Client SDK

2.106.2 (2026-05-25)

🩹 Fixes

• auth: restore signup user response (#2391)
• misc: add react-native export condition for Hermes-safe resolution (#2393)

❤️ Thank You

• Myroslav Hryhschenko @BLOCKMATERIAL
• Vaibhav @7ttp

2.106.1 (2026-05-20)

🩹 Fixes

• auth: encode client-id in oauth requests (#2383)
• misc: hide dynamic import from hermesc (#2381)

❤️ Thank You

• Etienne Stalmans @staaldraad
• Katerina Skroumpelou @mandarini

2.106.0 (2026-05-18)

🚀 Features

• supabase: W3C/OpenTelemetry trace context propagation (#2163)

🩹 Fixes

• auth: return null user and session for email_change single-confirmation verifyOtp (#2378)
• release: mark @supabase/tracing private and snapshot it for JSR (#2370)
• storage: make StreamDownloadBuilder implement Promise and memoize executor (#2367)

❤️ Thank You

• Claude Sonnet 4.5
• Guilherme Souza
• Katerina Skroumpelou @mandarini
• oniani1

2.105.4 (2026-05-08)

🩹 Fixes

• auth: return null from getItemAsync on JSON parse failure (#2336)
• postgrest: restore non-Error abort detection in fetch catch (#2335)
• realtime: guard sessionStorage access in restricted-storage browsers (#2339)

2.105.3 (2026-05-04)

🩹 Fixes

• auth: narrow OAuth/CustomProvider types to fix downstream consumer typecheck (#2326)

2.105.2 (2026-05-04)

🩹 Fixes

• auth: forward lockAcquireTimeout to SupabaseAuthClient (#2309)
• auth: add toJSON to WebAuthnError for correct JSON serialization (#2317)
• misc: widen enum-like unions with (string & {}) for forward compat (#2303)
• misc: reduce any usage across packages (#2314)
• postgrest: unify insert/upsert signatures (#2315)

❤️ Thank You

• Muzzaiyyan Hussain @MuzzaiyyanHussain

2.105.1 (2026-04-28)

🩹 Fixes

• postgrest: query reassignment regression (#2292)
• realtime: surface real Error on transport-level CHANNEL_ERROR (#2299)

❤️ Thank You

• Vaibhav @7ttp

2.105.0 (2026-04-27)

🚀 Features

• auth: add passkey support with WebAuthn registration, authentication, and management (#2283)
• realtime: Realtime deferred disconnect (#2282)

🩹 Fixes

• postgrest: narrow column types after not(column, is, null) (#2264)
• realtime: annotate Timer/Vsn getters to avoid deep phoenix imports (#2284)
• storage: apply metadata, headers, and cacheControl dedupe to uploadToSignedUrl (#2275)
• storage: forward duplex option for stream uploads via uploadToSignedUrl (#2289)

❤️ Thank You

• Katerina Skroumpelou @mandarini
• oniani1

2.104.1 (2026-04-23)

🩹 Fixes

• auth: emit PASSWORD_RECOVERY event for PKCE recovery flows (#2272)
• postgrest: restore runtime test files to tstyche scope (#2266)
• supabase: propagate custom fetch to realtime client (#2267)

❤️ Thank You

• Katerina Skroumpelou @mandarini

2.104.0 (2026-04-20)

🚀 Features

• storage: extract shared header normalization utility (#2251)

❤️ Thank You

• Katerina Skroumpelou @mandarini

2.103.3 (2026-04-16)

🩹 Fixes

• realtime: throw Error objects instead of bare strings (#2256)
• storage: correct signedUrl type to allow null in createSignedUrls (#2254)

❤️ Thank You

• Katerina Skroumpelou @mandarini
• oniani1

2.103.2 (2026-04-15)

🩹 Fixes

• auth: include Cloudflare error codes in NETWORK_ERROR_CODES (#2239)
• auth: remove Prettify wrapper from exported types for TypeDoc expansion (#2250)
• misc: add explicit return types to toJSON methods for JSR compat (#2252)
• storage: remove client-side signed URL render endpoint normalization (#2249)

❤️ Thank You

• Katerina Skroumpelou @mandarini
• Vansh Sharma @Vansh1811

2.103.1 (2026-04-15)

🩹 Fixes

• auth: add toJSON to AuthError for correct JSON serialization (#2238)
• postgrest: handle bigint rpc (#2245)
• storage: add toJSON to StorageError for correct JSON serialization (#2246)
• storage: apply empty transform check to download and getPublicUrl (#2219)

❤️ Thank You

• oniani1
• Vaibhav @7ttp

2.103.0 (2026-04-09)

🚀 Features

• postgrest: add stripNulls method for null value stripping (#2189)
• storage: add cacheNonce parameter for download (#2234)

🩹 Fixes

• postgrest: fix scalar computed column type inference for isNotNullable and SETOF scalar (#2224)

❤️ Thank You

• Katerina Skroumpelou @mandarini
• Seydi Charyyev @TheSeydiCharyyev
• Vaibhav @7ttp

2.102.1 (2026-04-07)

🩹 Fixes

• functions: add toJSON to FunctionsError for correct JSON serialization (#2226)

❤️ Thank You

• oniani1

2.102.0 (2026-04-07)

🚀 Features

• postgrest: add automatic retries for transient errors (#2072)
• postgrest: add success discriminator field to PostgREST response types (#2198)
• supabase: export PostgrestFilterBuilder and StorageApiError from supabase-js (#2222)

🩹 Fixes

• auth: downgrade console.error to console.warn for missing session (#2214)
• ci: add --ignore-scripts to platform test installs to block post install attacks (#2206)
• postgrest: add toJSON to PostgrestError for correct JSON serialization (#2212)
• postgrest: reject excess properties in insert, update, and upsert (#2186)
• storage: set correct content-type for uploads (#2211)
• storage: avoid duplicate content-type headers in vector requests (#2220)

❤️ Thank You

• Clay
• Guilherme Souza
• Katerina Skroumpelou @mandarini
• oniani1
• Vaibhav @7ttp

2.101.1 (2026-03-31)

🩹 Fixes

• storage: support exactOptionalPropertyTypes (#2200)

❤️ Thank You

• Vaibhav @7ttp

2.101.0 (2026-03-30)

🚀 Features

• realtime: add copyBindings functionality (#2197)
• realtime: block setting postgres_changes event listener after joining (#2201)

❤️ Thank You

• Dominik Pilipczuk @snickerdoodle2

2.100.1 (2026-03-26)

🩹 Fixes

• postgrest: add type safety for eq() and neq() column names (#2175)
• postgrest: fix maybeSingle for all request methods by removing Accept header override (#2182)
• postgrest: narrow tstyche testFileMatch to only type test files (#2193)
• postgrest: prevent Args: never functions from being classified as computed fields (#2195)
• storage: spread all DEFAULT_FILE_OPTIONS in uploadToSignedUrl (#2194)

❤️ Thank You

• Ayush Baluni @aayushbaluni
• Katerina Skroumpelou @mandarini

2.100.0 (2026-03-23)

🚀 Features

• realtime: use phoenix's js lib inside realtime-js (#2119)

🩹 Fixes

• auth: guard navigator lock steal against cascade when lock is stolen by another request (#2178)
• realtime: revert vsn type to string (#2170)
• storage: structural detection on json() to detect Response-like errors (#2179)

❤️ Thank You

• Alan Guzek @GuzekAlan
• Dominik Pilipczuk @snickerdoodle2
• Katerina Skroumpelou @mandarini