Skip to content

chore(deps): bump the supabase group across 1 directory with 3 updates - #106

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/supabase-65b1723285
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/supabase-65b1723285

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 11, 2026 •

Copy link
Copy Markdown
Contributor

Bumps the supabase group with 3 updates in the / directory: @supabase/ssr, @supabase/supabase-js and supabase.

Updates @supabase/ssr from 0.10.2 to 0.12.7

Release notes

Sourced from @​supabase/ssr's releases.

v0.12.7

0.12.7 (2026-09-08)

Bug Fixes

  • apply non-browser defaults when cookies only sets encode (#294) (9d6e2a5)

v0.12.7-rc.162

What's Changed

Full Changelog: supabase/ssr@v0.12.6...v0.12.7-rc.162

v0.12.6

0.12.6 (2026-09-04)

Bug Fixes

  • avoid duplicate cache headers per server client (#283) (af750e2)

v0.12.6-rc.158

What's Changed

New Contributors

Full Changelog: supabase/ssr@v0.12.5...v0.12.6-rc.158

v0.12.5

0.12.5 (2026-08-24)

Bug Fixes

  • warn when auth.storage is ignored by createBrowserClient/createServerClient (#284) (c1700f2), closes #142

v0.12.5-rc.154

What's Changed

... (truncated)

Changelog

Sourced from @​supabase/ssr's changelog.

0.12.7 (2026-09-08)

Bug Fixes

  • apply non-browser defaults when cookies only sets encode (#294) (9d6e2a5)

0.12.6 (2026-09-04)

Bug Fixes

  • avoid duplicate cache headers per server client (#283) (af750e2)

0.12.5 (2026-08-24)

Bug Fixes

  • warn when auth.storage is ignored by createBrowserClient/createServerClient (#284) (c1700f2), closes #142

0.12.4 (2026-07-28)

Bug Fixes

  • flush PKCE verifier slot removals on the server (#275) (6df6f03)

0.12.3 (2026-07-14)

Bug Fixes

  • cookies: keep domain-scoped deletion in name-keyed cookie stores (#258) (d3a8a98), closes #256

0.12.2 (2026-07-14)

Bug Fixes

  • align parseCookieHeader return type with getAll cookie method (#239) (e8fe1d5), closes #115

0.12.1 (2026-07-13)

Bug Fixes

  • cookies: deduplicate server cookie writes (#246) (035eabe)

0.12.0 (2026-06-09)

... (truncated)

Commits
  • 9b28f49 chore(main): release 0.12.7 (#295)
  • 9d6e2a5 fix: apply non-browser defaults when cookies only sets encode (#294)
  • 4ed9f65 chore: add workflow for autoclosing stale issues (#292)
  • 71c33a7 chore(main): release 0.12.6 (#291)
  • c7c7e68 docs: fix typos in tsdoc and design doc (#288)
  • af750e2 fix: avoid duplicate cache headers per server client (#283)
  • 905c7c3 build(deps): bump actions/deploy-pages from 5.0.0 to 5.0.1 (#290)
  • 9e2564d chore: update @​supabase/supabase-js to v2.114.0 (#289)
  • c5310fd chore(main): release 0.12.5 (#286)
  • c1700f2 fix: warn when auth.storage is ignored by createBrowserClient/createServerCli...
  • Additional commits viewable in compare view

Updates @supabase/supabase-js from 2.105.1 to 2.118.0

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.118.0

2.118.0 (2026-10-15)

🚀 Features

  • postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)
  • storage: add content-encoding support for uploads (#1949)

🩹 Fixes

  • ci: patch next and sharp advisories and pin node-browser playwright (#2753)

❤️ Thank You

  • Atharv Gaur @​Athaxv
  • Ferhat Elmas
  • Lukas Klingsbo

v2.118.0-canary.2

2.118.0-canary.2 (2026-10-12)

This was a version bump only, there were no code changes.

v2.118.0-canary.1

2.118.0-canary.1 (2026-10-12)

This was a version bump only, there were no code changes.

v2.118.0-canary.0

2.118.0-canary.0 (2026-10-09)

🚀 Features

  • postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)

🩹 Fixes

  • ci: patch next and sharp advisories and pin node-browser playwright (#2753)

