Changelog
Studio

What changed

Navigation has been rebuilt around a single command surface. Every destination, project switch, and table action is reachable from one input, and the sidebar is now a shortcut rather than the only path.

# open the command surface from anywhere
⌘ K

Design notes

• Results rank by recency first, then by exact prefix, then fuzzily
• Every row states its keyboard path, so the palette teaches the shortcut it replaces
• Focus never leaves the input; arrow keys move a virtual cursor instead
• Motion is capped at 200ms and respects prefers-reduced-motion

Why it matters

Dashboards accumulate navigation. Rather than adding another level of nesting, this release flattens the whole surface into something searchable, which keeps the sidebar honest about what deserves permanent real estate.

Performance

The edge runtime now pre-warms a small pool of isolates per region and reuses compiled module graphs between invocations. Median cold start dropped from 340ms to 129ms across the sampled fleet.

Details

• Module graphs are cached per deployment hash instead of per invocation
• Regions with sustained traffic keep two warm isolates; idle regions keep none
• Fixed a case where a failed import poisoned the cache for later requests

No configuration is required. Projects on dedicated compute see the same improvement without the pooling, since those isolates never fully drain.

Documentation

The type generation guide now covers the full path from migration to a typed client, including the cases that used to require reading the source: composite types, generated columns, and schemas excluded from the public API.

Added

• A worked example that starts from an empty project and ends at a typed query
• Reference tables mapping every Postgres type to its emitted TypeScript type
• Guidance on committing generated types versus generating them in CI

The CLI reference is now generated from the same source as --help, so the two can no longer drift.

What changed

Preview branches can now pull a scoped set of secrets without exposing production values to ephemeral environments. Teams can define branch patterns, map each pattern to a secret group, and rotate preview credentials independently from live projects.

supabase previews secrets pull --branch feat/billing-ledger

Why it matters

Previously, preview builds either depended on broad project credentials or required custom CI glue. Scoped secrets keep previews realistic while narrowing the blast radius of leaked variables.

Included in this release

• Secret groups with branch pattern matching
• Audit events for every preview secret read
• A new preview policy scope for CI tokens
• Dashboard controls for rotating preview-only credentials

Fixed

Type generation now invalidates the schema cache whenever a migration changes table ownership, generated columns, or enum values. This prevents the CLI from returning old TypeScript definitions after a successful migration.

Details

• Rebuilt cache keys around migration checksums instead of table timestamps
• Added coverage for enum edits inside transactional migrations
• Reduced noisy types generated with warnings output for clean projects

Improved

Query traces in the dashboard now group prepared statements, connection acquisition, policy checks, and response serialization under a single request timeline.

What changed

• Slow spans are highlighted inline instead of hidden behind a details drawer
• The timeline keeps the same ordering as server logs
• Trace rows preserve expanded state while switching between projects

This makes it easier to separate database time from application overhead when debugging API latency.

What changed

Realtime channels can now filter Postgres change events before they are broadcast to subscribers. Filters use the same compact syntax as REST queries, so clients can subscribe to only the rows they need.

const channel = supabase
  .channel('room-messages')
  .on(
    'postgres_changes',
    {
      event: 'INSERT',
      schema: 'public',
      table: 'messages',
      filter: 'room_id=eq.123',
    },
    handleMessage,
  )
  .subscribe()

Why it matters

Before this release, every matching table event was delivered to the channel and filtered on the client. Row-level filtering reduces bandwidth, improves privacy boundaries, and makes high-volume rooms easier to scale.

What changed

Edge Functions now expose structured logs, sampled traces, and per-route runtime metrics directly in the project dashboard. The new observability panel is designed for production incidents: dense, searchable, and fast to scan.

Deno.serve(async (request) => {
  console.info('checkout.started', {
    requestId: request.headers.get('x-request-id'),
  })

  return new Response('ok')
})

Included

• Log streams with severity, invocation id, region, and cold-start markers
• Route-level p50, p95, and error-rate charts
• Trace sampling controls per function
• One-click copy for replaying failed invocations locally

Migration notes

Existing functions continue to run without changes. Projects using custom log drains can opt in to the new structured format from the function settings page.

Fixed

The local dev runtime no longer retries indefinitely when the database container exits during startup. The CLI now surfaces the failing service, prints the last health check, and exits with a non-zero status.

Details

• Added a 45 second startup timeout for dependent services
• Preserved the first container error instead of replacing it with a retry message
• Fixed Windows path normalization for mounted seed files

Breaking change

Service role tokens must now declare the projects they can access. Tokens created before this release continue to work for 30 days, then require a scope update from the dashboard or CLI.

supabase tokens update service-role --project ref_9q2 --scope database:write

Action required

• Review existing service role tokens in organization settings
• Add explicit project scopes before the compatibility window closes
• Rotate tokens used by shared CI runners

Why the change: scoped service roles reduce accidental cross-project access and make audit logs easier to reason about during security reviews.

Improved

The migration runner now validates checksums before applying pending files. If a previously applied migration changes locally, the CLI stops before touching the database and points to the exact file that drifted.

Details

• Added supabase db diff --verify for CI pipelines
• Stored migration hashes in the local metadata schema
• Improved error output for squashed migration histories

Checksum validation is enabled by default for new projects and can be adopted incrementally in existing repositories.