[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
supabase (source)	^2.121.0 → ^3.0.0

---

Release Notes

supabase/cli (supabase)

v3.1.0

Compare Source

Supabase CLI v3.1.0 — 2026-11-09

This release adds inspect db diagnostics, a config.jsonc option, and an API retry cap for CI. Most of the rest is fixes for start, link, and db connections, plus a few local-stack behaviors that now match the hosted platform. One gotcha: local CORS on /functions/v1 changed (see Improvements).

Highlights

• Pinned Supabase CA on every linked database connection — db push/pull/dump/diff/reset/lint/advisors/query, migration *, and inspect * now verify the hosted server certificate. Previously only gen types did. (#​7518)
• TypeScript types for linked projects come from your local config.toml — gen types --lang typescript respects [api].extra_search_path and falls back to the Management API when needed. Remote output now matches local output. (#​7520)
• config.jsonc support — comments and trailing commas work, and the CLI keeps them when it writes the file. (#​7488)
• inspect db gets three new commands — xid-age, toast-sizes, and collation-drift, which reports indexes whose collation version has drifted and prints the fix steps. (#​6527, #​6528, #​7460)

New features

• SUPABASE_API_MAX_RETRIES caps Management API retries — set 0 in CI to send each request once. It applies to every API client, including login and services, and functions deploy respects it while still honouring rate limits. (#​7394)
• inspect db xid-age — lists user tables by transaction ID age, oldest first. Useful for spotting wraparound risk. (#​6527)
• inspect db toast-sizes — lists tables by TOAST storage, largest first. (#​6528)
• inspect db collation-drift — read-only check for btree indexes affected by OS collation changes. Run it, then follow the printed amcheck → REINDEX INDEX CONCURRENTLY → REFRESH VERSION steps. (#​7460)
• Logs commands unified — supabase logs is a single entry point for local and hosted logs, with an interactive explorer and structured output for scripts. (#​7437)
• config.jsonc and commented JSON configs — the loader reads config.json, config.jsonc, and config.toml from supabase/. Edits from the CLI preserve your comments. (#​7488)
• Config schema version is declared and checked — add $schema to config.json/config.jsonc, or #:schema at the top of config.toml. No declaration means v1. (#​7514)
• init writes a schema directive — new config.toml files start with #:schema https://supabase.com/schemas/config/v1.json, so Taplo, Tombi, and VS Code get autocomplete and validation. (#​7464)
• [auth.email] require_current_password — set it in config.toml to require the current password for password changes. config push/pull/diff support it too. (#​7458)
• Local stack serves auth email templates from content_path — templates are read on every fetch, so edits show up without a restart. (#​7527)
• Config-load telemetry records the failing key — config_key is added to cli_command_executed events. (#​7468)

Improvements

• Stack CORS now matches the hosted platform — preflights return 200 instead of 204, with a wider method list. A live parity test keeps them aligned. (#​7485)
• Gotcha: CORS on /functions/v1 is now handled by your function — the gateway no longer adds Access-Control-Allow-Origin: *, so a function that sends no CORS headers will be blocked by browsers. Add the headers in the function, or check your function's CORS handling if you call it from a browser. (#​7472)
• Linked sso list and sso show fail faster — each attempt is capped at 10s instead of 60s. When an SSO call fails, the CLI also warns if the project isn't ACTIVE_HEALTHY. (#​7491)
• supabase start skips Docker's first health-check wait — when services are already up, startup no longer waits about 10s on that check. (#​7430)
• supabase stop no longer shows an error for functions serve — stopping the stack while functions serve runs is treated as a normal stop, not a crash. (#​7463)
• Clearer migration errors for LOCK TABLE — a migration that fails with SQLSTATE 25P01 now explains the fix. Wrap the lock in BEGIN/COMMIT. (#​7487)
• Clearer Docker-down detection — newer Docker daemon-down messages, including the Windows form, are recognised. (#​7505)

