v2.122.0

Supabase CLI v2.122.0 — 2026-10-23

This release is mostly fixes. The headline changes are supabase/supabase.lock for pinning stack service versions, PGSSL* and TLS settings now reaching db push --linked and pg_dump, and clearer config parse errors. Several fixes cover start/stop on Podman and stack reliability.

Highlights

• Pin stack service versions in a lock file — stack mode can run any published service version, match your hosted project after supabase link, and reproduce the whole local stack from a committed supabase/supabase.lock. (#7195)
• Postgres TLS settings now apply to db push --linked and pg_dump — PGSSLMODE, PGSSLROOTCERT, and PGSSLCERT/PGSSLKEY are read from your shell on direct connections, and remote db dump and the first db pull pass the resolved TLS settings through. Before, verify-full was ignored and client-cert servers rejected the dump. (#7261, #7266)

New features

• supabase --help shows token permissions — every command's help now has a PERMISSIONS section listing the personal access token permissions it needs, so you can scope tokens for CI without guessing. (#7268)
• supabase stack can run any published service version — the lock file (see Highlights) also lets you try a hotfix or match production versions. (#7195)

Improvements

• Config errors say what's wrong and where — start, status, stop, and functions serve used to print a bare CliConfigParseError. They now point to the bad line. inf and nan numbers are rejected at load time instead of slipping through. (#7267)
• Heads-up: the default target is changing — the CLI now warns before the upcoming switch to a local default target. Check your scripts if you rely on the current default. (#7186)
• db pull and pg_dump honor TLS config — see Highlights. (#7266)

Bug fixes

• supabase start and stop no longer fail every few runs on Podman — when there's no docker on PATH (macOS with podman machine), you no longer hit failed to inspect docker image or ssh: handshake failed: EOF. (#7270)
• supabase stop --no-backup no longer exits 1 with older Docker CLIs — it works with Docker CLI older than 23.0 talking to a newer daemon. (#7177)
• Piping CLI output into head or another reader that exits early exits cleanly — the CLI used to crash with Unknown: Stdio.stdout (exit 1), and with --output json it could hang forever. It now exits 0. (#7175)
• db diff --from linked --to linked no longer fails without a database password — it used to fail with password authentication failed for user "cli_login_postgres" when no password was set via --password, SUPABASE_DB_PASSWORD, or supabase/.env. (#7139)
• functions deploy --use-api uploads multiline dynamic imports — functions with import( split across lines, or with import attributes, no longer throw Module not found after deploy. (#7282)
• supabase init test OTP example works — the [auth.sms.test_otp] example now includes the country code, so +14152127777 gets the test code instead of sending a real SMS. (#7279)
• Stack: concurrent native stacks no longer share a backend port — two stacks started at once could bind Logflare to the same private port. (#7184)
• Stack: idle gateway connections stay open for 75 s — a short pause between API calls no longer ends in TypeError: fetch failed. (#7193)
• Stack: local Studio logs work again — analytics is pinned to Logflare 1.50.15, so logs pages no longer show "Backend error". (#7182)
• Stack: rest starts when a db_pre_request hook rejects requests without an app header — it used to hang on readiness. (#7216)
• Stack: native launches are more reliable — the launcher waits for a cache lock instead of failing, and Realtime waits for its own bind line before it's marked ready. (#7145)

Internal

Plus 6 internal improvements and dependency updates.

Full changelog: v2.121.0...v2.122.0