Supabase JS

Fixed a realtime presence issue via an updated Phoenix dependency, corrected auth initialization on the INITIAL_SESSION event, and fixed a self-reference inference bug in PostgREST.

Updated Phoenix dependency to fix a realtime presence issue.

Corrected postgrest self-reference inference and fixed realtime to trigger set auth on the INITIAL_SESSION event.

Postgrest self-referencing embeds are now correctly typed as arrays, realtime track() forwards opts to send(), and unrecognized sb_ API key subtypes now warn instead of throwing.

Unrecognized sb_ API key subtypes now produce a warning instead of throwing an error, preventing crashes when new key formats are encountered.

Fixed a bug in realtime where the track() method was not forwarding options to send().

Fixed a postgrest type hinting issue where self-referencing embeds were not correctly typed as arrays.

Avoided an edge runtime warning in the Supabase client.

Functions no longer send the API key in the Authorization header, and broadcast header fields are now encoded as UTF-8.

Function calls no longer send the API key in the Authorization header, and broadcast header fields are now encoded as UTF-8.

PKCE verifier is now preserved, and the tstyche target is pinned off the floating latest.

Fixed an auth issue where the PKCE verifier was not being preserved, which could have broken the OAuth authorization code flow.

Pinned the tstyche target to a specific version to avoid issues with the floating latest tag.

Fixed auth signout failures that were leaving stale local sessions, which could cause authentication state mismatches.

Fixed a bug where local session was not cleared when signout operations failed, which could leave stale authentication state in place.

Auth initialization notifications are now deferred until initializePromise resolves, preventing premature notification dispatch. Realtime onHeartbeat consumers no longer receive disconnected status events.

Auth notifications are now deferred until initializePromise resolves, preventing race conditions during initialization. Realtime also suppresses disconnected status from onHeartbeat consumers.

Dropped Node.js 20 support. The SDK now requires Node.js 22 or later.

Drops support for Node.js 20.

New postgres_changes filter builder with additional operators and select methods for Realtime subscriptions. Storage now exposes purgeCache for buckets and single objects, and custom providers admin API gains custom_claims_allowlist. Fixes include Content-Type header case-insensitivity for Functions, sortBy defaults preserved with partial sortBy in Storage list(), and dependency pinning for Realtime.