This PR updates @supabase/supabase-js to v2.107.0.

Source: manual

Release Notes

v2.107.0

2.107.0 (2026-06-02)

🚀 Features

• auth: remove navigator.locks-based mutex; introduce commit guard + dispose() (#2392)
• realtime: allow httpSend to send binary payload (#2400)
• supabase: update X-Client-Info to structured metadata format (#2359)

🩹 Fixes

• auth: return AuthInvalidJwtError from getClaims for expired JWT (#2395)
• auth: recognize ?error= redirects in implicit grant gate (#2407)
• auth): revert fix(auth: encode client-id in oauth requests (#2383, #2417)
• postgrest: return a structured error for non-JSON body on successful responses (#2398)
• release: pin workspace:* sibling deps before JSR publish (#2418)
• release: publish gotrue-js legacy mirror via pnpm (#2419)

❤️ Thank You

• Claude Opus 4.7 (1M context)
• Claude Sonnet 4.6
• Eduardo Gurgel
• Guilherme Souza
• Katerina Skroumpelou @mandarini
• Omar Al Matar @Bewinxed
• youcef zr @youcefzemmar
• youcefzemmar

v2.106.2

2.106.2 (2026-05-25)

🩹 Fixes

• auth: restore signup user response (#2391)
• misc: add react-native export condition for Hermes-safe resolution (#2393)

❤️ Thank You

• Myroslav Hryhschenko @BLOCKMATERIAL
• Vaibhav @7ttp

v2.106.1

2.106.1 (2026-05-20)

🩹 Fixes

• auth: encode client-id in oauth requests (#2383)
• misc: hide dynamic import from hermesc (#2381)

❤️ Thank You

• Etienne Stalmans @staaldraad
• Katerina Skroumpelou @mandarini

v2.106.0

2.106.0 (2026-05-18)

🚀 Features

• supabase: W3C/OpenTelemetry trace context propagation (#2163)

🩹 Fixes

• auth: return null user and session for email_change single-confirmation verifyOtp (#2378)
• release: mark @supabase/tracing private and snapshot it for JSR (#2370)
• storage: make StreamDownloadBuilder implement Promise and memoize executor (#2367)

❤️ Thank You

• Claude Sonnet 4.5
• Guilherme Souza
• Katerina Skroumpelou @mandarini
• oniani1

v2.105.4

2.105.4 (2026-05-08)

🩹 Fixes

• auth: return null from getItemAsync on JSON parse failure (#2336)
• postgrest: restore non-Error abort detection in fetch catch (#2335)
• realtime: guard sessionStorage access in restricted-storage browsers (#2339)

This PR was created automatically.