Skip to content

fix(docker): bump the docker-minor group across 1 directory with 6 updates#5079

Merged
github-actions[bot] merged 4 commits intodevelopfrom
dependabot/docker/pkg/config/templates/docker-minor-0f0019e7d7
Apr 22, 2026
Merged

fix(docker): bump the docker-minor group across 1 directory with 6 updates#5079
github-actions[bot] merged 4 commits intodevelopfrom
dependabot/docker/pkg/config/templates/docker-minor-0f0019e7d7

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 14, 2026 •
edited
Loading

Bumps the docker-minor group with 6 updates in the /pkg/config/templates directory:

Package From To
postgrest/postgrest v14.8 v14.9
supabase/studio 2026.04.08-sha-205cbe7 2026.04.13-sha-e95f1cc
supabase/edge-runtime v1.73.3 v1.73.5
supabase/realtime v2.82.0 v2.83.1
supabase/storage-api v1.48.28 v1.51.0
supabase/logflare 1.37.1 1.38.2

Updates postgrest/postgrest from v14.8 to v14.9

Updates supabase/studio from 2026.04.08-sha-205cbe7 to 2026.04.13-sha-e95f1cc

Updates supabase/edge-runtime from v1.73.3 to v1.73.5

Updates supabase/realtime from v2.82.0 to v2.83.1

Updates supabase/storage-api from v1.48.28 to v1.51.0

Updates supabase/logflare from 1.37.1 to 1.38.2

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
fix(docker): bump the docker-minor group across 1 directory with 6 up…
2377385 
…dates

Bumps the docker-minor group with 6 updates in the /pkg/config/templates directory:

| Package | From | To |
| --- | --- | --- |
| postgrest/postgrest | `v14.8` | `v14.9` |
| supabase/studio | `2026.04.08-sha-205cbe7` | `2026.04.13-sha-e95f1cc` |
| supabase/edge-runtime | `v1.73.3` | `v1.73.5` |
| supabase/realtime | `v2.82.0` | `v2.83.1` |
| supabase/storage-api | `v1.48.28` | `v1.51.0` |
| supabase/logflare | `1.37.1` | `1.38.2` |



Updates `postgrest/postgrest` from v14.8 to v14.9

Updates `supabase/studio` from 2026.04.08-sha-205cbe7 to 2026.04.13-sha-e95f1cc

Updates `supabase/edge-runtime` from v1.73.3 to v1.73.5

Updates `supabase/realtime` from v2.82.0 to v2.83.1

Updates `supabase/storage-api` from v1.48.28 to v1.51.0

Updates `supabase/logflare` from 1.37.1 to 1.38.2

---
updated-dependencies:
- dependency-name: postgrest/postgrest
  dependency-version: v14.9
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/studio
  dependency-version: 2026.04.13-sha-e95f1cc
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/edge-runtime
  dependency-version: v1.73.5
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/realtime
  dependency-version: v2.83.1
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/storage-api
  dependency-version: v1.51.0
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/logflare
  dependency-version: 1.38.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file docker Pull requests that update Docker code labels Apr 14, 2026
@dependabot dependabot Bot requested a review from a team as a code owner April 14, 2026 00:08
@github-actions github-actions Bot enabled auto-merge (squash) April 14, 2026 00:08
@coveralls
Copy link
Copy Markdown

coveralls commented Apr 14, 2026 •
edited
Loading

Coverage Report for CI Build 24774390213

Warning

Build has drifted: This PR's base is out of sync with its target branch, so coverage data may include unrelated changes.
Quick fix: rebase this PR. Learn more →

Warning

No base build found for commit 51acd36 on develop.
Coverage changes can't be calculated without a base build.
If a base build is processing, this comment will update automatically when it completes.

