed — CLI-2234 (export-surface audit) and CLI-2232 (verify the bundler claim against a built artifact). ### Verification round (commits 5f389c9 + 0424ac7) An executed verification pass over 93b4679 re-ran all prior attacks (10/10 now pass) and surfaced residuals, fixed in 0424ac7: - **Orphan digests were 3, not 1** — the generated `V1GetAuthServiceConfigOutput` contract (not the legacy interface) is the authority; `external_slack_secret`, `hook_after_user_created_secrets`, and `nimbus_oauth_client_secret` join the deny list, and a new apps/cli **contract-guard test** cross-checks every auth apiPath + secret-suffixed contract key against the registry (also closing the open-Record vacuity in the integrity test's auth checks). Registry rows are now exported from the package root to serve it. - **Clone/freeze regression fixed**: deep/cyclic/non-cloneable payloads now throw `ProjectConfigParseError` instead of raw `RangeError`/`DOMException` (depth-capped pre-walk, wrapped clone, cycle-guarded `deepFreeze`). - **README example rewritten and executed** (the previous snippet self-subtracted and filtered section names — always empty); secret-stripped projections prune emptied containers; a real phantom-drift pin replaces an agreeing-case test; `comparableProjectConfigPaths`' docstring narrowed to the section-level claim it delivers; ADR 0019 gained a dated addendum (attach helper, structural "verbatim", debug-inspector caveat). - **Documented-not-changed**: byte-size canonicalization quantizes at 4 significant digits symmetrically on both arms — sub-0.1% differences comparing equal is a deliberate property (user-authored spellings are exact). The merge commit resolves the pre-agreed README conflict with #6335 (their `## Naming` section wins, its "in flight" sentence flipped) and de-stales ADR 0020's phrasing, per the coordinated rebase checklist. Known external: root `check:all` fails on `@supabase/cli-go#lint:check` (5 gosec findings in Go files byte-identical to develop — develop-side/toolchain, not this PR). ### Drift-audit round (commit 492ee25) A 2026-08-27 audit compared the post-codex state against CLI-2230's design intent. All eight structural commitments verified intact (pure entrypoint, no `packages/api` dependency, sparse output + `EffectiveConfig`, ADR 0019 guardrails, registry-driven with `inverse` unimplemented, purity graph, naming, secret stripping). Three executed repros surfaced semantic drift introduced by the codex rounds; fixed here: - **Leniency**: `JSON.parse('{"x":1e400}')` yields `Infinity`, so the round-12 non-finite pre-decode rejection hard-failed a real JSON payload on an *unknown* field (mis-bucketed as `caller_misuse`). The walk now rejects only bigint/`undefined`/`NaN` (values `JSON.parse` cannot produce); non-finite values decode and surface as `null` from `unmappedApiFields` (scalars and inside array leaves, identity preserved for all-finite arrays). ADR 0019 gains a dated leniency-boundary addendum. - **SMTP absence semantics**: an absent `smtp_host` previously counted as the disabled sentinel, silently dropping `smtp_user`/`smtp_admin_email`/`rate_limit.email_sent` from both the output and `unmappedApiFields` — contradicting the SMS absent-vs-sentinel rule beside it. Absence now says nothing; only the explicit `""`/`null` legacy sentinel disables (three-state, extended to the `email_sent` cross-section rule). - **Convergence-predictor ruling (ADR 0021)**: the codex rounds had incrementally turned both normalizers into *post-push convergence predictors* (SMS provider precedence flips extra enabled providers, disabled-sentinel pruning, `null`-gated booleans, CSV/uint/duration canonicalization) — defensible (it kills phantom drift for CLI-2156) but never adjudicated or documented. Ruling: **accepted**, now recorded in ADR 0021, the `ProjectConfig`/`fromConfigDocument`/`fromApiProjectConfig` docstrings, and the README ("not a verbatim representation" caveat). - **Guards**: the three hand-written sentinel/precedence tables (`DISABLED_SENTINEL_PRUNES`, `DISABLED_SENTINEL_ENTRY_SWEEPS`, `SMS_PROVIDER_PUSH_PRECEDENCE`) now resolve every path/key against the schema ASTs in `registry-integrity` — previously a schema rename silently no-opped them — and the SMS precedence order is pinned against the legacy push switch (`auth.sync.ts:2498-2539`). - Residual cleanups: the stale `Math.trunc` comment above the fraction arithmetic (round-11/14 artifact the round-20 revert missed), `ReadonlyJsonValue` exported (it appears in public types), `smtpExplicitlyDisabledInAttributes` simplified to mirror `smsProviderExplicitlyUnset`, ADR index gains 0020/0021. An engineer-review pass over the fix diff verified every change; its findings (the `email_sent` asymmetry, stale ADR citations, formatter gate, doc phrasing) are folded in. 984/984 package tests, 461/461 apps/cli guard tests, typechecks clean both packages. Follow-ups filed so they survive CLI-2230 closing: [CLI-2266](https://linear.app/supabase/issue/CLI-2266/derive-the-config-push-mapper-from-the-projectconfig-mapping-registry) (registry-derived push mapper — carries the three requirements previously parked as CLI-2230 comments) and [CLI-2267](https://linear.app/supabase/issue/CLI-2267/pin-supabaseconfigs-replicated-legacy-parsers-with-parity-fixtures-in) (parity fixtures pinning the replicated legacy parsers against `config-sync/*`). Fixes CLI-2230 🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Summary Replaces the Codex GitHub App's per-push auto-review churn (often 30–40 short rounds per PR) with an in-repo pipeline that reviews each PR **exactly once**, unless a maintainer explicitly re-runs it. **Pipeline** (`.github/workflows/ai-review.yml`; full design + security model in `.github/ai-review/README.md`): 1. **resolve** — decides whether to run: once-per-PR dedup (bot-authored marker), draft/bot/fork skips for auto triggers, `/ai-review` authorization (requires repo **write/admin** via effective-permission lookup), diff-size guard. Runs only trusted default-branch code. 2. **claude-review** — Claude Code headless (`claude-fable-5`), one exhaustive pass, read-only tools, JSON validated against `findings.schema.json`. 3. **codex-review** — `openai/codex-action` (`gpt-5.6-sol`, drop-sudo + read-only sandbox): independent review **plus** adjudication of every Claude finding (confirmed / refuted-with-evidence / uncertain), merged into `merged-review.schema.json`. 4. **post-review** — deterministic Bun script posts **one** consolidated PR review (`COMMENT`, advisory only): inline comments for anchorable findings, refuted findings preserved in a collapsed section (never silently dropped), verdict counts computed locally (not trusted from the model). Re-runs supersede the prior review. **Once-per-PR**: no `synchronize` trigger, bot-authored marker dedup, per-PR concurrency (non-command comments can't cancel an in-flight run). Re-run only via `/ai-review` (maintainers) or `workflow_dispatch`. ## Security model This ran through security + engineering review (twice). A critical secret-exfiltration path was found and closed; the design now enforces: - **Model jobs never execute PR-authored code.** The PR head is checked out only as read-only review subject matter (`claude` reads it with Read/Grep/Glob under `--bare`/`--strict-mcp-config`); every executed file — prompts, schemas, the validator script — comes from a separate trusted default-branch checkout, and no `bun` process ever runs with a cwd inside the PR checkout (so a PR-authored `bunfig.toml`/`.env` can't preload code). npm installs are config-isolated and version-pinned; Codex reviews from `/tmp` with no PR checkout at all. - **Least privilege**: top-level `permissions: {}`; model jobs hold no write scope; the only write-capable job (`post-review`) runs base-branch code exclusively. All actions SHA-pinned. - **Output is scrubbed**: model-provided text is sanitized (mentions/refs/HTML neutralized, `file` field guarded against markdown breakout) and secret-pattern-redacted before it's posted or uploaded as an artifact (defense-in-depth; a dedicated rotatable key is the real containment — see README). - Advisory-only (`COMMENT`), never a required check, never runs in the merge queue. ## Rollout (shadow mode) The `pull_request` trigger ships **commented out**. Plan: add a dedicated `OPENAI_API_KEY` secret (and ideally a dedicated `ANTHROPIC_API_KEY` rather than the shared release-notes key), tune prompts against real PRs via `workflow_dispatch`, then enable the trigger and switch the Codex app to manual-only simultaneously. Steps + caveats in the README. ## Notes for reviewers - New `.github/workflows/github-scripts-ci.yml` finally runs the `.github/scripts` test suites + type-check in CI (they ran nowhere before — this also covers the pre-existing `contribution-gate` tests). - Requires a new `OPENAI_API_KEY` repo secret; `ANTHROPIC_API_KEY` already exists.

Two CI fixes for the AI-review pipeline (#6358), both surfaced immediately after merge. ## 1. `Claude review` job fails at "Fetch PR diff and metadata" The first live `/ai-review` run failed with `fatal: not a git repository`. The `claude-review` job checks out into **subdirectories** (`pr/` for the PR head, `trusted/` for the base), so `$GITHUB_WORKSPACE` itself isn't a git repo — and `gh pr diff`/`gh pr view` infer the repo from the current directory's git remote. Fix: pass `--repo "$GITHUB_REPOSITORY"` explicitly at both `gh` call sites (claude-review and, defensively, codex-review) so `gh` never depends on cwd. ## 2. `Test and type-check` (github-scripts-ci) times out The shared `./.github/actions/setup` installs the full workspace + Go toolchain via mise (~9–10 min), which raced the job's `timeout-minutes: 10` and got cancelled on a cold cache (the setup step never finished; tests/type-check never ran). Raised to 20 min. Noted inline that the check is heavier than it needs to be for two scripts — slimming the setup is a possible follow-up.

## Summary Completes the command family with the three remaining subcommands: - `workers list` — this project's workers. - `workers status` — one worker in detail. - `workers delete` — remove a worker, with confirmation. All three reuse the API client and output helpers introduced in #6262, so this is the smallest layer of the stack. **Stack 4 of 4**, on top of `workers push` (#6262). ## Linked issue FUNC-753 (Linear). Supabase maintainer, exempt from the `open-for-contribution` flow. ## Checklist - [x] The PR title follows [Conventional Commits](https://www.conventionalcommits.org/)

## Summary Set up Effect-aware Oxlint for `packages/stack` and `packages/process-compose` using the Effect-recommended Oxlint preset and TypeScript plugin. The scoped check is wired into the monorepo task graph and denies warnings, matching the global Oxlint policy. The generic pass excludes these two packages while the scoped config extends the generic ruleset, so generic and Effect rules each run exactly once without bringing Effect lint into `apps/cli`. Remediate the existing scoped diagnostics in reviewable waves: typed Effect failures and schema decoding, reusable Effect and Stream service values, lifecycle-safe transport cleanup, and focused test-boundary cleanup. Persisted managed-stack documents and identity markers now encode through the same schemas used to read them. The merged #6303 transport architecture remains authoritative. Exact `apps/cli` callsites were updated where the stack Effect service API changed, but CLI code is intentionally not an Effect-lint target yet. Native Node, Bun, Deno, and Promise boundaries retain narrow documented suppressions where replacing the host API or dependency-ordered layer provisioning would worsen lifecycle semantics. Supersedes #6304

This PR was automatically created to sync API types from the infrastructure repository. Changes were detected in the generated API code after syncing with the latest spec from infrastructure. Co-authored-by: supabase-cli-releaser[bot] <246109035+supabase-cli-releaser[bot]@users.noreply.github.com>

… cap (#6365) Refines the AI review pipeline (built in #6358) into its intended shape, and removes the size limit. Validated end-to-end via a temporary self-test trigger during development (now removed — the pipeline ships in shadow mode). ## What changed - **Parallel independent reviews + a dedicated adjudicator.** `claude-review` and `codex-review` now run **in parallel** (Codex no longer depends on Claude); a new **`adjudicate`** job then reconciles both finding sets, verifying each finding by **reading the real code** (PR head checked out read-only), and `post-review` posts the merged result. This replaces the old single Codex job that did both an independent pass and adjudication sequentially — cutting the critical path and giving each job its own timeout. - **No size cap.** Removed the preemptive "too large" guard. The models review agentically (reading the diff and files via their own tools over many turns, like the local CLI), so PRs of any size are reviewed — very large diffs best-effort within the model's context/turn budget. - **Runtime fixes** surfaced by real runs: `gh pr diff --repo` (subdir checkouts), npm config isolation for the Claude CLI install, `set +e` so the Claude retry loop isn't killed by `bash -e`, and the reviewer model set to `claude-opus-5` (the account's API key returns 404 for `claude-fable-5`). Workflow + prompts only for the split (no TS/schema changes — Codex's independent findings reuse `findings.schema.json`; the adjudicator still emits `merged-review.json`). Ships in **shadow mode**: no `pull_request` trigger, only `workflow_dispatch` / maintainer `/ai-review`. ## Notes for reviewers - Two first-run unknowns for the adjudicator (can't verify offline): whether Codex's read-only sandbox can read the `pr/` subtree, and whether it picks up a nested `pr/AGENTS.md` (guarded in the prompt; blast radius bounded — read-only + no network + key-proxied + output-redacted). - Requires the org's Anthropic/OpenAI spend limit to be sufficient, or the model jobs 429. --------- Co-authored-by: Julien Goux <hi@jgoux.dev>

…e on >=1 review (#6380) Follow-up to the AI-review pipeline. Two changes. ## 1. Downgrade `codex-action` v1.12 → v1.11 On the large PR (#6366, ~130k-token diff) the `codex-review` step ran to completion — Codex finished the turn, wrote its output file, printed its final message and token count — then **sat idle until the 45-minute job timeout**, discarding a completed review. That is a confirmed v1.12 regression: **openai/codex-action#150** ("v1.12: Linux run never returns after the turn completes; job dies on timeout with the output file already written"). The reporter confirms **v1.11 handles the same heavy workload cleanly**, and there is no released fix above v1.12. v1.11 (`52fe01ec…`) supports every input we use (`safety-strategy`, `sandbox`, `output-schema-file`, `output-file`, `codex-version`, `working-directory`, `effort`), so this is a drop-in pin change in both Codex jobs. ## 2. Adjudicate on ≥1 independent review (graceful degradation) Previously `adjudicate` required BOTH `claude-review` and `codex-review` to succeed, so one flaky model job sank the whole review. Now it runs when **at least one** independent pass succeeded: each findings download is guarded by its job's result, and the stage step substitutes an empty findings set for any review that didn't complete, so the adjudicator reconciles one or two. The prompt notes the one-review case and records it in its summary. Together: a Codex hiccup no longer wastes a 45-minute run or blocks Claude's (working) review from being posted.

## Summary - prepare `/run/postgresql` for the Linux host UID/GID before the Docker stack drops privileges - preserve the existing root and non-Linux startup paths - cover the privilege-drop ordering with a Linux-specific regression test ## Context The refreshed slim Postgres image listens on a Unix socket under `/run/postgresql`. The stack wrapper bypassed the image root setup when switching to the host user on Linux, so Postgres restarted with a socket lock-file permission error. That readiness failure cascaded into the three e2e startup timeouts visible on #6400.

This PR was automatically created to sync API types from the infrastructure repository. Changes were detected in the generated API code after syncing with the latest spec from infrastructure. Co-authored-by: supabase-cli-releaser[bot] <246109035+supabase-cli-releaser[bot]@users.noreply.github.com> Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>

## Summary - consolidate fragmented Docker coverage into one public 13-service stack journey - verify canonical slim images, representative product behavior, and restart persistence - prove two automatically allocated sibling stacks keep ports, data, ownership, and cleanup isolated ## Context This is a test-only qualification change for CLI-2113. The existing stack implementation already satisfied the complete Docker graph and sibling-isolation contracts; the new journey makes those release-critical guarantees observable through the public package surface.

## TL;DR fixes the CLI rejecting dashboard issued `sbp_v0_` access tokens with `LegacyInvalidAccessTokenError` which was caused by the access token regex pattern only matching the `sbp_` and `sbp_oauth_` prefixes and is now fixed by widening the legacy validator to also accept the `sbp_v0_` prefix... ## ref: - closes: #6348 --------- Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>

## Summary Qualifies the first Dockerless native vertical slice through the public `@supabase/stack` surface: isolated native prefetch, lazy and eager activation, real Auth and PostgREST flows, PostgreSQL extensions, restart preservation, retryable typed preparation failure, and exact resource cleanup. Adds a consumer-selected cache root to Promise-based prefetch, exposes the public stack error type, and preserves lazy proxy activation across a whole-stack restart without weakening explicit per-service stops.

## TL;DR fixes `db reset, db lint, db diff`, and `migration down` silently skipping a user schema when its oid also appears in another catalog which was caused by joining `pg_depend` on objid without the `classid` that scopes `oids` to a single catalog now fixed by constraining the join to `pg_catalog.pg_namespace` rows in every copy of the query. Resets now drop schemas that earlier versions silently skipped.... ## ref: - closes: #6375

Adds one sentence to the Pull Requests section of `AGENTS.md`: this repo is public, so PR descriptions, issues, and code comments keep internal content out: absolute production metrics (percentages, ratios, or relative change instead), internal decision detail (vendor, legal, pricing, or strategy discussions), and competitor names (protocol identifiers such as user-agent strings are fine). That context goes in the linked Linear issue. Same rule as the supabase monorepo's agent instructions (supabase/supabase#49750); an agent-authored PR there had quoted absolute internal event volumes in its description.

## TL;DR adds live e2e coverage for the `services` command and `storage mv` ## whats introduced? - `services`: links the project and proves the postgres remote version lands in the json output proves the table renders that value in the LINKED cell, where a plain substring match would pass vacuously - `storage mv`: uploads an object, moves it through the real move endpoint, and proves via the listing that the destination exists and the source is gone closes the storage family, since ls, cp and rm already have coverage - `db pull`: deflakes the shipped live test, pull exits nonzero when nothing changed by design, so the test now seeds remote-only schema through db query and proves the initial pull writes it back as a migration ## ref: - closes: CLI-2263 CLI-2264 CLI-2278

## TL;DR adds live e2e coverage for `migration up` and `migration repair`, closing the migration family... ## whats introduced? - `migration up`: applies a test written migration to the remote database, proven by the apply banner and the history row migration list reads back - `migration repair`: inserts a history row with status applied, proves it through migration list, then removes it with status reverted and proves the absence ## ref: - closes: CLI-2269

This PR was automatically created to sync API types from the infrastructure repository. Changes were detected in the generated API code after syncing with the latest spec from infrastructure. Co-authored-by: supabase-cli-releaser[bot] <246109035+supabase-cli-releaser[bot]@users.noreply.github.com>

) ## Summary Adds an opt-in ambient env flag `SUPABASE_USE_SLIM_IMAGES` (`true` or `1`) that rewrites local-stack Docker image names from the embedded Dockerfile pins to the slim `ghcr.io/supabase/cli/` builds. Published slim postgres/storage/auth/edge-runtime images now match the docker.io contracts (root start, `sh`/`wget`), so the flag is an image-name rewrite rather than a second runtime. Spec builders still branch for services that remain distroless (auth/studio/pg-meta healthchecks, pooler/realtime/analytics busybox wget, Vector `secretFiles`). Kong, the `differ`/`migra`/`pgprove` job images, PG14, OrioleDB, historical 15.x pins, and `deno_version = 1` stay on docker.io. Slim refs skip `SUPABASE_INTERNAL_IMAGE_REGISTRY`. With the flag unset, image *names* stay on docker.io. This PR also bumps the shared Dockerfile pins (flag-off and flag-on use the same versions) and syncs stack `DEFAULT_VERSIONS`: - postgres `17.6.1.165` → `17.6.1.167` - postgres 15 fallback `15.8.1.085` → `15.14.1.167` (slim-services [#290](supabase/slim-services#290); published as `ghcr.io/supabase/cli/postgres:15.14.1.167`) - pooler `2.9.7` → `2.9.12` - realtime `v2.129.9` → `v2.130.0` - storage `v1.71.0` → `v1.72.1` Majors 13/15 slim-translate that current PG15 pin when the flag is on. Storage `v1.72.1` prefers `IMAGE_TRANSFORMATION_ENABLED` over `ENABLE_IMAGE_TRANSFORMATION`, so the CLI now emits both keys on every Storage spec (not slim-only). The rewrite always targets `ghcr.io/supabase/cli/`. The stack catalog's vector/pooler mirrors (`ghcr.io/supabase/{vector,supavisor}`) are not used. This is the code layer of a stack that splits the previous mixed review on #6329. Docs live in #6383. ## Linked issue Closes # - [x] The linked issue is **open** and carries the `open-for-contribution` label (or I'm a Supabase maintainer). ## Checklist - [x] The PR title follows [Conventional Commits](https://www.conventionalcommits.org/) (e.g. `fix(cli): …`). - [x] Tests added or updated for the change. - [ ] From the repository root, `pnpm check:all` passes; relevant package tests pass for every touched workspace, and `pnpm types:check` passes for each touched TypeScript workspace (or workspace declaring it). --------- Co-authored-by: Cursor <cursoragent@cursor.com>

## What kind of change does this PR introduce? Feature — flips `packages/config` to `private: false`, activating the publish half of the release pipeline that landed in #6381, and drops the README's "not yet published" caveat. ## What is the current behavior? `@supabase/config` is `private: true`: every push touching `packages/config/**` rehearses the plan half of the Release Config workflow (version computation, build, pack, type-surface gate), but `should_release` stays false and nothing publishes. npm currently hosts only a `0.0.0` placeholder stub. ## What is the new behavior? Merging this PR is the package's first real release. The squash commit (`feat(config)`) is the first releasable commit since the `config-v0.0.0` baseline tag, so the Release Config workflow will: 1. plan **0.1.0** (minor over the 0.0.0 stub baseline), 2. pack the tarball and generate the approval evidence — since the stub contains no `.d.ts`, the type-surface gate renders the **entire public surface as additions** for the approver, 3. wait on `config-release` environment approval (required reviewers configured), 4. publish that exact tarball via OIDC trusted publishing, push `config-v0.1.0`, and create the GitHub release (never repo-"latest"). Go-live preconditions, all in place: npm trusted publisher configured and bootstrap token revoked (verified with infra/security), `config-release` environment armed with required reviewers, `config-v0.0.0` baseline tag pushed at ed81a1c and verified green (plan run reports "0 commits: no release" pre-merge). Part of CLI-2169.

This PR was automatically created to sync API types from the infrastructure repository. Changes were detected in the generated API code after syncing with the latest spec from infrastructure. Co-authored-by: supabase-cli-releaser[bot] <246109035+supabase-cli-releaser[bot]@users.noreply.github.com>

#6429) Bumps the go-minor group with 3 updates in the /apps/cli-go directory: [github.com/posthog/posthog-go](https://github.com/posthog/posthog-go), [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) and [google.golang.org/grpc](https://github.com/grpc/grpc-go). Bumps the go-minor group with 1 update in the /apps/cli-go/pkg directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go). Updates `github.com/posthog/posthog-go` from 1.24.0 to 1.24.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/posthog/posthog-go/releases">github.com/posthog/posthog-go's releases</a>.</em></p> <blockquote> <h2>1.24.1</h2> <h2>Unreleased</h2> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/PostHog/posthog-go/blob/main/CHANGELOG.md">github.com/posthog/posthog-go's changelog</a>.</em></p> <blockquote> <h2>1.24.1</h2> <h3>Patch Changes</h3> <ul> <li>3d250c5: Return an empty feature flag snapshot without evaluating flags when <code>FlagKeys</code> is an explicit empty slice.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/PostHog/posthog-go/commit/5cfdbb4132e2923d9fd604f6157d03be8dd00485"><code>5cfdbb4</code></a> chore: release v1.24.1 [version bump] [skip ci]</li> <li><a href="https://github.com/PostHog/posthog-go/commit/3d250c57816f3d07cbafb489cd9333d2fc7650d1"><code>3d250c5</code></a> fix(flags): handle empty evaluation key scopes (<a href="https://redirect.github.com/posthog/posthog-go/issues/295">#295</a>)</li> <li><a href="https://github.com/PostHog/posthog-go/commit/d9a2e6ae838090241602e804bed357974d13456b"><code>d9a2e6a</code></a> refactor: unify property group evaluation paths (<a href="https://redirect.github.com/posthog/posthog-go/issues/291">#291</a>)</li> <li><a href="https://github.com/PostHog/posthog-go/commit/cb81811fda9f06e5d8e20865a84555d3b19b7144"><code>cb81811</code></a> ci: update flags project board workflow (<a href="https://redirect.github.com/posthog/posthog-go/issues/294">#294</a>)</li> <li>See full diff in <a href="https://github.com/posthog/posthog-go/compare/v1.24.0...v1.24.1">compare view</a></li> </ul> </details> <br /> Updates `go.opentelemetry.io/otel` from 1.45.0 to 1.46.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go/releases">go.opentelemetry.io/otel's releases</a>.</em></p> <blockquote> <h2>v1.46.0/v0.68.0/v0.22.0/v0.0.19</h2> <p>This release is the last to support <a href="https://go.dev/doc/go1.25">Go 1.25</a>. The next release will require at least <a href="https://go.dev/doc/go1.26">Go 1.26</a>.</p> <h3>Added</h3> <ul> <li>Support testing of <a href="https://go.dev/doc/go1.27">Go 1.27</a>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8811">#8811</a>)</li> <li>Support <code>http/json</code> protocol in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8273">#8273</a>, <a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8775">#8775</a>, <a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8831">#8831</a>)</li> <li>Add <code>Hasher</code> struct and methods in <code>go.opentelemetry.io/otel/attribute</code> to compute authoritative <code>Distinct</code> hashes incrementally for attribute filtering and deduplication. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8598">#8598</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Lazily evaluate filtered and dropped attributes on measurement hot paths in <code>go.opentelemetry.io/otel/sdk/metric</code> to avoid unnecessary attribute set allocations. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8598">#8598</a>)</li> <li>Add <code>ErrExporterShutdown</code> to <code>go.opentelemetry.io/otel/sdk/log</code> and return it from the <code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>, <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>, and <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code> exporters when <code>Export</code> is called after <code>Shutdown</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8773">#8773</a>)</li> <li>Clarify in <code>go.opentelemetry.io/otel/log</code> that calling <code>Logger.Enabled</code> is optional and that cached results can become stale. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8764">#8764</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Export dropped attribute counts in OTLP log records from <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code> and <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8829">#8829</a>)</li> <li>Name span events created from OpenTracing logs after the <code>event</code> log field, falling back to <code>log</code>, instead of always using an empty name in <code>go.opentelemetry.io/otel/bridge/opentracing</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8648">#8648</a>)</li> <li>Count exception attributes omitted due to the attribute count limit as dropped in <code>go.opentelemetry.io/otel/sdk/log</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8796">#8796</a>)</li> <li>Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in <code>go.opentelemetry.io/otel/sdk/log</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8797">#8797</a>)</li> <li>Fix a data race when span attributes are read concurrently in <code>go.opentelemetry.io/otel/sdk/trace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8706">#8706</a>)</li> <li>Prevent a panic in <code>(*Set).Filter</code> when called on a nil receiver in <code>go.opentelemetry.io/otel/attribute</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8792">#8792</a>)</li> <li>The simple span and log processors record <code>otel.sdk.processor.{span,log}.processed</code> when the record is submitted to the exporter instead of after the export completes, and no longer set <code>error.type</code> from the export outcome, in <code>go.opentelemetry.io/otel/sdk/trace</code> and <code>go.opentelemetry.io/otel/sdk/log</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8705">#8705</a>)</li> <li>Prevent <code>Resource.MarshalLog</code> from panicking on nil resources in <code>go.opentelemetry.io/otel/sdk/resource</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8758">#8758</a>)</li> </ul> <h2>What's Changed</h2> <ul> <li>chore(deps): update github/codeql-action action to v4.37.6 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8697">open-telemetry/opentelemetry-go#8697</a></li> <li>chore(deps): update module go.opentelemetry.io/collector/featuregate to v1.64.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8698">open-telemetry/opentelemetry-go#8698</a></li> <li>chore(deps): update golang.org/x/telemetry digest to bdd03c3 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8699">open-telemetry/opentelemetry-go#8699</a></li> <li>fix(deps): update module go.opentelemetry.io/collector/pdata to v1.64.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8700">open-telemetry/opentelemetry-go#8700</a></li> <li>chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.30.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8701">open-telemetry/opentelemetry-go#8701</a></li> <li>chore(deps): update module github.com/rogpeppe/go-internal to v1.16.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8702">open-telemetry/opentelemetry-go#8702</a></li> <li>chore(deps): update module github.com/cloudflare/circl to v1.6.5 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8703">open-telemetry/opentelemetry-go#8703</a></li> <li>Record processor.{span,log}.processed before invoking the exporter in simple processors by <a href="https://github.com/cijothomas"><code>@cijothomas</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8705">open-telemetry/opentelemetry-go#8705</a></li> <li>perf(sdk/metric): reduce benchmark suite execution time (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8683">#8683</a>) by <a href="https://github.com/dashpole"><code>@dashpole</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8688">open-telemetry/opentelemetry-go#8688</a></li> <li>chore(deps): update codspeedhq/action action to v5.0.3 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8710">open-telemetry/opentelemetry-go#8710</a></li> <li>attempt 2: Lazily compute filtered and dropped attributes by <a href="https://github.com/dashpole"><code>@dashpole</code></a> in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8598">open-telemetry/opentelemetry-go#8598</a></li> <li>fix(deps): update googleapis to c8921c7 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8712">open-telemetry/opentelemetry-go#8712</a></li> <li>chore(deps): update module github.com/santhosh-tekuri/jsonschema/v6 to v6.0.3 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8708">open-telemetry/opentelemetry-go#8708</a></li> <li>chore(deps): update github.com/charmbracelet/ultraviolet digest to 402eeaa by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8716">open-telemetry/opentelemetry-go#8716</a></li> <li>chore(deps): update module github.com/dlclark/regexp2/v2 to v2.6.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8715">open-telemetry/opentelemetry-go#8715</a></li> <li>chore(deps): update mvdan.cc/unparam digest to a64391f by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8717">open-telemetry/opentelemetry-go#8717</a></li> <li>fix(deps): update golang.org/x to a8b543c by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8720">open-telemetry/opentelemetry-go#8720</a></li> <li>fix(deps): update googleapis to ec0a776 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/open-telemetry/opentelemetry-go/pull/8719">open-telemetry/opentelemetry-go#8719</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel's changelog</a>.</em></p> <blockquote> <h2>[1.46.0/0.68.0/0.22.0/0.0.19] - 2026-08-25</h2> <p>This release is the last to support [Go 1.25]. The next release will require at least [Go 1.26].</p> <h3>Added</h3> <ul> <li>Support testing of [Go 1.27]. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8811">#8811</a>)</li> <li>Support <code>http/json</code> protocol in <code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8273">#8273</a>, <a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8775">#8775</a>, <a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8831">#8831</a>)</li> <li>Add <code>Hasher</code> struct and methods in <code>go.opentelemetry.io/otel/attribute</code> to compute authoritative <code>Distinct</code> hashes incrementally for attribute filtering and deduplication. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8598">#8598</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Lazily evaluate filtered and dropped attributes on measurement hot paths in <code>go.opentelemetry.io/otel/sdk/metric</code> to avoid unnecessary attribute set allocations. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8598">#8598</a>)</li> <li>Add <code>ErrExporterShutdown</code> to <code>go.opentelemetry.io/otel/sdk/log</code> and return it from the <code>go.opentelemetry.io/otel/exporters/stdout/stdoutlog</code>, <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>, and <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code> exporters when <code>Export</code> is called after <code>Shutdown</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8773">#8773</a>)</li> <li>Clarify in <code>go.opentelemetry.io/otel/log</code> that calling <code>Logger.Enabled</code> is optional and that cached results can become stale. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8764">#8764</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Export dropped attribute counts in OTLP log records from <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code> and <code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8829">#8829</a>)</li> <li>Name span events created from OpenTracing logs after the <code>event</code> log field, falling back to <code>log</code>, instead of always using an empty name in <code>go.opentelemetry.io/otel/bridge/opentracing</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8648">#8648</a>)</li> <li>Count exception attributes omitted due to the attribute count limit as dropped in <code>go.opentelemetry.io/otel/sdk/log</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8796">#8796</a>)</li> <li>Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in <code>go.opentelemetry.io/otel/sdk/log</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8797">#8797</a>)</li> <li>Fix a data race when span attributes are read concurrently in <code>go.opentelemetry.io/otel/sdk/trace</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8706">#8706</a>)</li> <li>Prevent a panic in <code>(*Set).Filter</code> when called on a nil receiver in <code>go.opentelemetry.io/otel/attribute</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8792">#8792</a>)</li> <li>The simple span and log processors record <code>otel.sdk.processor.{span,log}.processed</code> when the record is submitted to the exporter instead of after the export completes, and no longer set <code>error.type</code> from the export outcome, in <code>go.opentelemetry.io/otel/sdk/trace</code> and <code>go.opentelemetry.io/otel/sdk/log</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8705">#8705</a>)</li> <li>Prevent <code>Resource.MarshalLog</code> from panicking on nil resources in <code>go.opentelemetry.io/otel/sdk/resource</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8758">#8758</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/58db4c898f5b5594f8ba78f156475bf48486e2f2"><code>58db4c8</code></a> Release v1.46.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8858">#8858</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/524fc3c25f3b578a28f9ed10e685ac3567285e6b"><code>524fc3c</code></a> chore(deps): update golang.org/x/telemetry digest to 1f5465a (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8853">#8853</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/3b8ef6f6eacda76a1e6f20b4d7a8e95136fb29f1"><code>3b8ef6f</code></a> chore(deps): update codspeedhq/action action to v5.2.1 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8854">#8854</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/cfbeab547fb501fc239598e20a80054c13dbc7cb"><code>cfbeab5</code></a> attribute: clarify xxhash test purpose (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8753">#8753</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/3599b597202b0e3aa82c157fe6c3930e121ba0c7"><code>3599b59</code></a> sdk/log: Add interface stability markers (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8855">#8855</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/08d52dc720d967471eee7a6682c9e5d24400a7ed"><code>08d52dc</code></a> otlptracehttp: Accept quoted finite doubles in OTLP JSON (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8831">#8831</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/d720f5af01fb5cb448c1534171f1193b7e1270f7"><code>d720f5a</code></a> otlplog: export dropped attribute count (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8829">#8829</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/80fe23bd7774bce4a8cdff6af0c0b9e1382d45f9"><code>80fe23b</code></a> chore(deps): update module honnef.co/go/tools to v0.8.1 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8816">#8816</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/5337812ca9719aae921c20a8e794491590e1b328"><code>5337812</code></a> chore(deps): update codspeedhq/action action to v5.2.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8851">#8851</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-go/commit/2f73a3efde70227c5abf121bb8bd9d3a2a441c5a"><code>2f73a3e</code></a> chore(deps): update module github.com/uudashr/iface to v1.5.1 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-go/issues/8841">#8841</a>)</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.45.0...v1.46.0">compare view</a></li> </ul> </details> <br /> Updates `google.golang.org/grpc` from 1.83.1 to 1.83.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's releases</a>.</em></p> <blockquote> <h2>Release 1.83.2</h2> <h1>Security</h1> <ul> <li>server: Reject requests missing both <code>:authority</code> and <code>Host</code> headers with HTTP 400 and status <code>Internal</code>. (<a href="https://redirect.github.com/grpc/grpc-go/pull/9365">grpc/grpc-go#9365</a>) <ul> <li>Special Thanks: <a href="https://github.com/winklemad"><code>@winklemad</code></a></li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/grpc/grpc-go/commit/030ee8becb20ce4315d6bf2dfa26bdd876169dc4"><code>030ee8b</code></a> Update version to 1.83.2 (<a href="https://redirect.github.com/grpc/grpc-go/issues/9375">#9375</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4"><code>8668b69</code></a> cherry-pick <a href="https://redirect.github.com/grpc/grpc-go/issues/9365">#9365</a> to v1.83.x (<a href="https://redirect.github.com/grpc/grpc-go/issues/9366">#9366</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/a3e952d2b7c973b7ec6357676e55a2a9c9faaa0d"><code>a3e952d</code></a> cherry-pick <a href="https://redirect.github.com/grpc/grpc-go/issues/9346">#9346</a> to v1.83.x and update x/net dependency (<a href="https://redirect.github.com/grpc/grpc-go/issues/9369">#9369</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/58f8fd9a002536548ac96e34621d761b29cc4f3e"><code>58f8fd9</code></a> Change version to 1.83.2-dev (<a href="https://redirect.github.com/grpc/grpc-go/issues/9337">#9337</a>)</li> <li>See full diff in <a href="https://github.com/grpc/grpc-go/compare/v1.83.1...v1.83.2">compare view</a></li> </ul> </details> <br /> Updates `google.golang.org/grpc` from 1.83.1 to 1.83.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's releases</a>.</em></p> <blockquote> <h2>Release 1.83.2</h2> <h1>Security</h1> <ul> <li>server: Reject requests missing both <code>:authority</code> and <code>Host</code> headers with HTTP 400 and status <code>Internal</code>. (<a href="https://redirect.github.com/grpc/grpc-go/pull/9365">grpc/grpc-go#9365</a>) <ul> <li>Special Thanks: <a href="https://github.com/winklemad"><code>@winklemad</code></a></li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/grpc/grpc-go/commit/030ee8becb20ce4315d6bf2dfa26bdd876169dc4"><code>030ee8b</code></a> Update version to 1.83.2 (<a href="https://redirect.github.com/grpc/grpc-go/issues/9375">#9375</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4"><code>8668b69</code></a> cherry-pick <a href="https://redirect.github.com/grpc/grpc-go/issues/9365">#9365</a> to v1.83.x (<a href="https://redirect.github.com/grpc/grpc-go/issues/9366">#9366</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/a3e952d2b7c973b7ec6357676e55a2a9c9faaa0d"><code>a3e952d</code></a> cherry-pick <a href="https://redirect.github.com/grpc/grpc-go/issues/9346">#9346</a> to v1.83.x and update x/net dependency (<a href="https://redirect.github.com/grpc/grpc-go/issues/9369">#9369</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/58f8fd9a002536548ac96e34621d761b29cc4f3e"><code>58f8fd9</code></a> Change version to 1.83.2-dev (<a href="https://redirect.github.com/grpc/grpc-go/issues/9337">#9337</a>)</li> <li>See full diff in <a href="https://github.com/grpc/grpc-go/compare/v1.83.1...v1.83.2">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