❤️ Thank You

  • Lukas Klingsbo

v2.117.3

2.117.3 (2026-10-07)

🩹 Fixes

  • deps: bump next to patch RCE in realtime-js example (#2733)
  • functions: send a Blob or File with its own content type (#2714)

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.118.0 (2026-10-15)

🚀 Features

  • postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)

❤️ Thank You

  • Lukas Klingsbo

2.117.3 (2026-10-07)

🩹 Fixes

  • storage: send multipart fields before files (#2736)

❤️ Thank You

2.117.2 (2026-09-25)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.117.1 (2026-09-23)

🩹 Fixes

  • auth: return stored session when a refresh loses to another tab (#2698)

❤️ Thank You

2.117.0 (2026-09-22)

🚀 Features

  • auth: enable passkey API by default and deprecate experimental passkey opt-in (#2695)

❤️ Thank You

  • fadymak

2.116.0 (2026-09-07)

🚀 Features

  • auth: add MFA recovery codes API (#2676)

... (truncated)

Commits
  • b9753a1 feat(postgrest): leave computed fields out of select('*') and resolve no-argu...
  • 88faa11 fix(ci): patch next and sharp advisories and pin node-browser playwright (#2753)
  • aac9d32 chore(release): version 2.117.3 changelogs (#2744)
  • 4d23055 fix(storage): send multipart fields before files (#2736)
  • a684cf9 chore(release): version 2.117.2 changelogs (#2707)
  • 54c225d chore(release): version 2.117.1 changelogs (#2700)
  • 739b351 fix(auth): return stored session when a refresh loses to another tab (#2698)
  • f34d428 chore(release): version 2.117.0 changelogs (#2697)
  • cc45ccf feat(auth): enable passkey API by default and deprecate experimental passkey ...
  • c511286 docs(realtime): document relationship of accessToken() and heartbeat (#2680)
  • Additional commits viewable in compare view

Updates supabase from 2.98.1 to 2.121.0

Release notes

Sourced from supabase's releases.

v2.121.0

Supabase CLI v2.121.0 — 2026-10-14

This release is mostly stack reliability fixes, plus new stack options and deprecation warnings you'll want to see before the next major version. Most entries below are from PR titles, not full PR review.

Highlights

  • OrioleDB through db.orioledb_version — set the OrioleDB version in config instead of relying on a separate setup path. (#6934)
  • Repeatable --stack-id in stack destroy — tear down several stacks in one command. (#6964, #7000)
  • Gateway requests show up in Studio — API Gateway logs in Studio now include requests that pass through the local stack gateway. (#6942)

New features

  • stack destroy --stack-id accepts multiple IDs — e.g. supabase stack destroy --stack-id a --stack-id b. (#6964, #7000)
  • Leftover containers from deleted stacks get cleaned up — stale containers are removed automatically instead of piling up. (#7017)
  • Changed endpoint ports apply on restart — if you change endpoint ports while a stack is stopped, the new ports are used the next time it starts. (#6950)
  • Deprecation warnings for db pull and domains flags — you now see a warning at runtime when you use a deprecated flag. (#7115)

Improvements

  • functions serve defaults to stream-json for agents — when running non-interactively, output is streamed as JSON so agent tooling can parse it. (#7027)
  • Heads-up: deprecated config, env vars and import maps will be removed in the next major version — the CLI now warns when you use them. Migrate before upgrading to that major. (#7154)
  • Clearer db remote commit and inspect db deprecation messages — the warnings now say the features are removed in the next major version. (#7108)
  • More specific failure telemetry — stack and platform failures are classified and named more precisely, which makes issues easier to triage. (#7044, #7113, #7137, #7067)

Bug fixes

  • supabase start works with Podman when no snippets are present. (#7089)
  • Stack creates the supabase_functions database on the stack backend. (#7029)
  • functions serve overrides apply after the stack has started. (#7028)
  • Native Postgres trusts your host CA bundle, so connections through corporate or custom certificates work. (#7023)
  • Auth database and stack host connections stay alive instead of dropping mid-session. (#7080)
  • Gateway writes no longer fail under load, because they reuse keep-alive connections. (#7075, #6981)
  • Containers whose host port was taken before start are recreated rather than failing to start. (#7081)
  • Database helpers are removed when their owner exits, so they stop leaking between runs. (#7014, #6962)
  • Running dependents restart when a prerequisite crashes, so the stack recovers without a manual restart. (#7093)
  • pg_cron jobs run in background workers on native Postgres. (#7039)
  • Database helpers are created by name before they're attached to. (#7068)
  • supabase stop waits for a concurrent Docker prune instead of failing. (#7143, #7129)
  • Config accepts the new Management API Postgres settings, so they no longer get rejected. (#7056, #7054, #6934)

Plus 1 internal improvement and dependency update.

Full changelog: supabase/cli@v2.120.0...v2.121.0

v2.121.0-next.2

No release notes provided.

... (truncated)

Commits
  • 8a549df fix(cli): warn that deprecated config, env vars and import maps are removed i...
  • d47510f ci: speed up tests with sticky disks, parallel e2e and on-demand Windows and ...
  • d68f6d0 fix(cli): wait for a concurrent Docker prune in stop (#7143)
  • ddb5c6e chore(stack): bump storage to v1.82.1-r0 (#7153)
  • 2930f6d docs(cli): port pg-delta reference fixes into db diff and db pull overlays (#...
  • 45376da fix(cli): name the failing platform operation in defect telemetry (#7137)
  • cb2985f chore(cli): map db dump, pull, diff and declarative command permissions (#7136)
  • 28dad9c chore(stack): bump storage to v1.82.0-r0 (#7140)
  • 87e47b5 chore(cli): map db lint, push, reset and related command permissions (#7135)
  • 9af6852 chore(cli): bring the remaining commands under the effect skill (CLI-2693) (#...
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 11, 2026
@vercel

vercel Bot commented May 11, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
site-status Ready Ready Preview Oct 19, 2026 11:35am UTC

Request Review

@socket-security

socket-security Bot commented May 11, 2026 •

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​supabase/​supabase-js@​2.105.1 ⏵ 2.118.08810010098 +2100
Updated@​supabase/​ssr@​0.10.2 ⏵ 0.12.7100100100 +1096 +2100
Updatedsupabase@​2.98.1 ⏵ 2.121.098 +8100100 +198100

View full report

@dependabot dependabot Bot changed the title chore(deps): bump the supabase group with 3 updates chore(deps): bump the supabase group across 1 directory with 3 updates May 12, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/supabase-65b1723285 branch from 7f8992b to bd1fd62 Compare May 12, 2026 10:04
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/supabase-65b1723285 branch from bd1fd62 to 3b85d8c Compare May 29, 2026 18:56
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/supabase-65b1723285 branch from 3b85d8c to 7390109 Compare September 7, 2026 11:35
@socket-security

socket-security Bot commented Sep 7, 2026 •

Copy link
Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

Bumps the supabase group with 3 updates in the / directory: [@supabase/ssr](https://github.com/supabase/ssr), [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) and [supabase](https://github.com/supabase/cli/tree/HEAD/apps/cli).


Updates `@supabase/ssr` from 0.10.2 to 0.12.7
- [Release notes](https://github.com/supabase/ssr/releases)
- [Changelog](https://github.com/supabase/ssr/blob/main/CHANGELOG.md)
- [Commits](supabase/ssr@v0.10.2...v0.12.7)

Updates `@supabase/supabase-js` from 2.105.1 to 2.118.0
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.118.0/packages/core/supabase-js)

Updates `supabase` from 2.98.1 to 2.121.0
- [Release notes](https://github.com/supabase/cli/releases)
- [Changelog](https://github.com/supabase/cli/blob/develop/apps/cli/docs/release-process.md)
- [Commits](https://github.com/supabase/cli/commits/v2.121.0/apps/cli)

---
updated-dependencies:
- dependency-name: "@supabase/ssr"
  dependency-version: 0.10.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: supabase
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.105.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: supabase
- dependency-name: supabase
  dependency-version: 2.98.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: supabase
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/supabase-65b1723285 branch from 7390109 to 695bf60 Compare October 19, 2026 11:34

This branch was successfully deployed

1 active deployment
Preview — 695bf60a Deployed Oct 19, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants