--- collection: serverless-postgres collection_name: Serverless Postgres week_start: 2026-11-02 title: Supabase CLI v3 flips the default to local, as the Postgres tools race toward agents release_count: 25 generated: 2026-11-09 canonical: https://releases.sh/collections/serverless-postgres/digest/2026-11-02 --- # Supabase CLI v3 flips the default to local, as the Postgres tools race toward agents Supabase's CLI v3 makes local the default target and gates every hosted change behind confirmation, while Neon opens AI Gateway credits to Free plan accounts and ships project recovery, and PlanetScale adds OIDC auth for CI and emergency backups for Vitess. ### Supabase goes local-first The week's biggest shift came from Supabase, which cut a major CLI release that [makes the local stack the default target for every command that can run locally](https://github.com/supabase/cli/releases/tag/v3.0.0). The deprecated `--linked`, `--project-ref` and `--db-url` flags collapse into a single `--remote`, and any change to a hosted project now prompts for confirmation — failing outright in unattended CI unless you pass `--yes`. An experimental per-project local stack ships behind an environment variable. The config package got the same treatment: [1.0.0 removes `db remote commit`, several inspect aliases, and the bundled supabase-go binary](https://github.com/supabase/cli/releases/tag/config-v1.0.0), and replaces `[inbucket]` sections with `[local_smtp]`. The resolution order is now flag > shell environment > project env files > config file > default, which has a sharp edge: `SUPABASE_*` variables sitting in `.env` files now beat matched `[remotes.*]` blocks and get pushed to the linked project. The config package also [reads and writes JSONC and commented JSON configs](https://github.com/supabase/cli/releases/tag/config-v1.2.0) and [adds an `auth.email` require_current_password setting](https://github.com/supabase/cli/releases/tag/config-v1.1.0). Behind it all, the CLI now [skips Docker's first health check wait](https://github.com/supabase/cli/releases/tag/v3.0.1-next.2) for faster cold starts, [caps API retries with SUPABASE_API_MAX_RETRIES](https://github.com/supabase/cli/releases/tag/v3.1.0-next.1), and [pins the Supabase CA on linked database connections](https://github.com/supabase/cli/releases/tag/v4.0.0-next.7) in the next major's preview line. Two things soften the migration. A [maintenance release adds v2 install channels](https://github.com/supabase/cli/releases/tag/v2.122.1) — npm `supabase@v2.stable`, Homebrew `supabase@2`, Scoop `supabase-v2-stable` — for teams that can't move CI yet; v2 now receives only security and fundamentally-broken-behavior fixes. Separately, the changelog's [CLI v3 announcement](https://supabase.com/changelog#breaking-change-supabase-flutter-v3-brings-type-safety-to-th) is mandatory reading before upgrading automation. Supabase's client libraries had their own breaking week: [supabase-flutter v3 types queries, functions, realtime and auth](https://supabase.com/changelog#supabase-cli-v3-is-local-by-default-and-confirms-hosted-chan), changing v2 behavior for anyone who upgrades — nothing breaks until you do, but the migration guide covers what the compiler won't catch. [Supabase JS added Realtime broadcast persistence](https://github.com/supabase/supabase-js/releases/tag/v2.119.0), per-request custom fetch via query builder options on `.from`, and fixed global sign-out clearing the local session when the server failed, plus storage's `exists` reporting bad JWTs and missing buckets as missing files. ### Neon opens the gateway and undoes deletions Neon's week centered on access: [AI Gateway prepaid credits are now purchasable on the Free plan starting at $5](https://neon.com/docs/changelog/2026-11-06), giving one credential across 60-plus OpenAI, Google and other provider models. The same changelog brought [seven-day project recovery in the Console](https://neon.com/docs/changelog/2026-11-06) and automatic compute updates for computes up to 16 CU, autoscaling included, so no manual restarts. Neon's AI surface kept expanding. The [Function Registry](https://neon.com/blog/save-tokens-with-neon-function-templates) installs working templates — Vercel Chat SDK, Mastra, TanStack AI, Context.dev — with one command, so agents start from code rather than docs. The [MCP server adopted the stateless MCP 2.0 spec and retired its SSE endpoints](https://neon.com/blog/is-mcp-good-yet), now handling more tool calls and roughly double the daily active users of the Neon CLI. [Managed Better Auth gained the OAuth Provider plugin](https://neon.com/blog/managed-better-auth-oauth-provider-mcp), turning auth instances into OAuth 2.1 authorization servers that MCP clients can log into. And a deep architecture post showed [Lakebase Postgres serving 99.99999% of reads without touching object storage](https://neon.com/blog/lakebase-postgres-reads-never-touch-object-storage) — the compute node's local cache answers 99.46% of page accesses, with object storage reads confined largely to branches, restores and wake-from-zero first reads. ### PlanetScale hardens credentials and backups PlanetScale attacked long-lived secrets first: [GitHub Actions and Depot CI can exchange OIDC tokens for short-lived PlanetScale service tokens](https://planetscale.com/changelog/oidc-authentication-github-actions-depot-ci) under an admin-defined trust policy, so no more stored credentials in CI. On the resilience side, [emergency backups for Vitess copy directly from the running database](https://planetscale.com/changelog/vitess-emergency-backups) when regular backups are failing, optionally from a replica to spare the primary. The MCP server [moved onto four dedicated egress IPs](https://planetscale.com/changelog/mcp-server-dedicated-egress-ips) — Postgres databases behind IP restrictions must allow all four — and [gained feedback and question tools](https://planetscale.com/changelog/mcp-feedback-and-questions) so agents can report wrong results or docs gaps. Terraform provider v1.18.0 [manages VTGate, VTTablet and MySQL parameters](https://planetscale.com/changelog/vitess-parameters-terraform), and the CLI added [branch maintenance windows, events and replica detach](https://github.com/planetscale/cli/releases/tag/v0.349.0) as well as [system-CA verification of role connection URLs](https://github.com/planetscale/cli/releases/tag/v0.350.0). Elsewhere, Prisma's v8 release candidate [makes Postgres scalars convenience types and lets extension packs find Supabase via the search path](https://github.com/prisma/orm/releases/tag/v8.0.0-rc.23), with MongoDB indexes now carrying their names through migrations. ## Releases covered ### Neon - [Neon AI Gateway credits open to all accounts and project recovery arrives in Console](https://neon.com/docs/changelog/2026-11-06) - [Neon launches Function Registry with one-command templates for agents](https://neon.com/blog/save-tokens-with-neon-function-templates) - [Neon MCP server adopts stateless MCP 2.0 spec and retires SSE endpoints](https://neon.com/blog/is-mcp-good-yet) - [Neon Managed Better Auth adds OAuth provider with built-in MCP support](https://neon.com/blog/managed-better-auth-oauth-provider-mcp) - [Lakebase Postgres serves 99.99999% of reads without touching object storage](https://neon.com/blog/lakebase-postgres-reads-never-touch-object-storage) ### PlanetScale - [PlanetScale API adds OpenID Connect auth for GitHub Actions and Depot CI](https://planetscale.com/changelog/oidc-authentication-github-actions-depot-ci) - [PlanetScale adds emergency backups for Vitess databases](https://planetscale.com/changelog/vitess-emergency-backups) - [PlanetScale MCP server queries now leave from four dedicated IPs](https://planetscale.com/changelog/mcp-server-dedicated-egress-ips) - [PlanetScale MCP server adds tools to report feedback and ask questions](https://planetscale.com/changelog/mcp-feedback-and-questions) - [PlanetScale Terraform provider v1.18.0 adds Vitess parameter management](https://planetscale.com/changelog/vitess-parameters-terraform) - [PlanetScale CLI v0.349.0 adds branch maintenance window and event commands](https://github.com/planetscale/cli/releases/tag/v0.349.0) - [PlanetScale CLI v0.350.0 verifies role connection URLs against system CA store](https://github.com/planetscale/cli/releases/tag/v0.350.0) ### Prisma - [v8.0.0-rc.23](https://github.com/prisma/orm/releases/tag/v8.0.0-rc.23) ### Supabase - [Supabase CLI v3.0.0 makes local the default target and gates hosted changes on consent](https://github.com/supabase/cli/releases/tag/v3.0.0) - [Supabase CLI config v1.0.0 removes deprecated commands and changes config resolution order](https://github.com/supabase/cli/releases/tag/config-v1.0.0) - [Supabase CLI config v1.2.0 reads and writes commented JSONC configs](https://github.com/supabase/cli/releases/tag/config-v1.2.0) - [Supabase config v1.1.0 adds require_current_password auth email setting](https://github.com/supabase/cli/releases/tag/config-v1.1.0) - [Supabase CLI v3.0.1-next.2 skips Docker's first health check wait](https://github.com/supabase/cli/releases/tag/v3.0.1-next.2) - [Supabase CLI v3.1.0-next.1 adds SUPABASE_API_MAX_RETRIES to cap API retries](https://github.com/supabase/cli/releases/tag/v3.1.0-next.1) - [Supabase CLI v4.0.0-next.7 pins CA on linked database connections](https://github.com/supabase/cli/releases/tag/v4.0.0-next.7) - [Supabase CLI v2.122.1 adds v2 install channels for projects staying off v3](https://github.com/supabase/cli/releases/tag/v2.122.1) - [supabase-flutter v3 brings type safety to queries, functions, realtime and auth](https://supabase.com/changelog#breaking-change-supabase-flutter-v3-brings-type-safety-to-th) - [Supabase CLI v3 defaults to local stack and confirms hosted changes](https://supabase.com/changelog#supabase-cli-v3-is-local-by-default-and-confirms-hosted-chan) - [Supabase JS v2.119.0 adds Realtime broadcast persistence](https://github.com/supabase/supabase-js/releases/tag/v2.119.0)