## TL;DR fixes the CodeQL check blocking prod deploy & turning merges red which was caused by two new alerts on develop, and is now fixed by escaping HTML comment openers in the AI review sanitizer instead of stripping comments (stripping was not a fixpoint, so `<!--` re-formed an opener) and by dropping the `trace` field from the fallback 500 response in the functions serve template. The stack is still printed to the terminal by the existing `console.error`.... ## ref: - unblocks: #6416

#6430) Bumps the npm-major group with 28 updates in the / directory: | Package | From | To | | --- | --- | --- | | [verdaccio](https://github.com/verdaccio/verdaccio) | `6.9.3` | `6.10.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.4` | `8.2.2` | | [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.112.3` | `2.112.4` | | [jose](https://github.com/panva/jose) | `6.2.9` | `6.2.10` | | [@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript) | `0.3.234` | `0.3.246` | | [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.117.1` | `0.120.0` | | [@supabase/pg-delta](https://github.com/supabase/pg-delta) | `1.0.0-alpha.46` | `1.0.0-alpha.47` | | [@supabase/pg-topo](https://github.com/supabase/pg-toolbelt/tree/HEAD/packages/pg-topo) | `1.0.0-alpha.5` | `1.0.0-alpha.6` | | [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.49.1` | `5.51.2` | | [fumadocs-core](https://github.com/fuma-nama/fumadocs) | `16.14.4` | `16.15.1` | | [fumadocs-mdx](https://github.com/fuma-nama/fumadocs) | `15.2.3` | `15.3.1` | | [fumadocs-ui](https://github.com/fuma-nama/fumadocs) | `16.14.4` | `16.15.1` | | [next](https://github.com/vercel/next.js) | `16.3.1` | `16.3.3` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.3.0` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.4` | `19.2.5` | | [@effect/atom-react](https://github.com/Effect-TS/effect/tree/HEAD/packages/atom/react) | `4.0.0-rc.111` | `4.0.0-rc.112` | | [@effect/platform-bun](https://github.com/Effect-TS/effect/tree/HEAD/packages/platform-bun) | `4.0.0-rc.111` | `4.0.0-rc.112` | | [@effect/platform-node](https://github.com/Effect-TS/effect/tree/HEAD/packages/platform-node) | `4.0.0-rc.111` | `4.0.0-rc.112` | | [@effect/sql-pg](https://github.com/Effect-TS/effect/tree/HEAD/packages/sql-pg) | `4.0.0-rc.111` | `4.0.0-rc.112` | | [@effect/tsgo](https://github.com/Effect-TS/tsgo/tree/HEAD/_packages/tsgo) | `0.36.5` | `0.37.0` | | [@effect/vitest](https://github.com/Effect-TS/effect/tree/HEAD/packages/vitest) | `4.0.0-rc.111` | `4.0.0-rc.112` | | [@vitest/coverage-istanbul](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-istanbul) | `4.1.10` | `4.1.11` | | [effect](https://github.com/Effect-TS/effect/tree/HEAD/packages/effect) | `4.0.0-rc.111` | `4.0.0-rc.112` | | [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.63.0` | `0.65.0` | | [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.78.0` | `1.80.0` | | [tldts](https://github.com/remusao/tldts) | `6.1.86` | `7.4.11` | | [turbo](https://github.com/vercel/turborepo) | `2.10.11` | `2.10.12` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` | Updates `verdaccio` from 6.9.3 to 6.10.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/verdaccio/verdaccio/releases">verdaccio's releases</a>.</em></p> <blockquote> <h2>v6.10.0</h2> <h3>Minor Changes</h3> <ul> <li> <p>51c2733: Expose the optional legacy authentication cache for Verdaccio 6.x through <code>server.legacyAuthCache</code>.</p> <p>This feature is intended for performance-sensitive installations that still use legacy bearer tokens. When enabled, Verdaccio caches successful legacy token authentication results for a short period of time, so repeated requests using the same token do not need to run password verification through the authentication plugin every time. Concurrent requests for the same legacy token can also share the same in-flight authentication result.</p> <p>The cache is disabled by default, so existing installations keep their current authentication behavior unless they explicitly opt in. Basic authentication is not cached. If the cache is enabled, changed or revoked credentials may remain valid until the cached entry expires.</p> <p>Enable it in <code>config.yaml</code>:</p> <pre lang="yaml"><code>server: legacyAuthCache: enabled: true ttlMs: 15000 maxEntries: 1000 </code></pre> <p>Options:</p> <ul> <li><code>enabled</code>: enables the legacy token authentication cache. Default: <code>false</code>.</li> <li><code>ttlMs</code>: time in milliseconds before a cached validation expires. Default: <code>15000</code>.</li> <li><code>maxEntries</code>: maximum number of cached legacy tokens. Default: <code>1000</code>.</li> </ul> <p>See <a href="https://redirect.github.com/verdaccio/verdaccio/pull/6147">#6147</a> and the original 8.x backport in <a href="https://redirect.github.com/verdaccio/verdaccio/pull/6143">#6143</a>.</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/verdaccio/verdaccio/blob/v6.10.0/CHANGELOG.md">verdaccio's changelog</a>.</em></p> <blockquote> <h2>6.10.0</h2> <h3>Minor Changes</h3> <ul> <li>51c2733: Update internal Verdaccio types to include the optional <code>server.legacyAuthCache</code> configuration used by the 8.x auth and config packages.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/verdaccio/verdaccio/commit/dfe243924b76f38e15ac15be110aae57f48d5d3b"><code>dfe2439</code></a> chore: release 6.x (<a href="https://redirect.github.com/verdaccio/verdaccio/issues/6148">#6148</a>)</li> <li><a href="https://github.com/verdaccio/verdaccio/commit/51c2733d7da4ab370eaafdfc8388f3574e7576c8"><code>51c2733</code></a> feat: expose legacy auth cache config (<a href="https://redirect.github.com/verdaccio/verdaccio/issues/6147">#6147</a>)</li> <li>See full diff in <a href="https://github.com/verdaccio/verdaccio/compare/v6.9.3...v6.10.0">compare view</a></li> </ul> </details> <br /> Updates `vite` from 8.1.4 to 8.2.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p> <blockquote> <h2>plugin-legacy@8.2.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@8.2.2/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.2.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.2.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@8.2.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@8.2.1/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.2.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.2.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>create-vite@8.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/create-vite@8.2.0/packages/create-vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@8.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@8.2.0/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.2.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.2.0-beta.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.2.0-beta.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.1.5</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.1.5/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/vitejs/vite/compare/v8.2.1...v8.2.2">8.2.2</a> (2026-08-20)</h2> <h3>Features</h3> <ul> <li><strong>deps:</strong> widen <code>@vitejs/devtools</code> peer range to v0.5.0 (<a href="https://redirect.github.com/vitejs/vite/issues/23302">#23302</a>) (<a href="https://github.com/vitejs/vite/commit/495d9ff5a7d843ca876a9e49799947a5deb704c7">495d9ff</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>bundled-dev:</strong> handle lazy request error (<a href="https://redirect.github.com/vitejs/vite/issues/23291">#23291</a>) (<a href="https://github.com/vitejs/vite/commit/3ba026dade4af56df08815310d3458fa110f5c5c">3ba026d</a>)</li> <li><strong>bundled-dev:</strong> hot update through circular imports instead of reloading (<a href="https://redirect.github.com/vitejs/vite/issues/23259">#23259</a>) (<a href="https://github.com/vitejs/vite/commit/3dbddefaafc091a879b06f9279296f776691e455">3dbddef</a>)</li> <li><strong>config:</strong> resolve sourcemap paths against sourcemap location (<a href="https://redirect.github.com/vitejs/vite/issues/23239">#23239</a>) (<a href="https://github.com/vitejs/vite/commit/05a003e6a17a84d75f907ea0f1598bc39b8dce6c">05a003e</a>)</li> <li><strong>css:</strong> don't pass empty targets to lightningcss (<a href="https://redirect.github.com/vitejs/vite/issues/23295">#23295</a>) (<a href="https://github.com/vitejs/vite/commit/2804636ff608d105928009d274ffba7cfbe55340">2804636</a>)</li> <li><strong>define:</strong> fix match escaped dots to support $-prefixed define keys (<a href="https://redirect.github.com/vitejs/vite/issues/23249">#23249</a>) (<a href="https://github.com/vitejs/vite/commit/dcf88bd2ad2b1a8845f9029587cc8c825e382d42">dcf88bd</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/23217">#23217</a>) (<a href="https://github.com/vitejs/vite/commit/ba958bddfc9cabe302c6b34269dcf5c9634531e0">ba958bd</a>)</li> <li><strong>deps:</strong> update rolldown-related dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/23218">#23218</a>) (<a href="https://github.com/vitejs/vite/commit/83ecb2c8059e8ce946a7cc835d4c14ef78aef4fd">83ecb2c</a>)</li> <li><strong>module-runner:</strong> exclude completed modules from in-flight cycle detection (fix <a href="https://redirect.github.com/vitejs/vite/issues/22999">#22999</a>) (<a href="https://redirect.github.com/vitejs/vite/issues/23009">#23009</a>) (<a href="https://github.com/vitejs/vite/commit/d9b10a98db1c293ee64300bd75d568b44c8ae931">d9b10a9</a>)</li> <li><strong>optimizer:</strong> close custom extension analysis bundles (<a href="https://redirect.github.com/vitejs/vite/issues/23207">#23207</a>) (<a href="https://github.com/vitejs/vite/commit/8fb76752836f61224d3095b502fa237b478a06b2">8fb7675</a>)</li> <li>reduce Windows 8.3-short-name detection false-positives (<a href="https://redirect.github.com/vitejs/vite/issues/23066">#23066</a>) (<a href="https://github.com/vitejs/vite/commit/02cffa9e2d38d5d8f12e4043ee9d0f7abb1471e2">02cffa9</a>)</li> <li>respect <code>resolve.preserveSymlinks</code> when resolving root (fix <a href="https://redirect.github.com/vitejs/vite/issues/23197">#23197</a>) (<a href="https://redirect.github.com/vitejs/vite/issues/23198">#23198</a>) (<a href="https://github.com/vitejs/vite/commit/8413052731836d4aaf3eb94a0f25788dd35d2888">8413052</a>)</li> <li><strong>ssr:</strong> rewrite computed key of destructing parameter (<a href="https://redirect.github.com/vitejs/vite/issues/23307">#23307</a>) (<a href="https://github.com/vitejs/vite/commit/9db0b61d4c9c7caad7ea1d9670b637faf2bb6c93">9db0b61</a>)</li> <li><strong>vite:</strong> update outdated upstream file links in license comments (<a href="https://redirect.github.com/vitejs/vite/issues/23285">#23285</a>) (<a href="https://github.com/vitejs/vite/commit/c0f2fc607ee97ee4499337b04826420c00654065">c0f2fc6</a>)</li> </ul> <h3>Documentation</h3> <ul> <li><strong>build:</strong> note cssTarget precedence (<a href="https://redirect.github.com/vitejs/vite/issues/23200">#23200</a>) (<a href="https://github.com/vitejs/vite/commit/a20a35ec0685e374519864d0f41dd5f6e9ba0271">a20a35e</a>)</li> </ul> <h3>Miscellaneous Chores</h3> <ul> <li>fix ts errors in build test cases (<a href="https://redirect.github.com/vitejs/vite/issues/23209">#23209</a>) (<a href="https://github.com/vitejs/vite/commit/a0cfcf72f8ef8bf0f2f11d553333b9bb31f1d316">a0cfcf7</a>)</li> </ul> <h3>Code Refactoring</h3> <ul> <li>use JSON import attributes instead of readFileSync in constants (<a href="https://redirect.github.com/vitejs/vite/issues/23258">#23258</a>) (<a href="https://github.com/vitejs/vite/commit/1d9fa392a43229241f80630236f8552ce8f7cd0f">1d9fa39</a>)</li> <li>use named regex constants over inline literals (<a href="https://redirect.github.com/vitejs/vite/issues/22964">#22964</a>) (<a href="https://github.com/vitejs/vite/commit/5c1c6c609718303202832f706884192e1f1e9223">5c1c6c6</a>)</li> </ul> <h3>Tests</h3> <ul> <li><strong>define:</strong> close rolldown bundler after generate (<a href="https://redirect.github.com/vitejs/vite/issues/23231">#23231</a>) (<a href="https://github.com/vitejs/vite/commit/b4d66fee14d970f45b8a6f3d7d6aee73ca9b88ab">b4d66fe</a>)</li> <li><strong>module-runner:</strong> add TLA circular import case (<a href="https://redirect.github.com/vitejs/vite/issues/23299">#23299</a>) (<a href="https://github.com/vitejs/vite/commit/4a261f242831bef92afd2f1aacfb81eab9dec371">4a261f2</a>)</li> <li><strong>module-runner:</strong> simplify server-hmr tests (<a href="https://redirect.github.com/vitejs/vite/issues/23300">#23300</a>) (<a href="https://github.com/vitejs/vite/commit/599b44b6600ec426e10cd556908d53b027b0c4fb">599b44b</a>)</li> <li><strong>ssr:</strong> add destructing assignment case for moduleRunnerTransform (<a href="https://redirect.github.com/vitejs/vite/issues/23308">#23308</a>) (<a href="https://github.com/vitejs/vite/commit/cb77e2a93bad2a8ece00b4aa0ef507c092582c45">cb77e2a</a>)</li> </ul> <h3>Build System</h3> <ul> <li>use JSON import attributes instead of readFIleSync in rolldown configs (<a href="https://redirect.github.com/vitejs/vite/issues/23251">#23251</a>) (<a href="https://github.com/vitejs/vite/commit/d615bcdb23d96c1ca5ce1ee45e21d8d87381106f">d615bcd</a>)</li> </ul> <h2><a href="https://github.com/vitejs/vite/compare/v8.2.0...v8.2.1">8.2.1</a> (2026-08-06)</h2> <h3>Bug Fixes</h3> <ul> <li><strong>build:</strong> make client chunkImportMap work with <code>sharedPlugins: true</code> (<a href="https://redirect.github.com/vitejs/vite/issues/23184">#23184</a>) (<a href="https://github.com/vitejs/vite/commit/15f03073c915d6ffb9a1fda447ef66b02bf5cde8">15f0307</a>)</li> <li><strong>bundled-dev:</strong> inject client script tag before chunk scripts (<a href="https://redirect.github.com/vitejs/vite/issues/23161">#23161</a>) (<a href="https://github.com/vitejs/vite/commit/eac0cc84aa2472a85a19ee84561c1ba71e381a55">eac0cc8</a>)</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/vite/commit/de1111ab0be00879b404e7ed3b2a80e264edddc1"><code>de1111a</code></a> release: v8.2.2</li> <li><a href="https://github.com/vitejs/vite/commit/cb77e2a93bad2a8ece00b4aa0ef507c092582c45"><code>cb77e2a</code></a> test(ssr): add destructing assignment case for moduleRunnerTransform (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23308">#23308</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/9db0b61d4c9c7caad7ea1d9670b637faf2bb6c93"><code>9db0b61</code></a> fix(ssr): rewrite computed key of destructing parameter (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23307">#23307</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/8413052731836d4aaf3eb94a0f25788dd35d2888"><code>8413052</code></a> fix: respect <code>resolve.preserveSymlinks</code> when resolving root (fix <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23197">#23197</a>) (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23">#23</a>...</li> <li><a href="https://github.com/vitejs/vite/commit/05a003e6a17a84d75f907ea0f1598bc39b8dce6c"><code>05a003e</code></a> fix(config): resolve sourcemap paths against sourcemap location (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23239">#23239</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/495d9ff5a7d843ca876a9e49799947a5deb704c7"><code>495d9ff</code></a> feat(deps): widen <code>@vitejs/devtools</code> peer range to v0.5.0 (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23302">#23302</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/1d9fa392a43229241f80630236f8552ce8f7cd0f"><code>1d9fa39</code></a> refactor: use JSON import attributes instead of readFileSync in constants (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/2">#2</a>...</li> <li><a href="https://github.com/vitejs/vite/commit/2804636ff608d105928009d274ffba7cfbe55340"><code>2804636</code></a> fix(css): don't pass empty targets to lightningcss (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23295">#23295</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/599b44b6600ec426e10cd556908d53b027b0c4fb"><code>599b44b</code></a> test(module-runner): simplify server-hmr tests (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23300">#23300</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/4a261f242831bef92afd2f1aacfb81eab9dec371"><code>4a261f2</code></a> test(module-runner): add TLA circular import case (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23299">#23299</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/vite/commits/v8.2.2/packages/vite">compare view</a></li> </ul> </details> <br /> Updates `@supabase/supabase-js` from 2.112.3 to 2.112.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/supabase/supabase-js/releases">@supabase/supabase-js's releases</a>.</em></p> <blockquote> <h2>v2.112.4</h2> <h2>2.112.4 (2026-08-24)</h2> <h3>🩹 Fixes</h3> <ul> <li><strong>auth:</strong> convert stolen-lock AbortError when acquireTimeout is 0 (<a href="https://redirect.github.com/supabase/supabase-js/pull/2616">#2616</a>)</li> <li><strong>auth:</strong> warn on deprecated lock option and prevent unhandled refresh rejection (<a href="https://redirect.github.com/supabase/supabase-js/pull/2627">#2627</a>)</li> <li><strong>postgrest:</strong> move override fixtures out of generated types, repair codegen (<a href="https://redirect.github.com/supabase/supabase-js/pull/2605">#2605</a>)</li> <li><strong>realtime:</strong> respect custom logger for send() REST fallback warning (<a href="https://redirect.github.com/supabase/supabase-js/pull/2612">#2612</a>)</li> </ul> <h3>❤️ Thank You</h3> <ul> <li>Katerina Skroumpelou <a href="https://github.com/mandarini"><code>@mandarini</code></a></li> <li>mmustafasenoglu <a href="https://github.com/mmustafasenoglu"><code>@mmustafasenoglu</code></a></li> </ul> <h2>v2.112.4-canary.3</h2> <h2>2.112.4-canary.3 (2026-08-24)</h2> <h3>🩹 Fixes</h3> <ul> <li><strong>auth:</strong> warn on deprecated lock option and prevent unhandled refresh rejection (<a href="https://redirect.github.com/supabase/supabase-js/pull/2627">#2627</a>)</li> </ul> <h3>❤️ Thank You</h3> <ul> <li>Katerina Skroumpelou <a href="https://github.com/mandarini"><code>@mandarini</code></a></li> </ul> <h2>v2.112.4-canary.2</h2> <h2>2.112.4-canary.2 (2026-08-24)</h2> <h3>🩹 Fixes</h3> <ul> <li><strong>auth:</strong> convert stolen-lock AbortError when acquireTimeout is 0 (<a href="https://redirect.github.com/supabase/supabase-js/pull/2616">#2616</a>)</li> <li><strong>realtime:</strong> respect custom logger for send() REST fallback warning (<a href="https://redirect.github.com/supabase/supabase-js/pull/2612">#2612</a>)</li> </ul> <h3>❤️ Thank You</h3> <ul> <li>Katerina Skroumpelou <a href="https://github.com/mandarini"><code>@mandarini</code></a></li> <li>mmustafasenoglu <a href="https://github.com/mmustafasenoglu"><code>@mmustafasenoglu</code></a></li> </ul> <h2>v2.112.4-canary.1</h2> <h2>2.112.4-canary.1 (2026-08-12)</h2> <p>This was a version bump only, there were no code changes.</p> <h2>v2.112.4-canary.0</h2> <h2>2.112.4-canary.0 (2026-08-11)</h2> <h3>🩹 Fixes</h3> <ul> <li><strong>postgrest:</strong> move override fixtures out of generated types, repair codegen (<a href="https://redirect.github.com/supabase/supabase-js/pull/2605">#2605</a>)</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md">@supabase/supabase-js's changelog</a>.</em></p> <blockquote> <h2>2.112.4 (2026-08-24)</h2> <p>This was a version bump only for <code>@supabase/supabase-js</code> to align it with other projects, there were no code changes.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/supabase/supabase-js/commit/c7397c19cb6cb8b1562be27cb0a09ed0e240276a"><code>c7397c1</code></a> chore(supabase): bump supabase cli to 2.113.0 (<a href="https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js/issues/2606">#2606</a>)</li> <li><a href="https://github.com/supabase/supabase-js/commit/bbc167cbef7fb841d44c53fb3c45e1d19aa3ece3"><code>bbc167c</code></a> chore(release): version 2.112.3 changelogs (<a href="https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js/issues/2608">#2608</a>)</li> <li>See full diff in <a href="https://github.com/supabase/supabase-js/commits/v2.112.4/packages/core/supabase-js">compare view</a></li> </ul> </details> <br /> Updates `jose` from 6.2.9 to 6.2.10 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/panva/jose/releases">jose's releases</a>.</em></p> <blockquote> <h2>v6.2.10</h2> <h3>Fixes</h3> <ul> <li><strong>jose:</strong> consume serialization members once (<a href="https://github.com/panva/jose/commit/9bee285a6bc356b495c29ae0a5e70b24e723568e">9bee285</a>)</li> <li><strong>jose:</strong> reject empty protected and JWE AAD members (<a href="https://github.com/panva/jose/commit/8da41453dce79967c6e3f47a787039a7f94de8fe">8da4145</a>)</li> <li><strong>jose:</strong> validate serialized header values (<a href="https://github.com/panva/jose/commit/b711d8fe223e3e85520d6c822d7a417cd872b718">b711d8f</a>)</li> <li><strong>jwe:</strong> conceal invalid decrypted CEK lengths (<a href="https://github.com/panva/jose/commit/41fafe035a62d85f4b313e166100004dd09b111f">41fafe0</a>)</li> <li><strong>jwe:</strong> enforce AES-GCM tag boundaries (<a href="https://github.com/panva/jose/commit/9a5b74454bf145a106312d519efe95b8a9b53a87">9a5b744</a>)</li> <li><strong>jwe:</strong> validate explicit encryption parameters (<a href="https://github.com/panva/jose/commit/7a02697126e40757ed9e02ae786ec9a2b180aa5c">7a02697</a>)</li> <li><strong>jwk:</strong> accept empty octet-sequence keys (<a href="https://github.com/panva/jose/commit/3f871e7859c1ce51d1afcbfeff92c354b8e96dd9">3f871e7</a>)</li> <li><strong>jwk:</strong> normalize key resolution inputs (<a href="https://github.com/panva/jose/commit/f54ee7bad8e21c975606bc5e47b352921ac0d890">f54ee7b</a>)</li> <li><strong>jwks:</strong> enforce verification key metadata (<a href="https://github.com/panva/jose/commit/f9ba5101383154147780da7acf1aabc705f75aaf">f9ba510</a>)</li> <li><strong>jwks:</strong> order overlapping remote reloads (<a href="https://github.com/panva/jose/commit/9a1a913983aa44d065a423692a92148b2a6a36c3">9a1a913</a>)</li> <li><strong>jwks:</strong> reject invalid remote duration values (<a href="https://github.com/panva/jose/commit/7bdb9e56e6a74b833af582532c6fff5bc727ec1c">7bdb9e5</a>)</li> <li><strong>jwk:</strong> validate ext and key_ops parameters (<a href="https://github.com/panva/jose/commit/4d91c37fdd36241785cb172774fa017bb8854458">4d91c37</a>)</li> <li><strong>jws:</strong> reject mixed payload encoding modes (<a href="https://github.com/panva/jose/commit/dc69713081a55a3d6955dd1d8c2cf184905febad">dc69713</a>)</li> <li><strong>jws:</strong> validate unencoded payload strings (<a href="https://github.com/panva/jose/commit/541f28234442c5cbfc5f843a95ccd18a721f3697">541f282</a>)</li> <li><strong>jwt:</strong> enforce explicit verification policies (<a href="https://github.com/panva/jose/commit/b3471826b02589656eaf71843671922644cc60e2">b347182</a>)</li> <li><strong>jwt:</strong> prevent replacing protected headers (<a href="https://github.com/panva/jose/commit/ae07d09bcbac91825e27cde9989b603af3495263">ae07d09</a>)</li> <li><strong>jwt:</strong> reject invalid duration inputs (<a href="https://github.com/panva/jose/commit/282f9aaa496e57f55417bca15e13c369b3f242fb">282f9aa</a>)</li> <li><strong>jwt:</strong> validate builder claim values (<a href="https://github.com/panva/jose/commit/ea03f83d607fcaee6fc0778c8a4d40a2bbd75c9e">ea03f83</a>)</li> <li><strong>jwt:</strong> validate unsecured protected headers (<a href="https://github.com/panva/jose/commit/230c14e7a148f168912a4b9c21daff935f07722c">230c14e</a>)</li> <li><strong>key:</strong> validate generation and import options (<a href="https://github.com/panva/jose/commit/15d880e112777991cc9d38e0af255cc762c79884">15d880e</a>)</li> <li>reject mixed b64 modes for empty General JWS payloads (<a href="https://github.com/panva/jose/commit/61a2ef7bc405580073152b52e39287149b247dfe">61a2ef7</a>)</li> <li><strong>x509:</strong> reject DER truncated past its outer length (<a href="https://github.com/panva/jose/commit/d8db9f6dd751ecb852cd492f62d19d299b4fa1fe">d8db9f6</a>)</li> </ul> <h3>Documentation</h3> <ul> <li><strong>jwks:</strong> correct cache timestamp units (<a href="https://github.com/panva/jose/commit/01a44d918abd25a93259ada4f89e83bb2ff130c6">01a44d9</a>)</li> </ul> <h3>Refactor</h3> <ul> <li><strong>jose:</strong> share binary input validation (<a href="https://github.com/panva/jose/commit/eedb124fe2a719305f579a3e444f6ce74abbc681">eedb124</a>)</li> <li><strong>jose:</strong> share compact token processing internals (<a href="https://github.com/panva/jose/commit/85e30ed91ead6c10f19a500f14a49dc97875f2e2">85e30ed</a>)</li> <li><strong>jwe:</strong> consolidate CBC decryption failures (<a href="https://github.com/panva/jose/commit/1ee6f61cda63174c55c915687e34893b7c40de33">1ee6f61</a>)</li> <li><strong>jwe:</strong> specialize compact processing (<a href="https://github.com/panva/jose/commit/a998927cbd2faa8e1cdad36f97a86ebff13d0a5b">a998927</a>)</li> <li><strong>jwe:</strong> streamline single-recipient encryption (<a href="https://github.com/panva/jose/commit/290aaa60f14a8362024f1e23fb2659cebb3471be">290aaa6</a>)</li> <li><strong>jwks:</strong> compact JWK Set shape validation (<a href="https://github.com/panva/jose/commit/930c7dfc7979feb83ed2d1420dd627c42c5f44c4">930c7df</a>), references <a href="https://github.com/panva/jose/issues/every">Array#every</a></li> <li><strong>jwks:</strong> compact local key selection (<a href="https://github.com/panva/jose/commit/4cb5ae59ac4fae2cb4cfadcdba868be8203a58d4">4cb5ae5</a>)</li> <li><strong>jwks:</strong> compact remote resolver state (<a href="https://github.com/panva/jose/commit/ef5eaf405f7d07b61c1d52104af24bdc22ac1a52">ef5eaf4</a>)</li> <li><strong>jws:</strong> specialize compact processing (<a href="https://github.com/panva/jose/commit/021abf48774ef3921738cc7ea9f9705d488cae90">021abf4</a>)</li> <li><strong>jwt:</strong> compact claim validation helpers (<a href="https://github.com/panva/jose/commit/f39068383f8bd0db43c476b7447440c4a8406a5d">f390683</a>)</li> <li><strong>jwt:</strong> consolidate replicated claim checks (<a href="https://github.com/panva/jose/commit/7dd559118bc76303f888cd61a0356556580c9273">7dd5591</a>)</li> <li><strong>jwt:</strong> share producer claim state (<a href="https://github.com/panva/jose/commit/52ba1592cb7fe9e1995bd4c8230e3a5da56230c7">52ba159</a>)</li> <li><strong>key:</strong> compact JWK algorithm selection (<a href="https://github.com/panva/jose/commit/a6b29da1b8d4ed0f1f19f39d2684be44ce05aad0">a6b29da</a>)</li> <li><strong>key:</strong> compact secret length parsing (<a href="https://github.com/panva/jose/commit/cc03be885053160abc64fd90224fc8d0fa9edd0b">cc03be8</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/panva/jose/blob/main/CHANGELOG.md">jose's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/panva/jose/compare/v6.2.9...v6.2.10">6.2.10</a> (2026-08-21)</h2> <h3>Fixes</h3> <ul> <li><strong>jose:</strong> consume serialization members once (<a href="https://github.com/panva/jose/commit/9bee285a6bc356b495c29ae0a5e70b24e723568e">9bee285</a>)</li> <li><strong>jose:</strong> reject empty protected and JWE AAD members (<a href="https://github.com/panva/jose/commit/8da41453dce79967c6e3f47a787039a7f94de8fe">8da4145</a>)</li> <li><strong>jose:</strong> validate serialized header values (<a href="https://github.com/panva/jose/commit/b711d8fe223e3e85520d6c822d7a417cd872b718">b711d8f</a>)</li> <li><strong>jwe:</strong> conceal invalid decrypted CEK lengths (<a href="https://github.com/panva/jose/commit/41fafe035a62d85f4b313e166100004dd09b111f">41fafe0</a>)</li> <li><strong>jwe:</strong> enforce AES-GCM tag boundaries (<a href="https://github.com/panva/jose/commit/9a5b74454bf145a106312d519efe95b8a9b53a87">9a5b744</a>)</li> <li><strong>jwe:</strong> validate explicit encryption parameters (<a href="https://github.com/panva/jose/commit/7a02697126e40757ed9e02ae786ec9a2b180aa5c">7a02697</a>)</li> <li><strong>jwk:</strong> accept empty octet-sequence keys (<a href="https://github.com/panva/jose/commit/3f871e7859c1ce51d1afcbfeff92c354b8e96dd9">3f871e7</a>)</li> <li><strong>jwk:</strong> normalize key resolution inputs (<a href="https://github.com/panva/jose/commit/f54ee7bad8e21c975606bc5e47b352921ac0d890">f54ee7b</a>)</li> <li><strong>jwks:</strong> enforce verification key metadata (<a href="https://github.com/panva/jose/commit/f9ba5101383154147780da7acf1aabc705f75aaf">f9ba510</a>)</li> <li><strong>jwks:</strong> order overlapping remote reloads (<a href="https://github.com/panva/jose/commit/9a1a913983aa44d065a423692a92148b2a6a36c3">9a1a913</a>)</li> <li><strong>jwks:</strong> reject invalid remote duration values (<a href="https://github.com/panva/jose/commit/7bdb9e56e6a74b833af582532c6fff5bc727ec1c">7bdb9e5</a>)</li> <li><strong>jwk:</strong> validate ext and key_ops parameters (<a href="https://github.com/panva/jose/commit/4d91c37fdd36241785cb172774fa017bb8854458">4d91c37</a>)</li> <li><strong>jws:</strong> reject mixed payload encoding modes (<a href="https://github.com/panva/jose/commit/dc69713081a55a3d6955dd1d8c2cf184905febad">dc69713</a>)</li> <li><strong>jws:</strong> validate unencoded payload strings (<a href="https://github.com/panva/jose/commit/541f28234442c5cbfc5f843a95ccd18a721f3697">541f282</a>)</li> <li><strong>jwt:</strong> enforce explicit verification policies (<a href="https://github.com/panva/jose/commit/b3471826b02589656eaf71843671922644cc60e2">b347182</a>)</li> <li><strong>jwt:</strong> prevent replacing protected headers (<a href="https://github.com/panva/jose/commit/ae07d09bcbac91825e27cde9989b603af3495263">ae07d09</a>)</li> <li><strong>jwt:</strong> reject invalid duration inputs (<a href="https://github.com/panva/jose/commit/282f9aaa496e57f55417bca15e13c369b3f242fb">282f9aa</a>)</li> <li><strong>jwt:</strong> validate builder claim values (<a href="https://github.com/panva/jose/commit/ea03f83d607fcaee6fc0778c8a4d40a2bbd75c9e">ea03f83</a>)</li> <li><strong>jwt:</strong> validate unsecured protected headers (<a href="https://github.com/panva/jose/commit/230c14e7a148f168912a4b9c21daff935f07722c">230c14e</a>)</li> <li><strong>key:</strong> validate generation and import options (<a href="https://github.com/panva/jose/commit/15d880e112777991cc9d38e0af255cc762c79884">15d880e</a>)</li> <li>reject mixed b64 modes for empty General JWS payloads (<a href="https://github.com/panva/jose/commit/61a2ef7bc405580073152b52e39287149b247dfe">61a2ef7</a>)</li> <li><strong>x509:</strong> reject DER truncated past its outer length (<a href="https://github.com/panva/jose/commit/d8db9f6dd751ecb852cd492f62d19d299b4fa1fe">d8db9f6</a>)</li> </ul> <h3>Documentation</h3> <ul> <li><strong>jwks:</strong> correct cache timestamp units (<a href="https://github.com/panva/jose/commit/01a44d918abd25a93259ada4f89e83bb2ff130c6">01a44d9</a>)</li> </ul> <h3>Refactor</h3> <ul> <li><strong>jose:</strong> share binary input validation (<a href="https://github.com/panva/jose/commit/eedb124fe2a719305f579a3e444f6ce74abbc681">eedb124</a>)</li> <li><strong>jose:</strong> share compact token processing internals (<a href="https://github.com/panva/jose/commit/85e30ed91ead6c10f19a500f14a49dc97875f2e2">85e30ed</a>)</li> <li><strong>jwe:</strong> consolidate CBC decryption failures (<a href="https://github.com/panva/jose/commit/1ee6f61cda63174c55c915687e34893b7c40de33">1ee6f61</a>)</li> <li><strong>jwe:</strong> specialize compact processing (<a href="https://github.com/panva/jose/commit/a998927cbd2faa8e1cdad36f97a86ebff13d0a5b">a998927</a>)</li> <li><strong>jwe:</strong> streamline single-recipient encryption (<a href="https://github.com/panva/jose/commit/290aaa60f14a8362024f1e23fb2659cebb3471be">290aaa6</a>)</li> <li><strong>jwks:</strong> compact JWK Set shape validation (<a href="https://github.com/panva/jose/commit/930c7dfc7979feb83ed2d1420dd627c42c5f44c4">930c7df</a>), references <a href="https://github.com/panva/jose/issues/every">Array#every</a></li> <li><strong>jwks:</strong> compact local key selection (<a href="https://github.com/panva/jose/commit/4cb5ae59ac4fae2cb4cfadcdba868be8203a58d4">4cb5ae5</a>)</li> <li><strong>jwks:</strong> compact remote resolver state (<a href="https://github.com/panva/jose/commit/ef5eaf405f7d07b61c1d52104af24bdc22ac1a52">ef5eaf4</a>)</li> <li><strong>jws:</strong> specialize compact processing (<a href="https://github.com/panva/jose/commit/021abf48774ef3921738cc7ea9f9705d488cae90">021abf4</a>)</li> <li><strong>jwt:</strong> compact claim validation helpers (<a href="https://github.com/panva/jose/commit/f39068383f8bd0db43c476b7447440c4a8406a5d">f390683</a>)</li> <li><strong>jwt:</strong> consolidate replicated claim checks (<a href="https://github.com/panva/jose/commit/7dd559118bc76303f888cd61a0356556580c9273">7dd5591</a>)</li> <li><strong>jwt:</strong> share producer claim state (<a href="https://github.com/panva/jose/commit/52ba1592cb7fe9e1995bd4c8230e3a5da56230c7">52ba159</a>)</li> <li><strong>key:</strong> compact JWK algorithm selection (<a href="https://github.com/panva/jose/commit/a6b29da1b8d4ed0f1f19f39d2684be44ce05aad0">a6b29da</a>)</li> <li><strong>key:</strong> compact secret length parsing (<a href="https://github.com/panva/jose/commit/cc03be885053160abc64fd90224fc8d0fa9edd0b">cc03be8</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/panva/jose/commit/3eab1524782fab3f6421b98380f44c99da210a6b"><code>3eab152</code></a> chore(release): 6.2.10</li> <li><a href="https://github.com/panva/jose/commit/021abf48774ef3921738cc7ea9f9705d488cae90"><code>021abf4</code></a> refactor(jws): specialize compact processing</li> <li><a href="https://github.com/panva/jose/commit/a998927cbd2faa8e1cdad36f97a86ebff13d0a5b"><code>a998927</code></a> refactor(jwe): specialize compact processing</li> <li><a href="https://github.com/panva/jose/commit/eedb124fe2a719305f579a3e444f6ce74abbc681"><code>eedb124</code></a> refactor(jose): share binary input validation</li> <li><a href="https://github.com/panva/jose/commit/52ba1592cb7fe9e1995bd4c8230e3a5da56230c7"><code>52ba159</code></a> refactor(jwt): share producer claim state</li> <li><a href="https://github.com/panva/jose/commit/85e30ed91ead6c10f19a500f14a49dc97875f2e2"><code>85e30ed</code></a> refactor(jose): share compact token processing internals</li> <li><a href="https://github.com/panva/jose/commit/0bd81d29781e43b6374ec7ebe93d1e2acdb290c3"><code>0bd81d2</code></a> test(jose): cover hidden critical-header options</li> <li><a href="https://github.com/panva/jose/commit/9cf7876e15930781b47307f458e1b4154103ad68"><code>9cf7876</code></a> test(jose): reject callable object impostors</li> <li><a href="https://github.com/panva/jose/commit/f23cafd2d8501167b5949a07b9dbd7a72acf4faa"><code>f23cafd</code></a> test(jose): preserve resolved key data properties</li> <li><a href="https://github.com/panva/jose/commit/1ee6f61cda63174c55c915687e34893b7c40de33"><code>1ee6f61</code></a> refactor(jwe): consolidate CBC decryption failures</li> <li>Additional commits viewable in <a href="https://github.com/panva/jose/compare/v6.2.9...v6.2.10">compare view</a></li> </ul> </details> <br /> Updates `@anthropic-ai/claude-agent-sdk` from 0.3.234 to 0.3.246 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-agent-sdk-typescript/releases">@anthropic-ai/claude-agent-sdk's releases</a>.</em></p> <blockquote> <h2>v0.3.246</h2> <h2>What's changed</h2> <ul> <li>Added optional <code>user_message_uuid</code> to error result messages and to the first assistant message or <code>stream_event</code> of each turn, linking a reply or failure to the user message that triggered it</li> <li>Added <code>modelUsage[*].costBasis</code> (<code>'list' | 'managed' | 'unknown'</code>) reporting which price table each model's <code>costUSD</code> was computed from</li> <li>Added <code>modelPricing</code> support in the <code>managedSettings</code> option for hosts that set <code>CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST</code>; an admin-managed settings source that sets <code>modelPricing</code> still wins</li> <li>Added <code>perTaskStopAffordance</code> option: when set, <code>interrupt()</code> aborts only the current turn and keeps background agents and workflows running; otherwise (and for one-shot string prompts) they stop</li> </ul> <h2>Update</h2> <pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.246 # or yarn add @anthropic-ai/claude-agent-sdk@0.3.246 # or pnpm add @anthropic-ai/claude-agent-sdk@0.3.246 # or bun add @anthropic-ai/claude-agent-sdk@0.3.246 </code></pre> <h2>v0.3.245</h2> <h2>What's changed</h2> <ul> <li>Updated to parity with Claude Code v2.1.245</li> </ul> <h2>Update</h2> <pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.245 # or yarn add @anthropic-ai/claude-agent-sdk@0.3.245 # or pnpm add @anthropic-ai/claude-agent-sdk@0.3.245 # or bun add @anthropic-ai/claude-agent-sdk@0.3.245 </code></pre> <h2>v0.3.241</h2> <h2>What's changed</h2> <ul> <li>Updated to parity with Claude Code v2.1.241</li> </ul> <h2>Update</h2> <pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.241 # or yarn add @anthropic-ai/claude-agent-sdk@0.3.241 # or pnpm add @anthropic-ai/claude-agent-sdk@0.3.241 </tr></table> </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/claude-agent-sdk's changelog</a>.</em></p> <blockquote> <h2>0.3.246</h2> <ul> <li>Added optional <code>user_message_uuid</code> to error result messages and to the first assistant message or <code>stream_event</code> of each turn, linking a reply or failure to the user message that triggered it</li> <li>Added <code>modelUsage[*].costBasis</code> (<code>'list' | 'managed' | 'unknown'</code>) reporting which price table each model's <code>costUSD</code> was computed from</li> <li>Added <code>modelPricing</code> support in the <code>managedSettings</code> option for hosts that set <code>CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST</code>; an admin-managed settings source that sets <code>modelPricing</code> still wins</li> <li>Added <code>perTaskStopAffordance</code> option: when set, <code>interrupt()</code> aborts only the current turn and keeps background agents and workflows running; otherwise (and for one-shot string prompts) they stop</li> </ul> <h2>0.3.245</h2> <ul> <li>Updated to parity with Claude Code v2.1.245</li> </ul> <h2>0.3.244</h2> <ul> <li>Updated to parity with Claude Code v2.1.244</li> </ul> <h2>0.3.243</h2> <ul> <li>Added optional <code>queued_turn_count</code> to result messages: the number of queued user sends still pending when the result was produced, so hosts know whether another turn and result will follow</li> <li>Fixed <code>mcp_status</code> reporting a remote MCP server as connected after its connection dropped; it now reports pending while reconnecting, then connected or failed</li> <li>Fixed managed <code>disableAllHooks</code> also disabling hook callbacks registered through the <code>hooks</code> option; they now keep running, matching <code>allowManagedHooksOnly</code></li> <li>Changed Read tool PDF results: the <code>document</code> block (or page <code>image</code> blocks for <code>pages</code> reads) now arrives inside the <code>tool_result</code> content instead of as a separate <code>user</code> message after it</li> <li>Updated to parity with Claude Code v2.1.243</li> </ul> <h2>0.3.242</h2> <ul> <li>Updated to parity with Claude Code v2.1.242</li> </ul> <h2>0.3.241</h2> <ul> <li>Updated to parity with Claude Code v2.1.241</li> </ul> <h2>0.3.240</h2> <ul> <li>Updated to parity with Claude Code v2.1.240</li> </ul> <h2>0.3.239</h2> <ul> <li><code>total_cost_usd</code> / <code>modelUsage.costUSD</code> now include the 1.1× US-only-inference (data residency) multiplier when the response reports <code>inference_geo: "us"</code></li> <li>A result held back for background subagents in one-shot mode now reports <code>total_cost_usd</code>, <code>duration_api_ms</code> and <code>modelUsage</code> as of its release, not the turn-end snapshot</li> <li>Fixed <code>SYSTEM_PROMPT_DYNAMIC_BOUNDARY</code> in an array <code>systemPrompt</code> being sent to the model as literal text on Bedrock, Vertex, Foundry, and gateway providers</li> <li>A repeated <code>initialize</code> on a running process is now followed by a <code>background_tasks_changed</code> snapshot of the live background tasks, so reconnecting hosts see work that is still running</li> </ul> <h2>0.3.238</h2> <ul> <li>Added <code>is_backgrounded</code> and <code>spawn_depth</code> to <code>task_started</code> events for subagent tasks (<code>is_backgrounded</code> also on background Bash tasks)</li> <li>Added <code>suppressOriginalPrompt</code> to <code>UserPromptExpansion</code> hook output, matching <code>UserPromptSubmit</code></li> <li>Added <code>command_lifecycle</code> state <code>refused</code>: a cross-session peer message the session's receive-side policy declines now reports this terminal state instead of producing no lifecycle frames</li> <li>Fixed SDK hook callbacks silently not applying after a host re-sends <code>initialize</code> to an already-running CLI; the response now reports <code>hooks_applied</code></li> <li>Fixed <code>CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=true</code> not keeping <code>prompt_suggestion</code> messages on when the account is near, but not over, its usage limit</li> <li>Changed <code>vcs_state_changed</code> push events to emit one event per pushed branch</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/86e1856fc3f5e404ccfe93a5ec5078754ef4fa8e"><code>86e1856</code></a> chore: Update CHANGELOG.md</li> <li><a href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/9d56dae01499ea975b024da307d56c5db2c4c04b"><code>9d56dae</code></a> chore: Update CHANGELOG.md</li> <li><a href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/dca08feed872266ecab7943399f01b0cfb843af0"><code>dca08fe</code></a> chore: Update CHANGELOG.md</li> <li><a href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/0ebd3333636bfccdd9c9ed33622949fa29c12690"><code>0ebd333</code></a> chore: Update CHANGELOG.md</li> <li><a href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/48275071e804139579fabada9bb8d90cfe02b062"><code>4827507</code></a> chore: Update CHANGELOG.md</li> <li><a href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/bfa6b845963696edcb743eca7ba1461c11310947"><code>bfa6b84</code></a> chore: Update CHANGELOG.md</li> <li><a href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/ae7e3dd656244b67e8634c33b3137775ae5a3fcd"><code>ae7e3dd</code></a> chore: Update CHANGELOG.md</li> <li><a href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/c4fdbe3a4309f7165a4c3bee179c155d0422ff4c"><code>c4fdbe3</code></a> chore: Update CHANGELOG.md</li> <li><a href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/591a180a197a73ce90042a6f97a7c59c100d2c3a"><code>591a180</code></a> chore: Update CHANGELOG.md</li> <li><a href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/d933c997f2282179582d97c562b4d3451e74c0ee"><code>d933c99</code></a> chore: Update CHANGELOG.md</li> <li>Additional commits viewable in <a href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.3.234...v0.3.246">compare view</a></li> </ul> </details> <br /> Updates `@anthropic-ai/sdk` from 0.117.1 to 0.120.