Bump tar and supabase

[dependabot]

Bumps tar to 7.5.22 and updates ancestor dependency supabase. These dependencies need to be updated together.

Updates tar from 7.4.3 to 7.5.22

Changelog

Sourced from tar's changelog.

Changelog

7.5

• Added zstd compression support.
• Consistent TOCTOU behavior in sync t.list
• Only read from ustar block if not specified in Pax
• Fix sync tar.list when file size reduces while reading
• Sanitize absolute linkpaths properly
• Prevent writing hardlink entries to the archive ahead of their file target

7.4

• Deprecate onentry in favor of onReadEntry for clarity.

7.3

• Add onWriteEntry option

7.2

• DRY the command definitions into a single makeCommand method, and update the type signatures to more appropriately infer the return type from the options and arguments provided.

7.1

• Update minipass to v7.1.0
• Update the type definitions of write() and end() methods on Unpack and Parser classes to be compatible with the NodeJS.WritableStream type in the latest versions of @types/node.

7.0

• Drop support for node <18
• Rewrite in TypeScript, provide ESM and CommonJS hybrid interface
• Add tree-shake friendly exports, like import('tar/create') and import('tar/read-entry') to get individual functions or classes.
• Add chmod option that defaults to false, and deprecate noChmod. That is, reverse the default option regarding explicitly setting file system modes to match tar entry settings.
• Add processUmask option to avoid having to call process.umask() when chmod: true (or noChmod: false) is set.

... (truncated)

Commits

• 2a22bfc 7.5.22
• df1cd8d Allow transform to be falsey
• 0cd9cc3 7.5.21
• 631ae59 list: prevent unbounded recursion
• ebbb720 7.5.20
• 2f27196 fix: fully disable and dispose of unzip when aborting parser
• be440da 7.5.19
• 2812e93 add maxDecompressionRatio guard against explosive decompression
• 9ecd4d2 7.5.18
• 9e78bf0 refuse to let header size be less than 0
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for tar since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates supabase from 1.226.4 to 2.109.1

Release notes

Sourced from supabase's releases.

v2.109.1

Supabase CLI v2.109.1 — 2026-07-07

This patch release includes bug fixes for database and sync operations, improvements to error messaging, and corrections to flag handling.

Bug fixes

• db pull no longer hangs in non-interactive mode — fixed hang when using db pull without interactive prompts. (#5725)
• CSV flag parsing for sso and postgres-config — flags now correctly split multiple values. (#5764)
• Function deploy path resolution — fixed path handling in function deployments. (#5755)
• db diff respects schema order — schema_paths order is now maintained in diff output. (#5706)
• db unban-ip validation — project ref resolution now works correctly. (#5769)
• Declarative sync hanging — fixed hang when edge-runtime container exits. (#5714)
• Query command output formatting — fixed output formatting issues. (#5763)
• Eszip bundling errors — improved error handling. (#5747)

Improvements

• Error messages guide flag placement — the CLI suggests correct subcommand placement when flags are misplaced. (#5751)
• Shell completion customization — --no-descriptions flag suppresses descriptions in shell completions. (#5771)
• Non-TypeScript type generation — gen types now works for JavaScript and other languages. (#5622)
• Custom image registry support — gen types respects the SUPABASE_INTERNAL_IMAGE_REGISTRY env var. (#5786)
• Status command power-user flags — hidden --exclude and --ignore-health-check flags for advanced usage. (#5770)

TypeScript port progress

• db pull — ported to use PostgreSQL's native pg_dump for faster, more reliable snapshots. Behavior matches the Go CLI. (#5725)

---

Plus internal improvements including service version alignment and experimental feature gating enhancements, plus dependency and Docker image updates.

Full changelog: supabase/cli@v2.109.0...v2.109.1

v2.109.1-beta.22

2.109.1-beta.22 (2026-07-07)

Bug Fixes

• docker: bump supabase/postgres from 17.6.1.142 to 17.6.1.143 in /apps/cli-go/pkg/config/templates (#5807) (6d4c198)
• docker: bump the docker-minor group in /apps/cli-go/pkg/config/templates with 3 updates (#5806) (1cbf45a)

v2.109.1-beta.21

2.109.1-beta.21 (2026-07-07)

Bug Fixes

• deps: bump github.com/posthog/posthog-go from 1.16.2 to 1.17.2 in /apps/cli-go in the go-minor group across 1 directory (#5805) (60c2d17)

... (truncated)

Changelog

Sourced from supabase's changelog.

