Changelog

On Friday, March 06 2026, 08:00:00 UTC, we introduced a new rate limit on recursive/nested Edge Functions calls on the hosted platform.

What gets rate-limited?#

Rate limiting applies to outbound fetch() calls made by your Edge Functions to other Edge Functions within your project. This includes:

Direct recursion: A function calling itself Function chaining: Function A calling Function B Circular calls: Function A calling Function B, which calls Function A Fan-out patterns: A function calling multiple other functions concurrently

NOTE: Inbound requests to your Edge Functions and requests to external APIs (e.g., Stripe, OpenAI) are not subject to this rate limit. Only outbound calls from one Edge Function to another Edge Function are counted.

Rate limit budget#

Each request chain has a minimum budget of 5,000 requests per minute. In busier regions, this budget may be higher. All function-to-function calls within the same request chain share this budget.

Why was this introduced now?#

Over the last few weeks, we observed increased response times for Edge Functions across multiple regions. Upon analysing traffic, we noticed that a small number of projects that do recursive/nested function calls are adding significant strain on our servers. In particular, the incident we had on Feb 28th was caused by recursive function calls. We had to put this in as a safeguard to ensure reasonable performance for all projects hosted on the platform.

Based on our metrics, the rate limit has so far affected only 0.4% of projects. If you were affected, we apologize for the inconvenience.

How can you avoid being rate-limited?#

It's still possible to follow recursive/nested patterns within the rate-limit. We've published a guide that provides several examples of how you can avoid rate limits.

Please contact support if you have any further questions about these rate limits.

Here’s everything that happened with Supabase in the last month:

Webinar: Ship Fast, Stay Safe#

Learn how top agencies balance velocity with control when using AI coding tools to build production applications on Supabase.

Register

Logs Drains on Pro#

Log Drains are now available on Pro. Send your Postgres, Auth, Storage, Edge Functions, and Realtime logs to Datadog, Grafana Loki, Sentry, Axiom, S3, or your own endpoint.

Blog Post

Docs now export to Markdown for AI tools#

Every guide on docs.supabase.com now has a "Copy as Markdown" option, plus direct links to ask ChatGPT and Claude. Copy any page into your agent or tool of choice with one click.

Docs

Storage: major performance and security overhaul#

Object listing is up to 14.8x faster on 60M+ row datasets. The prefixes table and its 6 triggers are gone, replaced with a hybrid skip-scan algorithm and cursor-based pagination. Security fixes close a path traversal vulnerability and prevent orphan objects from direct SQL deletes.

Blog Post

Edge Functions dashboard for self-hosted and CLI#

List and search your functions, view details, test directly from the dashboard, and download as .zip. No longer cloud-only.

Twitter

Multigres Postgres parser: 2.5x faster than the cgo alternative#

Built in 8 weeks using Claude Code. A comparable MySQL parser took over a year.

Blog Post Twitter

Quick Product Announcements#

• ⚠️ Action Required: OpenAPI spec access via anon key deprecated March 11. The /rest/v1/ schema endpoint will only be accessible via service role or secret API keys after this date. Existing data API usage is unaffected. GitHub
• Observability Overview page is rolling out. Twitter
• Table filters now use AI. Describe what you want to find and the dashboard applies the right Postgres filters. Available under Feature Previews. Twitter GitHub
• Queue table operations in the Table Editor. Stage inserts, edits, and deletes, review in Diff View, then commit with cmd + s. Twitter
• Supabase plugin for Cursor is live. Twitter
• Copy AI prompts from the dashboard. The same prompts powering the Supabase AI Assistant are now exportable for use in your local agent or tool of choice. Twitter
• Inline SQL Editor saves SQL Snippets. Create and update snippets from Studio. Share via git in the supabase/snippets folder. GitHub
• Command Menu gets Create and Search shortcuts. Hit cmd + k to create tables, RLS policies, Edge Functions, and Storage buckets — or jump directly to an existing one. Twitter
• Read replicas now managed from the database replication page. Rolling out gradually — if you manage read replicas, look in Database settings.
• Receipt downloads now available. Download receipts from the Invoices section in your org billing page.