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/anthropic-sdk-typescript/releases">@anthropic-ai/sdk's releases</a>.</em></p> <blockquote> <h2>sdk: v0.120.0</h2> <h2>0.120.0 (2026-08-19)</h2> <p>Full Changelog: <a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.119.0...sdk-v0.120.0">sdk-v0.119.0...sdk-v0.120.0</a></p> <h3>Features</h3> <ul> <li><strong>api:</strong> managed agents web search config and self hosted sandbox memory (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/ba8ec50ffe31e10781971a942d54289439307424">ba8ec50</a>)</li> </ul> <h3>Chores</h3> <ul> <li><strong>internal:</strong> use a single pnpm workspace lockfile (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/359">#359</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/3c32145d2bc4d53888c6c6857c9af216eec95fb9">3c32145</a>)</li> </ul> <h2>sdk: v0.119.0</h2> <h2>0.119.0 (2026-08-19)</h2> <p>Full Changelog: <a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.118.0...sdk-v0.119.0">sdk-v0.118.0...sdk-v0.119.0</a></p> <h3>Features</h3> <ul> <li><strong>api:</strong> Files and Skills APIs are now GA; add computer use and browser use toolsets (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/ab41aa32b92a7964b35beb42a6be5b0bec1dd735">ab41aa3</a>)</li> </ul> <h2>sdk: v0.118.0</h2> <h2>0.118.0 (2026-08-18)</h2> <p>Full Changelog: <a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.117.1...sdk-v0.118.0">sdk-v0.117.1...sdk-v0.118.0</a></p> <h3>Features</h3> <ul> <li><strong>api:</strong> additions to files and memory stores (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/fdc03790dc3e7fb0352298382f8a9603e92e19c2">fdc0379</a>)</li> <li><strong>api:</strong> updates to skill, files, and user profiles (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/671e6b187f475b5a7a797adbbe5b908bd74d3935">671e6b1</a>)</li> <li><strong>client:</strong> add helpers for accessing the workspace ID in response headers (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/28aa5afe3284bcdc2cc35264f6f4d8dd762e186f">28aa5af</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>api:</strong> remove unsupported mid_conv_system content block (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/ae6ca9403125b5a0effb22c9d9c65804a99a80bd">ae6ca94</a>)</li> <li><strong>session-runner:</strong> retry tool-result sends for at least the lease TTL (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/339">#339</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/7dc632557bfea8475aab8345e27469f02faa6a5a">7dc6325</a>)</li> </ul> <h3>Chores</h3> <ul> <li><strong>internal:</strong> bump zod to 4.4.3 (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/334">#334</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/faa5b7b841a31967ee4679423c22802d4e70c79f">faa5b7b</a>)</li> <li><strong>internal:</strong> remove leftover prism references (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/a163b960ce982ffb2827a0e95a5ae05a1120aa51">a163b96</a>)</li> <li>stop shipping the v0.50 migration guide and migrate CLI (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/53992d708ba024c25adabc864fe0268cc065865d">53992d7</a>)</li> </ul> <h3>Documentation</h3>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/sdk's changelog</a>.</em></p> <blockquote> <h2>0.120.0 (2026-08-19)</h2> <p>Full Changelog: <a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.119.0...sdk-v0.120.0">sdk-v0.119.0...sdk-v0.120.0</a></p> <h3>Features</h3> <ul> <li><strong>api:</strong> managed agents web search config and self hosted sandbox memory (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/ba8ec50ffe31e10781971a942d54289439307424">ba8ec50</a>)</li> </ul> <h3>Chores</h3> <ul> <li><strong>internal:</strong> use a single pnpm workspace lockfile (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/359">#359</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/3c32145d2bc4d53888c6c6857c9af216eec95fb9">3c32145</a>)</li> </ul> <h2>0.119.0 (2026-08-19)</h2> <p>Full Changelog: <a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.118.0...sdk-v0.119.0">sdk-v0.118.0...sdk-v0.119.0</a></p> <h3>Features</h3> <ul> <li><strong>api:</strong> Files and Skills APIs are now GA; add computer use and browser use toolsets (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/ab41aa32b92a7964b35beb42a6be5b0bec1dd735">ab41aa3</a>)</li> </ul> <h2>0.118.0 (2026-08-18)</h2> <p>Full Changelog: <a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.117.1...sdk-v0.118.0">sdk-v0.117.1...sdk-v0.118.0</a></p> <h3>Features</h3> <ul> <li><strong>api:</strong> additions to files and memory stores (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/fdc03790dc3e7fb0352298382f8a9603e92e19c2">fdc0379</a>)</li> <li><strong>api:</strong> updates to skill, files, and user profiles (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/671e6b187f475b5a7a797adbbe5b908bd74d3935">671e6b1</a>)</li> <li><strong>client:</strong> add helpers for accessing the workspace ID in response headers (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/28aa5afe3284bcdc2cc35264f6f4d8dd762e186f">28aa5af</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>api:</strong> remove unsupported mid_conv_system content block (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/ae6ca9403125b5a0effb22c9d9c65804a99a80bd">ae6ca94</a>)</li> <li><strong>session-runner:</strong> retry tool-result sends for at least the lease TTL (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/339">#339</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/7dc632557bfea8475aab8345e27469f02faa6a5a">7dc6325</a>)</li> </ul> <h3>Chores</h3> <ul> <li><strong>internal:</strong> bump zod to 4.4.3 (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/334">#334</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/faa5b7b841a31967ee4679423c22802d4e70c79f">faa5b7b</a>)</li> <li><strong>internal:</strong> remove leftover prism references (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/a163b960ce982ffb2827a0e95a5ae05a1120aa51">a163b96</a>)</li> <li>stop shipping the v0.50 migration guide and migrate CLI (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/53992d708ba024c25adabc864fe0268cc065865d">53992d7</a>)</li> </ul> <h3>Documentation</h3> <ul> <li><strong>tools:</strong> warn that blocking tool bodies stall the worker heartbeat (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/299">#299</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/908fdb5d9de8809190bdcf9d14a8319e80d8f31c">908fdb5</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/bfa9197f0182084941052be9752c948638421601"><code>bfa9197</code></a> chore: release main</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/bc167f3c8fe36137c5594a3776e9677d493e6618"><code>bc167f3</code></a> feat(api): managed agents web search config and self hosted sandbox memory</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/83fd8981a7b11321257027c817755305cc0a4b59"><code>83fd898</code></a> chore(internal): use a single pnpm workspace lockfile (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/359">#359</a>)</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/7fe6dd50d509bb68eb0981ad1f7ad046984b426e"><code>7fe6dd5</code></a> remove internal ticket references from changelog- <a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/360">#360</a></li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/c67e4e2d2329d25ba057f5e60c6dec3b2f33ba97"><code>c67e4e2</code></a> chore: release main</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/50fc0dba920417d641734f4abef51627c4785380"><code>50fc0db</code></a> feat(api): Files and Skills APIs are now GA; add computer use and browser use...</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/18ea26d324911c3236f2ce762dd0c87f04d038d3"><code>18ea26d</code></a> chore: release main</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/6ed9ddd8924924d20ff4610b83668754629f9478"><code>6ed9ddd</code></a> feat(api): updates to skill, files, and user profiles</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/91921f5f0410a8caa638a85b0d38a8102d7e3c91"><code>91921f5</code></a> fix(session-runner): retry tool-result sends for at least the lease TTL (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/339">#339</a>)</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/142adcc2b864940a72464e41b63cc5733f38187b"><code>142adcc</code></a> docs(tools): warn that blocking tool bodies stall the worker heartbeat (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/299">#299</a>)</li> <li>Additional commits viewable in <a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.117.1...sdk-v0.120.0">compare view</a></li> </ul> </details> <br /> Updates `@supabase/pg-delta` from 1.0.0-alpha.46 to 1.0.0-alpha.47 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/supabase/pg-delta/releases">@supabase/pg-delta's releases</a>.</em></p> <blockquote> <h2><code>@supabase/pg-delta</code><a href="https://github.com/1"><code>@1</code></a>.0.0-alpha.47</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [7c9a23f] <ul> <li><code>@supabase/pg-topo</code><a href="https://github.com/1"><code>@1</code></a>.0.0-alpha.6</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/supabase/pg-toolbelt/commit/6f480e6ed707133e13bd76c5ff3a8df6102806ee"><code>6f480e6</code></a> chore: release (alpha) (<a href="https://redirect.github.com/supabase/pg-delta/issues/452">#452</a>)</li> <li><a href="https://github.com/supabase/pg-toolbelt/commit/7c9a23f9caf1b65e8de6806da611f97b093b5161"><code>7c9a23f</code></a> feat(pg-topo): expose typed privilege facts on GRANT and default ACL statemen...</li> <li>See full diff in <a href="https://github.com/supabase/pg-delta/compare/@supabase/pg-delta@1.0.0-alpha.46...@supabase/pg-delta@1.0.0-alpha.47">compare view</a></li> </ul> </details> <br /> Updates `@supabase/pg-topo` from 1.0.0-alpha.5 to 1.0.0-alpha.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/supabase/pg-toolbelt/releases">@supabase/pg-topo's releases</a>.</em></p> <blockquote> <h2><code>@supabase/pg-topo</code><a href="https://github.com/1"><code>@1</code></a>.0.0-alpha.6</h2> <h3>Minor Changes</h3> <ul> <li>7c9a23f: Expose a typed <code>privilege</code> payload on GRANT / REVOKE / ALTER DEFAULT PRIVILEGES nodes so consumers can read direction, roles, schemas, and privileges from the AST instead of regex-matching <code>sql</code>.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/supabase/pg-toolbelt/blob/main/packages/pg-topo/CHANGELOG.md">@supabase/pg-topo's changelog</a>.</em></p> <blockquote> <h2>1.0.0-alpha.6</h2> <h3>Minor Changes</h3> <ul> <li>7c9a23f: Expose a typed <code>privilege</code> payload on GRANT / REVOKE / ALTER DEFAULT PRIVILEGES nodes so consumers can read direction, roles, schemas, and privileges from the AST instead of regex-matching <code>sql</code>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/supabase/pg-toolbelt/commit/6f480e6ed707133e13bd76c5ff3a8df6102806ee"><code>6f480e6</code></a> chore: release (alpha) (<a href="https://github.com/supabase/pg-toolbelt/tree/HEAD/packages/pg-topo/issues/452">#452</a>)</li> <li><a href="https://github.com/supabase/pg-toolbelt/commit/7c9a23f9caf1b65e8de6806da611f97b093b5161"><code>7c9a23f</code></a> feat(pg-topo): expose typed privilege facts on GRANT and default ACL statemen...</li> <li><a href="https://github.com/supabase/pg-toolbelt/commit/52cb22a5dfac96c0bbd5b4f2d3c4bc842423b220"><code>52cb22a</code></a> feat(pg-delta)!: clean-room rewrite, promoted to <code>@supabase/pg-delta</code> (BREAKING...</li> <li>See full diff in <a href="https://github.com/supabase/pg-toolbelt/commits/@supabase/pg-topo@1.0.0-alpha.6/packages/pg-topo">compare view</a></li> </ul> </details> <br /> Updates `posthog-node` from 5.49.1 to 5.51.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/PostHog/posthog-js/releases">posthog-node's releases</a>.</em></p> <blockquote> <h2>posthog-node@5.51.2</h2> <h2>5.51.2</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/PostHog/posthog-js/pull/4639">#4639</a> <a href="https://github.com/PostHog/posthog-js/commit/1faeb749974a0c49ad86a6cb68ac4cd5f6414084"><code>1faeb74</code></a> Thanks <a href="https://github.com/marandaneto"><code>@marandaneto</code></a>! - Handle empty feature flag evaluation key scopes without running local or remote evaluation. (2026-08-25)</p> </li> <li> <p><a href="https://redirect.github.com/PostHog/posthog-js/pull/4610">#4610</a> <a href="https://github.com/PostHog/posthog-js/commit/930de1960872cb73d85bbeb71d8d5159d1740c74"><code>930de19</code></a> Thanks <a href="https://github.com/marandaneto"><code>@marandaneto</code></a>! - Share feature flag matching, hashing, variant, and payload evaluation helpers across the Node.js and Convex SDKs without changing their runtime-specific SemVer behavior. (2026-08-25)</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/PostHog/posthog-js/commit/930de1960872cb73d85bbeb71d8d5159d1740c74"><code>930de19</code></a>, <a href="https://github.com/PostHog/posthog-js/commit/d4eee8fe12de2caab4e91d6a0ada25ee6b822e12"><code>d4eee8f</code></a>]:</p> <ul> <li><code>@posthog/core</code><a href="https://github.com/1"><code>@1</code></a>.48.11</li> </ul> </li> </ul> <h2>posthog-node@5.51.1</h2> <h2>5.51.1</h2> <h3>Patch Changes</h3> <ul> <li><a href="https://redirect.github.com/PostHog/posthog-js/pull/4614">#4614</a> <a href="https://github.com/PostHog/posthog-js/commit/3593c43e98269cbe0bc18e697d38b8c862419b09"><code>3593c43</code></a> Thanks <a href="https://github.com/iamomiid"><code>@iamomiid</code></a>! - The Node SDK now sends the raw gzip bytes as the request body instead of wrapping them in a <code>Blob</code>. On Node 24.16 and later, reading a <code>Blob</code> request body leaks a native <code>BlobReader</code> that is never released, so a service calling <code>capture()</code> and <code>flush()</code> once per request grew by roughly 2.3 KB of heap per event and never gave it back. This completes the work in <a href="https://github.com/PostHog/posthog-js/tree/HEAD/packages/node/issues/4423">#4423</a>: switching to <code>node:zlib</code> removed the compression-time Blob reads, but the body itself was still a Blob and still got read once per request. Compression behaviour, headers and the wire format are unchanged, and the edge build keeps using <code>CompressionStream</code>. (2026-08-24)</li> <li>Updated dependencies [<a href="https://github.com/PostHog/posthog-js/commit/3593c43e98269cbe0bc18e697d38b8c862419b09"><code>3593c43</code></a>]: <ul> <li><code>@posthog/core</code><a href="https://github.com/1"><code>@1</code></a>.48.9</li> </ul> </li> </ul> <h2>posthog-node@5.51.0</h2> <h2>5.51.0</h2> <h3>Minor Changes</h3> <ul> <li><a href="https://redirect.github.com/PostHog/posthog-js/pull/4564">#4564</a> <a href="https://github.com/PostHog/posthog-js/commit/233ac88afd0168476178bda66d9f823a95bac068"><code>233ac88</code></a> Thanks <a href="https://github.com/marandaneto"><code>@marandaneto</code></a>! - Fall back to remote evaluation when a requested flag is missing from loaded local definitions. This changes scoped calls that previously omitted the flag without making a request. (2026-08-24)</li> </ul> <h2>posthog-node@5.50.0</h2> <h2>5.50.0</h2> <h3>Minor Changes</h3> <ul> <li><a href="https://redirect.github.com/PostHog/posthog-js/pull/4484">#4484</a> <a href="https://github.com/PostHog/posthog-js/commit/557140e4bb344eb22b5bbd1d324487b3fcef895e"><code>557140e</code></a> Thanks <a href="https://github.com/apps/posthog"><code>@posthog</code></a>! - <code>FeatureFlagEvaluations.isEnabled()</code> now accepts an optional <code>defaultValue</code> option, returned whenever the flag has no value (missing key, not loaded, or a failed request). A flag with a present value — including <code>false</code> and variant strings — always wins over <code>defaultValue</code>. Purely additive; omitting the option preserves the existing <code>false</code>-on-miss behavior. (2026-08-21)</li> </ul> <h2>posthog-node@5.49.4</h2> <h2>5.49.4</h2> <h3>Patch Changes</h3> <ul> <li><a href="https://redirect.github.com/PostHog/posthog-js/pull/4569">#4569</a> <a href="https://github.com/PostHog/posthog-js/commit/00d22ea71400190a0154d1a961b3f52652c50a1e"><code>00d22ea</code></a> Thanks <a href="https://github.com/v11t"><code>@v11t</code></a>! - fix getFeatureFlagResult returning null variant instead of undefined when remotely evaluated (2026-08-21)</li> </ul> <h2>posthog-node@5.49.3</h2> <h2>5.49.3</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md">posthog-node's changelog</a>.</em></p> <blockquote> <h2>5.51.2</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/PostHog/posthog-js/pull/4639">#4639</a> <a href="https://github.com/PostHog/posthog-js/commit/1faeb749974a0c49ad86a6cb68ac4cd5f6414084"><code>1faeb74</code></a> Thanks <a href="https://github.com/marandaneto"><code>@marandaneto</code></a>! - Handle empty feature flag evaluation key scopes without running local or remote evaluation. (2026-08-25)</p> </li> <li> <p><a href="https://redirect.github.com/PostHog/posthog-js/pull/4610">#4610</a> <a href="https://github.com/PostHog/posthog-js/commit/930de1960872cb73d85bbeb71d8d5159d1740c74"><code>930de19</code></a> Thanks <a href="https://github.com/marandaneto"><code>@marandaneto</code></a>! - Share feature flag matching, hashing, variant, and payload evaluation helpers across the Node.js and Convex SDKs without changing their runtime-specific SemVer behavior. (2026-08-25)</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/PostHog/posthog-js/commit/930de1960872cb73d85bbeb71d8d5159d1740c74"><code>930de19</code></a>, <a href="https://github.com/PostHog/posthog-js/co…

