Skip to content

Update dependencies, including the Supabase CLI 3 - #38

Merged
amyjko merged 1 commit into
mainfrom
update-dependencies
Nov 7, 2026
Merged

amyjko merged 1 commit into
mainfrom
update-dependencies

Conversation

@amyjko

@amyjko amyjko commented Nov 7, 2026

Copy link
Copy Markdown
Owner

Supabase CLI 2 → 3 and happy-dom 20 → 21, plus minor and patch bumps across the board. TypeScript stays at 6 because Kit 3.1.1 and svelte-check 4.7.8 both still cap it there.

Production deploy change: CLI 3 targets the local stack by default and won't change a hosted project unattended. The migrate job now runs supabase db push --remote --yes. Without that change, a bare db push would have succeeded against nothing and production migrations would silently stop applying.

Other changes:

  • --local is dropped from the types and diff scripts. It's deprecated in CLI 3 and does nothing.
  • [auth.email] and [auth.sms] now use enabled in place of the deprecated enable_signup.
  • Generated types gain ComputedFields: never on every table.
  • @axe-core/playwright 4.14's new label-in-name check (WCAG 2.5.3) caught the h1, h2, and 1. toolbar buttons. Their accessible names now lead with the text they show.
  • npm audit drops from 9 findings (2 high) to 7 (none high). The remaining 7 are upstream in Kit and adapter-vercel.

Verified locally on CLI 3: svelte-check, 288 unit tests, 208 e2e tests, 74 Playwright tests, build, vercel build, and format all pass, plus a logged-out crawl of the production build.

🤖 Generated with Claude Code

Supabase CLI 2 to 3 and happy-dom 20 to 21, plus minor and patch bumps to @axe-core/playwright,
@playwright/test, @supabase/supabase-js, Kit, adapter-vercel, fast-csv, prettier, svelte,
svelte-check, tslib, uuid, vite, and vitest. TypeScript stays at 6: Kit 3.1.1 and svelte-check
4.7.8 both still cap it there.

What CLI 3 required:
- Commands that can run locally now target the local stack by default, and every change to a
  hosted project needs consent. A bare `supabase db push` in the production workflow would have
  succeeded against nothing, so it is now `db push --remote --yes`. `link --project-ref` is
  unchanged.
- `--local` is deprecated and does nothing, so it's gone from the types and diff scripts.
- `[auth.email]` and `[auth.sms]` `enable_signup` are deprecated in favor of `enabled`, which is
  what they actually controlled: the provider, not new signups.
- Generated types gain `ComputedFields: never` on every table.

CI's `supabase start -x` list still leaves exactly db, kong, rest, auth, and realtime, and
`status -o env` still prints API_URL, ANON_KEY, and SERVICE_ROLE_KEY.

@axe-core/playwright 4.14 adds the label-in-name check (WCAG 2.5.3), which failed the h1, h2, and
1. toolbar buttons: their names didn't contain the text they show, so voice control couldn't
press them by it. Their names now lead with that text.

npm audit goes from 9 findings (2 high) to 7 (none high). The rest are in Kit's and
adapter-vercel's own dependencies, and the only fix npm offers is a downgrade.

`npm run diff` on CLI 3 proposes dropping pg_net, which exists in the local database but no migration
creates. Not addressed here.

Verified locally on CLI 3: svelte-check clean, 288 unit tests, 208 e2e tests, 74 Playwright tests
(three clean runs), build, vercel build, and format all pass, plus a logged-out crawl of the
production build.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
@amyjko
amyjko merged commit caa45f0 into main Nov 7, 2026
1 check passed
@amyjko
amyjko deleted the update-dependencies branch November 7, 2026 23:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant