docs(release): notes for v2.112.0 - #6114
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 47944e1936
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| This release improves local development stability with enhanced service lifecycle management, fixes migration and deployment edge cases, and continues the TypeScript migration. | ||
|
|
||
| ### Highlights | ||
| - **Service lifecycle improved** — Lazy startup and better health detection reduce startup issues. (#6072) |
There was a problem hiding this comment.
For the stable v2 release, this overstates a user-facing change: .github/workflows/release.yml builds stable/beta releases with the legacy shell, while #6072's production changes are in apps/cli/src/next/** and internal stack/process-compose packages (the only legacy path touched is a test). Users installing v2.112.0 therefore won't get lazy startup/service-lifecycle behavior from this PR, so this highlight (and the duplicate New features bullet) should be removed or kept out of the public CLI notes.
Useful? React with 👍 / 👎.
| ### Highlights | ||
| - **Service lifecycle improved** — Lazy startup and better health detection reduce startup issues. (#6072) | ||
| - **Migrations run in version order** — Fixes unpredictable behavior when multiple migrations exist. (#6038) | ||
| - **`supabase start` is more stable** — Migration failures no longer cause container hangs. (#6093) |
There was a problem hiding this comment.
For users who already hit the analytics migration crashloop, #6093 is not applied by merely upgrading: the PR notes say broken stacks need one supabase stop && supabase start because the fixed entrypoint only takes effect when the container is recreated. As written, this bullet implies the hang is fixed for existing local stacks without that extra action, so affected users may keep retrying against the stale container and see the same failure.
Useful? React with 👍 / 👎.
| ### Bug fixes | ||
| - **Profile loading fails fast with clear errors** — Malformed `--profile` config is reported immediately. (#6095) | ||
| - **Machine-readable output format is fixed** — `-o toml/yaml/json` now matches Go CLI output. (#6002) | ||
| - **Binary download cache is concurrent-safe** — Parallel CLI instances no longer corrupt the cache. (#6003) |
There was a problem hiding this comment.
#6003 only changes packages/stack/src/BinaryResolver.ts, and a repo-wide search of apps/cli/src/legacy shows the stable legacy CLI does not use that resolver for supabase start or other production commands. This bullet therefore promises a fix for parallel CLI invocations in the v2 stable release that those users cannot observe; it should be tailed as internal/alpha stack work instead of a public bug fix.
Useful? React with 👍 / 👎.
| - **Profile loading fails fast with clear errors** — Malformed `--profile` config is reported immediately. (#6095) | ||
| - **Machine-readable output format is fixed** — `-o toml/yaml/json` now matches Go CLI output. (#6002) | ||
| - **Binary download cache is concurrent-safe** — Parallel CLI instances no longer corrupt the cache. (#6003) | ||
| - **Path resolution is bounded to your project** — Symlinks can't escape your project directory. (#5956) |
There was a problem hiding this comment.
#5956 bounds extraction lexically with path.resolve/path.relative against utils.FunctionsDir; it does not resolve real paths or reject existing symlinks, and the bound is the functions directory rather than the whole project. Saying “Symlinks can't escape your project directory” overstates the security property users received, so this should be phrased as preventing downloaded function files from being written outside supabase/functions via path traversal.
Useful? React with 👍 / 👎.
| - **Kong reloads after `supabase db reset`** — Auth configuration stays synchronized. (#6017) | ||
| - **Auth email templates are preserved** — Kong templates survive CLI updates. (#6065) | ||
| - **SSO provider schemas are synchronized** — OIDC and SAML definitions match API expectations. (#6058) | ||
| - **Edge Functions deployment is unblocked** — Rollup integration issues are resolved. (#6057) |
There was a problem hiding this comment.
#6057's “rollup” is the develop→main rollup PR, not the Rollup bundler, and the commit only touches SSO test URL assertions plus packages/stack binary-cache fallback. There is no Edge Functions deployment or bundler change in that PR, so this release-note bullet advertises a user-facing deploy fix that was not actually shipped here.
Useful? React with 👍 / 👎.
|
|
||
| ### Deprecations | ||
| - **`db diff --use-pg-schema` is deprecated** — Plan to remove from your workflows. (#6060) | ||
| - **`db pull --experimental` is deprecated** — Use standard `db pull` instead. (#6028) |
There was a problem hiding this comment.
db pull --experimental users to --declarative
The implemented deprecation warning for #6028 explicitly tells users to use --declarative for per-object schema files, because plain db pull remains the migration-diff path and does not replace the deprecated structured-dump workflow. This guidance sends users to the wrong command form, so anyone migrating off db pull --experimental may lose the per-object output they were relying on.
Useful? React with 👍 / 👎.
|
|
||
| This release improves local development stability with enhanced service lifecycle management, fixes migration and deployment edge cases, and continues the TypeScript migration. | ||
|
|
||
| ### Highlights |
There was a problem hiding this comment.
There is no Breaking changes section before the highlights, but #6005 intentionally stops forwarding NPM_AUTH_TOKEN into Docker/legacy-bundle functions deploy; the PR calls out that private-registry users whose .npmrc expands ${NPM_AUTH_TOKEN} will fail auth again and need to inline the token or use --use-api. Without this release-note gotcha, CI users can upgrade into failed deployments with no migration step.