Coverage: 63.667%

Details

  • Patch coverage: No coverable lines changed in this PR.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

Requires a base build to compare against. How to fix this →

Coverage Stats

Coverage Status
Relevant Lines: 15501
Covered Lines: 9869
Line Coverage: 63.67%
Coverage Strength: 7.0 hits per line
💛 - Coveralls

@github-actions github-actions Bot merged commit 1456314 into develop Apr 22, 2026
10 checks passed
@github-actions github-actions Bot deleted the dependabot/docker/pkg/config/templates/docker-minor-0f0019e7d7 branch April 22, 2026 10:58
avallete added a commit that referenced this pull request Apr 24, 2026
@supabase-cli-releaser @avallete
@fadymak @7ttp @seanoliver @sweatybridge @jgoux @dependabot @myerekapan @kallebysantos @claude
Prod deploy (#5109)
8c9553c 
* fix(pg-delta): declarative-sync-no-declarative-dir-set (#5078)

* feat(declarative): add tests for skipping config updates when PgDelta is enabled

- These tests verify that the configuration remains unchanged when PgDelta is enabled, ensuring the declarative directory is the source of truth.
- Updated the WriteDeclarativeSchemas function to reflect the new behavior regarding PgDelta configuration.

* fix(declarative): DSL change due to upgrade

* feat(auth): add support for configuring passkeys and webauthn (#5077)

* fix: atomic parser  (#5064)

* fix

* test

---------

Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>

* fix(pg-delta): declarative apply error results (#5082)

* fix(pg-delta): declarative apply error results

Improve readability report for decalrative appy errors wrapping

* chore: upgrade pg-delta to alpha 13

* feat(telemetry): attach org/project groups to all CLI events

Only ~19% of CLI events had PostHog group properties ($group_0, $group_1)
because groups were only set during `supabase link`. Commands using
--project-ref without linking sent events invisible to group analytics.

Add EnsureProjectGroupsCached which resolves and caches project metadata
(including org ID) in linked-project.json when a project ref is available.
The cache is checked before every cli_command_executed event, so the API
call only happens once per unique project ref.

Closes GROWTH-761

* fix: address code review feedback

- Guard against log.Fatalln crash: check auth token before calling
  GetSupabase(), and move the API call to cmd/root.go where it belongs
- Don't overwrite existing linked-project.json cache — supabase link
  is the authoritative source, we only fill the gap when no cache exists
- Fire GroupIdentify for org and project after caching, matching the
  link flow so PostHog has group metadata
- Restructure so telemetry package has no API dependencies (pure
  caching + PostHog calls), making tests reliable without gock/mocks

* fix: adds etl to managed schema (#5090)

* chore: sync API types from infrastructure (#5093)

Co-authored-by: supabase-cli-releaser[bot] <246109035+supabase-cli-releaser[bot]@users.noreply.github.com>

* chore(deps): bump the actions-major group across 1 directory with 5 updates (#5088)

Bumps the actions-major group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `3.0.0` | `3.1.1` |
| [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) | `8.1.0` | `8.1.1` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.35.1` | `4.35.2` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `7.0.0` | `7.1.0` |



Updates `actions/create-github-app-token` from 3.0.0 to 3.1.1
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Commits](actions/create-github-app-token@f8d387b...1b10c78)

Updates `peter-evans/create-pull-request` from 8.1.0 to 8.1.1
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](peter-evans/create-pull-request@c0f553f...5f6978f)

Updates `actions/upload-artifact` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@bbbca2d...043fb46)

Updates `github/codeql-action` from 4.35.1 to 4.35.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@c10b806...95e58e9)

Updates `docker/build-push-action` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@d08e5c3...bcafcac)

---
updated-dependencies:
- dependency-name: actions/create-github-app-token
  dependency-version: 3.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: peter-evans/create-pull-request
  dependency-version: 8.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-major
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-major
- dependency-name: github/codeql-action
  dependency-version: 4.35.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-major
- dependency-name: docker/build-push-action
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>

* fix: functions download (#5096)

* fix

* test

---------

Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>

* feat(db): strengthen RLS advisory message for stronger agent compliance

* chore(deps): upgrade pg-delta to alpha.17 (#5110)

Closes: #5094

* chore(deps): bump the actions-major group across 1 directory with 4 updates (#5108)

Bumps the actions-major group with 4 updates in the / directory: [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata), [t1m0thyj/unlock-keyring](https://github.com/t1m0thyj/unlock-keyring), [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) and [actions/setup-node](https://github.com/actions/setup-node).


