pypi / supabase

supabase

What changed in supabase 2, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-31.

4 breaking1 security2 new APIs and options5 behavior and defaults30 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.9 on npm

supabase 242 changes

Breaking changes 4

x-relay-error responses now raise FunctionsRelayError.
2.33.0release notes
Relay errors are saved as text instead of being parsed as JSON.
2.33.0release notes
UserDoesntExist no longer includes the raw JWT.
2.33.0release notes
Raises AuthInvalidJwtError when the JWT has no exp claim.
2.32.0release notes

Security 1

invoke copies headers to prevent them from leaking across calls.
2.33.0release notes

New APIs and options 2

Function invocation no longer leaks options and supports specifying the HTTP method and sending a bytes body.
2.32.0release notes
Support for new realtime features was added.
2.32.0release notes

Behavior and default changes 5

delete now returns a select builder, allowing callers to chain a selection.
2.33.0release notes
insert now returns a select builder, allowing callers to chain a selection.
2.33.0release notes
update now returns a select builder, allowing callers to chain a selection.
2.33.0release notes
upsert now returns a select builder, allowing callers to chain a selection.
2.33.0release notes
X-Client-Info now uses structured semicolon-delimited metadata.
2.31.0release notes

Fixes and other changes 30

channel() returns the existing channel for a topic when one already exists.
2.33.0release notes
A caller-provided content-type is no longer overwritten.
2.33.0release notes
verify is passed as a keyword argument in create_client.
2.33.0release notes
Headers are handled case-insensitively with httpx.Headers.
2.33.0release notes
Quoted values in in filters are escaped.
2.33.0release notes
The session is kept after refreshing it during initialization.
2.33.0release notes
neq, gt, gte, lt and lte filter values are serialized like eq.
2.33.0release notes
OAuth query params are no longer mutated.
2.33.0release notes
set_auth updates channel join payloads.
2.33.0release notes
Listeners can now unsubscribe during notification.
2.33.0release notes
Vector index creation time is preserved.
2.33.0release notes
Vector object metadata is JSON.
2.33.0release notes
Connection params are included in the WebSocket URL.
2.33.0release notes
Sort parameters are sent in camelCase.
2.32.0release notes
Non-string values in array filters are coerced.
2.32.0release notes
Raises AuthWeakPasswordError for responses that do not include an error code.
2.32.0release notes
Every client-sent channel event now includes join_ref.
2.32.0release notes
Array-literal elements are escaped for these filters.
2.32.0release notes
Filter values are serialized in eq().
2.32.0release notes
Non-standard and non-JSON error responses are handled without raising AttributeError.
2.32.0release notes
Transient failures are retried for HEAD requests.
2.32.0release notes
Boolean values are normalized to lowercase literals.
2.32.0release notes
The key parameter is now optional for the storage list_v2 method.
2.32.0release notes
PostgREST RPC maybe_single behavior is aligned with select.
2.32.0release notes
Negation is preserved for or filters.
2.32.0release notes
Every key in a presence diff's leaves is processed.
2.32.0release notes
Boolean client options set to False are now honored when replacing options.
2.32.0release notes
Storage cache-control header handling and retry safety were fixed.
2.32.0release notes
Negation is preserved for text search filters.
2.32.0release notes
pyiceberg is now an optional dependency.
2.31.0release notes