# What changed in @supabase/supabase-js

> 240 changes in @supabase/supabase-js 2 from its official release notes, upgrade guides and advisories: 12 breaking, 1 deprecations, 1 security, 52 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/@supabase/supabase-js/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @supabase/supabase-js 2

### Breaking changes

- Computed fields are left out of select('*'), changing which fields are included when selecting all. (2.118.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.118.0)
- Enables the passkey API by default. (2.117.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.117.0)
- Node.js 20 is no longer supported. (2.110.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.110.0)
- auth.resend() now uses a consistent confirmation flow. (2.108.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.108.0)
- The fix that encoded the client ID in OAuth requests was reverted. (2.107.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.107.0)
- The client info header now uses a structured metadata format. (2.107.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.107.0)
- Blocks setting a postgres_changes event listener after joining. (2.101.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.101.0)
- The default lockAcquireTimeout is lowered to 5 seconds. (2.98.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.98.0)
- The default realtime serializer is now 2.0.0. (2.91.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.91.0)
- The storage analytics from method now follows the { data, error } return pattern. (2.87.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.87.0)
- Renames StorageAnalyticsApi to StorageAnalyticsClient, changing the name developers use for the Storage Analytics API. (2.83.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.83.0)
- Node.js 20+ is required; node-fetch was removed. (2.79.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.79.0)

### Security

- PostgREST adds URL length validation, affecting requests with long URLs. (2.94.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.94.0)

### Deprecations

- Deprecates the experimental passkey opt-in. (2.117.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.117.0)

### New APIs and options

- Uploads support content-encoding. (2.118.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.118.0)
- Adds support for bucket lifecycle configuration. (2.116.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.116.0)
- Adds an API for MFA recovery codes. (2.116.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.116.0)
- Adds support for topk values up to 10k. (2.116.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.116.0)
- Create URL methods now support versionId. (2.116.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.116.0)
- Adds getOpenApiSpec() to postgrest for retrieving the OpenAPI specification. (2.115.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.115.0)
- Realtime now allows waiting for Postgres changes. (2.113.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.113.0)
- OpenTelemetry tracing is available through an opt-in /tracing subpath. (2.112.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.112.0)
- Adds custom_claims_allowlist to the custom providers admin API. (2.109.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.109.0)
- Adds a postgres_changes filter builder, new operators, and select. (2.109.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.109.0)
- Exposes purgeCache for buckets and individual objects. (2.109.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.109.0)
- Adds an option for the replication connection system message. (2.109.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.109.0)
- Auth removes the navigator.locks-based mutex and introduces a commit guard and dispose() for cleanup. (2.107.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.107.0)
- Adds W3C/OpenTelemetry trace context propagation. (2.106.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.106.0)
- Adds WebAuthn registration, authentication, and management support for passkeys. (2.105.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.105.0)
- Adds deferred disconnect support in Realtime. (2.105.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.105.0)
- Adds the cacheNonce parameter to downloads. (2.103.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.103.0)
- Adds a PostgREST method for stripping null values. (2.103.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.103.0)
- PostgrestFilterBuilder is now exported from supabase-js for direct use. (2.102.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.102.0)
- StorageApiError is now exported from supabase-js for direct use. (2.102.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.102.0)
- PostgREST response types now include a success discriminator field. (2.102.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.102.0)
- Adds copyBindings functionality to realtime. (2.101.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.101.0)
- Adds RateLimitError to the Deno.errors namespace. (2.99.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.99.1)
- Adds admin CRUD methods for custom OIDC/OAuth providers. (2.99.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.99.0)
- The Provider type supports custom providers using the custom: prefix. (2.98.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.98.0)
- OAuth client create and update operations accept token_endpoint_auth_method. (2.98.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.98.0)
- The UserAttributes type adds currentPassword. (2.98.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.98.0)
- Adds an auth option to prevent automatic initialization in the constructor. (2.97.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.97.0)
- Adds the setHeader method to BaseApiClient. (2.96.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.96.0)
- Adds a canonical CORS headers export for edge functions. (2.95.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.95.3), [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.95.0)
- Exposes fetch parameters in the download method. (2.95.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.95.3), [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.95.0)
- Adds missing HTTP headers used for client platform and runtime detection. (2.93.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.93.0)
- Adds an optional jwt parameter to getAuthenticatorAssuranceLevel. (2.93.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.93.0)
- Heartbeat callbacks now expose heartbeat latency. (2.90.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.90.0)
- A configurable lock acquisition timeout is available to prevent deadlocks. (2.90.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.90.0)
- AMR claims now support string arrays. (2.89.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.89.0)
- Exports the DatabaseWithoutInternals utility type. (2.89.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.89.0)
- Adds the X (OAuth 2.0) provider for authentication. (2.89.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.89.0)
- The option now accepts a custom predicate for detecting a session in the URL. (2.88.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.88.0)
- A notin filter is now available in PostgREST. (2.88.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.88.0)
- Storage adds a from method, enabled by installing iceberg-js. (2.86.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.86.0)
- Realtime user broadcast push now supports metadata. (2.85.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.85.0)
- Adds the isdistinct and regex pattern matching operators for PostgREST queries. (2.84.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.84.0)
- Adds an endpoint for listing OAuth grants. (2.82.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.82.0)
- Adds an endpoint for revoking OAuth grants. (2.82.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.82.0)
- Functions requests support a configurable timeout. (2.81.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.81.0)
- Auth supports throwing errors instead of returning them. (2.79.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.79.0)
- Adds support for paginating and sorting buckets. (2.77.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.77.0)
- Adds API calls for managing OAuth 2.1 authorization consent. (2.77.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.78.0), [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.77.0)
- Adds support for updating OAuth clients. (2.77.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.78.0), [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.77.0)
- Adds an explicit REST call for Realtime. (2.76.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.76.0)
- Adds storage vectors and analytics in storage-js. (2.76.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.76.0)