Updates `dependabot/fetch-metadata` from 3.0.0 to 3.1.0
- [Release notes](https://github.com/dependabot/fetch-metadata/releases)
- [Commits](dependabot/fetch-metadata@ffa630c...25dd0e3)

Updates `t1m0thyj/unlock-keyring` from 1.1.0 to 1.2.0
- [Release notes](https://github.com/t1m0thyj/unlock-keyring/releases)
- [Commits](t1m0thyj/unlock-keyring@728cc71...cbcf205)

Updates `goreleaser/goreleaser-action` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](goreleaser/goreleaser-action@ec59f47...e24998b)

Updates `actions/setup-node` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@53b8394...48b55a0)

---
updated-dependencies:
- dependency-name: dependabot/fetch-metadata
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: t1m0thyj/unlock-keyring
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: goreleaser/goreleaser-action
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: actions/setup-node
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>

* fix(docker): bump the docker-minor group across 1 directory with 6 updates (#5079)

* fix(docker): bump the docker-minor group across 1 directory with 6 updates

Bumps the docker-minor group with 6 updates in the /pkg/config/templates directory:

| Package | From | To |
| --- | --- | --- |
| postgrest/postgrest | `v14.8` | `v14.9` |
| supabase/studio | `2026.04.08-sha-205cbe7` | `2026.04.13-sha-e95f1cc` |
| supabase/edge-runtime | `v1.73.3` | `v1.73.5` |
| supabase/realtime | `v2.82.0` | `v2.83.1` |
| supabase/storage-api | `v1.48.28` | `v1.51.0` |
| supabase/logflare | `1.37.1` | `1.38.2` |



Updates `postgrest/postgrest` from v14.8 to v14.9

Updates `supabase/studio` from 2026.04.08-sha-205cbe7 to 2026.04.13-sha-e95f1cc

Updates `supabase/edge-runtime` from v1.73.3 to v1.73.5

Updates `supabase/realtime` from v2.82.0 to v2.83.1

Updates `supabase/storage-api` from v1.48.28 to v1.51.0

Updates `supabase/logflare` from 1.37.1 to 1.38.2

---
updated-dependencies:
- dependency-name: postgrest/postgrest
  dependency-version: v14.9
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/studio
  dependency-version: 2026.04.13-sha-e95f1cc
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/edge-runtime
  dependency-version: v1.73.5
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/realtime
  dependency-version: v2.83.1
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/storage-api
  dependency-version: v1.51.0
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/logflare
  dependency-version: 1.38.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Downgrade postgrest version from 14.9 to 14.8

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>

* chore(workflows): enable install scripts for supabase package in Yarn (#5111)

chore(workflows): enable install scripts for supabase package in Yarn Berry setup

This change sets the YARN_ENABLE_SCRIPTS environment variable to true during the installation of the supabase package, allowing its postinstall script to run as required by Yarn Berry 4.14+. This adjustment ensures the necessary binary is fetched correctly.

* feat: --diff-engine flag on db pull

* fix(docker): bump the docker-minor group in /pkg/config/templates with 6 updates (#5113)

fix(docker): bump the docker-minor group

Bumps the docker-minor group in /pkg/config/templates with 6 updates:

| Package | From | To |
| --- | --- | --- |
| postgrest/postgrest | `v14.8` | `v14.10` |
| supabase/studio | `2026.04.13-sha-e95f1cc` | `2026.04.20-sha-b721a2d` |
| supabase/edge-runtime | `v1.73.5` | `v1.73.13` |
| supabase/realtime | `v2.83.1` | `v2.86.3` |
| supabase/storage-api | `v1.51.0` | `v1.54.1` |
| supabase/logflare | `1.38.2` | `1.39.1` |


Updates `postgrest/postgrest` from v14.8 to v14.10

Updates `supabase/studio` from 2026.04.13-sha-e95f1cc to 2026.04.20-sha-b721a2d

Updates `supabase/edge-runtime` from v1.73.5 to v1.73.13

Updates `supabase/realtime` from v2.83.1 to v2.86.3

Updates `supabase/storage-api` from v1.51.0 to v1.54.1

Updates `supabase/logflare` from 1.38.2 to 1.39.1

---
updated-dependencies:
- dependency-name: postgrest/postgrest
  dependency-version: v14.10
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/studio
  dependency-version: 2026.04.20-sha-b721a2d
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/edge-runtime
  dependency-version: v1.73.13
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/realtime
  dependency-version: v2.86.3
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/storage-api
  dependency-version: v1.54.1
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/logflare
  dependency-version: 1.39.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>

* feat: exposing new api keys to functions (#4946)

Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>

* chore: upgrade pg-delta to alpha.20 in multiple templates

* fix: remove version comparison check for storage image updates (#5118)

fix: honor pinned storage version offline

Remove the version comparison that only pinned storage when the local
version was newer than the default. This prevented `supabase start` from
using an already-downloaded image offline, since Docker would still try
to pull the default newer image.

