Developer Update - April 2026

[ana1337x]

Here’s everything that happened with Supabase in the last month:

Multigres Operator is now open source

The Multigres Kubernetes operator is now open source, with direct pod management, zero-downtime rolling upgrades, pgBackRest PITR backups, and OTel tracing.

GitHub | Twitter

GitHub integration on all plans

GitHub integration is now available on all plans. Connect your repo on the free tier to deploy migrations from your main branch via CI/CD, no branching required.

GitHub

Supabase joins the Stripe Projects developer preview

Supabase is a co-design partner in Stripe Projects, a new CLI tool that provisions and connects services like Supabase, Vercel, and Clerk from your terminal, with credentials synced to your .env automatically.

Blog

Supabase docs over SSH

Browse all Supabase docs with standard Unix tools, or pipe them directly into Claude Code: ssh supabase.sh setup | claude.

Blog

Supabase Security Newsletter

Subscribe to the Supabase security newsletter, sent only when there are important security updates.

Sign Up

Quick Product Announcements

• Studio now has "Fix with Assistant" buttons across touchpoints, with a dropdown to send the prompt to Claude or ChatGPT. Twitter
• Browser tabs now show your exact navigation path so you can tell your tabs apart at a glance. Twitter
• Supabase secret keys now have Push Protection on GitHub, blocking accidental commits before they land. Twitter
• Schema Visualiser: relation lines are now clickable, tables and columns have context actions, and popovers appear between connected tables. Link

Made with Supabase

• Menugo - AI-powered QR code menu generator for restaurants
• Gasindex - AI voice agents call thousands of businesses to track real-time gas prices in America, with Vision AI and crowdsourced submissions keeping data fresh
• Guinndex - AI voice agents call thousands of businesses to track real-time Guinness prices in Ireland with Vision AI and crowdsourced submissions keeping data fresh
• Festie - The unofficial Coachella 2026 companion
• burn0 - Track Supabase costs per-request in real time

Community Highlights

• I Dare You to Fact-Check Me: You Need Supabase Before You Build Anything Else with AI
• Supabase in Production: What I Actually Learned Building Real Features
• I Got Surprised By A GitHub Actions Quota. Built A Tool To Make Sure It Never Happens Again
• The Solo Dev Cheat Code: Building Fast with Next.js, Supabase, and Vercel in 2026

---

This discussion was created from the release Developer Update - April 2026.

[jfutey]

Hi Team, inquiring again about CVE counts. We see some general improvement in a number of the services, especially in Kong with the big version update. Some of the others still post big critical and high counts with Studio, Supavisor and the Supabase Postgres db fork accounting for the majority of the CVE's of the entire suite. Can anyone comment on how these specifically are being addressed? Supavisor hasn't seen an update in 6 months and the Postgres fork is a fair amount behind the original whose count is generally kept acceptably low in comparison.

[aantti]

About Kong - correct, it was updated, and there's now also the option to use Envoy (check the how-to).

Regarding the (still default) Postgres 15 - check the upgrade docs. I'm planning to switch to Pg 17 in a month maybe as the default.

I'll work on updating the Supavisor image.

However, I'm not sure about the Studio issues, maybe @awaseem could add more.

[awaseem]

We review security alerts every week and merge the ones that are highly critical, What we have right now being reported and will be taken care of tomorrow. We also have pnpm policies locally that ensure new version of packages don't slip in by mistake, this is because of all the recent attacks that have happened with malicious code being published in recent versions. If there is something more specific please let us know