Skip to content

fix(auth): revert fix(auth): encode client-id in oauth requests (#2383) - #2417

Merged
mandarini merged 1 commit into
masterfrom
revert/url-encode
Jun 2, 2026
Merged

fix(auth): revert fix(auth): encode client-id in oauth requests (#2383)#2417
mandarini merged 1 commit into
masterfrom
revert/url-encode

Conversation

@mandarini

@mandarini mandarini commented Jun 2, 2026

Copy link
Copy Markdown
Contributor

This reverts commit 3944b82. (PR #2383)

That commit introduced breaking changes that caused issues to some users.

@mandarini
mandarini requested review from a team as code owners June 2, 2026 06:57
@github-actions github-actions Bot added the auth-js Related to the auth-js library. label Jun 2, 2026
@mandarini mandarini changed the title fix(auth): revert "fix(auth): encode client-id in oauth requests (#2383) fix(auth): revert fix(auth): encode client-id in oauth requests (#2383) Jun 2, 2026
@pkg-pr-new

pkg-pr-new Bot commented Jun 2, 2026

Copy link
Copy Markdown

Open in StackBlitz

@supabase/auth-js

npm i https://pkg.pr.new/@supabase/auth-js@2417

@supabase/functions-js

npm i https://pkg.pr.new/@supabase/functions-js@2417

@supabase/postgrest-js

npm i https://pkg.pr.new/@supabase/postgrest-js@2417

@supabase/realtime-js

npm i https://pkg.pr.new/@supabase/realtime-js@2417

@supabase/storage-js

npm i https://pkg.pr.new/@supabase/storage-js@2417

@supabase/supabase-js

npm i https://pkg.pr.new/@supabase/supabase-js@2417

commit: 94349d2

Comment thread packages/core/auth-js/src/GoTrueAdminApi.ts
@mandarini
mandarini merged commit d20695f into master Jun 2, 2026
25 checks passed
@mandarini
mandarini deleted the revert/url-encode branch June 2, 2026 07:23
mandarini pushed a commit to supabase/supabase that referenced this pull request Jun 2, 2026
This PR updates @supabase/*-js libraries to version 2.107.0.

**Source**: manual

**Changes**:
- Updated @supabase/supabase-js to 2.107.0
- Updated @supabase/auth-js to 2.107.0
- Updated @supabase/realtime-js to 2.107.0
- Updated @supabase/postgest-js to 2.107.0
- Refreshed pnpm-lock.yaml

---

## Release Notes

## v2.107.0

## 2.107.0 (2026-06-02)

### 🚀 Features

- **auth:** remove navigator.locks-based mutex; introduce commit guard +
dispose() ([#2392](supabase/supabase-js#2392))
- **realtime:** allow httpSend to send binary payload
([#2400](supabase/supabase-js#2400))
- **supabase:** update X-Client-Info to structured metadata format
([#2359](supabase/supabase-js#2359))

### 🩹 Fixes

- **auth:** return AuthInvalidJwtError from getClaims for expired JWT
([#2395](supabase/supabase-js#2395))
- **auth:** recognize ?error= redirects in implicit grant gate
([#2407](supabase/supabase-js#2407))
- **auth): revert fix(auth:** encode client-id in oauth requests
([#2383](supabase/supabase-js#2383),
[#2417](supabase/supabase-js#2417))
- **postgrest:** return a structured error for non-JSON body on
successful responses
([#2398](supabase/supabase-js#2398))
- **release:** pin workspace:* sibling deps before JSR publish
([#2418](supabase/supabase-js#2418))
- **release:** publish gotrue-js legacy mirror via pnpm
([#2419](supabase/supabase-js#2419))

### ❤️ Thank You

- Claude Opus 4.7 (1M context)
- Claude Sonnet 4.6
- Eduardo Gurgel
- Guilherme Souza
- Katerina Skroumpelou @mandarini
- Omar Al Matar @Bewinxed
- youcef zr @youcefzemmar
- youcefzemmar

This PR was created automatically.

Co-authored-by: supabase-workflow-trigger[bot] <266661614+supabase-workflow-trigger[bot]@users.noreply.github.com>
imor pushed a commit to supabase/supabase that referenced this pull request Jun 3, 2026
This PR updates @supabase/*-js libraries to version 2.107.0.

