3.0.0-beta.14 (2026-10-29)

• feat(cli)!: default secrets unset to no and require --all to unset every secret (#7172) (59d4627)
• feat(cli)!: one --remote flag, local target defaults and one hosted-mutation consent rule (#7188) (1fa6164)
• feat(cli)!: remove db remote commit and the low-use inspect db aliases (#7109) (948107b), closes #7108
• feat(cli)!: remove deprecated commands and the supabase-go binary (#6609) (6b3541d)
• feat(cli)!: remove deprecated config keys, env vars and per-function import maps (CLI-2597) (#7176) (2f60e0b), closes #7154
• feat(cli)!: remove deprecated db pull and domains flags (CLI-2596) (#7116) (8913e85), closes #7115
• feat(cli)!: resolve config values as flags > env > config.toml > defaults (#7074) (eaa5c4f)
• fix(cli)!: stop db advisors --remote minting a login role (CLI-2829) (#7297) (9e84159), closes #7188
• fix(config)!: honor sms enable_confirmations on config push (CLI-2624) (#7221) (fdb5914)
• refactor(cli)!: remove Go CLI naming and framing from code and docs (#7064) (b903db0)

Features

• config: add db.migrations.checks severities and exclusions (CLI-2782, CLI-2783) (#7312) (fdb0e1f)

BREAKING CHANGES

• db advisors --remote no longer connects to the
  database first (matches db query --remote), so it no longer resolves
  database settings, creates a temporary login role or removes network
  bans under --yes
• Commands that can run locally now default to the local
  stack, --remote replaces the target flags, and every hosted mutation
  follows one consent rule.

• db push, db pull, migration fetch, db dump, migration list,
  migration repair, inspect db *, inspect report, gen types and
  storage ls/cp/mv/rm now target the local stack when run without a
  target flag. Add --remote to reach the linked project (supabase db push --remote), --remote=<ref> for another project,
  --remote=<branch> for a branch of the linked project, or
  --remote=<postgres-url> for a database URL. SUPABASE_PROJECT_ID on
  its own no longer selects a hosted project for these commands; it only
  says which project bare --remote means.
• gen types with no target generates from the local database instead
  of opening a project picker or failing. In a linked checkout with no
  local stack running, it suggests --remote. db schema declarative generate no longer asks which target to use. db schema declarative sync with no declarative files generates them from the local database
  and no longer offers the linked project as the source; run supabase db schema declarative generate --remote first to start from the linked
  project.
• --linked, --project-ref, --db-url and gen types --project-id
  are deprecated: they still work and print a warning on stderr naming the
  --remote form. --local does nothing and warns. v4 removes all of
  them, along with db diff's linked (use remote). They no longer
  appear in help.
• --remote=<value> can't be combined with any of the deprecated flags.
  --project-ref on a database command no longer needs --linked. An
  empty --project-ref= is now an error instead of being ignored.
  --password only applies to a hosted target.
• db diff rejects --remote together with --from/--to; use
  --from=remote or --to=remote.
• db query rejects SQL passed both as an argument and with --file.
• Bare --remote (and the deprecated --linked) opens the project
  picker in an interactive terminal when the checkout isn't linked.
  Database and storage commands used to fail.
• --remote <word> after a command that takes an operand fails with a
  "did you mean" error when <word> is, or is close to, a branch name of
  the linked project, when it's shaped like a project ref, or when the
  branch list can't be fetched. Put the operand before --remote
  (supabase db pull add_profiles --remote) or use --remote=<branch>.
• Every hosted mutation now asks for confirmation, and fails with
  HostedMutationConsentRequiredError in non-interactive, JSON,
  stream-json, agent or -o json|yaml|toml|env runs unless --yes (or
  SUPABASE_YES exported in the shell) is set. Commands that newly need
  this for unattended runs:
• db push; db pull when it updates the remote migration history; pull,
  except with --dry-run
  • migration up/down/squash/repair against a hosted target
  • db reset and test db against a hosted target
  • db query against a hosted target (or pass --read-only for reads)
  • seed buckets and storage cp/mv/rm against a hosted target
  • functions deploy/delete; secrets set/unset; config push
  • branches create/delete/disable/pause/unpause/update; backups restore
• encryption update-root-key; network-bans remove; network-restrictions
  update; ssl-enforcement update
  • postgres-config update/delete; sso add/update/remove
  • vanity-subdomains activate/delete; domains create/activate/delete
• notebooks push; projects create/delete; orgs create; bootstrap;
  feedback delete
  • compute push/delete
• A y piped on stdin no longer confirms a hosted mutation.
• The default answer is No for every hosted mutation except projects,
  branches, orgs and domains create, and bootstrap. Pressing Enter now
  declines db push, deploys, secrets changes and migration history
  updates.
• SUPABASE_YES in supabase/.env, or in a .env, .env.local or
  .env.<NODE_ENV>[.local] file in the working directory, no longer
  confirms hosted mutations. When a working-directory file defines it at
  all, a shell-exported SUPABASE_YES doesn't count either, since the CLI
  can't tell the two apart. Use --yes.
• db push, db reset against a hosted target (including seeding), config
  push and functions deploy --prune each ask one combined question instead
  of several. Deploy and prune are confirmed before anything is deployed,
  and --prune now runs even when every function is already up to date.
  secrets unset --all lists the secrets before asking.
• Declining a hosted mutation fails with HostedMutationDeclinedError
  ("context canceled"). The command-specific cancelled error codes are
  removed. Declining db pull or pull aborts before any file is
  written; there's no longer a files-only path.
• Removing network bans automatically, while connecting to a hosted
  database, now needs --yes. Otherwise the command fails and points to
  supabase network-bans remove.
• migration down and migration repair --all on the local database no
  longer prompt.
• Commands that resolve a target print Target: … once on stderr,
  including read-only commands against a hosted project. config push no
  longer prints its own "Pushing config to" line. JSON object results and
  error envelopes gain a target object; db reset's target changes
  from a string to that object, and config push JSON no longer reports
  declined_addons or a skipped status. Arrays and generated artifacts
  are unchanged.
• migration up against a hosted target reports "Remote database is up
  to date." instead of "Local database is up to date.", and migration list labels the history column "Local DB" when the target is local.
• Agents never get a confirmation prompt, even with a terminal attached;
  they need --yes for hosted mutations.