## TL;DR Windows PowerShell 5.1 re-encodes piped native stdout and corrupts multi-byte UTF-8 in `db dump` output so: added one stderr warning pointing at `--file`, only when a piped Windows dump actually contains non-ASCII bytes... ## ref - closes CLI-2277 CLI-2276 - closes #6397

This PR was automatically created to sync API types from the infrastructure repository. Changes were detected in the generated API code after syncing with the latest spec from infrastructure. Co-authored-by: supabase-cli-releaser[bot] <246109035+supabase-cli-releaser[bot]@users.noreply.github.com>

#6435) ## Summary The commented `format_options` example in the `supabase init` config template (TypeScript and Go variants) and the `examples` annotation on `experimental.pgdelta.format_options` in `@supabase/config` showed `"maxWidth":80`. The runtime default is 180: the pg-delta adapter layer and the Deno diff templates apply `maxWidth: 180` when the option is omitted, and the `db diff` / `db pull` / `db schema declarative generate` docs already describe 180. A user who uncommented the example to tweak one setting silently narrowed their SQL from 180 to 80 columns. This change: - Uses `180` in the example in both init templates and in the config schema so it matches the runtime default. - Expands the `format_options` schema description to state the default formatting (uppercase keywords, indent 2, max width 180, trailing commas, column/key alignment) and the `"null"` opt-out for raw SQL. - Regenerates `apps/docs/public/cli/config.schema.json` and `project-config.schema.json` from the config package build so the published schemas carry the corrected example and description. No runtime behavior changes; the actual formatting defaults are untouched. **Also included:** the second commit ports the regenerated `apps/cli-go/pkg/api/types.gen.go` from the pending API sync in #6434, because the `Codegen` check regenerates that file from the live Management API spec and was red on this branch for a drift this PR did not cause. It is the same one-file diff as #6434 and becomes a no-op once that sync lands on `develop`. ## Linked issue Reported internally; no GitHub issue. - [x] The linked issue is **open** and carries the `open-for-contribution` label (or I'm a Supabase maintainer). ## Checklist - [x] The PR title follows [Conventional Commits](https://www.conventionalcommits.org/) (e.g. `fix(cli): …`). - [x] Tests added or updated for the change (not applicable: comment text and schema annotations only). - [x] From the repository root, `pnpm check:all` passes; relevant package tests pass for every touched workspace, and `pnpm types:check` passes for each touched TypeScript workspace (or workspace declaring it). All checks pass locally except `@supabase/cli-go#lint:check`, which could not run in the authoring environment because its golangci-lint build predates the module's Go 1.26 target; the Go diff is one digit in a comment line of the embedded config template, so CI covers it. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Jq8az2X32Fh4UWvRxKUjAR --------- Co-authored-by: Claude <noreply@anthropic.com>

## TL;DR adds live e2e coverage for `db query`, `db lint`, and `db advisors` completing the db family (push, pull, reset, and dump already have it) ## whats introduced? - `db query`: runs a marker select over the real connection and proves the row comes back as the `-o json` payload - `db lint`: seeds a plpgsql function referencing a missing table and proves the reported finding names both the function and the missing relation - `db advisors`: seeds a public table without row level security and proves the `rls_disabled_in_public` finding names it ## ref: - closes: CLI-1949

…6427) ## TL;DR adds live e2e coverage for `postgres-config get`, `update`, and `delete`, covering the postgres-config command family ## whats introduced? - `postgres-config get`: reads the target project's config and proves a json object payload on stdout - `postgres-config update`: applies a `work_mem` override with `--no-restart`, proves the row in its own output and through get, then removes it - `postgres-config delete`: seeds a override, proves it landed, deletes it, and proves get no longer returns the key ## ref: - closes: CLI-2271

Implements [CLI-2156](https://linear.app/supabase/issue/CLI-2156/add-supabase-config-diff-to-the-cli): a read-only `supabase config diff` that classifies drift between `supabase/config.toml` and the effective configuration `GET /v2/projects/{ref}/config` reports for a target project or branch. Never writes. Builds on CLI-2155's sparse subtraction/defaults (#6205) and consumes CLI-2230's `ProjectConfig` convergence normalizers (#6339) as its comparison operands. ## What changed **`packages/config` — the comparison core (ADR 0022)** - `config-diff.ts`: a pure classifier producing a typed `ConfigChangeSet` (`update` / `remote_only` / `local_only`, plus `masked` and per-class `counts`), reusable by `config pull` without the command layer. - Both operands are CLI-2230 convergence projections (ADR 0021): `fromConfigDocument({config, document})` locally (raw-presence-masked, canonicalized, secret-omitting) and `fromApiProjectConfig(response)` remotely. All wire knowledge — renames, boolean inversions, duration/byte-size conversions, the GoTrue key table — lives in the shared `projectConfigMappingRows` registry, so the managed surface is `isComparableProjectConfigPath` **by construction**: a path with no registry row (`[studio]`, ports, image pins, `[realtime]` locals, `workers`) can never be reported. - Classification is driven by the raw document's *declared*-key set — the one signal a decoded config cannot recover — so "the file wrote the default" and "the file is silent" classify differently (`update` vs suppressed/`remote_only`). - `remote_only` suppression baseline: the default config's own convergence projection, falling back to the raw schema default for push-gated containers (network restrictions' allow-all default is exactly the platform's unconfigured state), then to the type's zero value. An untouched project diffs clean. - Secrets (the registry's `isSecret` rows) are "present, unknown": both normalizers omit them, they never classify or count, and locally-declared ones surface via `masked` so a clean diff is visibly a partial claim. - Residual equality is meaning-based: multiset array comparison (`additional_redirect_urls` order is not drift) and string/number, string/boolean scalar tolerance. - `io.ts`/`lib/env.ts`: value origins now record the resolving env-var name, so a change on an `env()`-fed property names the variable. **`apps/cli` — legacy-shell command** - `legacy/commands/config/diff/`: command + handler + errors + `SIDE_EFFECTS.md`. Target resolution: `--target <branch-name|uuid|ref>` (same acceptance as `link`; 404 → "run `supabase branches list`"), `--project-ref`, else the linked ref; `--target` + `--project-ref` together is a hard error. When the resolved ref matches a `[remotes.*]` block's `project_id`, the local operand is the branch's merged effective config (ADR 0018), otherwise the base config — the echoed line always says which. - Output: text (unset renders `(unset)` / `(not returned)`; `(from env VAR)` annotations; masked note) and `--output-format json|stream-json` (structured payload with `schema_version`, `target`, `scope`, `changes[]`, `masked[]`, `counts`). The comparison-scope line lists which response blocks were carried. The Go-compat `-o/--output` flag is **rejected outright** (every value, `pretty` included) with an error pointing at `--output-format` — per the ticket-thread decision that net-new commands carry no Go parity contract. `--exit-code` sets exit 1 on drift via `ProcessControl.setExitCode` after the payload is emitted. - `legacy/shared/legacy-branch-ref.resolver.ts`: the branch name/UUID/ref resolver hoisted out of the branches family (cross-family use) with injected error mappers; the branches family keeps a thin binding so its call sites are unchanged. **Docs**: ADR 0022 (classification + managed surface, incl. the registry consolidation and its relationship to ADR 0019/0020/0021), `go-cli-divergences.md` TS-only command entry (replacing the ticket's stale `go-cli-porting-status.md` criterion), per-command `SIDE_EFFECTS.md`. ## History note for reviewers The branch was first implemented with a self-contained translation table (a ~900-line port of the Go CLI's `FromRemoteAuthConfig`). After #6339 landed the registry-driven normalizers on `develop` — with this command as their named consumer — the merge commit (`766182f`) brought `develop` in and the follow-up (`cae9c14`) deleted the tables and rebuilt the classifier on the registry, per the repo's no-parallel-code-paths policy. ADR 0022's "Considered Alternatives" records both designs. ## Decisions & assumptions worth reviewing 1. **Managed surface = the shared registry** (vs schema annotations or response-key walking): single source of truth shared with Studio and the future push mapper; a missing row fails safe (silently unmanaged, never misreported). Alternatives in ADR 0022. 2. **Suppression baseline chain** (default projection → raw schema default → zero value) is a judgment call: without it, every unconfigured OAuth provider and the platform's allow-all network restrictions read as drift on untouched projects. The cost is that a remote override that happens to equal a schema default on an undeclared path is not reported. 3. **`schema_version`** in the payload is the file's `$schema` ref (falling back to the current schema URL) — CLI-2155 shipped no separate version token. 4. **Rendered "local" values are convergence projections** (ADR 0021), i.e. what pushing the file would produce hosted — canonicalized durations/byte sizes, push-gated omissions — not necessarily the file's literal spelling. Documented in `SIDE_EFFECTS.md`. 5. **Legacy `-o` support was implemented per the original acceptance criteria, then removed** after Colum confirmed on the ticket that parity isn't a goal for net-new commands. The flag now fails fast with a bespoke invalid-input error; the JSON payload always carries explicit `null` for unset sides. 6. **Masked credentials are transparent**: listed in `masked[]` / a text note rather than silently skipped, and never affect `--exit-code`. 7. **Partial responses degrade, never error**: comparable paths the response doesn't carry are `local_only` when declared locally, silent otherwise; the scope line calls out missing blocks. (Today's v2 schema requires all six blocks, so this is belt-and-braces for API evolution and permission-trimmed keys.) 8. The classifier inherits ADR 0021's limits: unconditionally-mapped fields with no local-silence signal can surface as honest-but-push-unactionable `remote_only` entries (tracked on CLI-2266). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Colum Ferry <cferry09@gmail.com>