**Source**: manual

**Changes**:
- Updated @supabase/supabase-js to 2.107.0
- Updated @supabase/auth-js to 2.107.0
- Updated @supabase/realtime-js to 2.107.0
- Updated @supabase/postgest-js to 2.107.0
- Refreshed pnpm-lock.yaml

---

## Release Notes

## v2.107.0

## 2.107.0 (2026-06-02)

### 🚀 Features

- **auth:** remove navigator.locks-based mutex; introduce commit guard +
dispose() ([#2392](supabase/supabase-js#2392))
- **realtime:** allow httpSend to send binary payload
([#2400](supabase/supabase-js#2400))
- **supabase:** update X-Client-Info to structured metadata format
([#2359](supabase/supabase-js#2359))

### 🩹 Fixes

- **auth:** return AuthInvalidJwtError from getClaims for expired JWT
([#2395](supabase/supabase-js#2395))
- **auth:** recognize ?error= redirects in implicit grant gate
([#2407](supabase/supabase-js#2407))
- **auth): revert fix(auth:** encode client-id in oauth requests
([#2383](supabase/supabase-js#2383),
[#2417](supabase/supabase-js#2417))
- **postgrest:** return a structured error for non-JSON body on
successful responses
([#2398](supabase/supabase-js#2398))
- **release:** pin workspace:* sibling deps before JSR publish
([#2418](supabase/supabase-js#2418))
- **release:** publish gotrue-js legacy mirror via pnpm
([#2419](supabase/supabase-js#2419))

### ❤️ Thank You

- Claude Opus 4.7 (1M context)
- Claude Sonnet 4.6
- Eduardo Gurgel
- Guilherme Souza
- Katerina Skroumpelou @mandarini
- Omar Al Matar @Bewinxed
- youcef zr @youcefzemmar
- youcefzemmar

This PR was created automatically.

Co-authored-by: supabase-workflow-trigger[bot] <266661614+supabase-workflow-trigger[bot]@users.noreply.github.com>
mandarini pushed a commit to supabase/ssr that referenced this pull request Jun 3, 2026
This PR updates `@supabase/supabase-js` to v2.107.0.

**Source**: manual

---

## Release Notes

## v2.107.0

## 2.107.0 (2026-06-02)

### 🚀 Features

- **auth:** remove navigator.locks-based mutex; introduce commit guard +
dispose() ([#2392](supabase/supabase-js#2392))
- **realtime:** allow httpSend to send binary payload
([#2400](supabase/supabase-js#2400))
- **supabase:** update X-Client-Info to structured metadata format
([#2359](supabase/supabase-js#2359))

### 🩹 Fixes

- **auth:** return AuthInvalidJwtError from getClaims for expired JWT
([#2395](supabase/supabase-js#2395))
- **auth:** recognize ?error= redirects in implicit grant gate
([#2407](supabase/supabase-js#2407))
- **auth): revert fix(auth:** encode client-id in oauth requests
([#2383](supabase/supabase-js#2383),
[#2417](supabase/supabase-js#2417))
- **postgrest:** return a structured error for non-JSON body on
successful responses
([#2398](supabase/supabase-js#2398))
- **release:** pin workspace:* sibling deps before JSR publish
([#2418](supabase/supabase-js#2418))
- **release:** publish gotrue-js legacy mirror via pnpm
([#2419](supabase/supabase-js#2419))

### ❤️ Thank You

- Claude Opus 4.7 (1M context)
- Claude Sonnet 4.6
- Eduardo Gurgel
- Guilherme Souza
- Katerina Skroumpelou @mandarini
- Omar Al Matar @Bewinxed
- youcef zr @youcefzemmar
- youcefzemmar
## v2.106.2

## 2.106.2 (2026-05-25)

### 🩹 Fixes

- **auth:** restore signup user response
([#2391](supabase/supabase-js#2391))
- **misc:** add react-native export condition for Hermes-safe resolution
([#2393](supabase/supabase-js#2393))

### ❤️ Thank You

- Myroslav Hryhschenko @BLOCKMATERIAL
- Vaibhav @7ttp

This PR was created automatically.

Co-authored-by: supabase-workflow-trigger[bot] <266661614+supabase-workflow-trigger[bot]@users.noreply.github.com>
sickn33 added a commit to sickn33/agentic-awesome-skills that referenced this pull request Jun 25, 2026
![snyk-top-banner](https://res.cloudinary.com/snyk/image/upload/r-d/scm-platform/snyk-pull-requests/pr-banner-default.svg)

<h3>Snyk has created this PR to upgrade @supabase/supabase-js from 2.98.0 to 2.107.0.</h3>

:information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

<hr/>

- The recommended version is **119 versions** ahead of your current version.

- The recommended version was released **22 days ago**.

<details>
<summary><b>Release notes</b></summary>
<br/>
  <details>
    <summary>Package name: <b>@supabase/supabase-js</b></summary>
    <ul>
      <li>
        <b>2.107.0</b> - <a href="https://redirect.github.com/supabase/supabase-js/releases/tag/v2.107.0">2026-06-02</a></br><h2>2.107.0 (2026-06-02)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>auth:</strong> remove navigator.locks-based mutex; introduce commit guard + dispose() (<a href="https://redirect.github.com/supabase/supabase-js/pull/2392" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2392/hovercard">#2392</a>)</li>
<li><strong>realtime:</strong> allow httpSend to send binary payload (<a href="https://redirect.github.com/supabase/supabase-js/pull/2400" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2400/hovercard">#2400</a>)</li>
<li><strong>supabase:</strong> update X-Client-Info to structured metadata format (<a href="https://redirect.github.com/supabase/supabase-js/pull/2359" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2359/hovercard">#2359</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>auth:</strong> return AuthInvalidJwtError from getClaims for expired JWT (<a href="https://redirect.github.com/supabase/supabase-js/pull/2395" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2395/hovercard">#2395</a>)</li>
<li><strong>auth:</strong> recognize ?error= redirects in implicit grant gate (<a href="https://redirect.github.com/supabase/supabase-js/pull/2407" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2407/hovercard">#2407</a>)</li>
<li><strong>auth): revert fix(auth:</strong> encode client-id in oauth requests (<a href="https://redirect.github.com/supabase/supabase-js/pull/2383" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2383/hovercard">#2383</a>, <a href="https://redirect.github.com/supabase/supabase-js/pull/2417" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2417/hovercard">#2417</a>)</li>
<li><strong>postgrest:</strong> return a structured error for non-JSON body on successful responses (<a href="https://redirect.github.com/supabase/supabase-js/pull/2398" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2398/hovercard">#2398</a>)</li>
<li><strong>release:</strong> pin workspace:* sibling deps before JSR publish (<a href="https://redirect.github.com/supabase/supabase-js/pull/2418" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2418/hovercard">#2418</a>)</li>
<li><strong>release:</strong> publish gotrue-js legacy mirror via pnpm (<a href="https://redirect.github.com/supabase/supabase-js/pull/2419" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2419/hovercard">#2419</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Claude Opus 4.7 (1M context)</li>
<li>Claude Sonnet 4.6</li>
<li>Eduardo Gurgel</li>
<li>Guilherme Souza</li>
<li>Katerina Skroumpelou <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/mandarini/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/mandarini">@ mandarini</a></li>
<li>Omar Al Matar <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Bewinxed/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/Bewinxed">@ Bewinxed</a></li>
<li>youcef zr <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/youcefzemmar/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/youcefzemmar">@ youcefzemmar</a></li>
<li>youcefzemmar</li>
</ul>
      </li>
      <li>
        <b>2.107.0-canary.6</b> - <a href="https://redirect.github.com/supabase/supabase-js/releases/tag/v2.107.0-canary.6">2026-06-02</a></br><h2>2.107.0-canary.6 (2026-06-02)</h2>
<p>This was a version bump only, there were no code changes.</p>
      </li>
      <li>
        <b>2.107.0-canary.5</b> - <a href="https://redirect.github.com/supabase/supabase-js/releases/tag/v2.107.0-canary.5">2026-06-02</a></br><h2>2.107.0-canary.5 (2026-06-02)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>release:</strong> publish gotrue-js legacy mirror via pnpm (<a href="https://redirect.github.com/supabase/supabase-js/pull/2419" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2419/hovercard">#2419</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Katerina Skroumpelou <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/mandarini/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/mandarini">@ mandarini</a></li>
</ul>
      </li>
      <li>