• [auth.sms] enable_confirmations = false, the init
  default, now turns phone confirmation off on the next config push, set
  it to true to keep the phone code and run config diff before pushing
• [inbucket] and [remotes.<name>.inbucket] are
  removed; use [local_smtp]. A non-empty [experimental] orioledb_version is removed; use [db] orioledb_version.
  SUPABASE_EXPERIMENTAL_ORIOLEDB_VERSION is removed; use
  SUPABASE_DB_ORIOLEDB_VERSION. The linkedin and slack auth
  providers are removed; use linkedin_oidc and slack_oidc.
  INBUCKET_URL is removed from status and stack status output and
  --override-name inbucket.url is rejected; use MAILPIT_URL and
  mailpit.url. An import_map.json inside a function directory is no
  longer picked up by functions deploy, functions serve or start;
  rename it to deno.json or set functions.<slug>.import_map.
• supabase secrets unset no longer defaults to yes. The
  prompt defaults to No, and a run that can't prompt (non-TTY stdin,
  non-interactive stdout, or JSON output) now fails unless --yes or
  SUPABASE_YES=1 is set, for named secrets and --all alike. Piped
  stdin answers are no longer read. Running it with no secret names now
  fails instead of unsetting every secret; pass --all to do that. Add
  --yes to unattended secrets unset invocations.
• db pull --use-pg-delta is removed; use
  --declarative. db pull no longer has an --experimental
  structured-dump mode: with --experimental or SUPABASE_EXPERIMENTAL
  set and no --declarative it now exits 1; use --declarative, or
  --experimental=false for a migration pull. --include-raw-output is
  removed from domains create, get, reverify, activate and
  delete; use -o json.
• supabase db remote commit is removed; use supabase db pull. supabase inspect db total-index-size is removed; use
  supabase inspect db index-stats. supabase inspect db total-table-sizes and supabase inspect db table-index-sizes are
  removed; use supabase inspect db table-stats. Each removed command
  exits 1 and prints its replacement.
• Flags and SUPABASE_* environment variables now
  override config, including a matched [remotes.<name>] block. Every
  value resolves in one order: flag > shell environment > project env
  files > config.json/config.toml (a matched remote block over the
  base) > default. Project env files are .env.<SUPABASE_ENV>.local,
  .env.local, .env.<SUPABASE_ENV> and .env, in supabase/ and then
  the project root; SUPABASE_ENV defaults to development.