Release Process

This document is the operational playbook for releasing the Supabase CLI TypeScript build. It covers three environments ("rings"):

1. Ring 1 — Local Verdaccio. Fastest feedback loop. Build and install the CLI from a local npm registry on your own machine. No network side-effects; no repo pushes.
2. Ring 2 — User-owned PoC repos. End-to-end validation through the exact same Homebrew / Scoop / GitHub-Release code paths production uses, but pointed at a reviewer's own GitHub account and a non-supabase artifact name. This is how ADR 0011 gates 2 and 3 are validated without risking the real production channels.
3. Ring 3 — Production. The real supabase npm package + supabase/homebrew-tap + supabase/scoop-bucket + GitHub Releases on supabase/cli. Driven by GitHub Actions (release.yml, which dispatches three channels — alpha, beta, stable — into the shared release-shared.yml).

flowchart LR
    local["Ring 1: Local Verdaccio<br/>pnpm cli-release<br/>--next or --legacy"]
    poc["Ring 2: User-owned PoC repos<br/>avallete/supabase-cli-release-poc<br/>avallete/homebrew-supabase-shim-poc<br/>avallete/scoop-bucket<br/>--name supabase-shim-poc"]
    prod["Ring 3: Production<br/>supabase/cli<br/>supabase/homebrew-tap<br/>supabase/scoop-bucket<br/>(default name: supabase)"]
local --&gt; poc --&gt; prod

Loading

Move outward one ring at a time. Only promote to production after Ring 2 has exercised the full channel end-to-end on a fresh machine.

See ADR 0011 for the decision record behind this process (why Bun SFE, why npm optionalDependencies, why nfpm, why no hosted apt/rpm repo, why unsigned).

---

Ring 1 — Local Verdaccio

Use this loop while iterating on build scripts, the Node shim, or anything that changes what gets packed into supabase or @supabase/cli-<platform>. It installs the CLI into a local npm registry and lets you npx --registry http://localhost:4873 supabase as if you'd installed from npm.

Start the registry in one terminal:

pnpm local-registry

Publish the CLI into it from another terminal (current platform only, faster than a cross-platform build):

# TS-native shell only ("next"):
pnpm cli-release --next
Legacy shell (TS shim + Go sidecar — requires Go on PATH and pnpm repos:install):
pnpm cli-release --legacy

Test it:

npx --registry http://localhost:4873 supabase@<printed-version> --version

[tools/release/local-release.ts](https://github.com/supabase/cli/blob/develop/tools/release/local-release.ts) does the heavy lifting: it builds the platform SFE (+ Go binary for --legacy) and the umbrella supabase package, materialises them in a tmp dir (so no workspace package.json is modified), and publishes both to Verdaccio. The cleanup is automatic even on failure.

... (truncated)

Commits

• 2b8eeea fix(deps): bump the npm-major group with 8 updates (#5808)
• 1439680 fix(cli): honor SUPABASE_INTERNAL_IMAGE_REGISTRY in gen types (#5786)
• 28b17f6 fix(cli): add hidden --exclude and --ignore-health-check flags to status (#5770)
• f28efed fix(cli): run --experimental gate before storage's mutex check (#5768)
• 4efa0df fix(cli): add --no-descriptions flag to completion subcommands (#5771)
• c62b558 fix(cli): resolve network-bans project ref before validating --db-unban-ip (#...
• 28cc844 fix(cli): wire --experimental gate into 7 ungated native leaves (#5766)
• 31d6fb9 fix(cli): generate non-TypeScript types from project refs (#5622)
• 5a0e4a9 fix(deps): bump the npm-major group with 3 updates (#5782)
• 9bb97be fix(db): respect schema_paths order in diff (#5706)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for supabase since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
connectedkw	Ready	Preview, Comment	Jul 26, 2026 4:17am