        <b>2.107.0-canary.4</b> - <a href="https://redirect.github.com/supabase/supabase-js/releases/tag/v2.107.0-canary.4">2026-06-02</a></br><h2>2.107.0-canary.4 (2026-06-02)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>release:</strong> pin workspace:* sibling deps before JSR publish (<a href="https://redirect.github.com/supabase/supabase-js/pull/2418" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2418/hovercard">#2418</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Katerina Skroumpelou <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/mandarini/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/mandarini">@ mandarini</a></li>
</ul>
      </li>
      <li>
        <b>2.107.0-canary.3</b> - <a href="https://redirect.github.com/supabase/supabase-js/releases/tag/v2.107.0-canary.3">2026-06-02</a></br><h2>2.107.0-canary.3 (2026-06-02)</h2>
<p>This was a version bump only, there were no code changes.</p>
      </li>
      <li>
        <b>2.107.0-canary.2</b> - <a href="https://redirect.github.com/supabase/supabase-js/releases/tag/v2.107.0-canary.2">2026-06-02</a></br><h2>2.107.0-canary.2 (2026-06-02)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>auth): revert fix(auth:</strong> encode client-id in oauth requests (<a href="https://redirect.github.com/supabase/supabase-js/pull/2383" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2383/hovercard">#2383</a>, <a href="https://redirect.github.com/supabase/supabase-js/pull/2417" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2417/hovercard">#2417</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Katerina Skroumpelou <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/mandarini/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/mandarini">@ mandarini</a></li>
</ul>
      </li>
      <li>
        <b>2.107.0-canary.1</b> - <a href="https://redirect.github.com/supabase/supabase-js/releases/tag/v2.107.0-canary.1">2026-06-01</a></br><h2>2.107.0-canary.1 (2026-06-01)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>auth:</strong> remove navigator.locks-based mutex; introduce commit guard + dispose() (<a href="https://redirect.github.com/supabase/supabase-js/pull/2392" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2392/hovercard">#2392</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Katerina Skroumpelou</li>
<li>Omar Al Matar <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Bewinxed/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/Bewinxed">@ Bewinxed</a></li>
</ul>
      </li>
      <li>
        <b>2.107.0-canary.0</b> - <a href="https://redirect.github.com/supabase/supabase-js/releases/tag/v2.107.0-canary.0">2026-06-01</a></br><h2>2.107.0-canary.0 (2026-06-01)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>realtime:</strong> allow httpSend to send binary payload (<a href="https://redirect.github.com/supabase/supabase-js/pull/2400" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2400/hovercard">#2400</a>)</li>
<li><strong>supabase:</strong> update X-Client-Info to structured metadata format (<a href="https://redirect.github.com/supabase/supabase-js/pull/2359" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2359/hovercard">#2359</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>auth:</strong> recognize ?error= redirects in implicit grant gate (<a href="https://redirect.github.com/supabase/supabase-js/pull/2407" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2407/hovercard">#2407</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Claude Sonnet 4.6</li>
<li>Eduardo Gurgel</li>
<li>Guilherme Souza</li>
<li>Katerina Skroumpelou <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/mandarini/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/mandarini">@ mandarini</a></li>
</ul>
      </li>
      <li>
        <b>2.107.0-beta.7</b> - <a href="https://redirect.github.com/supabase/supabase-js/releases/tag/v2.107.0-beta.7">2026-06-02</a></br><h2>2.107.0-beta.7 (2026-06-02)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>auth:</strong> remove navigator.locks-based mutex; introduce commit guard + dispose() (<a href="https://redirect.github.com/supabase/supabase-js/pull/2392" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2392/hovercard">#2392</a>)</li>
