Database
Supabase: latest release, open vulnerabilities and status today
The latest release of the @supabase/supabase-js package is 2.118.0. No advisories for the @supabase/supabase-js package were published in the last 12 months. Supabase Status shows no open incidents right now.
Last checked against npm, OSV.dev and Supabase Status.
- Latest @supabase/supabase-js release
- 2.118.0
- npm downloads last week
- 31.1M
- Licence
- MIT
Security advisories
No advisories published in the last 12 months. Checked packages: @supabase/supabase-js.
Status now
No open incidents or maintenance right now.
16 incidents in the last 90 days (6 major). Most recent major: “Permission errors in the Supabase Dashboard” (2026-09-24). Consider retries, timeouts and a fallback path for this dependency. Not counted: 9 notices marked no impact.
Production checklist
Supabase production checklist: 5 checks before launch
- Must do: Enable Row Level Security on every table
- Must do: Keep the service_role key server-side only
- Should do: Turn on Point-in-Time Recovery and test a restore
Alternatives
Firebase Realtime Database
Real-time NoSQL cloud database
Strengths
- Real-time synchronization
- Offline support
Trade-offs
- Google vendor lock-in
- Limited querying
PocketBase
Open-source backend in a single file with real-time database
Strengths
- Single executable (Go) - no dependencies
- Built-in authentication and file storage
Trade-offs
- SQLite limitations for high concurrency
- Single-server deployment (no horizontal scaling)
Appwrite
Open-source backend server with real-time database and auth
Strengths
- Self-hosted and open-source
- All-in-one backend (database, auth, storage, functions)
Trade-offs
- Requires Docker/container infrastructure
- More complex setup than PocketBase
Convex
Backend platform with reactive real-time database
Strengths
- Reactive queries with automatic caching
- TypeScript-first with full type safety
Trade-offs
- Vendor lock-in (hosted only)
- Relatively new platform
Example stacks with Supabase
Docs and release notes
Check Supabase in your own stack
This page checks Supabase in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.