1.0.0 (2026-11-02)

• feat(cli)!: remove db remote commit and the low-use inspect db aliases (#7109) (948107b), closes #7108
• feat(cli)!: remove deprecated commands and the supabase-go binary (#6609) (6b3541d)
• feat(cli)!: remove deprecated config keys, env vars and per-function import maps (CLI-2597) (#7176) (2f60e0b), closes #7154
• feat(cli)!: resolve config values as flags > env > config.toml > defaults (#7074) (eaa5c4f)
• fix(config)!: honor sms enable_confirmations on config push (CLI-2624) (#7221) (fdb5914)
• refactor(cli)!: remove Go CLI naming and framing from code and docs (#7064) (b903db0)

Features

• config: add [auth.email] and [auth.sms] enabled, deprecating enable_signup (#7398) (3045479), closes #7055 #7055
• config: add db.migrations.checks severities and exclusions (CLI-2782, CLI-2783) (#7312) (fdb0e1f)

BREAKING CHANGES

• [auth.sms] enable_confirmations = false, the init
  default, now turns phone confirmation off on the next config push, set
  it to true to keep the phone code and run config diff before pushing
• [inbucket] and [remotes.<name>.inbucket] are
  removed; use [local_smtp]. A non-empty [experimental] orioledb_version is removed; use [db] orioledb_version.
  SUPABASE_EXPERIMENTAL_ORIOLEDB_VERSION is removed; use
  SUPABASE_DB_ORIOLEDB_VERSION. The linkedin and slack auth
  providers are removed; use linkedin_oidc and slack_oidc.
  INBUCKET_URL is removed from status and stack status output and
  --override-name inbucket.url is rejected; use MAILPIT_URL and
  mailpit.url. An import_map.json inside a function directory is no
  longer picked up by functions deploy, functions serve or start;
  rename it to deno.json or set functions.<slug>.import_map.
• supabase db remote commit is removed; use supabase db pull. supabase inspect db total-index-size is removed; use
  supabase inspect db index-stats. supabase inspect db total-table-sizes and supabase inspect db table-index-sizes are
  removed; use supabase inspect db table-stats. Each removed command
  exits 1 and prints its replacement.
• Flags and SUPABASE_* environment variables now
  override config, including a matched [remotes.<name>] block. Every
  value resolves in one order: flag > shell environment > project env
  files > config.json/config.toml (a matched remote block over the
  base) > default. Project env files are .env.<SUPABASE_ENV>.local,
  .env.local, .env.<SUPABASE_ENV> and .env, in supabase/ and then
  the project root; SUPABASE_ENV defaults to development.

• If you deploy to a project with a [remotes.*] block, any
  SUPABASE_* variable in the job or in those files now beats the block.
  The CLI warns for each value it overrides. Check env | grep ^SUPABASE_
  in CI and grep -h ^SUPABASE_ supabase/.env* .env* in the repo, and set
  SUPABASE_ENV in CI so .env.development doesn't apply.
• supabase config push now pushes those overrides; for example, a
  SUPABASE_AUTH_SITE_URL in .env.local replaces the value in
  [remotes.production]. Push labels each env-sourced value, and
  supabase config diff shows the same values.
• Seeding a project that matches a [remotes.*] block now asks first,
  unless the block itself sets db.seed.enabled = true. db push --include-seed and db reset --linked exit 1 in CI unless you pass
  --yes. --include-seed and SUPABASE_DB_SEED_ENABLED=true now
  override enabled = false in the base [db.seed] too. db push still
  seeds only with --include-seed.
• --password with --local or --db-url now exits 1 on db push,
  db pull, db dump, db schema declarative generate, migration list
  and migration repair. migration squash targets the local database by
  default, so migration squash -p needs --linked. Put the password in
  the URL, or set [db].password for the local database.
• In a directory linked to project A, SUPABASE_DB_PASSWORD is no
  longer sent to another project (--project-ref B). Pass --password,
  or provide an access token so the CLI can create a temporary login role.
• An invalid value in config or in a SUPABASE_* variable now fails
  every command that loads project config, including db push, stop and
  services (for example SUPABASE_STUDIO_PORT=abc). The error names the
  variable or file and reports CliConfigValueError.
• SUPABASE_EXPERIMENTAL_PGDELTA_ENABLED overrides
  [experimental.pgdelta].enabled, so false selects migra for the run.
  Boolean variables, including SUPABASE_EXPERIMENTAL_STACK, accept 1,
  t, T, true, True, TRUE or 0, f, F, false, False,
  FALSE and fail on anything else.
• supabase db diff --use-pg-delta=false now turns pg-delta off even
  when config or env turns it on.
• supabase gen types --local uses [db].password, not
  SUPABASE_DB_PASSWORD.
• SUPABASE_PROJECT_ID now names local containers even when a remote
  block matches. Without a project_id in config.toml, local containers
  and volumes are named after the project folder, not the project ref. Run
  supabase stop before upgrading, or set project_id.
• Ports with a leading zero (054322) are rejected.
• services and the functions commands read config.json before
  config.toml.
• Without --workdir, the CLI uses the nearest directory with
  supabase/config.toml or supabase/config.json, so a nested
  config.json project now wins over an outer config.toml one.
• inspect report needs [[experimental.inspect.rules]] with string
  fields; a single [experimental.inspect.rules] table now fails.
• supabase link --password is deprecated and ignored.
• Error codes: MigrationPasswordFlagsError is now
  DbPasswordFlagsError; invalid values report CliConfigValueError;
  seeding without consent reports SeedConsentRequiredError.