<li><strong>realtime:</strong> allow httpSend to send binary payload (<a href="https://redirect.github.com/supabase/supabase-js/pull/2400" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2400/hovercard">#2400</a>)</li>
<li><strong>supabase:</strong> update X-Client-Info to structured metadata format (<a href="https://redirect.github.com/supabase/supabase-js/pull/2359" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2359/hovercard">#2359</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>auth:</strong> return AuthInvalidJwtError from getClaims for expired JWT (<a href="https://redirect.github.com/supabase/supabase-js/pull/2395" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2395/hovercard">#2395</a>)</li>
<li><strong>auth:</strong> recognize ?error= redirects in implicit grant gate (<a href="https://redirect.github.com/supabase/supabase-js/pull/2407" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2407/hovercard">#2407</a>)</li>
<li><strong>auth): revert fix(auth:</strong> encode client-id in oauth requests (<a href="https://redirect.github.com/supabase/supabase-js/pull/2383" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2383/hovercard">#2383</a>, <a href="https://redirect.github.com/supabase/supabase-js/pull/2417" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2417/hovercard">#2417</a>)</li>
<li><strong>postgrest:</strong> return a structured error for non-JSON body on successful responses (<a href="https://redirect.github.com/supabase/supabase-js/pull/2398" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2398/hovercard">#2398</a>)</li>
<li><strong>release:</strong> pin workspace:* sibling deps before JSR publish (<a href="https://redirect.github.com/supabase/supabase-js/pull/2418" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2418/hovercard">#2418</a>)</li>
<li><strong>release:</strong> publish gotrue-js legacy mirror via pnpm (<a href="https://redirect.github.com/supabase/supabase-js/commit/8f5c54db">8f5c54db</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Claude Opus 4.7 (1M context)</li>
<li>Claude Sonnet 4.6</li>
<li>Eduardo Gurgel</li>
<li>Guilherme Souza</li>
<li>Katerina Skroumpelou <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/mandarini/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/mandarini">@ mandarini</a></li>
<li>Omar Al Matar <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Bewinxed/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/Bewinxed">@ Bewinxed</a></li>
<li>youcef zr <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/youcefzemmar/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/youcefzemmar">@ youcefzemmar</a></li>
<li>youcefzemmar</li>
</ul>
      </li>
      <li>
        <b>2.107.0-beta.6</b> - <a href="https://redirect.github.com/supabase/supabase-js/releases/tag/v2.107.0-beta.6">2026-06-02</a></br><h2>2.107.0-beta.6 (2026-06-02)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>auth:</strong> remove navigator.locks-based mutex; introduce commit guard + dispose() (<a href="https://redirect.github.com/supabase/supabase-js/pull/2392" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2392/hovercard">#2392</a>)</li>
<li><strong>realtime:</strong> allow httpSend to send binary payload (<a href="https://redirect.github.com/supabase/supabase-js/pull/2400" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2400/hovercard">#2400</a>)</li>
<li><strong>supabase:</strong> update X-Client-Info to structured metadata format (<a href="https://redirect.github.com/supabase/supabase-js/pull/2359" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2359/hovercard">#2359</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>auth:</strong> return AuthInvalidJwtError from getClaims for expired JWT (<a href="https://redirect.github.com/supabase/supabase-js/pull/2395" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2395/hovercard">#2395</a>)</li>
<li><strong>auth:</strong> recognize ?error= redirects in implicit grant gate (<a href="https://redirect.github.com/supabase/supabase-js/pull/2407" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2407/hovercard">#2407</a>)</li>
<li><strong>auth): revert fix(auth:</strong> encode client-id in oauth requests (<a href="https://redirect.github.com/supabase/supabase-js/pull/2383" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2383/hovercard">#2383</a>, <a href="https://redirect.github.com/supabase/supabase-js/pull/2417" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2417/hovercard">#2417</a>)</li>
<li><strong>postgrest:</strong> return a structured error for non-JSON body on successful responses (<a href="https://redirect.github.com/supabase/supabase-js/pull/2398" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2398/hovercard">#2398</a>)</li>
<li><strong>release:</strong> pin workspace:* sibling deps before JSR publish (<a href="https://redirect.github.com/supabase/supabase-js/commit/be5cd5f9">be5cd5f9</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Claude Opus 4.7 (1M context)</li>
<li>Claude Sonnet 4.6</li>
<li>Eduardo Gurgel</li>
<li>Guilherme Souza</li>
<li>Katerina Skroumpelou <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/mandarini/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/mandarini">@ mandarini</a></li>
<li>Omar Al Matar <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Bewinxed/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/Bewinxed">@ Bewinxed</a></li>
<li>youcef zr <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/youcefzemmar/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/youcefzemmar">@ youcefzemmar</a></li>
<li>youcefzemmar</li>
</ul>
      </li>
      <li>
        <b>2.107.0-beta.1</b> - 2026-05-27
      </li>
      <li>
        <b>2.107.0-beta.0</b> - 2026-05-26
      </li>
      <li>
        <b>2.106.3-canary.2</b> - 2026-05-28
      </li>
      <li>
        <b>2.106.3-canary.1</b> - 2026-05-28
      </li>
      <li>
        <b>2.106.3-canary.0</b> - 2026-05-28
      </li>
      <li>
        <b>2.106.2</b> - 2026-05-25
      </li>
      <li>
        <b>2.106.2-canary.1</b> - 2026-05-22
      </li>
      <li>
        <b>2.106.2-canary.0</b> - 2026-05-22
      </li>
      <li>
        <b>2.106.2-beta.2</b> - 2026-05-22
      </li>
      <li>
        <b>2.106.2-beta.0</b> - 2026-05-21
      </li>
      <li>
        <b>2.106.1</b> - 2026-05-20
      </li>
      <li>
        <b>2.106.1-canary.1</b> - 2026-05-20
      </li>
      <li>
        <b>2.106.1-canary.0</b> - 2026-05-20
      </li>
      <li>
        <b>2.106.1-beta.3</b> - 2026-05-20
      </li>
      <li>
        <b>2.106.1-beta.2</b> - 2026-05-20
      </li>
      <li>
        <b>2.106.1-beta.1</b> - 2026-05-19
      </li>
      <li>
        <b>2.106.1-beta.0</b> - 2026-05-19
      </li>
      <li>
        <b>2.106.0</b> - 2026-05-18
      </li>
      <li>
        <b>2.106.0-canary.4</b> - 2026-05-15
      </li>
      <li>
        <b>2.106.0-canary.3</b> - 2026-05-15
      </li>
      <li>
        <b>2.106.0-canary.2</b> - 2026-05-14
      </li>
      <li>
        <b>2.106.0-canary.1</b> - 2026-05-13
      </li>
      <li>
        <b>2.105.5-beta.10</b> - 2026-05-14
      </li>
      <li>
        <b>2.105.5-beta.9</b> - 2026-05-13
      </li>
      <li>
        <b>2.105.5-beta.8</b> - 2026-05-13
      </li>
      <li>
        <b>2.105.5-beta.5</b> - 2026-05-13
      </li>
      <li>
        <b>2.105.5-beta.0</b> - 2026-05-11
      </li>
      <li>
        <b>2.105.4</b> - 2026-05-08
      </li>
      <li>
        <b>2.105.4-canary.2</b> - 2026-05-08
      </li>
      <li>
        <b>2.105.4-canary.1</b> - 2026-05-08
      </li>
      <li>
        <b>2.105.4-canary.0</b> - 2026-05-08
      </li>
      <li>
        <b>2.105.3</b> - 2026-05-04
      </li>
      <li>
        <b>2.105.2</b> - 2026-05-04
      </li>
      <li>
        <b>2.105.2-canary.4</b> - 2026-05-04
      </li>
      <li>
        <b>2.105.2-canary.3</b> - 2026-05-04
      </li>
      <li>
        <b>2.105.2-canary.2</b> - 2026-05-04
      </li>
      <li>
        <b>2.105.2-canary.1</b> - 2026-05-04
      </li>
      <li>
        <b>2.105.2-canary.0</b> - 2026-04-28
      </li>
      <li>
        <b>2.105.1</b> - 2026-04-28
      </li>
      <li>
        <b>2.105.1-canary.2</b> - 2026-04-28
      </li>
      <li>
        <b>2.105.1-canary.1</b> - 2026-04-28
      </li>
      <li>
        <b>2.105.1-canary.0</b> - 2026-04-28
      </li>
      <li>
        <b>2.105.0</b> - 2026-04-27
      </li>
      <li>
        <b>2.104.2-canary.4</b> - 2026-04-27
      </li>
      <li>
        <b>2.104.2-canary.3</b> - 2026-04-27
      </li>
      <li>
        <b>2.104.2-canary.2</b> - 2026-04-27
      </li>
      <li>
        <b>2.104.2-canary.1</b> - 2026-04-24
      </li>
      <li>
        <b>2.104.2-canary.0</b> - 2026-04-24
      </li>
      <li>
        <b>2.104.1</b> - 2026-04-23
      </li>
      <li>
        <b>2.104.1-canary.3</b> - 2026-04-23
      </li>
      <li>
        <b>2.104.1-canary.2</b> - 2026-04-23
      </li>
      <li>
        <b>2.104.1-canary.1</b> - 2026-04-22
      </li>
      <li>
        <b>2.104.1-canary.0</b> - 2026-04-22
      </li>
      <li>
        <b>2.104.0</b> - 2026-04-20
      </li>
      <li>
        <b>2.104.0-canary.2</b> - 2026-04-17
      </li>
      <li>
        <b>2.104.0-canary.1</b> - 2026-04-17
      </li>
      <li>
        <b>2.104.0-canary.0</b> - 2026-04-02
      </li>
      <li>
        <b>2.103.3</b> - 2026-04-16
      </li>
      <li>
        <b>2.103.3-canary.1</b> - 2026-04-16
      </li>
      <li>
        <b>2.103.3-canary.0</b> - 2026-04-15
      </li>
      <li>
        <b>2.103.2</b> - 2026-04-15
      </li>
      <li>
        <b>2.103.2-canary.3</b> - 2026-04-15
      </li>
      <li>
        <b>2.103.2-canary.2</b> - 2026-04-15
      </li>
      <li>
        <b>2.103.2-canary.1</b> - 2026-04-15
      </li>
      <li>
        <b>2.103.2-canary.0</b> - 2026-04-15
      </li>
      <li>
        <b>2.103.1</b> - 2026-04-15
      </li>
      <li>
        <b>2.103.1-canary.0</b> - 2026-04-15
      </li>
      <li>
        <b>2.103.1-beta.0</b> - 2026-04-09
      </li>
      <li>
        <b>2.103.0</b> - 2026-04-09
      </li>
      <li>
        <b>2.103.0-canary.2</b> - 2026-04-09
      </li>
      <li>
        <b>2.103.0-canary.1</b> - 2026-04-09
      </li>
      <li>
        <b>2.103.0-canary.0</b> - 2026-04-02
      </li>
      <li>
        <b>2.102.2-canary.0</b> - 2026-04-08
      </li>
      <li>
        <b>2.102.1</b> - 2026-04-07
      </li>
      <li>
        <b>2.102.1-canary.0</b> - 2026-04-07
      </li>
      <li>
        <b>2.102.0</b> - 2026-04-07
      </li>
      <li>
        <b>2.102.0-canary.5</b> - 2026-04-07
      </li>
      <li>
        <b>2.102.0-canary.4</b> - 2026-04-07
      </li>
      <li>
        <b>2.102.0-canary.3</b> - 2026-04-06
      </li>
      <li>
        <b>2.102.0-canary.2</b> - 2026-04-03
      </li>
      <li>
        <b>2.102.0-canary.1</b> - 2026-04-03
      </li>
      <li>
        <b>2.102.0-canary.0</b> - 2026-04-02
      </li>
      <li>
        <b>2.102.0-beta.0</b> - 2026-03-31
      </li>
      <li>
        <b>2.101.1</b> - 2026-03-31
      </li>
      <li>
        <b>2.101.1-canary.0</b> - 2026-03-31
      </li>
      <li>
        <b>2.101.0</b> - 2026-03-30
      </li>
      <li>
        <b>2.101.0-canary.0</b> - 2026-03-30
      </li>
      <li>
        <b>2.100.1</b> - 2026-03-26
      </li>
      <li>
        <b>2.100.0</b> - 2026-03-23
      </li>
      <li>
        <b>2.100.0-rc.0</b> - 2026-03-16
      </li>
      <li>
        <b>2.100.0-canary.9</b> - 2026-03-30
      </li>
      <li>
        <b>2.100.0-canary.8</b> - 2026-03-30
      </li>
      <li>
        <b>2.100.0-canary.7</b> - 2026-03-26
      </li>
      <li>
        <b>2.100.0-canary.6</b> - 2026-03-26
      </li>
      <li>
        <b>2.100.0-canary.5</b> - 2026-03-26
      </li>
      <li>
        <b>2.100.0-canary.4</b> - 2026-03-23
      </li>
      <li>
        <b>2.100.0-canary.3</b> - 2026-03-20
      </li>
      <li>
        <b>2.100.0-canary.2</b> - 2026-03-19
      </li>
      <li>
        <b>2.100.0-canary.1</b> - 2026-03-19
      </li>
      <li>
        <b>2.100.0-canary.0</b> - 2026-03-17
      </li>
      <li>
        <b>2.99.3</b> - 2026-03-19
      </li>
      <li>
        <b>2.99.3-canary.0</b> - 2026-03-16
      </li>
      <li>
        <b>2.99.2</b> - 2026-03-16
      </li>
      <li>
        <b>2.99.2-canary.0</b> - 2026-03-13
      </li>
      <li>
        <b>2.99.1</b> - 2026-03-11
      </li>
      <li>
        <b>2.99.1-canary.0</b> - 2026-03-11
      </li>
      <li>
        <b>2.99.0</b> - 2026-03-09
      </li>
      <li>
        <b>2.98.1-canary.1</b> - 2026-03-05
      </li>
      <li>
        <b>2.98.1-canary.0</b> - 2026-02-27
      </li>
      <li>
        <b>2.98.0</b> - 2026-02-26
      </li>
    </ul>
    from <a href="https://redirect.github.com/supabase/supabase-js/releases">@supabase/supabase-js GitHub release notes</a>
  </details>
</details>

