Supabase

Recently shipped supabase pull for building a local project from a remote one, plus passkey auth without the experimental flag.

CLI setup now runs from the remote project.

• supabase pull orchestrates a full local setup from a remote project.
• Experimental stack commands — start, stop, status, list, logs, prepare, restart — control the local development stack.
• gen types runs against the configured stack with no Docker; storage commands target the managed stack.
• whoami reports the current account; notebooks push / notebooks pull sync notebooks.

Auth added MFA recovery codes and passkeys by default.

• MFA recovery codes shipped end to end across the Auth service and JS SDK v2.116.0; failed registrations now unenroll the unverified factor.
• Passkeys no longer require the experimental opt-in, now deprecated; signInWithPasskey forwards options.mediation.
• A session refresh that loses a race to another tab returns the stored session.

Generated Postgres types got sharper. postgrest-typegen now leaves computed fields out of select('*') results and resolves no-argument rpc overloads.

Storage added lifecycle rules and versioned URLs. JS SDK v2.116.0 shipped bucket lifecycle configuration and versionId support on createUrl. Legacy prefixes are dropped from lifecycles.

Upload and query fixes landed in the JS SDK. Blob and File uploads carry their own content type, multipart fields are sent before files, large relationship unions no longer hit instantiation depth errors, and PostgREST retries treat TimeoutError as an abort. A next bump patched an RCE in a realtime-js example.