[{"data":1,"prerenderedAt":89},["ShallowReactive",2],{"Xz4PssgzrV":3,"related-supabase-notes/weekly-roundup-2026-10-02":27},{"id":4,"slug":5,"title":6,"excerpt":7,"meta_title":8,"meta_description":9,"page_content":10,"featured_image":18,"fields":19,"tags":21,"published":25,"published_at":26,"created_at":26,"updated_at":26},"4b57ca81-a3e2-4785-a023-dcbdf8c077d5","notes/weekly-roundup-2026-10-02","Weekly round-up: Postgres security release, OrioleDB beta, and Supabase Middleware 1.0","Supabase's Postgres security release with four breaking changes, OrioleDB in public beta, Supabase Middleware 1.0, and a note on WordPress 7.1.2.","Weekly Round-Up: Postgres Release, OrioleDB Beta","This week: Supabase's Postgres 17.11 security release and its four breaking changes, OrioleDB public beta, and Supabase Middleware 1.0.",{"blocks":11},[12],{"id":13,"data":14,"type":17},"e561457e-c545-404b-bc84-5a6f7adc1b2d",{"content":15,"maxWidth":16},"\u003Cp>Three things worth knowing this week, and one of them is a database change you may need to act on if you run Postgres, with or without Supabase.\u003C/p>\u003Ch2>Supabase ships a Postgres security release with four breaking changes\u003C/h2>\u003Cp>On 25 September \u003Ca href=\"/supabase\">Supabase\u003C/a> announced a minor release, Postgres 15.19 and 17.11, closing 44 CVEs. Security releases are normally a shrug. This one isn't, because Supabase's changelog lists four changes that may need work on your side.\u003C/p>\u003Cul>\u003Cli>\u003Cstrong>ltree indexes.\u003C/strong> A case-folding fix affects multibyte and ICU databases, and an overflow fix covers very deep ltree values. Affected indexes need reindexing, and Supabase provides detection queries.\u003C/li>\u003Cli>\u003Cstrong>pgcrypto legacy ciphers (CVE-2026-14663).\u003C/strong> Data encrypted with blowfish, bf or cast5 was effectively stored unencrypted. After the upgrade those values fail to decrypt by default, so scan for affected rows and re-encrypt with something modern like AES.\u003C/li>\u003Cli>\u003Cstrong>btree_gist on float columns.\u003C/strong> Indexes holding NaN values built under earlier versions can return wrong results until reindexed.\u003C/li>\u003Cli>\u003Cstrong>Custom operators (CVE-2026-2004).\u003C/strong> Only superusers can now attach non-built-in selectivity estimators. Existing operators keep working, but recreating one needs superuser rights.\u003C/li>\u003C/ul>\u003Cp>The pgcrypto one is the uncomfortable one. If you used those ciphers, the issue is that your data was never as protected as you thought, and the upgrade just makes that visible. Run the scan before the upgrade lands on your project, not after.\u003C/p>\u003Ch2>OrioleDB goes to public beta\u003C/h2>\u003Cp>On 1 October Supabase put OrioleDB into public beta. It's an alternative storage engine for Postgres that swaps the default heap. Transactions use 64-bit IDs so wraparound goes away, and dead rows move to an undo log, so you stop depending on VACUUM to reclaim them. Supabase quotes 1.8x higher throughput than heap storage in benchmarks, which is their number, so test it against your own workload. The caveats matter more than the headline: no point-in-time recovery, no restoring backups into a new project, and pgvector HNSW indexes run through an experimental bridge. For a client site I wouldn't touch it yet. For a side project with a heavy write load, it's worth an afternoon.\u003C/p>\u003Ch2>Supabase Middleware 1.0\u003C/h2>\u003Cp>On 30 September the \u003Ccode>@supabase/middleware\u003C/code> package hit 1.0. It's a small MIT-licensed engine for per-request logic, built on Web Fetch handlers, so the same code runs in Supabase Edge Functions, Vercel, Cloudflare Workers and Node 22 and up. I like the direction. Less framework-specific glue is good for anyone who has been bitten by a platform move.\u003C/p>\u003Ch2>WordPress 7.1.2, briefly\u003C/h2>\u003Cp>WordPress shipped 7.1.2 on 22 September for a critical vulnerability in page template resolution that could allow remote code execution under certain conditions. It auto-updates where background updates are on. I don't build on WordPress here, but plenty of the sites I get asked to migrate started life on it. If you need plain WordPress hosting and security sorted, \u003Ca href=\"https://pwadeveloper.uk\">pwadeveloper.uk\u003C/a> covers it properly.\u003C/p>\u003Ch2>What went up here recently\u003C/h2>\u003Cp>Last Friday's piece asked whether \u003Ca href=\"/notes/is-claude-ai-good-for-small-business\">Claude is actually good for a small business\u003C/a>, and the \u003Ca href=\"/notes/weekly-roundup-2026-09-25\">round-up before this one\u003C/a> has the Nuxt 4.5 notes if you missed them. A piece on the exposed Supabase databases story goes up this morning, and next Friday it's Claude against ChatGPT for a small business.