Developer Update - March 2026

[ana1337x]

Here’s everything that happened with Supabase in the last month:

Webinar: Ship Fast, Stay Safe

Learn how top agencies balance velocity with control when using AI coding tools to build production applications on Supabase.

Register

Logs Drains on Pro

Log Drains are now available on Pro. Send your Postgres, Auth, Storage, Edge Functions, and Realtime logs to Datadog, Grafana Loki, Sentry, Axiom, S3, or your own endpoint.

Blog Post

Docs now export to Markdown for AI tools

Every guide on docs.supabase.com now has a "Copy as Markdown" option, plus direct links to ask ChatGPT and Claude. Copy any page into your agent or tool of choice with one click.

Docs

Storage: major performance and security overhaul

Object listing is up to 14.8x faster on 60M+ row datasets. The prefixes table and its 6 triggers are gone, replaced with a hybrid skip-scan algorithm and cursor-based pagination. Security fixes close a path traversal vulnerability and prevent orphan objects from direct SQL deletes.

Blog Post

Edge Functions dashboard for self-hosted and CLI

List and search your functions, view details, test directly from the dashboard, and download as .zip. No longer cloud-only.

Twitter

Multigres Postgres parser: 2.5x faster than the cgo alternative

Built in 8 weeks using Claude Code. A comparable MySQL parser took over a year.

Blog Post Twitter

Quick Product Announcements

• ⚠️ Action Required: OpenAPI spec access via anon key deprecated March 11. The /rest/v1/ schema endpoint will only be accessible via service role or secret API keys after this date. Existing data API usage is unaffected. GitHub
• Observability Overview page is rolling out. Twitter
• Table filters now use AI. Describe what you want to find and the dashboard applies the right Postgres filters. Available under Feature Previews. Twitter GitHub
• Queue table operations in the Table Editor. Stage inserts, edits, and deletes, review in Diff View, then commit with cmd + s. Twitter
• Supabase plugin for Cursor is live. Twitter
• Copy AI prompts from the dashboard. The same prompts powering the Supabase AI Assistant are now exportable for use in your local agent or tool of choice. Twitter
• Inline SQL Editor saves SQL Snippets. Create and update snippets from Studio. Share via git in the supabase/snippets folder. GitHub
• Command Menu gets Create and Search shortcuts. Hit cmd + k to create tables, RLS policies, Edge Functions, and Storage buckets — or jump directly to an existing one. Twitter
• Read replicas now managed from the database replication page. Rolling out gradually — if you manage read replicas, look in Database settings.
• Receipt downloads now available. Download receipts from the Invoices section in your org billing page.

Made with Supabase

• A purpose-built tool for running powerful affiliate and referral campaigns. Website
• Supabase x YCombinator Hackathon winner: An AI Agent Personal Trainer Website
• AI video production for professionals Website
• Generate APA citation-ready references from a URL or DOI in seconds Website
• SupaClaw - A basic version of OpenClaw but built entirely on Supabase built-in features GitHub

Community Highlights

• Supabase is sponsoring Postgres Conference 2026. Deepthi and Sugu are speaking on Multigres: horizontal scalability and intelligent sharding for Postgres. April 21-23 in San Jose. Use code 2026_SUPABASE20 for 20% off. Register
• Codepup AI launched Supabase integration. Build a complete web app with a real Supabase backend — auto-generated, tested, and fixed by AI in under 30 minutes. Blog Post
• BKND joins Supabase. Dennis Senn, creator of BKND, is joining to build a Lite offering for agentic workloads. BKND stays open source. Blog Post
• Hydra joins Supabase. Joe Sciarrino, co-creator of Hydra, is joining to build Supabase Warehouse: an open data warehouse architecture for developers. Hydra co-developed pg_duckdb, which accelerates analytics queries on Postgres by over 600x. Blog Post
• Getting Started with Supabase - Official Guide YouTube
• Supabase on Observable Flutter - Episode YouTube
• Inside Supabase Edge Functions: How Serverless Magic Actually Works Blog
• Unlocking Scalable Backend Development: Why Supabase and Node.js are Revolutionizing Modern Applications in 2026 Blog
• Adding GitHub, Google, and X Login to Next.js 15 with Supabase Auth Blog

[miranda455590-dot]

Hello dev

[jfutey]

Question about the CVE counts for Supabase Docker images. First, what is the general plan for addressing the overall vulnerability counts of internal images? We see the counts dropping with consecutive release tags but the HIGH and CRIT counts are still in the many hundreds collectively whether you use Docker Scout or Trivy to scan. Second, for the 3rd party images that Supabase packages with it, how are these being considered for updating thier versions to fix vulnerabilities? Kong has been stagnant at 2.8.1 in the compose file for a long time and there are more recent versions that eliminate the issues. We're having trouble getting acceptance in some customer environments with such overall numbers of outstanding HIGH and CRITICAL issues and would help to have some official guidance on this.

