v2.112.0

Supabase CLI v2.112.0 — 2026-08-07

This release fixes migration ordering, stops supabase start from hanging when analytics migrations fail, and unblocks Edge Functions deploys on Windows. There is one breaking change for private npm registry users.

⚠️ Breaking changes

• functions deploy no longer forwards NPM_AUTH_TOKEN into Docker bundling — this restores Go CLI behavior. If you deploy against a private npm registry with an .npmrc that expands ${NPM_AUTH_TOKEN}, Docker-based bundling will fail to authenticate after upgrading. Inline the token in .npmrc, or deploy with supabase functions deploy --use-api. (#6005)

Highlights

• Migrations run in version order — db push and migration up no longer report an already-applied migration as missing when one version is a string prefix of another (for example 1 vs 10, or 20260420 vs 20260420010000). (#6038)
• supabase start no longer hangs when analytics migrations fail — the analytics container now exits and retries instead of booting against an unmigrated database. If your stack is already stuck, run supabase stop && supabase start once after upgrading; the fix only takes effect when the container is recreated. (#6093)
• Edge Functions deploys work on Windows again — bundling no longer fails with permission errors. (#6109)

Improvements

• supabase start works on SELinux-enforcing hosts (for example Fedora with rootless Podman) — CLI-generated secret files are relabeled so containers can read them. (#6000)
• functions serve and Docker-based deploys continue when the working directory can't be mounted. (#6048)

Bug fixes

• Malformed --profile config fails fast with a clear error instead of being silently ignored. (#6095)
• -o toml/yaml/json machine-readable output matches the Go CLI again. (#6002)
• functions download can no longer write files outside supabase/functions via path traversal in downloaded entry paths. (#5956)
• supabase start reuses existing volumes instead of failing when they already exist, notably on Podman. (#6037)
• Kong reloads after supabase db reset, so auth requests no longer fail with 502 when container IPs rotate. (#6017)
• Custom auth email templates no longer revert to defaults after db reset, functions serve reloads, or branch switch. (#6065)
• SSO provider schemas are synchronized — OIDC and SAML definitions match API expectations. (#6058)
• db schema declarative generate prints your configured declarative directory as written in config instead of an absolute path. (#6066)
• Small parity fixes from the July audit — db dump, db query formatting, credentials handling, and other edge cases now match the Go CLI. (#5978)

Deprecations

• db diff --use-pg-schema is deprecated — plan to remove it from your workflows. (#6060)
• db pull --experimental is deprecated — use db pull --declarative for per-object schema files instead. (#6028)

TypeScript port progress

• Now served by the TypeScript shell: db start container bootstrap, db test, and bootstrap's db push step. Behavior matches the Go CLI. (#6022, #6063, #6021)

---

Plus 33 internal improvements and dependency updates.

Full changelog: v2.111.0...v2.112.0