Useful? React with 👍 / 👎.
Verified every bullet against the actual v2.111.0..v2.112.0 tree diff (the range came from a rebased develop rollup, so commit subjects alone were misleading) and applied the Codex review feedback: - Drop #6072 and #6080: packages/next-only, not in the stable shell - Drop #6003 and #6057: the stable CLI does not exercise the stack binary cache; #6057's "rollup" was the develop->main rollup PR, not the Rollup bundler - Add breaking-change section for NPM_AUTH_TOKEN no longer being forwarded by functions deploy (#6005, ships in this tag) - Note the one-time stop/start needed for already-stuck stacks (#6093) - Scope #5956 to functions download path traversal - Point db pull --experimental users at --declarative (#6028) - Fix #6065 and #6066 descriptions to match the shipped changes - Recount the internal tail (33 uncited commits in the compare range) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018h8krKpNet85649nqtj95b
|
Reviewed the proposed notes and verified every bullet against the actual All 7 Codex review comments checked out and were applied:
Additional corrections beyond Codex:
Generated by Claude Code |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1267c3596a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| ### Improvements | ||
| - `supabase start` works on SELinux-enforcing hosts (for example Fedora with rootless Podman) — CLI-generated secret files are relabeled so containers can read them. (#6000) | ||
| - `functions serve` and Docker-based deploys continue when the working directory can't be mounted. (#6048) |
There was a problem hiding this comment.
For Podman projects with no enabled functions, #6048 fixes supabase start by omitting the Edge Runtime container's --workdir when no bind materializes that directory; startEdgeRuntimeContainer is used by start/serve, not by the Docker bundling path in functions deploy. The only deploy-side change in that commit extends bind-string parsing for :ro,Z, so this note incorrectly promises that Docker-based deployments recover from an unmountable working directory; describe the zero-function Podman start/serve scenario instead.
Useful? React with 👍 / 👎.
| @@ -0,0 +1,39 @@ | |||
| ## Supabase CLI v2.112.0 — 2026-08-07 | |||
|
|
|||
| This release fixes migration ordering, stops `supabase start` from hanging when analytics migrations fail, and unblocks Edge Functions deploys on Windows. There is one breaking change for private npm registry users. | |||
There was a problem hiding this comment.
For monorepos where the Supabase workdir is below the Git root and a function imports a shared file outside that workdir, #6005 now makes the default API deploy fail: writeSourceDeployForm computes the upload name relative to the workdir and rejects the resulting ../… path with failed to read file: open …: invalid argument. Before #6005 these uploads were anchored at the Git root and supported, so the assertion that there is only one breaking change omits a distinct deployment break that affected users need called out.
Useful? React with 👍 / 👎.
|
|
||
| ### Bug fixes | ||
| - Malformed `--profile` config fails fast with a clear error instead of being silently ignored. (#6095) | ||
| - `-o toml/yaml/json` machine-readable output matches the Go CLI again. (#6002) |
There was a problem hiding this comment.
#6058 only resynchronizes the SAML-provider response schemas by removing the obsolete nested saml.id and domains[].id requirements; its diff contains no OIDC schema change. Saying that OIDC definitions were synchronized therefore promises an OIDC fix that was not shipped; describe the restored sso list/show/update/remove handling for current SAML responses instead.
Useful? React with 👍 / 👎.
| - Small parity fixes from the July audit — `db dump`, `db query` formatting, credentials handling, and other edge cases now match the Go CLI. (#5978) | ||
|
|
||
| ### Deprecations | ||
| - **`db diff --use-pg-schema` is deprecated** — plan to remove it from your workflows. (#6060) |
There was a problem hiding this comment.
--use-pg-schema
Users relying on this deprecated diff engine cannot act on “plan to remove it” because no replacement is given. #6060's implemented warning provides the concrete migration paths—use the pg-delta engine via [experimental.pgdelta] enabled = true or --use-pg-delta, or return to the default migra engine—so the release note should include that guidance rather than leaving workflows without an alternative.
Useful? React with 👍 / 👎.
2 participants
Proposed user-facing release notes for
v2.112.0, generated byapps/cli/scripts/propose-release-notes.tsagainsttools/release/release-notes-prompt.md.How to update the notes
Edit
release-notes/v2.112.0.mddirectly on this branch — use the GitHub web editor or push commits torelease-notes/v2.112.0— before approving. The applied notes will reflect the file at the approved commit.How to publish
Approve this PR as a
supabase/cliteam member. The.github/workflows/apply-release-notes.ymlworkflow will then:v2.112.0with the contents ofrelease-notes/v2.112.0.md.release-notes/v2.112.0branch.This PR is not merged — the
do not mergelabel is a reminder. It targetsdevelopso that even an accidental merge never rewritesmain. Nothing is meant to land on any branch.Approvals from anyone outside the
supabase/cliteam are ignored; the workflow will post a comment explaining that and leave the release untouched.How to abandon
Close the PR without approving. The auto-generated semantic-release body for
v2.112.0stays in place.Re-generation
After this PR is closed, rerun the Propose release notes workflow from the Actions tab against
v2.112.0to get a fresh proposal.