• COBRA_COMPLETION_DESCRIPTIONS is no longer read; set
  SUPABASE_COMPLETION_DESCRIPTIONS to control shell completion
  descriptions. Error messages that quoted Go library errors are reworded:
  invalid boolean flag values (e.g. sso add --skip-url-validation) now
  say expected a boolean instead of strconv.ParseBool: …; invalid
  unsigned values for storage cp --jobs and db reset --last now say
  expected an unsigned integer (or value out of range) instead of
  strconv.ParseUint: …; oversized migration/seed statements report
  scanner: token too long instead of bufio.Scanner: token too long;
  gen bearer-jwt claim and JWK parse errors now read invalid claims: expected a JSON object, got <kind>, invalid claims: number <n> is out of range, failed to parse JWK: expected a JSON object, got <kind>,
  and invalid JWK field <field>: expected <type>, got <kind> instead of
  json: cannot unmarshal … into Go value/struct field …. Config type
  errors name values by shape: SUPABASE_PROFILE files report expected a YAML mapping at the top level and array/object type names, [db]
  glob entries report TOML type names (local date, offset date-time,
  array, table, …) instead of Go type names, and malformed db lint/db advisors payloads report invalid <field>: expected <shape>
  instead of naming Go types. SUPABASE_PROFILE errors are reworded
  (unknown keys: …, <key> is required, <key> must be an http(s) URL,
  unsupported config file type …, no profile config file specified)
  and multi-line profile errors no longer pad lines with trailing spaces.
  Config decode errors drop the decoding failed due to the following error(s): header and render entries as <key>: expected a string, got <type>, <key>: unknown keys: …, <key>: must be one of …. failed to unmarshal … messages (postgres-config, bootstrap templates, functions
  download) now read failed to parse …, db lint's failed to marshal json: reads failed to parse lint result:, and TOML output errors drop
  the toml: prefix.
• Removed the deprecated commands and flags that still
  ran through the bundled Go binary, and the supabase-go binary itself.
  If your scripts or CI use any of these, switch to the replacement. Each
  removed command or flag now exits with code 1 and prints its
  replacement.

• supabase db remote changes → supabase db diff --linked
• supabase gen keys → supabase projects api-keys --project-ref <ref>
• supabase db diff --use-pg-schema → omit the flag to use the default
  engine, or pass --use-pg-delta
• supabase functions download --legacy-bundle → supabase functions download --use-api. If that also fails and the Function was deployed
  with a CLI older than 1.120.0, redeploy it with the current CLI first.
• supabase db branch create, delete, list and switch → removed
  with no local replacement. Hosted preview branches are managed with
  supabase branches.
• --create-ticket (global flag) → removed. Report CLI problems with
  supabase issue bug.
• supabase-go → no longer installed. Call supabase instead.