Supabase JS

The storage exists method no longer reports an invalid JWT or a missing bucket as a missing file.

Storage uploads now support content-encoding, and postgrest-typegen output leaves computed fields out of select('*') and resolves no-argument rpc overloads.

2.118.0-canary.2 (2026-10-12)

This was a version bump only, there were no code changes.

2.118.0-canary.1 (2026-10-12)

This was a version bump only, there were no code changes.

postgrest-typegen output now leaves computed fields out of select('*') and resolves no-argument rpc overloads. Also patches next and sharp advisories and pins node-browser playwright in CI.

Bumped Next.js to patch a remote code execution vulnerability in the realtime-js example. Functions invocations now send Blob or File parts with their own content type, Storage sends multipart fields before files, and PostgREST treats TimeoutError as an abort in the retry guard.

Storage multipart uploads now send multipart fields before files.

Bumps the Next.js dependency to patch a remote code execution vulnerability in the realtime-js example, and Functions now send a Blob or File with its own content type. PostgREST retry guard now treats TimeoutError as an abort.

Fixed instantiation depth errors in PostgREST types when working with large relationship unions.

PostgREST types no longer hit instantiation depth errors when a query involves large relationship unions.

Fixed auth so the stored session is returned when a token refresh loses a race to another tab, preventing the losing tab from dropping into a logged-out state.

Fixed an auth bug where a token refresh losing a cross-tab race would not return the stored session.

The passkey API is now enabled by default, deprecating the experimental passkey opt-in. signInWithPasskey also forwards options.mediation to navigator.credentials.get.

The auth passkey API is now enabled by default, and the experimental passkey opt-in is deprecated.

signInWithPasskey now forwards the options.mediation setting to navigator.credentials.get.

Auth now has an API for MFA recovery codes, and storage adds bucket lifecycle configuration, topk 10k support, and versionId on create URL methods. Includes fixes for a refresh-token commit-guard edge case and a deprecation warning when schema is passed outside db options.

Added an MFA recovery codes API and versionId support to Storage create URL methods.

Storage now supports topk up to 10k, and the legacy prefix is removed from storage lifecycles.

Silenced a warning emitted when the commit guard discards a refresh during initial session setup.

Storage buckets now support lifecycle configuration, enabling automated management of bucket lifecycle policies.