Extension version pinning is deprecated in favor of default versions

[changelog-reporter[bot]]

Specifying an explicit version in CREATE or ALTER EXTENSION is deprecated. From 2026-08-05 the version clause is ignored and the extension's default version is installed, with a warning.

Starting 2026-08-05, specifying an explicit version when creating or updating a Postgres extension on Supabase is deprecated. Statements like:

create extension pgvector version '0.7.0';
alter extension pg_graphql update to '1.5.9';

will still succeed, but the requested version is now ignored: the extension is installed at (or updated to) its current default version on your project's Postgres instance, and the statement emits a warning:

WARNING:  only superusers can specify extension versions, ignoring version "0.7.0" and installing the default version

In a future release, announced separately in advance, these statements will be rejected with an error instead.

Why we're making this change

Supabase instances ship multiple versions of some extensions side by side. Allowing any role to install or downgrade to an older version means projects can end up running extension versions with known security issues — including reintroducing vulnerabilities that were already patched in the default version. Pinning versions is now reserved for platform operations.

What's not affected

• Extensions you've already installed — nothing changes on running databases.
• create extension / alter extension ... update without a version clause.
• Database backups and restores (pg_dump output never includes version clauses).
• Installing extensions from the dashboard.

Migration steps

1. Remove VERSION '...' and UPDATE TO '...' clauses from your migrations, scripts, and tooling — the bare forms are drop-in replacements:

   -- instead of:                                   use:
   create extension pgvector version '0.7.0';   -->  create extension pgvector;
   alter extension pgvector update to '0.7.4';  -->  alter extension pgvector update;

2. After 2026-08-05, check your Postgres logs for only superusers can specify extension versions warnings to find any remaining call sites.

Affected products: Database, Security

Authored by @utkarash2991