## TL;DR stop sending the migration ledger DDL to remotes that already have the ledger, which is the traffic the Supavisor session pooler kills... ## what's biting? migration repair dies with a connection error over the session pooler while migration list works on the same connection. every history command runs the seven statement ledger setup transaction on every invocation, even when the ledger already exists, and that DDL is what the pooler drops. list only sends a SELECT. ## now fixed by: a read-only probe with the same wire shape as the list SELECT. ledger fully there: no DDL is sent. anything less, or any odd probe answer: the full unchanged DDL runs, so ledger upgrades behave exactly as before. covers the history and seed ledgers... ## ref: - closes: #6393

…6436) Reuses the CLI release train's Slack webhook (`SLACK_RELEASE_WEBHOOK`, the cli-deployer-notifier app) for the `@supabase/config` release pipeline, covering both halves of the release lifecycle: paging reviewers when a release is awaiting approval, and confirming the publish actually landed. ## What changed - **`slack-notify.yml`** is generalized beyond the CLI: a required `package` display-name input, `tag_prefix` so changelog links can point at `config-v*` tags, an optional `npm_package` input that adds an npm version-page link to success messages, and two new statuses — `awaiting-approval` and `declined`. Unknown statuses now fail the step instead of silently rendering as success. - **`release.yml`** passes the new required `package` input at both call sites. CLI notification firing conditions are unchanged; payload deltas are cosmetic copy only. - **`release-config.yml`**: - `notify-slack-approval` pings the channel when a real (non-dry) release arms the `config-release` environment gate. It needs only `plan`, so it runs while the publish job sits in `waiting` — the message links to the run, where the Approve button and the plan job's evidence summary live. The webhook is one-way, so the approval click itself deliberately stays on GitHub. - A new **"Verify the release is live on npm"** step runs after `npm publish` and before the tag push: it probes the registry with backoff (~2 min budget, `--prefer-online`) until the version resolves, then requires the packument's `dist.integrity` to match the reviewed tarball and the dist-tag to point at the published version. The success notification therefore means registry-visible with the approved bytes, not merely "the job didn't error". The step runs no package-controlled code, preserving the publish job's `id-token: write` boundary. - `notify-slack` posts the success message (npm + changelog links) via the implicit `success()` gate — dry runs and no-release pushes skip publish and stay silent. - `classify-failure` + `notify-slack-failure` report broken releases. The classifier reads the run's approvals record (`GET .../actions/runs/{run_id}/approvals`) and classifies on the **last** review's state, so a reviewer rejection is announced as "release not approved" instead of a broken release, while a reject → re-run → approve → genuine-failure sequence still pages as a real failure. The notify job fails open: if the classifier itself breaks, the page still goes out as a plain failure. - **`packages/config/AGENTS.md`** documents the webhook secret as standing invariant 5 (notify jobs are terminal — a missing/rotated webhook reddens the run but cannot affect the release) and the verify step in the publish sequence. ## Reviewer notes - Rejection semantics were verified against GitHub docs: rejecting a pending deployment marks the waiting job **failed**, so `failure()` fires and the declined path is reachable; the approvals endpoint returns `state ∈ approved|rejected|pending` and is readable with the default token plus job-level `permissions: actions: read`. - The Slack payload stays heredoc-built rather than `jq --arg`: every new input is a workflow-file literal at all five call sites, and a `jq --arg` migration would re-escape the literal `\n` sequences the message bodies rely on. Considered and deliberately not done here. - There is no automated exercise of these workflows in CI (actionlint config exists but nothing runs it — possible follow-up); this diff was validated with actionlint locally and by executing the notifier script offline for every status/input combination.

This PR was automatically created to sync API types from the infrastructure repository. Changes were detected in the generated API code after syncing with the latest spec from infrastructure. Co-authored-by: supabase-cli-releaser[bot] <246109035+supabase-cli-releaser[bot]@users.noreply.github.com>

depthfirst-app · 2026-09-02T22:19:08Z

+        # heavy workload cleanly. There is no released fix above v1.12 yet.
+        uses: openai/codex-action@52fe01ec70a42f454c9d2ebd47598f9fd6893d56 # v1.11
+        with:
+          openai-api-key: ${{ secrets.OPENAI_API_KEY }}


🟡 Severity: MEDIUM

On a maintainer-requested review of a fork, untrusted PR content is supplied to Codex while OPENAI_API_KEY is available to the action process. Prompt injection can direct Codex to read the process environment, encode the key to evade regex redaction, and publish it through findings artifacts or the public review.
Helpful? Add 👍 / 👎

💡 Fix Suggestion

Suggestion: This vulnerability requires a multi-file architectural fix to prevent Codex from processing untrusted fork PR diff content while OPENAI_API_KEY is in scope.

Root cause: When a maintainer triggers /ai-review on a fork PR, resolve.ts intentionally bypasses the fork skip (line 174: "draft/fork/bot skips below don't apply"), and the codex-review job then passes OPENAI_API_KEY to openai/codex-action while feeding it the fork's untrusted diff. A prompt injection payload in the diff can instruct Codex to read process.env.OPENAI_API_KEY, base64-encode it to bypass redactSecrets(), and emit it in codex-findings.json.

Fix requires changes in two files:

In .github/scripts/ai-review/resolve.ts: Add is_fork to ResolveResult and populate it from pr.headRepoFullName !== pr.baseRepoFullName. Then output it via writeOutputs by adding is_fork: String(result.isFork ?? false) to the entries record.

In .github/workflows/ai-review.yml: (a) Add is_fork: ${{ steps.resolve.outputs.is_fork }} to the resolve job's outputs: block (alongside should_run, pr_number, head_ref, and trigger). (b) Add a condition to the codex-review job's if: to exclude fork PRs: if: needs.resolve.outputs.should_run == 'true' && needs.resolve.outputs.is_fork != 'true'. This ensures Codex is never invoked with OPENAI_API_KEY while processing untrusted diff content from a fork — only the Claude review (which runs in a fully isolated job with a separate key and a read-only tool allowlist) handles fork PRs on manual trigger.

As an additional defense-in-depth measure, rotate OPENAI_API_KEY immediately and consider using a dedicated, scope-limited OpenAI API key for CI that is separate from keys used in other contexts, so any future exposure has minimal blast radius.

…6442) Bumps the go-minor group with 2 updates in the /apps/cli-go directory: [github.com/getsentry/sentry-go](https://github.com/getsentry/sentry-go) and [github.com/posthog/posthog-go](https://github.com/posthog/posthog-go). Updates `github.com/getsentry/sentry-go` from 0.48.0 to 0.49.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-go/releases">github.com/getsentry/sentry-go's releases</a>.</em></p> <blockquote> <h2>0.49.0</h2> <h3>Breaking Changes 🛠</h3> <ul> <li>removing DisableLogs and DisableMetrics client options. Sending metrics and logs is already gated by the usage of our APIs already, so having a global kill switch is counter intuitive. Users that won't to opt out should just not call the relevant APIs or setup the integrations. by <a href="https://github.com/giortzisg"><code>@giortzisg</code></a> in <a href="https://redirect.github.com/getsentry/sentry-go/pull/1392">#1392</a></li> </ul> <h3>New Features ✨</h3> <ul> <li>add <code>WithProxy</code>option for OTLP. This allows setting an <code>otlptracehttp.HTTPTransportProxyFunc</code> for the span exporter by <a href="https://github.com/pierrre"><code>@pierrre</code></a> in <a href="https://redirect.github.com/getsentry/sentry-go/pull/1377">#1377</a></li> </ul> <h3>Bug Fixes 🐛</h3> <ul> <li>(echo) Propagate span through request context by <a href="https://github.com/EricGusmao"><code>@EricGusmao</code></a> in <a href="https://redirect.github.com/getsentry/sentry-go/pull/1385">#1385</a></li> <li>Skip recover frames on panic. This changes stacktrace behavior for captured panics, removing <code>sentry.Recover</code> frames to focus on the actual panic frames. The changes might affect issue grouping. by <a href="https://github.com/giortzisg"><code>@giortzisg</code></a> in <a href="https://redirect.github.com/getsentry/sentry-go/pull/1364">#1364</a></li> </ul> <h3>Internal Changes 🔧</h3> <h4>Deps</h4> <ul> <li>Bump github.com/labstack/echo/v5 from 5.0.3 to 5.2.0 in /echo by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/getsentry/sentry-go/pull/1399">#1399</a></li> <li>Bump github.com/gorilla/websocket from 1.5.1 to 1.5.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/getsentry/sentry-go/pull/1397">#1397</a></li> <li>Bump getsentry/craft from 2.26.6 to 2.27.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/getsentry/sentry-go/pull/1381">#1381</a></li> <li>Bump actions/setup-go from 6.4.0 to 7.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/getsentry/sentry-go/pull/1382">#1382</a></li> <li>Bump actions/checkout from 6.0.3 to 7.0.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/getsentry/sentry-go/pull/1380">#1380</a></li> <li>Bump google.golang.org/grpc to 1.82.1 and golang.org/x/sys to 0.46.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/getsentry/sentry-go/pull/1375">#1375</a></li> <li>Bump golang.org/x/text to v0.39.0 and x/net to v0.56.0 by <a href="https://github.com/giortzisg"><code>@giortzisg</code></a> in <a href="https://redirect.github.com/getsentry/sentry-go/pull/1374">#1374</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-go/blob/master/CHANGELOG.md">github.com/getsentry/sentry-go's changelog</a>.</em></p> <blockquote> <h2>0.49.0</h2> <h3>Breaking Changes 🛠</h3> <ul> <li>removing DisableLogs and DisableMetrics client options. Sending metrics and logs is already gated by the usage of our APIs already, so having a global kill switch is counter intuitive. Users that won't to opt out should just not call the relevant APIs or setup the integrations. by <a href="https://github.com/giortzisg"><code>@giortzisg</code></a> in <a href="https://redirect.github.com/getsentry/sentry-go/pull/1392">#1392</a></li> </ul> <h3>New Features ✨</h3> <ul> <li>add <code>WithProxy</code>option for OTLP. This allows setting an <code>otlptracehttp.HTTPTransportProxyFunc</code> for the span exporter by <a href="https://github.com/pierrre"><code>@pierrre</code></a> in <a href="https://redirect.github.com/getsentry/sentry-go/pull/1377">#1377</a></li> </ul> <h3>Bug Fixes 🐛</h3> <ul> <li>(echo) Propagate span through request context by <a href="https://github.com/EricGusmao"><code>@EricGusmao</code></a> in <a href="https://redirect.github.com/getsentry/sentry-go/pull/1385">#1385</a></li> <li>Skip recover frames on panic. This changes stacktrace behavior for captured panics, removing <code>sentry.Recover</code> frames to focus on the actual panic frames. The changes might affect issue grouping. by <a href="https://github.com/giortzisg"><code>@giortzisg</code></a> in <a href="https://redirect.github.com/getsentry/sentry-go/pull/1364">#1364</a></li> </ul> <h3>Internal Changes 🔧</h3> <h4>Deps</h4> <ul> <li>Bump github.com/labstack/echo/v5 from 5.0.3 to 5.2.0 in /echo by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/getsentry/sentry-go/pull/1399">#1399</a></li> <li>Bump github.com/gorilla/websocket from 1.5.1 to 1.5.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/getsentry/sentry-go/pull/1397">#1397</a></li> <li>Bump getsentry/craft from 2.26.6 to 2.27.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/getsentry/sentry-go/pull/1381">#1381</a></li> <li>Bump actions/setup-go from 6.4.0 to 7.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/getsentry/sentry-go/pull/1382">#1382</a></li> <li>Bump actions/checkout from 6.0.3 to 7.0.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/getsentry/sentry-go/pull/1380">#1380</a></li> <li>Bump google.golang.org/grpc to 1.82.1 and golang.org/x/sys to 0.46.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/getsentry/sentry-go/pull/1375">#1375</a></li> <li>Bump golang.org/x/text to v0.39.0 and x/net to v0.56.0 by <a href="https://github.com/giortzisg"><code>@giortzisg</code></a> in <a href="https://redirect.github.com/getsentry/sentry-go/pull/1374">#1374</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/getsentry/sentry-go/commit/78b09d19307aafb162cd57838bd5c72055b14c8c"><code>78b09d1</code></a> release: 0.49.0</li> <li><a href="https://github.com/getsentry/sentry-go/commit/eff9f377d6f5c6cd17d981a503d9c4efa863471f"><code>eff9f37</code></a> build(deps): bump github.com/labstack/echo/v5 from 5.0.3 to 5.2.0 in /echo (#...</li> <li><a href="https://github.com/getsentry/sentry-go/commit/c60a2f6f2f70c818795c3b9f064e5d507483f23d"><code>c60a2f6</code></a> feat!: remove DisableLogs and DisableMetrics options (<a href="https://redirect.github.com/getsentry/sentry-go/issues/1392">#1392</a>)</li> <li><a href="https://github.com/getsentry/sentry-go/commit/c3f2330e3b2e508df29de709f9c88e79a6acd2a8"><code>c3f2330</code></a> build(deps): bump github.com/gorilla/websocket from 1.5.1 to 1.5.3 (<a href="https://redirect.github.com/getsentry/sentry-go/issues/1397">#1397</a>)</li> <li><a href="https://github.com/getsentry/sentry-go/commit/9bb14a7138ebe6ddf1c3fb9ced5c7874f7e338ca"><code>9bb14a7</code></a> fix(echo): propagate span through request context (<a href="https://redirect.github.com/getsentry/sentry-go/issues/1385">#1385</a>)</li> <li><a href="https://github.com/getsentry/sentry-go/commit/fb9acd84b1dfc91073c046e9c5612faf3422d749"><code>fb9acd8</code></a> build(deps): bump getsentry/craft from 2.26.6 to 2.27.2 (<a href="https://redirect.github.com/getsentry/sentry-go/issues/1381">#1381</a>)</li> <li><a href="https://github.com/getsentry/sentry-go/commit/17f540e8a47f9af562099008fdb0f5f45a54954c"><code>17f540e</code></a> feat(otel/otlp): add WithProxy option to span exporter (<a href="https://redirect.github.com/getsentry/sentry-go/issues/1377">#1377</a>)</li> <li><a href="https://github.com/getsentry/sentry-go/commit/ed9834eec263025a1d099e41adfff2d738d2ac57"><code>ed9834e</code></a> build(deps): bump actions/setup-go from 6.4.0 to 7.0.0 (<a href="https://redirect.github.com/getsentry/sentry-go/issues/1382">#1382</a>)</li> <li><a href="https://github.com/getsentry/sentry-go/commit/af6d9dbfd0dbe4836896717ec59732ddd75979dc"><code>af6d9db</code></a> build(deps): bump actions/checkout from 6.0.3 to 7.0.1 (<a href="https://redirect.github.com/getsentry/sentry-go/issues/1380">#1380</a>)</li> <li><a href="https://github.com/getsentry/sentry-go/commit/93223f752b00e794aacd0b87b4d86b220af06081"><code>93223f7</code></a> build(deps): bump google.golang.org/grpc to 1.82.1 and golang.org/x/sys to 0....</li> <li>Additional commits viewable in <a href="https://github.com/getsentry/sentry-go/compare/v0.48.0...v0.49.0">compare view</a></li> </ul> </details> <br /> Updates `github.com/posthog/posthog-go` from 1.24.1 to 1.24.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/posthog/posthog-go/releases">github.com/posthog/posthog-go's releases</a>.</em></p> <blockquote> <h2>1.24.2</h2> <h2>Unreleased</h2> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/PostHog/posthog-go/blob/main/CHANGELOG.md">github.com/posthog/posthog-go's changelog</a>.</em></p> <blockquote> <h2>1.24.2</h2> <h3>Patch Changes</h3> <ul> <li>360bc8d: Align local <code>is_set</code> and <code>is_not_set</code> evaluation with partial property context.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/PostHog/posthog-go/commit/5e7fa9819ff248a3696c478a1691bb50755d9ea9"><code>5e7fa98</code></a> chore: release v1.24.2 [version bump] [skip ci]</li> <li><a href="https://github.com/PostHog/posthog-go/commit/360bc8d46821cdbd5b443b690a8b51a08677c53d"><code>360bc8d</code></a> fix(flags): align presence operator semantics (<a href="https://redirect.github.com/posthog/posthog-go/issues/297">#297</a>)</li> <li>See full diff in <a href="https://github.com/posthog/posthog-go/compare/v1.24.1...v1.24.2">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