Made with Supabase#

• A purpose-built tool for running powerful affiliate and referral campaigns. Website
• Supabase x YCombinator Hackathon winner: An AI Agent Personal Trainer Website
• AI video production for professionals Website
• Generate APA citation-ready references from a URL or DOI in seconds Website
• SupaClaw - A basic version of OpenClaw but built entirely on Supabase built-in features GitHub

Community Highlights#

• Supabase is sponsoring Postgres Conference 2026. Deepthi and Sugu are speaking on Multigres: horizontal scalability and intelligent sharding for Postgres. April 21-23 in San Jose. Use code 2026_SUPABASE20 for 20% off. Register
• Codepup AI launched Supabase integration. Build a complete web app with a real Supabase backend — auto-generated, tested, and fixed by AI in under 30 minutes. Blog Post
• BKND joins Supabase. Dennis Senn, creator of BKND, is joining to build a Lite offering for agentic workloads. BKND stays open source. Blog Post
• Hydra joins Supabase. Joe Sciarrino, co-creator of Hydra, is joining to build Supabase Warehouse: an open data warehouse architecture for developers. Hydra co-developed pg_duckdb, which accelerates analytics queries on Postgres by over 600x. Blog Post
• Getting Started with Supabase - Official Guide YouTube
• Supabase on Observable Flutter - Episode YouTube
• Inside Supabase Edge Functions: How Serverless Magic Actually Works Blog
• Unlocking Scalable Backend Development: Why Supabase and Node.js are Revolutionizing Modern Applications in 2026 Blog
• Adding GitHub, Google, and X Login to Next.js 15 with Supabase Auth Blog

What’s Changing?#

The Data API returns the full OpenAPI spec for any schema exposed to the Data API at the root path: https://[projectref].supabase.co/rest/v1/

Starting March 11, we will begin deprecating support for accessing this endpoint via the anon key. You will get the following error message if this endpoint is accessed via the anon key

The endpoint remains accessible and the behaviour doesn't change if you are using the service role keys or the new secret API keys.

This does not affect normal Data API usage. Accessing data via /rest/v1/your_table or any client library will continue to work exactly as they do today.

Why?#

Today, the endpoint returns schema details (tables, columns, and types of an exposed schema) to anyone with the anon key. While this does not expose actual row data, it provides more information about your schema than most production applications need.

As part of an ongoing effort to tighten default security across Supabase, we are removing this exposure. In practice, the schema spec is mostly useful during development, where you can use the service_role key. There are few cases where you would need it client-side in production (less than 0.1% of our projects have made a request to this endpoint using the anon key in the last 24 hours), and we do not think supporting those use cases is worth the security tradeoff.

Am I Affected?#

You are affected if your app currently uses the anon key to fetch the Swagger spec.

You can check by reviewing requests to the /rest/v1/ endpoint via this log query.

If you see requests:

1. Click into the event.
2. Check whether the request is coming from the anon role.

What Should I Do?#

1. Check your logs. Use the log query above to see if any of your application traffic relies on this endpoint with the anon key.
2. Move affected calls server-side If your application fetches the schema spec, move that call to a server-side context like Edge Functions where you can safely use the service_role or the new secret API keys.

Rollout and Communications Timeline#

We may push these dates back based on customer feedback, but we will not move them forward.

What’s Next?#

This is the first in a series of changes we are making to tighten default security settings across Supabase. Stay tuned for improvements to RLS usability, default table grants, and additional security features.

Here’s everything that happened with Supabase in the last month:

Supabase PrivateLink is now available#

Connect your database to AWS resources over private networks. No public internet exposure. Traffic stays within AWS infrastructure using VPC Lattice.

Blog Post

Postgres Best Practices for AI Agents#

30 rules across 8 categories teaching AI agents to write correct Postgres code. Works with Claude Code, Cursor, GitHub Copilot, and other tools.

Blog Post

Query Ethereum directly from Postgres#

Use SQL to query real-time Ethereum blockchain data with the Infura wrapper.

View docs

Supabase is now an official Claude connector#

Connect your Supabase projects to Claude and manage your database by telling Claude what you need.

