diff --git a/release-notes/v2.112.0.md b/release-notes/v2.112.0.md
new file mode 100644
index 0000000000..a1d2b74239
--- /dev/null
+++ b/release-notes/v2.112.0.md
@@ -0,0 +1,39 @@
+## Supabase CLI v2.112.0 — 2026-08-07
+
+This release fixes migration ordering, stops `supabase start` from hanging when analytics migrations fail, and unblocks Edge Functions deploys on Windows. There is one breaking change for private npm registry users.
+
+### ⚠️ Breaking changes
+- **`functions deploy` no longer forwards `NPM_AUTH_TOKEN` into Docker bundling** — this restores Go CLI behavior. If you deploy against a private npm registry with an `.npmrc` that expands `${NPM_AUTH_TOKEN}`, Docker-based bundling will fail to authenticate after upgrading. Inline the token in `.npmrc`, or deploy with `supabase functions deploy --use-api`. (#6005)
+
+### Highlights
+- **Migrations run in version order** — `db push` and `migration up` no longer report an already-applied migration as missing when one version is a string prefix of another (for example `1` vs `10`, or `20260420` vs `20260420010000`). (#6038)
+- **`supabase start` no longer hangs when analytics migrations fail** — the analytics container now exits and retries instead of booting against an unmigrated database. If your stack is already stuck, run `supabase stop && supabase start` once after upgrading; the fix only takes effect when the container is recreated. (#6093)
+- **Edge Functions deploys work on Windows again** — bundling no longer fails with permission errors. (#6109)
+
+### Improvements
+- `supabase start` works on SELinux-enforcing hosts (for example Fedora with rootless Podman) — CLI-generated secret files are relabeled so containers can read them. (#6000)
+- `functions serve` and Docker-based deploys continue when the working directory can't be mounted. (#6048)
+
+### Bug fixes
+- Malformed `--profile` config fails fast with a clear error instead of being silently ignored. (#6095)
+- `-o toml/yaml/json` machine-readable output matches the Go CLI again. (#6002)
+- `functions download` can no longer write files outside `supabase/functions` via path traversal in downloaded entry paths. (#5956)
+- `supabase start` reuses existing volumes instead of failing when they already exist, notably on Podman. (#6037)
+- Kong reloads after `supabase db reset`, so auth requests no longer fail with 502 when container IPs rotate. (#6017)
+- Custom auth email templates no longer revert to defaults after `db reset`, `functions serve` reloads, or `branch switch`. (#6065)
+- SSO provider schemas are synchronized — OIDC and SAML definitions match API expectations. (#6058)
+- `db schema declarative generate` prints your configured declarative directory as written in config instead of an absolute path. (#6066)
+- Small parity fixes from the July audit — `db dump`, `db query` formatting, credentials handling, and other edge cases now match the Go CLI. (#5978)
+
+### Deprecations
+- **`db diff --use-pg-schema` is deprecated** — plan to remove it from your workflows. (#6060)
+- **`db pull --experimental` is deprecated** — use `db pull --declarative` for per-object schema files instead. (#6028)
+
+### TypeScript port progress
+- **Now served by the TypeScript shell:** `db start` container bootstrap, `db test`, and bootstrap's `db push` step. Behavior matches the Go CLI. (#6022, #6063, #6021)
+
+---
+
+Plus 33 internal improvements and dependency updates.
+
+**Full changelog:** https://github.com/supabase/cli/compare/v2.111.0...v2.112.0