### Behavior and default changes

- Forwards options.mediation to navigator.credentials.get in signInWithPasskey. (2.117.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.117.0)
- PKCE verifiers are stored in per-flow slots so they survive overlapping flows. (2.111.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.111.0)
- httpSend can send binary payloads. (2.107.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.107.0)
- PostgREST now automatically retries transient errors. (2.102.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.102.0)
- PostgREST adds timeout protection for requests. (2.94.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.94.0)

### Tooling

- postgrest-typegen output resolves no-argument rpc overloads. (2.118.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.118.0)

### Fixes and other changes

- Functions now send a Blob or File with its own content type. (2.117.3) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.117.3)
- Storage now sends multipart fields before files. (2.117.3) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.117.3)
- The PostgREST retry guard treats TimeoutError as an abort. (2.117.3) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.117.3)
- Avoids instantiation depth errors for large relationship unions. (2.117.2) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.117.2)
- Returns the stored session when a refresh loses to another tab. (2.117.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.117.1)
- Silences a commit-guard-discarded refresh during initial session handling. (2.116.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.116.0)
- Drops the legacy prefix from lifecycles. (2.116.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.116.0)
- Warns when schema is passed outside db options. (2.116.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.116.0)
- Storage object versioning was updated; the notes do not specify the details. (2.114.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.114.0)
- An unverified factor is unenrolled after registration fails. (2.114.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.114.0)
- Converts a stolen-lock AbortError when acquireTimeout is 0. (2.112.4) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.112.4)
- Warns when the deprecated lock option is used. (2.112.4) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.112.4)
- Uses the custom logger for the warning when send() falls back to REST. (2.112.4) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.112.4)
- Prevents an unhandled rejection during refresh. (2.112.4) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.112.4)
- Trace context headers are added to the canonical CORS allow-list, so they are allowed by CORS. (2.112.3) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.112.3)
- Trace propagation sampling and diagnostics are improved. (2.112.3) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.112.3)
- Prevents duplicate on bindings in realtime. (2.112.2) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.112.2)
- Clears stale join payload on sign-out. (2.112.2) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.112.2)
- Auth preserves the error message for 5xx errors. (2.112.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.112.1)
- Calling setAuth no longer disables token refresh. (2.112.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.112.1)
- The return type mismatch for createSignedUrls is resolved. (2.112.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.112.0)
- The db retry option is now forwarded. (2.112.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.112.0)
- throwOnError is now honoured when maybeSingle finds multiple rows. (2.112.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.112.0)
- StorageApiError now exposes the service error code. (2.112.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.112.0)
- UUID validation now accepts uppercase UUIDs. (2.112.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.112.0)
- Realtime now preserves presence refs. (2.110.9) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.110.9)
- Console noise from stale refresh tokens is downgraded. (2.110.9) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.110.9)
- Aborted and transient fetch failures are logged with console.warn instead of console.error. (2.110.8) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.110.8)
- Object keys are URL-encoded in CDN purge methods. (2.110.8) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.110.8)
- Response Content-Type matching is case-insensitive. (2.110.8) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.110.8)
- The Node warning is skipped when running in Deno. (2.110.8) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.110.8)
- The cross-signal abort listener is cleaned up when invoke returns. (2.110.8) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.110.8)
- Auth is now set when the INITIAL_SESSION event is triggered. (2.110.7) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.110.7)
- Fixed a Realtime presence issue. (2.110.7) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.110.7)
- Corrected PostgREST self-reference inference. (2.110.7) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.110.7)
- Self-referencing embeds are now type hinted as arrays. (2.110.6) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.110.6)
- track() now forwards opts to send(). (2.110.6) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.110.6)
- Unrecognized sb_ API key subtypes now produce a warning instead of throwing. (2.110.6) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.110.6)
- Avoids an edge runtime warning. (2.110.5) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.110.5)
- Function calls no longer send the API key in the Authorization header. (2.110.4) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.110.4)
- Broadcast header fields are encoded as UTF-8. (2.110.4) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.110.4)
- Preserves the PKCE verifier during auth flows. (2.110.3) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.110.3)
- Local session is now cleared when signout fails. (2.110.2) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.110.2)
- Init-time notifications are deferred until initializePromise resolves. (2.110.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.110.1)
- Disconnected status is suppressed for onHeartbeat consumers. (2.110.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.110.1)
- Functions now honor a caller's Content-Type override regardless of casing. (2.109.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.109.0)
- Storage list() keeps sortBy defaults when passed a partial sortBy. (2.109.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.109.0)
- Preserves a valid session when refresh fails and cools down repeated failures. (2.108.2) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.108.2)
- Fixes PostgREST then typing. (2.108.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.108.1)
- AuthApiError instances already returned through the contract are no longer logged with console.error. (2.108.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.108.0)
- Request headers are passed as a plain object for React Native and custom-fetch compatibility. (2.108.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.108.0)
- For expired JWTs, getClaims returns AuthInvalidJwtError. (2.107.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.107.0)
- The implicit grant gate recognizes redirects containing ?error=. (2.107.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.107.0)
- PostgREST returns a structured error when a successful response has a non-JSON body. (2.107.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.107.0)
- Adds a react-native export condition for Hermes-safe resolution. (2.106.2) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.106.2)
- Restores the signup user response. (2.106.2) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.106.2)
- Client IDs are encoded in OAuth requests. (2.106.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.106.1)
- StreamDownloadBuilder implements Promise and memoizes its executor. (2.106.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.106.0)
- For email_change single-confirmation verification, verifyOtp now returns a null user and session. (2.106.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.106.0)
- Restores detection of aborts represented by non-Error values in the fetch catch handler. (2.105.4) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.105.4)
- Returns null when JSON parsing fails. (2.105.4) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.105.4)
- Guards sessionStorage access in browsers with restricted storage. (2.105.4) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.105.4)
- The CustomProvider type was narrowed to fix downstream consumer typechecking. (2.105.3) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.105.3)
- The OAuth type was narrowed to fix downstream consumer typechecking. (2.105.3) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.105.3)
- Enum-like unions are widened with (string & {}) for forward compatibility, allowing additional string values. (2.105.2) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.105.2)
- The insert and upsert signatures are unified, making their API signatures consistent. (2.105.2) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.105.2)
- The auth client now forwards lockAcquireTimeout to SupabaseAuthClient, so the configured timeout can take effect. (2.105.2) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.105.2)
- WebAuthnError gains toJSON for correct JSON serialization. (2.105.2) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.105.2)
- Transport-level CHANNEL_ERROR now surfaces a real Error. (2.105.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.105.1)
- Fixes a regression in query reassignment. (2.105.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.105.1)
- Narrows column types after a not(column, is, null) filter. (2.105.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.105.0)
- Applies metadata, headers, and cacheControl deduplication to signed URL uploads. (2.105.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.105.0)
- Forwards the duplex option for stream uploads through uploadToSignedUrl. (2.105.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.105.0)
- Custom fetch is now propagated to the realtime client. (2.104.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.104.1)
- PKCE recovery flows now emit the PASSWORD_RECOVERY event. (2.104.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.104.1)
- The signedUrl type now allows null in createSignedUrls. (2.103.3) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.103.3)
- Realtime now throws Error objects instead of bare strings. (2.103.3) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.103.3)
- Cloudflare error codes are now included in NETWORK_ERROR_CODES. (2.103.2) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.103.2)
- The Prettify wrapper was removed from exported types for TypeDoc expansion. (2.103.2) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.103.2)
- Client-side normalization of signed URL render endpoints was removed. (2.103.2) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.103.2)
- Explicit return types were added to toJSON methods for JSR compatibility. (2.103.2) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.103.2)
- The empty transform check is now applied to download. (2.103.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.103.1)