Fixes CLI-1393.

Co-authored-by: Claude <noreply@anthropic.com>

* fix: improve error handling and output formatting in pg-delta apply process (#5120)

- Updated the `runDeclarativeSync` function to avoid wrapping SQL output with `utils.Bold`, preventing excessive whitespace in multi-line SQL.
- Changed the result accumulation in `migra.ts` from string concatenation to an array for better performance and clarity.
- Enhanced the `ApplyResult` struct to include `ValidationErrors` and `Diagnostics`, allowing for more detailed error reporting.
- Modified the `formatApplyFailure` function to include validation errors and diagnostics in the output, improving user feedback on apply failures.
- Added tests for validation error handling in `apply_test.go` to ensure robustness against various error scenarios.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>
Co-authored-by: fadymak <dev@fadymak.com>
Co-authored-by: Vaibhav <117663341+7ttp@users.noreply.github.com>
Co-authored-by: Sean Oliver <882952+seanoliver@users.noreply.github.com>
Co-authored-by: Han Qiao <sweatybridge@gmail.com>
Co-authored-by: Julien Goux <hi@jgoux.dev>
Co-authored-by: supabase-cli-releaser[bot] <246109035+supabase-cli-releaser[bot]@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Mert YEREKAPAN <mertyerekapan@gmail.com>
Co-authored-by: Mert YEREKAPAN <33198490+myerekapan@users.noreply.github.com>
Co-authored-by: Kalleby Santos <105971119+kallebysantos@users.noreply.github.com>
Co-authored-by: avallete <andrew.valleteau@supabase.io>
Co-authored-by: Claude <noreply@anthropic.com>
avallete added a commit that referenced this pull request Apr 27, 2026
@avallete @supabase-cli-releaser
@fadymak @7ttp @seanoliver @sweatybridge @jgoux @dependabot @myerekapan @kallebysantos @claude
chore: resync develop with main (#5123)
3596a05 
Prod deploy (#5109)

* fix(pg-delta): declarative-sync-no-declarative-dir-set (#5078)

* feat(declarative): add tests for skipping config updates when PgDelta is enabled

- These tests verify that the configuration remains unchanged when PgDelta is enabled, ensuring the declarative directory is the source of truth.
- Updated the WriteDeclarativeSchemas function to reflect the new behavior regarding PgDelta configuration.

* fix(declarative): DSL change due to upgrade

* feat(auth): add support for configuring passkeys and webauthn (#5077)

* fix: atomic parser  (#5064)

* fix

* test

---------



* fix(pg-delta): declarative apply error results (#5082)

* fix(pg-delta): declarative apply error results

Improve readability report for decalrative appy errors wrapping

* chore: upgrade pg-delta to alpha 13

* feat(telemetry): attach org/project groups to all CLI events

Only ~19% of CLI events had PostHog group properties ($group_0, $group_1)
because groups were only set during `supabase link`. Commands using
--project-ref without linking sent events invisible to group analytics.

Add EnsureProjectGroupsCached which resolves and caches project metadata
(including org ID) in linked-project.json when a project ref is available.
The cache is checked before every cli_command_executed event, so the API
call only happens once per unique project ref.

Closes GROWTH-761

* fix: address code review feedback

- Guard against log.Fatalln crash: check auth token before calling
  GetSupabase(), and move the API call to cmd/root.go where it belongs
- Don't overwrite existing linked-project.json cache — supabase link
  is the authoritative source, we only fill the gap when no cache exists
- Fire GroupIdentify for org and project after caching, matching the
  link flow so PostHog has group metadata
- Restructure so telemetry package has no API dependencies (pure
  caching + PostHog calls), making tests reliable without gock/mocks

* fix: adds etl to managed schema (#5090)

* chore: sync API types from infrastructure (#5093)



* chore(deps): bump the actions-major group across 1 directory with 5 updates (#5088)

Bumps the actions-major group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `3.0.0` | `3.1.1` |
| [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) | `8.1.0` | `8.1.1` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.35.1` | `4.35.2` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `7.0.0` | `7.1.0` |



Updates `actions/create-github-app-token` from 3.0.0 to 3.1.1
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Commits](actions/create-github-app-token@f8d387b...1b10c78)

Updates `peter-evans/create-pull-request` from 8.1.0 to 8.1.1
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](peter-evans/create-pull-request@c0f553f...5f6978f)

Updates `actions/upload-artifact` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@bbbca2d...043fb46)

Updates `github/codeql-action` from 4.35.1 to 4.35.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@c10b806...95e58e9)

Updates `docker/build-push-action` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@d08e5c3...bcafcac)

---
updated-dependencies:
- dependency-name: actions/create-github-app-token
  dependency-version: 3.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: peter-evans/create-pull-request
  dependency-version: 8.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-major
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-major
- dependency-name: github/codeql-action
  dependency-version: 4.35.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-major
- dependency-name: docker/build-push-action
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
...





* fix: functions download (#5096)

* fix

* test

---------



* feat(db): strengthen RLS advisory message for stronger agent compliance

* chore(deps): upgrade pg-delta to alpha.17 (#5110)

Closes: #5094

* chore(deps): bump the actions-major group across 1 directory with 4 updates (#5108)

Bumps the actions-major group with 4 updates in the / directory: [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata), [t1m0thyj/unlock-keyring](https://github.com/t1m0thyj/unlock-keyring), [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) and [actions/setup-node](https://github.com/actions/setup-node).


Updates `dependabot/fetch-metadata` from 3.0.0 to 3.1.0
- [Release notes](https://github.com/dependabot/fetch-metadata/releases)
- [Commits](dependabot/fetch-metadata@ffa630c...25dd0e3)

Updates `t1m0thyj/unlock-keyring` from 1.1.0 to 1.2.0
- [Release notes](https://github.com/t1m0thyj/unlock-keyring/releases)
- [Commits](t1m0thyj/unlock-keyring@728cc71...cbcf205)

Updates `goreleaser/goreleaser-action` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](goreleaser/goreleaser-action@ec59f47...e24998b)

Updates `actions/setup-node` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@53b8394...48b55a0)

---
updated-dependencies:
- dependency-name: dependabot/fetch-metadata
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: t1m0thyj/unlock-keyring
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: goreleaser/goreleaser-action
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: actions/setup-node
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
...





* fix(docker): bump the docker-minor group across 1 directory with 6 updates (#5079)

* fix(docker): bump the docker-minor group across 1 directory with 6 updates

Bumps the docker-minor group with 6 updates in the /pkg/config/templates directory:

| Package | From | To |
| --- | --- | --- |
| postgrest/postgrest | `v14.8` | `v14.9` |
| supabase/studio | `2026.04.08-sha-205cbe7` | `2026.04.13-sha-e95f1cc` |
| supabase/edge-runtime | `v1.73.3` | `v1.73.5` |
| supabase/realtime | `v2.82.0` | `v2.83.1` |
| supabase/storage-api | `v1.48.28` | `v1.51.0` |
| supabase/logflare | `1.37.1` | `1.38.2` |



Updates `postgrest/postgrest` from v14.8 to v14.9

Updates `supabase/studio` from 2026.04.08-sha-205cbe7 to 2026.04.13-sha-e95f1cc

Updates `supabase/edge-runtime` from v1.73.3 to v1.73.5

Updates `supabase/realtime` from v2.82.0 to v2.83.1

Updates `supabase/storage-api` from v1.48.28 to v1.51.0

Updates `supabase/logflare` from 1.37.1 to 1.38.2

---
updated-dependencies:
- dependency-name: postgrest/postgrest
  dependency-version: v14.9
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/studio
  dependency-version: 2026.04.13-sha-e95f1cc
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/edge-runtime
  dependency-version: v1.73.5
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/realtime
  dependency-version: v2.83.1
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/storage-api
  dependency-version: v1.51.0
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/logflare
  dependency-version: 1.38.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-minor
...