• If you deploy to a project with a [remotes.*] block, any
  SUPABASE_* variable in the job or in those files now beats the block.
  The CLI warns for each value it overrides. Check env | grep ^SUPABASE_
  in CI and grep -h ^SUPABASE_ supabase/.env* .env* in the repo, and set
  SUPABASE_ENV in CI so .env.development doesn't apply.
• supabase config push now pushes those overrides; for example, a
  SUPABASE_AUTH_SITE_URL in .env.local replaces the value in
  [remotes.production]. Push labels each env-sourced value, and
  supabase config diff shows the same values.
• Seeding a project that matches a [remotes.*] block now asks first,
  unless the block itself sets db.seed.enabled = true. db push --include-seed and db reset --linked exit 1 in CI unless you pass
  --yes. --include-seed and SUPABASE_DB_SEED_ENABLED=true now
  override enabled = false in the base [db.seed] too. db push still
  seeds only with --include-seed.
• --password with --local or --db-url now exits 1 on db push,
  db pull, db dump, db schema declarative generate, migration list
  and migration repair. migration squash targets the local database by
  default, so migration squash -p needs --linked. Put the password in
  the URL, or set [db].password for the local database.
• In a directory linked to project A, SUPABASE_DB_PASSWORD is no
  longer sent to another project (--project-ref B). Pass --password,
  or provide an access token so the CLI can create a temporary login role.
• An invalid value in config or in a SUPABASE_* variable now fails
  every command that loads project config, including db push, stop and
  services (for example SUPABASE_STUDIO_PORT=abc). The error names the
  variable or file and reports CliConfigValueError.
• SUPABASE_EXPERIMENTAL_PGDELTA_ENABLED overrides
  [experimental.pgdelta].enabled, so false selects migra for the run.
  Boolean variables, including SUPABASE_EXPERIMENTAL_STACK, accept 1,
  t, T, true, True, TRUE or 0, f, F, false, False,
  FALSE and fail on anything else.
• supabase db diff --use-pg-delta=false now turns pg-delta off even
  when config or env turns it on.
• supabase gen types --local uses [db].password, not
  SUPABASE_DB_PASSWORD.
• SUPABASE_PROJECT_ID now names local containers even when a remote
  block matches. Without a project_id in config.toml, local containers
  and volumes are named after the project folder, not the project ref. Run
  supabase stop before upgrading, or set project_id.
• Ports with a leading zero (054322) are rejected.
• services and the functions commands read config.json before
  config.toml.
• Without --workdir, the CLI uses the nearest directory with
  supabase/config.toml or supabase/config.json, so a nested
  config.json project now wins over an outer config.toml one.
• inspect report needs [[experimental.inspect.rules]] with string
  fields; a single [experimental.inspect.rules] table now fails.
• supabase link --password is deprecated and ignored.
• Error codes: MigrationPasswordFlagsError is now
  DbPasswordFlagsError; invalid values report CliConfigValueError;
  seeding without consent reports SeedConsentRequiredError.

• COBRA_COMPLETION_DESCRIPTIONS is no longer read; set
  SUPABASE_COMPLETION_DESCRIPTIONS to control shell completion
  descriptions. Error messages that quoted Go library errors are reworded:
  invalid boolean flag values (e.g. sso add --skip-url-validation) now
  say expected a boolean instead of strconv.ParseBool: …; invalid
  unsigned values for storage cp --jobs and db reset --last now say
  expected an unsigned integer (or value out of range) instead of
  strconv.ParseUint: …; oversized migration/seed statements report
  scanner: token too long instead of bufio.Scanner: token too long;
  gen bearer-jwt claim and JWK parse errors now read invalid claims: expected a JSON object, got <kind>, invalid claims: number <n> is out of range, failed to parse JWK: expected a JSON object, got <kind>,
  and invalid JWK field <field>: expected <type>, got <kind> instead of
  json: cannot unmarshal … into Go value/struct field …. Config type
  errors name values by shape: SUPABASE_PROFILE files report expected a YAML mapping at the top level and array/object type names, [db]
  glob entries report TOML type names (local date, offset date-time,
  array, table, …) instead of Go type names, and malformed db lint/db advisors payloads report invalid <field>: expected <shape>
  instead of naming Go types. SUPABASE_PROFILE errors are reworded
  (unknown keys: …, <key> is required, <key> must be an http(s) URL,
  unsupported config file type …, no profile config file specified)
  and multi-line profile errors no longer pad lines with trailing spaces.
  Config decode errors drop the decoding failed due to the following error(s): header and render entries as <key>: expected a string, got <type>, <key>: unknown keys: …, <key>: must be one of …. failed to unmarshal … messages (postgres-config, bootstrap templates, functions
  download) now read failed to parse …, db lint's failed to marshal json: reads failed to parse lint result:, and TOML output errors drop
  the toml: prefix.
• Removed the deprecated commands and flags that still
  ran through the bundled Go binary, and the supabase-go binary itself.
  If your scripts or CI use any of these, switch to the replacement. Each
  removed command or flag now exits with code 1 and prints its
  replacement.

• supabase db remote changes → supabase db diff --linked
• supabase gen keys → supabase projects api-keys --project-ref <ref>
• supabase db diff --use-pg-schema → omit the flag to use the default
  engine, or pass --use-pg-delta
• supabase functions download --legacy-bundle → supabase functions download --use-api. If that also fails and the Function was deployed
  with a CLI older than 1.120.0, redeploy it with the current CLI first.
• supabase db branch create, delete, list and switch → removed
  with no local replacement. Hosted preview branches are managed with
  supabase branches.
• --create-ticket (global flag) → removed. Report CLI problems with
  supabase issue bug.
• supabase-go → no longer installed. Call supabase instead.