Supabase

Recently shipped supabase pull to build a local project from a remote one, and passkey sign-in without the experimental flag.

CLI setup now runs from the remote project.

• supabase pull orchestrates a full local setup from a remote project.
• Experimental stack commands — start, stop, status, list, logs, prepare, restart — control the local development stack.
• gen types runs against the configured stack with no Docker; storage commands target the managed stack.
• whoami reports the current account; notebooks push / notebooks pull sync notebooks.

Auth added MFA recovery codes and passkeys by default.

• MFA recovery codes shipped end to end across the Auth service and JS SDK; failed registrations now unenroll the unverified factor.
• Passkeys no longer require the experimental opt-in, now deprecated; signInWithPasskey forwards options.mediation.
• A session refresh that loses a race to another tab returns the stored session.

Storage uploads gained content encoding and versioned URLs. JS SDK 2.118.0 lets uploads set a content encoding alongside bucket lifecycle configuration and versionId support on createUrl.

Generated Postgres types got sharper. postgrest-typegen leaves computed fields out of select('*') results and resolves no-argument rpc overloads.

Upload and query fixes landed in the JS SDK. Blob and File uploads carry their own content type, multipart fields are sent before files, large relationship unions no longer hit instantiation depth errors, and PostgREST retries treat TimeoutError as an abort. A next bump patched an RCE in a realtime-js example.