Three things worth knowing this week, and one of them is a database change you may need to act on if you run Postgres, with or without Supabase.

Supabase ships a Postgres security release with four breaking changes

On 25 September Supabase announced a minor release, Postgres 15.19 and 17.11, closing 44 CVEs. Security releases are normally a shrug. This one isn't, because Supabase's changelog lists four changes that may need work on your side.

• ltree indexes. A case-folding fix affects multibyte and ICU databases, and an overflow fix covers very deep ltree values. Affected indexes need reindexing, and Supabase provides detection queries.
• pgcrypto legacy ciphers (CVE-2026-14663). Data encrypted with blowfish, bf or cast5 was effectively stored unencrypted. After the upgrade those values fail to decrypt by default, so scan for affected rows and re-encrypt with something modern like AES.
• btree_gist on float columns. Indexes holding NaN values built under earlier versions can return wrong results until reindexed.
• Custom operators (CVE-2026-2004). Only superusers can now attach non-built-in selectivity estimators. Existing operators keep working, but recreating one needs superuser rights.

The pgcrypto one is the uncomfortable one. If you used those ciphers, the issue is that your data was never as protected as you thought, and the upgrade just makes that visible. Run the scan before the upgrade lands on your project, not after.

OrioleDB goes to public beta

On 1 October Supabase put OrioleDB into public beta. It's an alternative storage engine for Postgres that swaps the default heap. Transactions use 64-bit IDs so wraparound goes away, and dead rows move to an undo log, so you stop depending on VACUUM to reclaim them. Supabase quotes 1.8x higher throughput than heap storage in benchmarks, which is their number, so test it against your own workload. The caveats matter more than the headline: no point-in-time recovery, no restoring backups into a new project, and pgvector HNSW indexes run through an experimental bridge. For a client site I wouldn't touch it yet. For a side project with a heavy write load, it's worth an afternoon.

Supabase Middleware 1.0

On 30 September the @supabase/middleware package hit 1.0. It's a small MIT-licensed engine for per-request logic, built on Web Fetch handlers, so the same code runs in Supabase Edge Functions, Vercel, Cloudflare Workers and Node 22 and up. I like the direction. Less framework-specific glue is good for anyone who has been bitten by a platform move.

WordPress 7.1.2, briefly

WordPress shipped 7.1.2 on 22 September for a critical vulnerability in page template resolution that could allow remote code execution under certain conditions. It auto-updates where background updates are on. I don't build on WordPress here, but plenty of the sites I get asked to migrate started life on it. If you need plain WordPress hosting and security sorted, pwadeveloper.uk covers it properly.

What went up here recently

Last Friday's piece asked whether Claude is actually good for a small business, and the round-up before this one has the Nuxt 4.5 notes if you missed them. A piece on the exposed Supabase databases story goes up this morning, and next Friday it's Claude against ChatGPT for a small business.

That's the round-up. If you want a second opinion on a Supabase setup or a migration, get in touch.