\u003C/p>\u003Cp>That's the round-up. If you want a second opinion on a Supabase setup or a migration, \u003Ca href=\"/contact\">get in touch\u003C/a>.\u003C/p>","lg","wysiwyg","",{"author":20},"Headless Digital",[22,23,24],"roundup","supabase","wordpress",true,"2026-10-02T07:13:16.097003+00:00",[28,39,50,53,67,78],{"id":29,"slug":30,"title":31,"excerpt":32,"meta_title":33,"meta_description":34,"featured_image":18,"fields":35,"tags":36,"published":25,"published_at":38,"created_at":38,"updated_at":38},"3fa30c75-b63a-4414-8078-bf9a57b7eb3c","notes/weekly-roundup-2026-10-16","Weekly round-up: Magento APSB26-153 and a Supabase TLS deadline","Adobe's APSB26-153 has five critical Magento fixes, Supabase disables old TLS 1.2 ciphers on 10 November, and the .NET SDK grows up.","Weekly Round-Up: Magento APSB26-153, Supabase TLS","This week: Magento APSB26-153 with five critical fixes, Supabase disabling old TLS 1.2 ciphers on 10 November, and .NET SDK updates.",{"author":20},[22,37,23],"magento","2026-10-16T07:14:57.117895+00:00",{"id":40,"slug":41,"title":42,"excerpt":43,"meta_title":44,"meta_description":45,"featured_image":18,"fields":46,"tags":47,"published":25,"published_at":49,"created_at":49,"updated_at":49},"cdfe1566-04cc-4260-96ab-1f2d0bf327d7","notes/weekly-roundup-2026-10-09","Weekly round-up: Nuxt 4.6, scoped Supabase tokens, and a December deadline","Nuxt 4.6 and the end of Nuxt 3, scoped Supabase personal access tokens, the 1 December adapter removal, and WordPress 7.1.3.","Weekly Round-Up: Nuxt 4.6, Supabase Scoped Tokens","This week: Nuxt 4.6 and Nuxt 3 end of life, scoped Supabase access tokens, a 1 December deprecation date, and WordPress 7.1.3.",{"author":20},[22,23,48],"nuxt","2026-10-09T07:14:08.209884+00:00",{"id":4,"slug":5,"title":6,"excerpt":7,"meta_title":8,"meta_description":9,"featured_image":18,"fields":51,"tags":52,"published":25,"published_at":26,"created_at":26,"updated_at":26},{"author":20},[22,23,24],{"id":54,"slug":55,"title":56,"excerpt":57,"meta_title":58,"meta_description":59,"featured_image":18,"fields":60,"tags":62,"published":25,"published_at":64,"created_at":65,"updated_at":66},"fd7b0e56-d3d2-4824-a2ce-2948a6ecfa7d","notes/why-16000-supabase-databases-were-left-exposed","16,326 Supabase Databases Were Left Exposed. Here's Why","UpGuard found over 16,000 public Supabase databases leaking real personal data this week. The cause traces back to one setting, and it's worth checking on your own project.","16,000 Exposed Supabase Databases: What Happened","UpGuard found 16,326 public Supabase databases leaking real data this week. The cause was one setting. Here's what to check on your own project.",{"author":61},"Adam Jackson",[23,63],"ai","2026-10-02T08:00:00+00:00","2026-09-27T07:18:05.689274+00:00","2026-10-02T08:00:01.68075+00:00",{"id":68,"slug":69,"title":70,"excerpt":71,"meta_title":72,"meta_description":73,"featured_image":18,"fields":74,"tags":75,"published":25,"published_at":76,"created_at":76,"updated_at":77},"d75fb417-2460-4469-b103-4e062f46d229","notes/weekly-roundup-2026-09-25","Weekly round-up: a critical WordPress RCE, Nuxt's build layer swap, and Claude gets serious about small business","A critical WordPress RCE worth patching today, Nuxt 4.5's build layer swap, Claude for Small Business grows up, and a quick look at this month's Supabase changelog.","Weekly Round-Up: WordPress RCE, Nuxt 4.5, Claude for SMBs","This week: a critical WordPress RCE worth patching today, Nuxt 4.5's new build layer, Claude for Small Business grows up, and a Supabase changelog look.",{"author":61},[22,24,48,63,23],"2026-09-25T07:19:43.316037+00:00","2026-10-01T19:41:42.773395+00:00",{"id":79,"slug":80,"title":81,"excerpt":82,"meta_title":83,"meta_description":84,"featured_image":18,"fields":85,"tags":86,"published":25,"published_at":87,"created_at":88,"updated_at":77},"37675193-0337-4634-bafa-c503df69b0c6","notes/weekly-roundup-2026-09-18","Weekly round-up: StyleSmuggler clean-up, a Supabase deadline, and the Claude Code limits shuffle","A week on from the Magento zero day, the mopping-up is where the real work is. Plus a Supabase logs endpoint being removed on 23 September, and the Claude Code limits change that is both a rise and a cut.","Round-up: StyleSmuggler clean-up and a Supabase deadline","The week after the Magento zero day: patching is the easy part, Supabase removes logs.all on 23 September, and Claude Code's limits moved.",{"author":61},[22,37,23,63],"2026-09-19T06:13:53.415+00:00","2026-09-18T06:10:00+00:00",1792137657142]