Blog Post

Vibe coding, done right#

Join us for a 45 minute online workshop with Bolt where we’ll walk through several success stories and best practices for introducing vibe coding safely into your company

Register now

Free eBook: Using Postgres to its full extent#

Manning Publications and Supabase created a free eBook on using Postgres to its full extent—contemporary SQL techniques, full-text search, data types, and avoiding design mistakes that cost performance.

Download

Quick Product Announcements#

• Action Required: pg_graphql disabled by default on new projects. Ships mid-February. New projects won't have pg_graphql enabled automatically. Existing projects with zero GraphQL requests will also have it disabled. If you use GraphQL, manually enable the extension. GitHub
• TRAE SOLO integration with Supabase. Manage your database, storage, and auth inside ByteDance's AI IDE. Blog Post
• Edge Functions now support drag-and-drop zip files. Upload entire function bundles to migrate between projects. Docs
• SQL snippets save locally in Studio. Share queries via git with your team in supabase/snippets folder. GitHub
• Supabase Assistant helps with database query performance. Get optimization suggestions directly in the dashboard. Twitter
• postgrest-js hits 9M weekly downloads. Twitter

Made with Supabase#

• Fanakin - Organize movies, shows, books, games, and more in one place. Create lists, share your profile, and get AI-powered recommendations based on your taste. Website
• PolicyCheck - Free client-side security analysis for your Supabase project. See what's exposed through your public API with just your anon key or user authenticated mode. Website
• Renamify - AI-powered bulk file renaming with 99% accuracy. Rename hundreds of photos instantly with intelligent, descriptive names. Built to make the web more accessible. Website

Community Highlights#

• Supabase becomes a Tailwind partner. Announcement
• New contributor site launched at supabase.com/contribute. Search issues across GitHub, Reddit, and Discord filtered by technology. Visit Site
• SupaSquad community program now open. Join as a Contributor, Content Creator, Trusted Host, or Event Speaker. Get early access to features, partner deals, and direct team access. Apply Now

In a forthcoming release within approximately 3 weeks, pg_graphql will be disabled by default on new Supabase projects.

This change aligns pg_graphql with our security-first approach of minimizing exposed API surface area by default. Services and extensions that expose schema metadata are now opt-in rather than opt-out, reducing the default attack surface for new projects.

Who is affected:

New projects will no longer have pg_graphql enabled automatically

Existing projects older than 30 days with zero graphql requests will also have the extension disabled (where previously it was enabled by default). Existing projects with requests will be unaffected.

Action required: If your application relies on GraphQL, you can enable pg_graphql manually via the Database Extensions page in your dashboard. You can also add create extension pg_graphql to your migrations as well if you wish to keep using pg_graphql

We continue to fully support pg_graphql for projects that need it. This change simply ensures it's an intentional choice rather than a default.

We'll follow up on this thread with links to relevant documents for actions required.

Saving SQL snippets now works in the local Studio! This has been a top community request for a long time, and we’re happy to finally release it.

You can save SQL snippets directly while working in the local Studio via the CLI. Snippets are stored in supabase/snippets, making them easy to commit to Git and share with your team working in the same repo—or ignore entirely with .gitignore if you prefer.

Your saved snippets automatically appear in Studio, just like they do in the hosted Dashboard.

This feature is available since CLI v2.72.7. You can check the version by running supabase -v.

Here’s everything that happened with Supabase in the last month:

Update on security progress and roadmap#

Learn about all the security features we added last year and our 2026 roadmap.

[Blog Post]

Stripe Sync Engine in the Supabase Dashboard#

One-click integration for the Stripe Sync Engine directly in the Supabase dashboard. Query your customers, subscriptions, invoices, and payments using standard SQL.

[Blog Post]

Enhanced docs for the Metrics API#

Better guidance on how to stream Supabase database telemetry into any Prometheus-compatible observability stack.

[Blog Post]

Build ChatGPT apps with Supabase and mcp-use#

Learn how to build ChatGPT apps that connect to your Supabase database. Use mcp-use, an open source SDK that makes it easy to deploy MCP Servers on Supabase Edge Functions.

[Blog Post]

Index Advisor in Table Editor#

It’s now much easier to detect missing indexes in your database.