[aantti]

I'll update Kong shortly, long overdue for sure. It's also going to be replaced by Envoy - but we have to finalize configuration and testing. Regarding the other questions I'll leave it to a dedicated team to respond.

[jfutey]

Appreciate the update. Will kong be updated in the interrim until Envoy replaces it or are you going straight to envoy? Estimate on what tag we'll see that transition?

Is there a process to tag or contact the team about CVE counts on the supabase owned images?

[aantti]

Updated Kong version to 3.9.1 a couple of days ago - see the changelog :)

Is there a process to tag or contact the team about CVE counts on the supabase owned images?

I do not know that, I'll inquire.

[staaldraad]

hey @jfutey

You can reach out to the team through security@supabase.io. Our focus is to burn down potential risk without impacting performance and stability. This is done in a methodical manner, where each vulnerability is evaluated on reachability and actual risk.

For example, if a scan reports CVE-2023-24538 – Go stdlib v1.18.2, as a critical, we will examine where and how Go is used in the image. And if the reported vulnerability is at all reachable in our use of the library. In the case of this particular CVE, we do not use templating anywhere or have any direct Go based processes in the Docker image. With exploitability determined to be zero, it pushes us towards evaluating the purpose of Go within the image and how we can remove it completely instead of focusing on an update. That leaves us at the current state, where the team is working on reducing the overall surface area of the Docker images, stripping down to the required minimum to have small, fast and secure images. We are behind on our targets for accomplishing this, but we do feel the effort put into ensuring this is done right outweighs any current risk within the Docker images.

[MeNafi]

Thanks for the update! This month’s highlights show real momentum in both performance improvements and developer ergonomics, and it’s great to see a mix of infrastructure, UX, and tooling enhancements.

Here are a few standout points from my perspective:

---

🚀 What I’m Most Excited About

1. Storage Performance & Security Overhaul

The improvements to object listing speed — especially on very large datasets — are a huge deal. Faster pagination and stronger security help make Supabase much more viable for enterprise-scale storage workloads, not just small apps.

2. Docs Export to Markdown + AI Integrations

Having guides that export directly to Markdown, plus links to ChatGPT and Claude, dramatically improves knowledge portability. This makes it easier to:

• integrate docs into local development tooling
• feed them into agents (like Claude Code or custom AI workflows)
• keep documentation versioned alongside code

This signals a push toward developer automation workflows rather than just manual lookups.

3. Edge Functions Dashboard

Bringing the Edge Functions dashboard to self-hosted and CLI users levels the playing field for teams who don’t want cloud‑only lock‑in. Listing/searching from the dashboard streamlines testing and deployment.

---

🛠️ Practical Impact

✅ Observability & Logs Drains on Pro

Log drains to external tools (Datadog, Sentry, Grafana, etc.) are essential for production readiness. Being able to centralize logs from Postgres, Auth, Storage, and Functions in established observability platforms makes debugging and monitoring far easier.

✅ Inline SQL Editor & Command Menu Improvements

These feel like quality‑of‑life upgrades that reduce context switching:

• SQL snippets that live in Git (supabase/snippets) fit nicely into Git‑first workflows.
• Cmd+K shortcuts for creating tables, RLS, buckets, etc., speed up routine tasks and reduce cognitive overhead.

---

🧠 Why This Matters for the Ecosystem

Supabase is clearly pushing toward:

• AI‑augmented development workflows
• productivity tools that support real teams
• scalable performance for modern apps

That alignment shows Supabase evolving from “Firebase competitor” into a holistic developer platform — not just backend building blocks, but developer experience and automation tooling.

It’s also really encouraging to see:

• Multigres and analytics acceleration
• Flutter and Observable content in the learning ecosystem
• Community and ecosystem growth (e.g., AI Agent Personal Trainer tools, Codepup AI)

---

❗One Suggestion

The recent depreciation of anonymous access to the OpenAPI schema (requiring secret/service role keys) makes sense from a security perspective, but it will require many client libraries and integrations to update how they introspect APIs. Clear migration guidance for this change might help teams update faster with fewer surprises.

---

Overall, these monthly dev updates show a good balance between infrastructure robustness, developer experience, and community tooling. Looking forward to next month’s evolution!

[j0nr33v3]

For anyone hitting this on the free tier or before they're ready to set up a drain destination: we built a Supabase integration for Gonzo (open-source terminal log analysis TUI) that pulls all 9 log sources - Postgres, Auth, Edge Functions, Storage, API Gateway, Realtime, PostgREST, Edge network, and Supavisor - into a single filterable view with no Supabase configuration changes required.

It uses the same Management API that powers the Logs Explorer, so it works on free plans. The normalization handles the nested metadata differences between sources (Cloudflare edge metadata vs. Postgres parsed logs vs. GoTrue events are all flattened to a common structure), which is most of what makes cross-service correlation painful in the dashboard today.

./supabase-log-poller.sh 2>/dev/null | gonzo

Script and setup guide are in the Gonzo repo: https://github.com/control-theory/gonzo