- The empty transform check is now applied to getPublicUrl. (2.103.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.103.1)
- RPC calls now handle bigint values. (2.103.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.103.1)
- AuthError now implements toJSON for correct JSON serialization. (2.103.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.103.1)
- StorageError now implements toJSON for correct JSON serialization. (2.103.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.103.1)
- Fixes type inference for isNotNullable and SETOF scalar computed columns. (2.103.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.103.0)
- Adds toJSON to FunctionsError for correct JSON serialization. (2.102.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.102.1)
- Vector requests no longer send duplicate content-type headers. (2.102.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.102.0)
- Excess properties are now rejected in insert, update, and upsert. (2.102.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.102.0)
- Missing-session messages are logged with console.warn instead of console.error. (2.102.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.102.0)
- PostgrestError now implements toJSON for correct JSON serialization. (2.102.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.102.0)
- Excess properties are now rejected in insert, update, and upsert. (2.102.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.102.0)
- Uploads now set the correct content-type. (2.102.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.102.0)
- Excess properties are now rejected in insert, update, and upsert. (2.102.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.102.0)
- Storage types now support TypeScript projects using exactOptionalPropertyTypes. (2.101.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.101.1)
- Prevents Args: never functions from being classified as computed fields. (2.100.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.100.1)
- Adds type safety for column names passed to eq() and neq(). (2.100.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.100.1)
- Fixes maybeSingle for all request methods by removing the Accept header override. (2.100.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.100.1)
- Spreads all DEFAULT_FILE_OPTIONS in uploadToSignedUrl. (2.100.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.100.1)
- The vsn type is reverted to string, affecting TypeScript types for realtime. (2.100.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.100.0)
- Structural detection in json() recognizes Response-like errors. (2.99.3) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.100.0), [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.99.3)
- Guards lock stealing against cascading when another request steals the lock. (2.99.3) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.100.0), [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.99.3)
- Signed URLs are no longer rewritten to the render endpoint when the transform object is empty. (2.99.2) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.99.2)
- Improves FileObject type accuracy by making fields nullable where appropriate. (2.99.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.99.0)
- Realtime patches channel join payloads with the resolved access token before flushing the send buffer. (2.98.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.98.0)
- Auth can recover from orphaned navigator locks using a steal fallback. (2.98.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.98.0)
- Resolves Firefox content script Promise.then() security errors in locks. (2.96.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.96.0)
- Enforces type safety for table and view names passed to from(). (2.96.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.96.0)
- Fixes removeChannel when unsubscribe succeeds. (2.95.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.95.3), [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.95.0)
- OAuth authorization types now match API responses, improving type accuracy for authorization flows. (2.94.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.94.1)
- Vector operations now handle empty 200 responses. (2.93.3) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.93.3)
- Fixed fallback naming in auth WebAuthn handling. (2.93.3) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.93.3)
- Reverts the client platform and runtime detection headers. (2.93.2) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.93.2)
- Reverts table-filter validation in postgres_changes event dispatch. (2.93.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.93.1)
- Handles uncaught promise rejections during initialization. (2.93.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.93.0)
- Makes environment detection safe across Node and browser runtimes. (2.93.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.93.0)
- Adds a generic overload for the postgres_changes event type. (2.93.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.93.0)
- Sends a heartbeat when the initial connection encounters an error. (2.93.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.93.0)
- Clears local storage on signOut when the session is already missing. (2.93.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.93.0)
- Exposes status on the StorageError base class. (2.93.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.93.0)
- Exposes statusCode on the StorageError base class. (2.93.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.93.0)
- Restores SSR OAuth functionality that was broken in v2.91.0. (2.91.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.91.1)
- Subscriber notification is deferred to prevent a deadlock during exchangeCodeForSession. (2.91.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.91.0)
- Resolves a cross-context Promise error in Firefox extensions. (2.91.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.91.0)
- Validates the table filter during postgres_changes event dispatch. (2.90.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.90.1)
- Prevents shared state between query builder operations. (2.90.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.90.1)
- The user type now includes the banned_until property. (2.90.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.90.0)
- Object bodies are automatically stringified when a custom Content-Type header is provided. (2.90.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.90.0)
- The factor type now includes the last_challenged_at property. (2.90.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.90.0)
- The session is preserved when a magic link is clicked twice. (2.90.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.90.0)
- RPC HEAD requests with object arguments use POST with return minimal. (2.90.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.90.0)
- The authorization header is omitted when no access token exists. (2.88.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.88.0)
- A websocket race condition in Node.js is now handled. (2.88.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.88.0)
- Resolves ESM import failures on jsDelivr by adding .js extensions. (2.87.2) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.87.3), [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.87.2)
- A helpful error is now provided when the PKCE code verifier is missing. (2.87.2) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.87.2)
- The web worker is terminated on disconnect to prevent a memory leak. (2.87.2) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.87.2)
- Custom JWT tokens are preserved across channel resubscribe. (2.87.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.87.1)
- The auth client skips the navigator lock when persistSession is false. (2.87.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.87.1)
- Postgres changes filter comparison handles null values. (2.87.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.87.1)
- Corrects QueryVectorsResponse to use vectors instead of matches. (2.86.2) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.86.2)
- Keeps the code verifier in storage during edge cases. (2.86.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.86.1)
- Adds an ESM wrapper to resolve a module-not-found error in Nuxt. (2.86.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.86.1)
- Suppresses the getSession warning when getUser is called first. (2.86.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.86.1)
- Fixes setof type inference for cross-schema RPC calls. (2.86.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.86.1)
- Minor fixes were made to OAuth types. (2.85.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.85.0)
- Validates empty or invalid relation names in Postgrest. (2.84.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.84.0)
- Fixes the storage analytics bucket property. (2.82.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.82.0)
- PostgREST errors now bubble up fetch error causes and codes. (2.82.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.82.0)
- Realtime message encoding now accounts for null refs. (2.82.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.82.0)
- Callback IDs use Symbols to resolve compatibility with Next.js 16. (2.81.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.81.1)
- Calling setAuth is not required when using a custom JWT token. (2.81.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.81.1)
- signInWithSSO now performs an automatic browser redirect. (2.81.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.81.1)
- Registration and authentication use direct attestation. (2.81.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.81.0)
- Abort and timeout errors are normalized as FunctionsFetchError. (2.81.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.81.0)
- The UserAppMetadata interface gains a providers type. (2.81.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.81.0)
- The webauthn parameter is optional, and registration parameters are moved to webauthn. (2.81.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.81.0)
- Adds TypeScript types for documented JWT claims fields. (2.80.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.80.0)
- Warnings are emitted only if multiple clients share a storage-key. (2.80.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.80.0)
- Moves the session warning proxy from the session to the user object. (2.78.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.78.0)
- Removes redirection from getAuthorizationDetails. (2.77.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.78.0), [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.77.0)
- Handles 204 No Content responses when deleting an OAuth client. (2.77.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.77.0)
- Adds support for the incoming PostgreSQL major version 14. (2.77.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.77.0)
- Fixes a missing request body when the developer supplies a Content-Type header. (2.76.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.76.0)
- Adds application/pdf response parsing. (2.76.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.76.0)
- Corrects list v2 types to match the data returned by the API. (2.76.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.76.0)
- Enhances the RealtimeChannel type. (2.76.0) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.76.0)
- Uses a backward-compatible return type in the download function. (2.75.1) — [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.76.0), [release notes](https://github.com/supabase/supabase-js/releases/tag/v2.75.1)