[Twitter]

Quick Product Announcements#

• Supabase is now in the top-100 repos on GitHub. [Twitter]
• Data API upgraded to PostgREST v14. [GitHub]
• Python Type Generation in the CLI. [Twitter]
• Three new quick starts in docs for Expo React Native, TanStack Start, and Flask. [Twitter]
• Explain/Analyze diagrams are now available in the Supabase Dashboard. [Twitter]

Update: v14 is now available worlwide :world_map:

Hey everyone, PostgREST v14 is now available for new projects on the ap-northeast-1 region. Please try it out and give us your feedback!

v14 will be available for other regions over the next week.

Notable Features#

JWT cache#

This increases throughput of all requests (~20% more RPS for GET requests according to our benchmarks). It's enabled by default.

This comes at the expense of a bit more memory usage, if you see any problems you can disable the JWT cache with:

Faster schema cache loading#

For complex databases, we've improved the schema cache loading time (from 7 minutes to 2 seconds on a complex real-world database). No configuration knob needed for this, it's done by default.

Breaking Changes#

No breaking changes expected for Supabase users.

Full Changelog#

You can see the full changelog at https://github.com/PostgREST/postgrest/releases/tag/v14.0.

Here’s everything that happened with Supabase in the last month. Be sure to keep reading for a special gift:

Supabase ETL#

A change-data-capture pipeline that continuously replicates data from Supabase Postgres to external destinations, starting with Iceberg. Available in private alpha now.

[Blog Post]

Analytics Buckets#

Specialized storage buckets built on Apache Iceberg and AWS S3 Tables that provide columnar storage for analytical workloads while maintaining compatibility with the Postgres interface. Available in public alpha now.

[Blog Post]

Vector Buckets#

Vector Buckets are a specialized bucket type built on Amazon S3 Vectors. They are cold storage for your embeddings, with a query engine attached. Available in public alpha now.

[Blog Post]

iceberg-js#

A minimal, vendor-agnostic JavaScript client for the Apache Iceberg REST Catalog API.

[Blog Post]

Supabase Platform#

A white-label offering that lets platforms provision and manage fully managed backends on behalf of their users

[Blog Post]

New Auth Templates#

We now include more email templates to handle security-sensitive changes to you app, including password changed, email changed, phone number changed, identity linked or unlinked, multi-factor authentication enrolled or unenrolled, and more.

[Blog Post]

Sign in with [Your App]#

You can now turn your project into a full-fledged identity provider. You’ve heard about “Sign in With Google,” now you can build “Sign in With [Your App].” The immediate catalyst for this is that soon you can build MCP servers that use Supabase Auth in your app to authenticate the user.

[Blog Post]

Supabase power for Amazon Kiro#

With these powers for [Amazon’s Kiro IDE](https://www.kiro.dev), you can build full-stack applications faster by giving Kiro deep knowledge of your Supabase project, best practices for database migrations, edge functions, and security policies.

[Blog Post]

Supabase in the AWS Marketplace#

You can now purchase Supabase through the AWS Marketplace, which means that if your company has an AWS spend-commit you can use it to purchase Supabase.

[LinkedIn]

Quick Product Announcements#

• We’ve added asynchronous streaming to Postgres Foreign Data Wrappers. [Blog Post]
• We now support deploying legacy NodeJS applications as Edge Functions.
• You can now download Edge Functions from the Supabase CLI without Docker.
• You can now bulk paste and edit individual secrets for Edge Functions.

Manage Vector Buckets from the dashboard#

We're rolling out management of Vector Buckets where you can store, index, and query your vector embeddings at scale! 📈

Vector Buckets is currently in Public Alpha, hence expect rapid changes and possible breaking updates as we expand access to make this increasingly available to everyone. 🙂🙏

Analytics Buckets is also currently in Public Alpha if that might interest you too! 🙏

What we'd like to know from you#

• Any bugs / issues that you might run into when using Vector Buckets
• Any UX friction that you might run into when managing Vector Buckets through the dashboard
• Any use cases for Analytics Buckets, and how we might be able to improve the DX to support your development / workflow

Related Links#

Dashboard: https://supabase.com/dashboard/project/_/storage/vectors Documentation: https://supabase.com/docs/guides/storage/vector/introduction