* Downgrade postgrest version from 14.9 to 14.8

---------





* chore(workflows): enable install scripts for supabase package in Yarn (#5111)

chore(workflows): enable install scripts for supabase package in Yarn Berry setup

This change sets the YARN_ENABLE_SCRIPTS environment variable to true during the installation of the supabase package, allowing its postinstall script to run as required by Yarn Berry 4.14+. This adjustment ensures the necessary binary is fetched correctly.

* feat: --diff-engine flag on db pull

* fix(docker): bump the docker-minor group in /pkg/config/templates with 6 updates (#5113)

fix(docker): bump the docker-minor group

Bumps the docker-minor group in /pkg/config/templates with 6 updates:

| Package | From | To |
| --- | --- | --- |
| postgrest/postgrest | `v14.8` | `v14.10` |
| supabase/studio | `2026.04.13-sha-e95f1cc` | `2026.04.20-sha-b721a2d` |
| supabase/edge-runtime | `v1.73.5` | `v1.73.13` |
| supabase/realtime | `v2.83.1` | `v2.86.3` |
| supabase/storage-api | `v1.51.0` | `v1.54.1` |
| supabase/logflare | `1.38.2` | `1.39.1` |


Updates `postgrest/postgrest` from v14.8 to v14.10

Updates `supabase/studio` from 2026.04.13-sha-e95f1cc to 2026.04.20-sha-b721a2d

Updates `supabase/edge-runtime` from v1.73.5 to v1.73.13

Updates `supabase/realtime` from v2.83.1 to v2.86.3

Updates `supabase/storage-api` from v1.51.0 to v1.54.1

Updates `supabase/logflare` from 1.38.2 to 1.39.1

---
updated-dependencies:
- dependency-name: postgrest/postgrest
  dependency-version: v14.10
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/studio
  dependency-version: 2026.04.20-sha-b721a2d
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/edge-runtime
  dependency-version: v1.73.13
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/realtime
  dependency-version: v2.86.3
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/storage-api
  dependency-version: v1.54.1
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/logflare
  dependency-version: 1.39.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-minor
...





* feat: exposing new api keys to functions (#4946)



* chore: upgrade pg-delta to alpha.20 in multiple templates

* fix: remove version comparison check for storage image updates (#5118)

fix: honor pinned storage version offline

Remove the version comparison that only pinned storage when the local
version was newer than the default. This prevented `supabase start` from
using an already-downloaded image offline, since Docker would still try
to pull the default newer image.

Fixes CLI-1393.



* fix: improve error handling and output formatting in pg-delta apply process (#5120)

- Updated the `runDeclarativeSync` function to avoid wrapping SQL output with `utils.Bold`, preventing excessive whitespace in multi-line SQL.
- Changed the result accumulation in `migra.ts` from string concatenation to an array for better performance and clarity.
- Enhanced the `ApplyResult` struct to include `ValidationErrors` and `Diagnostics`, allowing for more detailed error reporting.
- Modified the `formatApplyFailure` function to include validation errors and diagnostics in the output, improving user feedback on apply failures.
- Added tests for validation error handling in `apply_test.go` to ensure robustness against various error scenarios.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: supabase-cli-releaser[bot] <246109035+supabase-cli-releaser[bot]@users.noreply.github.com>
Co-authored-by: fadymak <dev@fadymak.com>
Co-authored-by: Vaibhav <117663341+7ttp@users.noreply.github.com>
Co-authored-by: Sean Oliver <882952+seanoliver@users.noreply.github.com>
Co-authored-by: Han Qiao <sweatybridge@gmail.com>
Co-authored-by: Julien Goux <hi@jgoux.dev>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Mert YEREKAPAN <mertyerekapan@gmail.com>
Co-authored-by: Mert YEREKAPAN <33198490+myerekapan@users.noreply.github.com>
Co-authored-by: Kalleby Santos <105971119+kallebysantos@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
This was referenced Apr 27, 2026
Closed
Merged
@BrewTestBot BrewTestBot mentioned this pull request Apr 27, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@avallete avallete avallete approved these changes

@supabase-cli-releaser supabase-cli-releaser[bot] supabase-cli-releaser[bot] approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file docker Pull requests that update Docker code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@coveralls @avallete