## Summary Makes the `name` argument to `supabase experimental workers new` optional and prompts for it when it is omitted, so a bare `supabase experimental workers new` walks through name, runtime and size rather than failing the parse. The name is the one input this command cannot default — it is the directory, the `[workers.<name>]` key and the hostname all at once. So where the runtime and size prompts fall back to a default when there is nowhere to ask, the name prompt has nothing to fall back to: with `-o json|yaml|toml|env` or no interactive terminal, the command fails with a new `MissingWorkerNameError` pointing at `supabase experimental workers new api`. The prompt validates against everything the command would otherwise refuse a moment later — a non-DNS-label name, and a name `config.toml` already records — so a typo is corrected in place instead of ending the run. That also means the project has to be loaded before the first prompt, and the machine-output check moves up with it: `-o` leaves `output.format` as `text`, and Clack writes its terminal UI to stdout, so a name prompt would land in front of the payload for the same reason the runtime prompt would. The handler's inline name validation is replaced by the shared `legacyValidateWorkerName`, which the rest of the command family already uses, so an explicitly-passed name and a prompted one are refused on identical terms. `mockOutput` now records `promptTextCalls` so tests can assert on the prompt's message and exercise its `validate` callback. ## Stack Bottom of the workers stack, on `develop`. Above it: output polish (#6389), `workers logs` (#6410), and `push --wait` (#6371). ## Linked issue FUNC-840 (Linear). Supabase maintainer, exempt from the `open-for-contribution` flow. ## Checklist - [x] The PR title follows [Conventional Commits](https://www.conventionalcommits.org/)

depthfirst-app · 2026-09-03T05:22:13Z

+        # heavy workload cleanly. There is no released fix above v1.12 yet.
+        uses: openai/codex-action@52fe01ec70a42f454c9d2ebd47598f9fd6893d56 # v1.11
+        with:
+          openai-api-key: ${{ secrets.OPENAI_API_KEY }}


🟡 Severity: MEDIUM

On a maintainer-requested review of a fork, this adjudication job feeds untrusted PR files to Codex while providing OPENAI_API_KEY. Prompt-injected PR content can direct Codex to read its process environment, encode the key, and return it through the merged-review artifact or public review.
Helpful? Add 👍 / 👎

💡 Fix Suggestion

Suggestion: Apply a two-layer defence: (1) At line 500, replace the shared OPENAI_API_KEY with a dedicated, spend-capped OpenAI Project API key stored as a separate secret (e.g. OPENAI_ADJUDICATE_API_KEY). A Project key can be scoped to a single model with a hard spend cap, so even if it is exfiltrated through encoded Codex output the blast radius is isolated to this job and the key is cheap to rotate. (2) In .github/scripts/ai-review/post-review.ts, extend redactSecretsDeep / redactSecrets to also detect and redact base64- and hex-encoded variants of each secret pattern: after the normal regex pass, base64-decode every ≥20-char base64 token and re-apply SECRET_PATTERNS, and similarly hex-decode even-length hex runs; remove any token that matched. This closes the encoding bypass that lets prompt-injected Codex smuggle an encoded key through the artifact redaction step. Until encoding-aware redaction is in place, consider adding a field-length cap and a non-ASCII reject gate in the assertMergedReview validator so suspiciously long or non-printable strings fail validation before the artifact is uploaded.

⚠️ Experimental Feature: This code suggestion is automatically generated. Please review carefully.

Suggested change

openai-api-key: ${{ secrets.OPENAI_API_KEY }}

openai-api-key: ${{ secrets.OPENAI_ADJUDICATE_API_KEY }}

## Summary The workers commands each grew their own way of saying "here is what happened" and "here is what to run next". This settles them on the shapes the rest of the legacy shell already uses. **No command changes what it does** — this is output, plus the coverage that pins it. - **Success trailers.** "What to run next" lines in `new`, `push`, `delete` and `status` move to `emitSuccessTrailer`, the way `stop`, `bootstrap`, `migration repair` and `gen signing-key` already emit theirs: printed once at the end of the run rather than inline, so a multi-worker push does not bury each worker's hint under the next worker's output. The commands within them are aqua'd. - **`list` advisories.** Both take the yellow `WARNING:` prefix and the two-line consequence shape `start`'s Docker notice uses. Each was one long sentence that re-flowed at a different width, directly under a table that lines its columns up. - **`list` drops the URL column.** Every worker's URL is the same host and prefix with the name on the end, and carrying it pushed the table past 130 columns for one derivable field — `renderGlamourTable` sizes each column to its widest cell and never wraps. `status` still renders it vertically, and every machine format still carries `url` per worker. - **`push` progress.** Per-worker announcements are counted (`Deploying Worker 1/2:`) and a multi-worker run closes with a summary. Each worker takes minutes; the name alone said nothing about how much of the run was left. - **`push` names what it never attempted.** The loop stops at the first failure and the error only names the worker that broke, leaving the rest to be reconstructed from argument order. On stderr in every format, machine ones included: that run is a CI run. - **`--project-ref` survives into `push`'s retry suggestions**, via the `legacyWorkersProjectRefSuffix` helper `status` and `delete` already use. A suggestion is copy-pasted verbatim, so one that dropped it re-resolved against whatever this checkout was linked to. Also adds unit coverage for `legacyRenderWorkerDetails`, pins the shared `-o env` refusal, and adds a guard (own commit) asserting no legacy boolean flag ships required — `Flag.boolean` alone builds a *required* param, and nothing in the existing suites notices. ## Stack On top of the `workers new` name prompt (#6349). Above it: `workers logs` (#6410), then `push --wait` (#6371) last, so the output work can ship independently of both. ## Linked issue [FUNC-851](https://linear.app/supabase/issue/FUNC-851/general-output-polish). Supabase maintainer, exempt from the `open-for-contribution` flow. ## Checklist - [x] The PR title follows [Conventional Commits](https://www.conventionalcommits.org/) --------- Co-authored-by: kanad <git@kanad.dev>

## Summary - upgrades mise lockfile using `mise lock --upgrade` (and bumps `mise` minimum version + github action accordingly) - upgrades `pnpm` to v12 - enables pnpm global store to speed up installation time in worktrees (and makes a few updates in our `pnpm-workspace` file so types and tests work properly) - upgrades node.js to latest v24 channel (24.18.0 => 24.20.0) - moves our node.js source-of-truth to `.node-version` — tiny and hopefully harmless change to better indicate to agents/etc. that we treat node and bun equally in this repo this PR was inspired by [these changes](https://supabase.slack.com/archives/C09PB9QMQG2/p1788257957531829) ## Checklist - [x] The PR title follows [Conventional Commits](https://www.conventionalcommits.org/) (e.g. `fix(cli): …`). - [x] Tests added or updated for the change. - [x] From the repository root, `pnpm check:all` passes; relevant package tests pass for every touched workspace, and `pnpm types:check` passes for each touched TypeScript workspace (or workspace declaring it). --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

## TL;DR fixes the `config diff` live test failing on every CI run since it landed, which was caused by asserting a fresh `supabase init` config has no auth drift against a fresh project whose platform defaults legitimately differ from the local template. now fixed by: pinning only the auth paths the registry declares baselines for, requiring the auth block in the comparison scope so the pin cannot pass vacuously, and stripping the spinner's ANSI from stdout before matching... ## ref: - closes: CLI-2294 - broken by: #6295 - spotted in: https://github.com/supabase/cli/actions/runs/33633309281/job/100257915846 - passed here: https://github.com/supabase/cli/actions/runs/33643747588/job/100293154783

## TL;DR adds live e2e coverage for `ssl-enforcement get` and `update`, covering the ssl-enforcement command family ## whats introduced? - `ssl-enforcement get`: reads the target project's posture and proves the json payload carries `currentConfig.database` and `appliedSuccessfully` - `ssl-enforcement update`: captures the current posture, toggles it, proves the flip in its own output and through get, then restores the captured posture in the same test ## ref: - closes: CLI-2270

## What Adds `supabase config pull` (CLI-2064): fetches the config the Management API reports for a target project or branch (`GET /v2/projects/{ref}/config`) and applies it to the local `config.toml`/`config.json`, reusing the `config diff` comparison core (CLI-2156) for classification and `--dry-run`. ``` supabase config pull # linked project → config root supabase config pull --project-ref staging # branch → [remotes.staging] supabase config pull --dry-run # preview, equivalent to config diff supabase config pull --yes # skip confirmation (CI) ``` ## How it writes - **Scope resolution** (ADR 0023): reuse the `[remotes.*]` block whose raw `project_id` literal matches the resolved ref (the same rule the loader's overlay uses, so pull and push stay inverses); else a branch-named target creates `[remotes.<branch-name>]` (`--remote-label` overrides; label collisions error rather than silently retargeting an existing block); else the config root, with warnings on `dualScope` properties (new registry metadata) that also configure `supabase start`. - **Surgical writes**: a new format-preserving editor in `@supabase/config` (`config-edit.ts`) splices values into the raw TOML text — comments, blank lines, ordering, and quote style survive. Every edit is verified by re-parsing and deep-comparing against the independently computed expected document before an atomic temp+rename write; anything the editor can't handle safely is a typed refusal, never a best-effort splice. JSON configs are re-serialized with detected indent and preserved key order. - **Never harms the file**: pull never removes properties; `local_only`/unmanaged paths are untouched; `env()` references are never replaced with literals (reported with the variable name); masked credentials are never written; a plan fixpoint + pre-write schema-validation gate guarantee the written file always re-loads (see below). Uncommitted/untracked changes to the config abort non-interactive runs unless `--force`; `--yes` answers the prompt but never bypasses that guard. - **Convergence**: running pull twice against an unchanged remote writes nothing the second time and leaves the file byte-identical — verified live against staging. ## Notable decisions (details in ADR 0023 and the Linear issue) - Single `--project-ref` flag accepting ref/branch/UUID per the settled CLI-2167 vocabulary (the issue text's separate `--target` was dropped). - An `[remotes.*].project_id` spelled as `env(...)` that resolves to the target is a hard error: the loader matches raw literals, so writing there would never take effect and pull would never converge. `--remote-label` is the escape hatch; CLI-2291 tracks a load-time warning. - ADR-0021 "unpushable" families are written, with a note that `config push` cannot send them back. - No `go-cli-porting-status.md` row: the file now records only the residual Go delegation surface, and this command is net-new TS. User docs live at `apps/cli/docs/supabase/config/pull.md`. ## Found while dogfooding against staging Pulling `auth.sms.twilio.enabled = true` while the required sibling `account_sid` stayed gated (declared-but-unpushable against the pre-write state) produced a config that failed every subsequent schema load. Fixed with two layers: the plan expands to a fixpoint (re-classifying after projecting writes, so un-gated siblings get pulled too), and a pre-write validation gate decodes the projected document with the real schema and drops any family that would not re-load (skip reason `would_invalidate`, naming the missing fields) instead of writing it. Both layers verified live: the same scenario now withholds the twilio family with an actionable note while the other changes apply, and the file always re-loads. ## Also in this PR - Fixes CLI-2287: the `[remotes.*]` matching rule is now exported once from `@supabase/config` (`remoteNameForProjectRef`, raw-literal semantics) and `config diff`'s reload precheck uses it — an `env()`-valued `project_id` no longer triggers a wasted reload with duplicated deprecation warnings. Diff's behavior is otherwise byte-identical (its full suite passes unchanged). - Hoists diff's target resolution and shared formatters to the config family root (`config.target.ts`, `config.format.ts`) with per-command error constructors, per the Hoist-Before-You-Duplicate rule. - New `dualScope` registry metadata (36 paths, snapshot-pinned), `writeCliConfigDocumentText` atomic writer, and a git dirty-check helper. ## Reviewer notes - The handler is callable as a library (`legacyRunConfigPull` with an injected target and a constructor-produced source) for the planned `supabase pull` orchestrator. - Docs-site follow-up (not in this repo): `supabase/supabase`'s `common-cli-sections.json` needs a `config pull` entry when the CLI docs next sync. - Follow-ups filed: CLI-2289 (push branch-name vocabulary so the pull/push round trip has no manual step), CLI-2290 (`--only` subset pulls), CLI-2291 (load-time env()-project_id warning), CLI-2292 (config family cleanup). Pre-existing CLI-2285 (`--workdir` climb) applies to pull the same way it does to diff/push and stays a separate fix. Fixes CLI-2064

## Summary Reads the project's unified logs stream rather than a worker route — there is no worker-scoped log endpoint — via `v1GetProjectLogs`, which the generated client already carries. `--kind app|requests|builds` narrows to one of the three streams; without it all three are returned, tagged per line. `--tail` caps the rows. `--follow` keeps printing until interrupted. ## Three non-obvious things about that endpoint Each is documented at its call site, because none is guessable from the API surface: - **The filter is `log_attributes`, not the `source` column.** Worker rows carry an empty top-level `source`, because the Workers Logflare source is not enrolled as a category in the generic logs path, so `where source = 'worker_guest_logs'` matches nothing. The `in (...)` list over the three known streams is a tenancy guard rather than a convenience — with `source` empty it is the only thing excluding a non-worker row that happens to carry a `worker` attribute. - **Both timestamp bounds are always sent, spanning under 24h.** One bound alone yields a one-minute window, silently; neither is an outright error; and a span over 24h is clamped to `start + 24h`, returning an *older* slice than the one asked for rather than a truncated one. - **A failed query can arrive as HTTP 200** with a populated `error`, so the envelope is checked before `result`. The response is decoded against a local schema rather than the generated `V1GetProjectLogsOutput`: that schema marks `result`/`error` optional but permits neither to be `null`, while the endpoint always sends one of them as an explicit `null`. Decoding a real response against it always fails — worth fixing in the spec separately. ## Rendering Per-stream, because `event_message` differs in kind: on the request stream it is only `"GET /"`, with status and duration in `log_attributes`, so the request line is composed. `severity_text` is ignored — it is `INFO` on every row of every stream — so the level is derived, and app lines report none rather than a guess. An app message is tenant-controlled bytes, so escape sequences are stripped before it reaches a terminal while a stack trace's newlines and indentation survive. ## `--follow` The poll interval is set by the rate limit, not by responsiveness: the v1 analytics endpoints allow 10 requests per 60 seconds, so the two-second poll a live tail suggests would spend the whole allowance in ten seconds. It polls every 10 seconds, measured at ~7 requests in the worst 60-second window. The cursor deliberately lags 60 seconds behind the newest line printed. Guest lines are relayed CloudWatch → subscription filter → Lambda → Logflare and arrive late and out of order, so a cursor sitting on the newest timestamp would drop every straggler permanently. Overlap is therefore guaranteed; dedupe on the Logflare-minted `id` is what makes it invisible. `-o json|yaml|toml` and `--output-format json` are refused up front — each promises one terminal payload and a tail has no last element. `--output-format stream-json` emits one `log-entry` event per line. SIGINT exits 130. ## Stack On top of the workers output polish (#6389), with `push --wait` (#6371) stacked above so it can be rejected independently. Below those: the `workers new` name prompt (#6349). ## Note Replaces #6408, which GitHub marked merged during a stack reorder. It was never merged to `develop`; the branch and its commits are intact here.

…#6371) ## Summary `supabase experimental workers push` blocks on the server-side container build. That build routinely runs for minutes, so the common case — a deploy that builds fine — is the slowest thing in the loop. `--no-wait` returns once the platform accepts the deploy, which is the last thing the command can learn without waiting: the deploy response arrives only after the spec and the uploaded context are accepted, and it carries the accepted spec back. Waiting stays the default, so a plain push still reports the build's verdict and existing invocations are unchanged. - Under `--no-wait` the details block leads with a `State` row — the one row that says the worker is not serving yet — and drops `Image`, since no image exists until the build produces one. - A success trailer then points at `experimental workers status` for the build's outcome. Text output only; machine callers read `build_state` from the payload. - A deploy answered with a spec already in `failed` is reported as a failure whether or not the build was waited on, rather than exiting zero on a worker that will never come up. The second commit is a separate fix that fell out of the review: the wait now runs only when the deploy response left `build_state` at `building`. `V2DeployAWorkerOutput` permits a terminal `active` or `failed` on the deploy response itself, and polling on top of that could only contradict it — `awaitWorkerBuild` reads a post-deploy 404 as "still building", so an already-failed deploy could burn the full poll budget and surface as a timeout rather than the failure the platform had already reported. ## Stack Top of the workers stack, on top of `workers logs` (#6410). Everything below it — the name prompt (#6349), the output polish (#6389) and `workers logs` — is independent of this flag, so this PR can be rejected on its own without holding any of them up. ## Linked issue FUNC-848 (Linear). Supabase maintainer, exempt from the `open-for-contribution` flow. ## Checklist - [x] The PR title follows [Conventional Commits](https://www.conventionalcommits.org/)

johnstonmatt and others added 30 commits August 26, 2026 20:17

github-merge-queue Bot deployed to config-release September 1, 2026 18:39 View deployment

supabase-cli-releaser Bot and others added 2 commits September 1, 2026 19:44

7ttp mentioned this pull request Sep 2, 2026

chore(codeql): resolve deploy scan findings #6433

Merged

7ttp and others added 2 commits September 2, 2026 09:10

github-merge-queue Bot deployed to config-release September 2, 2026 09:29 View deployment

7ttp and others added 8 commits September 2, 2026 09:39

github-merge-queue Bot deployed to config-release September 2, 2026 15:49 View deployment

supabase-cli-releaser Bot added 2 commits September 2, 2026 17:01

depthfirst-app Bot reviewed Sep 2, 2026

View reviewed changes

dependabot Bot and others added 2 commits September 3, 2026 00:15

depthfirst-app Bot reviewed Sep 3, 2026

View reviewed changes

johnstonmatt and others added 7 commits September 3, 2026 05:32

Navigation Menu

Uh oh!

chore: production deploy - #6416

chore: production deploy#6416
supabase-cli-releaser[bot] wants to merge 69 commits into
mainfrom
develop

supabase-cli-releaser Bot commented Sep 1, 2026

Uh oh!

depthfirst-app Bot Sep 2, 2026

Uh oh!

depthfirst-app Bot Sep 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

	openai-api-key: ${{ secrets.OPENAI_API_KEY }}
	openai-api-key: ${{ secrets.OPENAI_ADJUDICATE_API_KEY }}

Uh oh!

Conversation

supabase-cli-releaser Bot commented Sep 1, 2026

Uh oh!

depthfirst-app Bot Sep 2, 2026

Choose a reason for hiding this comment

Uh oh!

depthfirst-app Bot Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants