2026.24

Deprecation Notice: Legacy Verifier

Warning

The Legacy Verifier component (backed by the Supabase Legacy JWT secret) is deprecated and scheduled for removal. If you currently rely on legacy HS256 authentication, plan your migration to OIDC-backed auth now to avoid disruption.

What's Changing

The Legacy Verifier authenticates requests using HS256 (HMAC with SHA-256), where JWT signatures are produced from a single shared secret. Because every party that can verify a token must also hold the secret capable of minting one, this model is difficult to scale securely and increases the blast radius if the secret is ever leaked.

To improve security across the product, we are moving away from Legacy HS256 toward OIDC-backed authentication, which uses asymmetric signing and standardized identity flows.

Why

• Shared-secret risk — HS256 relies on a shared secret for both signing and verification, so a single leak compromises both issuing and verifying tokens.
• Stronger, standards-based security — OIDC uses asymmetric keys and well-established discovery/rotation mechanisms, reducing the risk of secret sprawl.
• A clearer long-term path — Consolidating on OIDC lets us invest in a single, well-supported auth surface for all users.

Recommended Path Forward

Many current auth features are not part of the OIDC spec. While we are actively investigating raw OIDC support, we recommend the following at this time:

• JWTs issued by Ory Hydra — an OAuth 2.0 and OpenID Connect provider for issuing tokens.
• User identities maintained by Ory Kratos — an identity and user management system.

We believe this open-source auth toolkit provides the best path forward for supporting better authentication for all users, bridging the gap between legacy features and a fully OIDC-based future.

What’s Changed

API

Features

• Add SOCKS5 egress proxy on sandbox network config (BYOP) by @arkamar in #2642

Improvements

• Make volume signing config an optional dependency by @sitole in #2956

Bug Fixes

• Support snapshots for non-default clusters by @sitole in #2947

---

Dashboard API

Features

• Include build resources in /builds response by @drankou in #3009
• Improve templates list sorting by @drankou in #2983
• Add internal admin route for deleting a user by @devin-ai-integration[bot] in #2986
• Add template tags handlers by @drankou in #2885

Improvements

• Resolve billing creator context via profile providers and deprecate dual user profile provider by @ben-fornefeld in #2967

Bug Fixes

• Avoid repeated Ory bootstrap provisioning by @ben-fornefeld in #2940
• Pass signup metadata to billing provisioning by @ben-fornefeld in #2978

---

Authentication & Identity

Features

• Support admin token team auth by @ben-fornefeld in #2934

Improvements

• Return only client message from auth middleware by @sitole in #2946

---

Orchestrator

Features

• Add allocated resource metrics for sandboxes by @jakubno in #2943
• Add per-start UFFD startup working-set metric by @kalyazin in #2960
• Add snapshot fragmentation metrics by @kalyazin in #2931
• Track sandbox lifecycles by @wj-e2b in #2998

Performance

• Add memfile dedup density threshold by @ValentaTomas in #2862
• Avoid V3-ancestor header refresh by @levb in #2999

Bug Fixes

• Split scheduling base build ID per artifact by @ValentaTomas in #2920
• Export dirty-page stall counter from process start by @ValentaTomas in #2992
• Keep dedup empty-pages telemetry scan-only by @ValentaTomas in #2991
• Read V3 ancestors as uncompressed instead of failing by @ValentaTomas in #2994
• Harden Firecracker process shutdown by @wj-e2b in #2996
• Harden shutdown network cleanup by @wj-e2b in #3000
• Retain pause uploads across retries by @jakubno in #2993
• Discard poisoned nftables connection on firewall errors by @arkamar in #3008

---

Storage & Build Artifacts

Features

• Validate template upload hashes by @matthewlouisbrockman in #2952
• Add raw exec artifact SHA aliases by @dobrac in #2971
• Support V4/V5 headers and compression in inspect-build CLI by @levb in #2985

Improvements

• Simplify template validation by @matthewlouisbrockman in #2961
• Split FrameTable and FullFrameTable by @levb in #2975

Bug Fixes

• Use 512-byte units for stat.Blocks in FileSize by @levb in #2949
• Fix upload header synchronization for P2P compression by @levb in #2919
• Adapt inspect-build validate to new Chunker upstream API by @ValentaTomas in #2989

---

Sandbox Runtime (envd)

Features

• Support user-defined file metadata via xattrs by @mishushakov in #2732
• Add optional EntryInfo to watch FilesystemEvent by @mishushakov in #2930
• Allow opting into watching network mounts by @mishushakov in #2982

Improvements

• Trim unused server dependencies by @ValentaTomas in #2937

Bug Fixes

• Tolerate busy tmpfs cleanup in tests by @ValentaTomas in #2938
• Pin create-next-app to stable in TestCommandKillNextApp by @mishushakov in #2964
• Stop freezing socat cgroup across pause/resume by @arkamar in #2923

---

Infrastructure & IaC

Features

• Add name field for cluster by @sitole in #2955

---

ClickHouse & Events

Features

• Implement multi-cluster fan-out for events and stats by @rguliyev in #2925

---

Full Changelog:
2026.23...2026.24