[supabase-py-releaser]

🤖 I have created a release beep boop

2.34.0 (2026-11-03)

Features

• drop support for python 3.9 and 3.10 (#1915) (37786ed)
• examples: add FastAPI Realtime Rule Engine example (#1519) (6449e1e)
• postgrest: add client-level retry toggle (#1900) (e1916b5), closes #1561
• postgrest: add strip_nulls() (#1760) (c86ec9f)
• realtime: add explicit REST API call for broadcast (#1256) (deec947)

Bug Fixes

• auth: accept oauth clients without a name (#1830) (936458e)
• auth: accept pending secure email confirmations (#1845) (1e0c262)
• auth: avoid cancelling the running refresh callback (#1716) (606e0ac)
• auth: copy query_params in link_identity (#1879) (36e9952)
• auth: emit PASSWORD_RECOVERY from verify_otp (#1743) (b571cc2)
• auth: emit SIGNED_IN when set_session keeps a valid token (#1749) (9c092db)
• auth: handle empty OAuth client lists (#1736) (7d68e6b)
• auth: keep existing session in sign-up and sign-in methods (#1935) (c3fa0f1)
• auth: keep existing session when verify_otp does not return one (#1933) (cae942d)
• auth: keep expired session in initialize_from_storage when auto refresh is off (#1938) (1436832)
• auth: keep or clear the session by scope when sign out fails (#1824) (de9932e)
• auth: make code_verifier optional in CodeExchangeParams (#1922) (0b1d490)
• auth: map httpx transport errors to AuthRetryableError (#1808) (901f00d)
• auth: normalize trailing slash in base URL (#1766) (de040ec)
• auth: preserve phone numbers in MFA factor responses (#1837) (0e1cf4c)
• auth: preserve the PKCE recovery event (#1906) (cd0c4a3)
• auth: preserve the server error message on retryable 5xx responses (#1833) (c1727d5)
• auth: raise AuthInvalidJwtError for malformed JWTs in get_claims (#1871) (1aa8090)
• auth: raise AuthInvalidJwtError for malformed tokens in set_session (#1920) (301ce7d)
• auth: read implicit grant params from the url fragment (#1923) (de2c6fc)
• auth: require pyjwt>=2.15.1 for security fixes (#1820) (f41e80e)
• auth: send one refresh request per auto-refresh tick (#1854) (bc29bc6)
• auth: send PKCE challenges for email and SSO flows (#1682) (66cd7ee)
• auth: stop the admin API from sharing the client's header dict (#1645) (6b53131)
• auth: use inspect.iscoroutinefunction in Timer (#1875) (4d5d430)
• auth: validate session and mfa enroll response after field validation (#1904) (0310467)
• functions: drop the apiKey header on cross host redirects (#1885) (268557a)
• functions: keep the query string when invoking a function (#1816) (685469c)
• make the capability matrix verifiable (#1867) (804e7e2)
• postgrest: accept generated typeddict types in insert, upsert and update (#1939) (1ae57b8)
• postgrest: apply normalized timeout to internal httpx clients (#1758) (774e996)
• postgrest: clear basic auth when selecting bearer auth (#1713) (32e748b)
• postgrest: describe non-JSON error responses with the decoded body and a string code (#1912) (dd75df1)
• postgrest: drop pydantic v1 compat layer and align pydantic floor (#1902) (8ddd531)
• postgrest: escape quotes and backslashes in bulk column names (#1948) (7bebdeb)
• postgrest: json-encode dictionary rpc arguments in get and head requests (#1899) (86da454), closes #1847
• postgrest: keep the http client and basic auth in schema() (#1672) (c4e440c)
• postgrest: make APIError fields optional so partial error bodies keep their message (#1732) (18bd628)
• postgrest: omit columns for empty bulk inserts and upserts (#1815) (62a4e4d)
• postgrest: preserve chaining after text search (#1708) (9588283)
• postgrest: preserve injected HTTPX client authentication (#1838) (79d14d9)
• postgrest: quote rpc array elements sent on GET and HEAD (#1762) (1bb870e)
• postgrest: raise on a non-http base_url (#1881) (610875d)
• postgrest: read the Proxy-Status error code when an error response has no body (#1621) (34227d1)
• postgrest: replace conflicting max-affected preferences (#1827) (5f989e1)
• postgrest: retry GET and HEAD requests on network errors (#1777) (1113f40)
• postgrest: return no count when the total is unknown (#1892) (3c21359)
• postgrest: send rpc list args as array literals on GET and HEAD (#1752) (50e7a4c)
• postgrest: serialize null and booleans in in_() like other filters (#1863) (2cc0e03)
• preserve functions timeout when replacing client options (#1722) (7fac036)
• realtime: accept postgres change error arrays (#1908) (9c59f9a)
• realtime: call late timeout handlers without a payload (#1831) (b6ddb74)
• realtime: cap reconnect backoff at 60 seconds (#1768) (23ddbca)
• realtime: default postgres_changes schema to public (#1884) (a6e562d)
• realtime: deliver every broadcast to "*" listeners, ignoring case (#1818) (eae2838)
• realtime: deprecate channel.join() and route it through subscribe (#1928) (8ac936c)
• realtime: honor the WebSocket opening timeout (#1839) (46efa11)
• realtime: keep postgres bindings and report mismatches on join replies (#1929) (cfb2159)
• realtime: keep references to background tasks (#1888) (f959593)
• realtime: keep the replacement channel when the old one closes (#1877) (af1d15d)
• realtime: notify subscribers of channel errors and closure (#1846) (bcecfc3)
• realtime: reconnect when the server closes the socket normally (#1675) (4dafafd)
• realtime: redact api key and access tokens from debug logs (#1750) (17147f2)
• realtime: rejoin channels on the stepped schedule (#1916) (db14ec5)
• realtime: rejoin the channel after a presence callback is added while joined (#1686) (697170c)
• realtime: report CHANNEL_ERROR to subscribers when the connection drops (#1897) (a00d1aa)
• realtime: restart timeout after resending push (#1654) (da3a353)
• realtime: serialize initial websocket handshakes (#1853) (c5150d6)
• realtime: use the client timeout for join and leave pushes (#1685) (198396d)
• realtime: wait for the join reply in subscribe (#1940) (c725015)
• storage: accept field names in MetadataConfiguration (#1921) (e0b5716)
• storage: allow null metadata in list_v2 (#1804) (9d2f19c)
• storage: close the upload handle we opened, and only that one (#1607) (2f3bf40)
• storage: install the iceberg file backend (#1873) (b2cbf04)
• storage: let upload headers override the client's headers (#1942) (09855c3)
• storage: merge a partial sortBy with the default in list (#1817) (3fb5620)
• storage: parse analytics bucket error responses (#1894) (c5d0149)
• storage: read object info in exists() so auth and bucket errors raise (#1825) (980ac9f)
• storage: require topK in vector index query (#1946) (a60e0d2)
• storage: stop create_client from emitting the timeout deprecation warning (#1919) (3349ad8)
• supabase: keep postgrest and storage timeouts in replace() (#1809) (795cad4)
• supabase: keep the session token on every auth event that has one (#1856) (ca2fb99)
• supabase: reject non-string url and key in create_client (#1926) (030cbc9)
• supabase: replace() preserves postgrest and storage timeouts (#1840) (772ee24)

Performance Improvements

• postgrest: speed up JSON parsing by 22x using json.loads (#1571) (c56c5bb)

Documentation

• add support policy (#1917) (f1392d4)
• Clarify when get_user() returns None (#1569) (3d8417f)
• document SDK compatibility with Supabase services (#1870) (1ff1e4a)

---

This PR was generated with Release Please. See documentation.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: supabase/supabase-py
• Branch: main
• File: .coderabbit.yaml
• Commit: 7bebdeb
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 31022173-752e-44f8-8dc0-6ef34d988f9a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

[supabase-py-releaser]

🤖 Created releases:

• v2.34.0

🌻