Supabase

Recently shipped an OpenCode /supabase slash command, a MongoDB foreign data wrapper, and experimental provider linking-domain groups for auth.

New integrations with OpenCode, MongoDB, TanStack DB, and CipherStash.

• OpenCode agents can now work with Supabase via /supabase slash command, granting access to account/project management APIs and bundled skills. Requires OpenCode 1.3.4 or later.
• The new Wrappers MongoDB foreign data wrapper lets you query MongoDB collections from Postgres with standard SQL.
• @supabase-labs/tanstack-db syncs TanStack DB collections with Supabase tables over PostgREST and Realtime (alpha).
• CipherStash encrypts sensitive fields at the application layer with per-value keys, supporting searches and joins without decryption while keeping keys under your control.

Auth gained per-provider claim control, KMS-backed signing, and experimental linking-domain groups. custom_claims_allowlist now works per-provider for custom OAuth. RS256 signing keys are backed by AWS KMS, SAML SP key rotation happens without downtime, and non-standard OIDC discovery URLs are supported. Auth v2.193.0 adds experimental provider linking with domain groups for more flexible identity management.

The JS SDK fixed API key leakage and PKCE flow, and improved type hints. Functions no longer send the API key in the Authorization header. PKCE verifier is preserved across sessions. Broadcast header fields are now encoded as UTF-8. Type hints for self-referencing embeds are now arrays.

The CLI restored configless type generation and Edge Function docker bundling. The CLI also decrypts dotenvx encrypted secrets during config push, matches legacy seed globbing behavior, and suppresses vendored error noise.

Node.js 20 support dropped from the JS SDK. v2.110.0 requires Node.js 22 or later.