Bug fixes

• supabase start no longer hangs after the output pipe closes — piping into a reader that exits early, like projects list | true, now ends the command. (#​7469)
• db push works against a remote Postgres without TLS — an unset or sslmode=prefer URL falls back to plaintext, like psql. (#​7509)
• db start --from-backup works on Windows — the drive letter is kept in the backup bind path. (#​7498)
• link no longer carries the old project's service versions — relinking to a new project no longer runs the old Auth, PostgREST, or Storage versions. (#​7476)
• gen types includes views from db-extra-search-path schemas — embeds that work at runtime are no longer rejected by the generated types. (#​7515)
• Studio's Logs pages are hidden when Logflare is off — with [analytics] enabled = false, Studio no longer shows Logs pages that fail with a 500. (#​7530)
• Functions get [edge_runtime.secrets] as written — secret names keep their case, and supabase/functions/<slug>/.env is read. (#​7481, #​7499)
• Stack image transforms match the legacy backend — imgproxy gets the same tuning, so browsers that accept WebP get WebP. (#​7483)
• Studio can create vector buckets on the stack — the local S3 keys are passed through. (#​7486)
• Binary request bodies type-check correctly in the Management API client — Uint8Array, ArrayBuffer, and Blob uploads to the update-function body are accepted again. (#​7443)
• Linked project health is surfaced on SSO failures — the warning above appears when a project isn't healthy. (#​7491)
• Docker start no longer leaves containers with a ~1B open-file limit — supabase start caps Erlang port tables for realtime, analytics, and the pooler. (#​7512)
• Missing supabase_privileged_role gets its own error — the login-role mint failure now says what's missing instead of a generic status error. (#​7461)
• Functions deploy errors are classified by cause — a malformed deno.json or import map counts as invalid config, not an internal bug. (#​7510)
• Stack gateway and registry fixes — the port registry opens in WAL mode so concurrent reads don't fail on Windows, and a directory restriction no longer strips a traverse bit. (#​7342, #​7276)
• Timeout and readiness errors name the stalled step — engine and helper timeouts report which command or container stalled. (#​7407, #​7319)
• Edge runtime exit 15 is treated as a stop — see the Improvements note above. (#​7463)

---

Plus 5 internal improvements and dependency updates.

Full changelog: supabase/cli@v3.0.0...v3.1.0

v3.0.0

Compare Source

Supabase CLI v3.0.0 — 2026-11-02

v3 is a major release. Commands that can run locally now target your local stack by default, one --remote flag replaces --linked, --project-ref and --db-url, and every change to a hosted project asks for confirmation (or --yes in CI). Flags and SUPABASE_* environment variables now override config.toml, and deprecated commands, flags, config keys and the bundled supabase-go binary are gone. Read the breaking changes before you upgrade CI.

The v2 to v3 migration guide walks through each change.

⚠️ Upgrading an older project? Rename [inbucket] to [local_smtp] first. v3 can't load a supabase/config.toml that still has an [inbucket] section, which supabase init wrote before v2.108.0, so start, stop, status and the db commands fail with [inbucket] in supabase/config.toml is no longer supported. Rename the section, and any [remotes.<name>.inbucket] block; the keys inside don't change. v2.108.0 and later already read [local_smtp], so you can rename it before you upgrade. See Rename [inbucket] to [local_smtp].

Try the experimental local stack. Each project, worktree or agent gets its own local Supabase that starts in seconds, on Docker or Podman, or with no container engine at all through supabase start --runtime native. Start a new project with SUPABASE_EXPERIMENTAL_STACK=1 supabase init; for an existing one, follow the setup steps in the blog post. The multiple local projects guide covers listing, stopping and removing projects. It's experimental, so its flags and output can still change.

⚠️ Breaking changes

Local by default, one --remote flag

• db push, db pull, db dump, migration fetch/list/repair, inspect db *, inspect report, gen types and storage ls/cp/mv/rm target the local stack when you pass no target. Add --remote for the linked project, --remote=<ref> for another project, --remote=<branch> for a branch of the linked project, or --remote=<postgres-url> for a database URL. SUPABASE_PROJECT_ID on its own no longer selects a hosted project; it only says which project bare --remote means. (#​7188)
• --linked, --project-ref, --db-url and gen types --project-id are deprecated. They still work, print a warning naming the --remote form, and are hidden from help. --local does nothing and warns. None of them can be combined with --remote=<value>. (#​7188)
• gen types with no target generates from the local database instead of opening a project picker. db schema declarative sync with no declarative files generates them from the local database; run supabase db schema declarative generate --remote first to start from the linked project. (#​7188)
• --remote <word> after a command that takes an operand fails with a "did you mean" error when the word looks like a branch name or project ref. Put the operand first (supabase db pull add_profiles --remote) or use --remote=<branch>. (#​7188)
• db diff rejects --remote together with --from/--to (use --from=remote or --to=remote), db query rejects SQL passed both as an argument and with --file, and an empty --project-ref= is now an error. Bare --remote in an unlinked checkout opens the project picker in an interactive terminal. (#​7188)

