---
scope: org
organization: supabase
release_count: 183
last_release: 2026-09-25
generated: 2026-04-16
updated: 2026-10-16
canonical: https://releases.sh/supabase/overview.md
---

Recently shipped `supabase pull` to build a local project from a remote one, and passkey sign-in without the experimental flag.

**CLI setup now runs from the remote project.**
- `supabase pull` orchestrates a full local setup from a remote project.
- Experimental `stack` commands — `start`, `stop`, `status`, `list`, `logs`, `prepare`, `restart` — control the local development stack.
- `gen types` runs against the configured stack with no Docker; storage commands target the managed stack.
- `whoami` reports the current account; `notebooks push` / `notebooks pull` sync notebooks.

**Auth added MFA recovery codes and passkeys by default.**
- MFA recovery codes shipped end to end across the Auth service and JS SDK; failed registrations now unenroll the unverified factor.
- Passkeys no longer require the experimental opt-in, now deprecated; `signInWithPasskey` forwards `options.mediation`.
- A session refresh that loses a race to another tab returns the stored session.

**Storage uploads gained content encoding and versioned URLs.** JS SDK 2.118.0 lets uploads set a content encoding alongside bucket lifecycle configuration and `versionId` support on `createUrl`.

**Generated Postgres types got sharper.** postgrest-typegen leaves computed fields out of `select('*')` results and resolves no-argument rpc overloads.

**Upload and query fixes landed in the JS SDK.** Blob and File uploads carry their own content type, multipart fields are sent before files, large relationship unions no longer hit instantiation depth errors, and PostgREST retries treat `TimeoutError` as an abort. A `next` bump patched an RCE in a realtime-js example.