Local stack ships postgres 17.6.1.111, whose supautils segfaults on function permission denials (fixed in .121)

[VDentesano]

Summary

supabase start provisions public.ecr.aws/supabase/postgres:17.6.1.111, which ships a
supautils build affected by a known SIGSEGV: any call to a function the current role lacks
EXECUTE on terminates the backend with signal 11 and takes the whole local cluster into
recovery.

The bug itself is already fixed upstream — supautils PR #190, released in v3.2.2, tracked in supautils #196 and #200. The image the CLI pins for local development still predates the fix.

Because supautils.hint_roles defaults to anon, authenticated, service_role and the anon
key is public by design, any local stack is one unauthenticated POST /rest/v1/rpc/<fn> away
from a cluster restart, for any function without EXECUTE for anon — which is the default
for every function created by the postgres role.

Reproduction

supabase init && supabase start

create schema zz;
create function zz.f(t text) returns text language sql stable as $$ select t $$;
revoke all on function zz.f(text) from public, anon;
grant usage on schema zz to anon;

set role anon;
select zz.f('x');
-- server closed the connection unexpectedly

Server log:

LOG:  server process (PID NNN) was terminated by signal 11: Segmentation fault
LOG:  terminating any other active server processes
LOG:  database system was not properly shut down; automatic recovery in progress

Over HTTP, with nothing but the public anon key:

POST /rest/v1/rpc/<any function without EXECUTE for anon>
apikey: <anon key>
-> HTTP 503, backend killed, cluster in recovery

Evidence that a newer image fixes it

Same repro, same default supautils.hint_roles, only the image changed:

Image	Result
17.6.1.111 (what supabase start provisions)	signal 11: Segmentation fault
17.6.1.121	ERROR: permission denied for function f (clean)

Verified 2026-08-05 by running 17.6.1.121 standalone with the stock image config.

Environment

• Supabase CLI 2.109.1 and 2.111.0 — both provision 17.6.1.111
• supabase/config.toml has no image pin; [db] major_version = 17
• PostgreSQL 17.6, supautils in session_preload_libraries
• Linux, Docker

Ask

Bump the pinned local Postgres image to >= 17.6.1.121.

Workaround for anyone hitting this

supautils.hint_roles is sighup and not settable by the postgres role (ALTER SYSTEM →
permission denied to set parameter; ALTER DATABASE/ALTER ROLE/SET → cannot be changed now). As supabase_admin it works:

docker exec -i -e PGPASSWORD=postgres supabase_db_<project> \
  psql -U supabase_admin -h 127.0.0.1 -d postgres \
  -c "alter system set supautils.hint_roles = ''" -c "select pg_reload_conf()"

Note this lives in postgresql.auto.conf inside PGDATA, so it survives a container restart
but not supabase db reset, which recreates the container.

[avallete]

Has been upgraded in the latest version. Also in the future, you can use the npx supabase@beta channels to get the cutting edge version when such update bugs occurs.