Every hosted change needs your consent

• Every command that changes a hosted project asks first, and fails unattended unless you pass --yes. Non-interactive, JSON, stream-json, agent and -o json|yaml|toml|env runs fail with HostedMutationConsentRequiredError. This includes db push, db pull when it updates the remote migration history, pull (except --dry-run), functions deploy/delete, secrets set/unset, config push, branches changes, backups restore, project and org create/delete, and the project settings commands. migration up/down/squash/repair, db reset, test db, db query, seed buckets and storage cp/mv/rm need it against a hosted target; db query --read-only doesn't. The migration guide has the full list. (#​7188)
• The default answer is No. Pressing Enter now declines db push, deploys, secrets changes and migration history updates. Only projects, branches, orgs and domains create, and bootstrap, default to Yes. (#​7188)
• A y piped on stdin no longer confirms, and SUPABASE_YES in a .env file no longer counts. When an env file in the working directory defines SUPABASE_YES, a shell-exported one doesn't count either. Use --yes. (#​7188)
• secrets unset defaults to No and needs --all to remove every secret. Running it with no secret names now fails. (#​7172)
• Declining fails with HostedMutationDeclinedError, replacing the per-command cancelled error codes. Declining db pull or pull writes no files. (#​7188)
• db push, hosted db reset, config push and functions deploy --prune ask one combined question, and --prune now runs even when every function is up to date. Removing network bans automatically while connecting now needs --yes. migration down and migration repair --all on the local database no longer prompt. (#​7188)
• Commands that resolve a target print Target: … once on stderr. JSON object results and error envelopes gain a target object; db reset's target changes from a string to that object, and config push JSON drops declined_addons and its skipped status. (#​7188)

Flags and env vars override config

• Every value now resolves as flag > shell environment > project env files > config.json/config.toml > default, and that includes a matched [remotes.<name>] block. Project env files are .env.<SUPABASE_ENV>.local, .env.local, .env.<SUPABASE_ENV> and .env, in supabase/ and then the project root. SUPABASE_ENV defaults to development. (#​7074)
• If you deploy with [remotes.*] blocks, audit the SUPABASE_* variables in CI and in your env files. They now beat the block, and config push pushes them (labelled per value; config diff shows the same). Set SUPABASE_ENV in CI so .env.development doesn't apply. (#​7074)
• Without a project_id in config.toml, local containers and volumes are named after the project folder, not the project ref. Run supabase stop before upgrading, or set project_id. (#​7074)
• An invalid config value or SUPABASE_* variable (for example SUPABASE_STUDIO_PORT=abc) now fails every command that loads config with CliConfigValueError. Boolean variables accept only 1/t/true and 0/f/false (with T, True, TRUE, F, False, FALSE). (#​7074)
• Seeding a project matched by a [remotes.*] block asks first unless the block sets db.seed.enabled = true. SUPABASE_DB_PASSWORD is no longer sent to a project other than the linked one, and --password with a local or URL target exits 1. (#​7074)
• Without --workdir, the nearest directory with supabase/config.toml or supabase/config.json wins. supabase link --password is ignored, ports with a leading zero are rejected, and MigrationPasswordFlagsError is now DbPasswordFlagsError. (#​7074)

Removed commands, flags and config

Each removed command or flag exits 1 and prints its replacement. (#​6609, #​7109, #​7116, #​7176)

Removed	Use instead
db remote commit	db pull
db remote changes	db diff --remote
db branch create/delete/list/switch	branches for hosted preview branches
gen keys	projects api-keys
inspect db total-index-size	inspect db index-stats
inspect db total-table-sizes, table-index-sizes	inspect db table-stats
db diff --use-pg-schema	the default engine, or --use-pg-delta
db pull --use-pg-delta, db pull --experimental	db pull --declarative
functions download --legacy-bundle	functions download --use-api
--include-raw-output on domains commands	-o json
--create-ticket	supabase issue bug
supabase-go binary	supabase
[inbucket], INBUCKET_URL, inbucket.url	[local_smtp], MAILPIT_URL, mailpit.url
[experimental] orioledb_version	[db] orioledb_version
SUPABASE_EXPERIMENTAL_ORIOLEDB_VERSION	SUPABASE_DB_ORIOLEDB_VERSION
linkedin and slack auth providers	linkedin_oidc and slack_oidc
import_map.json inside a function directory	deno.json, or functions.<slug>.import_map
COBRA_COMPLETION_DESCRIPTIONS	SUPABASE_COMPLETION_DESCRIPTIONS

Other behavior changes

• [auth.sms] enable_confirmations = false, the init default, now turns phone confirmation off on config push. Set it to true to keep phone codes, and run config diff before pushing. (#​7221)
• db advisors --remote no longer connects to the database first, so it no longer resolves database settings, creates a temporary login role or removes network bans. (#​7297)
• Error messages that quoted Go library errors are reworded, for example expected a boolean instead of strconv.ParseBool: …. Update anything that matches on error text. (#​7064)

Highlights

• db reset stops failing at random — the intermittent error running container: exit 1 at "Initialising schema…", mostly seen in CI, is gone. (#​7380)
• link works with least-privilege tokens — a project-scoped token that can't read secret API keys can now link and db push; the CLI warns and skips the optional version checks instead of failing. (#​7388)
• [auth.email] enabled and [auth.sms] enabled — enable_signup in those sections switched the whole provider off, blocking existing users from signing in, not just new signups. Use enabled for the provider toggle and [auth] enable_signup to stop new signups; the old keys still work but are deprecated. (#​7398)

New features

• Plan-gate details in JSON errors — when your plan doesn't include a feature, --output-format json and stream-json errors carry an entitlement object with feature and upgrade_url, so scripts and agents don't have to parse the message. (#​7271)

Improvements

• Better editor support for config.toml: the published config schemas use draft-07, which Taplo (Even Better TOML) understands, accept env() on number, boolean, enum and list fields, and mark secret fields with x-secret. (#​7330, #​7333, #​7366)
• With SUPABASE_USE_SLIM_IMAGES, a GHCR rate limit no longer fails supabase start; the CLI pulls the same image from ECR Public instead. (#​7350)
• supabase init adds a commented [auth.web3.ethereum] example to config.toml. (#​7334)
• Experimental stack: the gateway serves /graphql/v1 (so Studio's GraphiQL works), /rest-admin/v1, /pg/, /analytics/v1/ and /pooler/v2/, forwards X-Forwarded-For and X-Real-IP to upstreams, and Edge Functions that boot together no longer fail with 503 BOOT_ERROR. (#​7345, #​7347, #​7382)

Bug fixes

• supabase start and supabase db start recover from a database container left in Docker's created state, instead of failing with container is not running: created. (#​7369)
• Overlapping start and stop runs on the same project no longer fail with network supabase_network_<id> not found. (#​7372)
• supabase start works on nested or sandboxed Docker hosts where docker exec fails, instead of timing out on health checks. (#​7362)
• secrets set honors --workdir and SUPABASE_WORKDIR instead of uploading secrets from the current directory. (#​7361)
• Local db advisors lints every schema exposed in [api], instead of only public or sometimes nothing. (#​7379)
• db push and db reset place the migration error caret correctly when accented letters or emoji come before the failing token. (#​7351)
• config push no longer fails when you change the OAuth server path or turn the OAuth server on or off. (#​7367)
• Restoring a db dump --role-only file as postgres no longer fails on a parameter grant to a reserved role. (#​7320)

---

Plus 106 internal improvements and dependency updates.

Full changelog: supabase/cli@v2.122.0...v3.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 425b528

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (86732dc) to head (5faf185).

Additional details and impacted files

@@            Coverage Diff            @@
##            master      #786   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            1         1           
  Lines            2         2           
=========================================
  Hits             2         2           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.