---

> [!IMPORTANT]
>
> - Check the changes in this PR to ensure they won't cause issues with your project.
> - This PR was automatically created by Snyk using the credentials of a real user.

---

**Note:** _You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs._

**For more information:** <img src="https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6ImZha2Uta2V5IiwiYW5vbnltb3VzSWQiOiJjMDY0ZmVjNC1jYTNmLTQ3MzQtYjIxMi0wNTM3ZWVhNGRjYTYiLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6ImMwNjRmZWM0LWNhM2YtNDczNC1iMjEyLTA1MzdlZWE0ZGNhNiJ9fQ==" width="0" height="0"/>

> - 🧐 [View latest project report](https://app.eu.snyk.io/org/antigravity-awesome-skills-default/project/e1f199d3-0a16-4ac7-a9a1-528e774fc41f?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;upgrade-pr)
> - 📜 [Customise PR templates](https://docs.snyk.io/scan-using-snyk/pull-requests/snyk-fix-pull-or-merge-requests/customize-pr-templates?utm_source=&utm_content=fix-pr-template)
> - 🛠 [Adjust upgrade PR settings](https://app.eu.snyk.io/org/antigravity-awesome-skills-default/project/e1f199d3-0a16-4ac7-a9a1-528e774fc41f/settings/integration?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;upgrade-pr)
> - 🔕 [Ignore this dependency or unsubscribe from future upgrade PRs](https://app.eu.snyk.io/org/antigravity-awesome-skills-default/project/e1f199d3-0a16-4ac7-a9a1-528e774fc41f/settings/integration?pkg&#x3D;@supabase/supabase-js&amp;utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;upgrade-pr#auto-dep-upgrades)

[//]: # 'snyk:metadata:{"breakingChangeRiskLevel":null,"FF_showPullRequestBreakingChanges":false,"FF_showPullRequestBreakingChangesWebSearch":false,"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"@supabase/supabase-js","from":"2.98.0","to":"2.107.0"}],"env":"prod","hasFixes":false,"isBreakingChange":false,"isMajorUpgrade":false,"issuesToFix":[],"prId":"c064fec4-ca3f-4734-b212-0537eea4dca6","prPublicId":"c064fec4-ca3f-4734-b212-0537eea4dca6","packageManager":"npm","priorityScoreList":[],"projectPublicId":"e1f199d3-0a16-4ac7-a9a1-528e774fc41f","projectUrl":"https://app.eu.snyk.io/org/antigravity-awesome-skills-default/project/e1f199d3-0a16-4ac7-a9a1-528e774fc41f?utm_source=github&utm_medium=referral&page=upgrade-pr","prType":"upgrade","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":[],"type":"auto","upgrade":[],"upgradeInfo":{"versionsDiff":119,"publishedDate":"2026-06-02T14:09:20.056Z"},"vulns":[]}'
munir-abbasi pushed a commit to munir-abbasi/agentic-awesome-skills that referenced this pull request Jul 13, 2026
)

![snyk-top-banner](https://res.cloudinary.com/snyk/image/upload/r-d/scm-platform/snyk-pull-requests/pr-banner-default.svg)

<h3>Snyk has created this PR to upgrade @supabase/supabase-js from 2.98.0 to 2.107.0.</h3>

:information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

<hr/>

- The recommended version is **119 versions** ahead of your current version.

- The recommended version was released **22 days ago**.

<details>
<summary><b>Release notes</b></summary>
<br/>
  <details>
    <summary>Package name: <b>@supabase/supabase-js</b></summary>
    <ul>
      <li>
        <b>2.107.0</b> - <a href="https://redirect.github.com/supabase/supabase-js/releases/tag/v2.107.0">2026-06-02</a></br><h2>2.107.0 (2026-06-02)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>auth:</strong> remove navigator.locks-based mutex; introduce commit guard + dispose() (<a href="https://redirect.github.com/supabase/supabase-js/pull/2392" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2392/hovercard">#2392</a>)</li>
<li><strong>realtime:</strong> allow httpSend to send binary payload (<a href="https://redirect.github.com/supabase/supabase-js/pull/2400" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2400/hovercard">#2400</a>)</li>
<li><strong>supabase:</strong> update X-Client-Info to structured metadata format (<a href="https://redirect.github.com/supabase/supabase-js/pull/2359" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2359/hovercard">#2359</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>auth:</strong> return AuthInvalidJwtError from getClaims for expired JWT (<a href="https://redirect.github.com/supabase/supabase-js/pull/2395" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2395/hovercard">#2395</a>)</li>
<li><strong>auth:</strong> recognize ?error= redirects in implicit grant gate (<a href="https://redirect.github.com/supabase/supabase-js/pull/2407" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2407/hovercard">#2407</a>)</li>
<li><strong>auth): revert fix(auth:</strong> encode client-id in oauth requests (<a href="https://redirect.github.com/supabase/supabase-js/pull/2383" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2383/hovercard">#2383</a>, <a href="https://redirect.github.com/supabase/supabase-js/pull/2417" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2417/hovercard">#2417</a>)</li>
<li><strong>postgrest:</strong> return a structured error for non-JSON body on successful responses (<a href="https://redirect.github.com/supabase/supabase-js/pull/2398" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2398/hovercard">#2398</a>)</li>
<li><strong>release:</strong> pin workspace:* sibling deps before JSR publish (<a href="https://redirect.github.com/supabase/supabase-js/pull/2418" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2418/hovercard">#2418</a>)</li>
<li><strong>release:</strong> publish gotrue-js legacy mirror via pnpm (<a href="https://redirect.github.com/supabase/supabase-js/pull/2419" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2419/hovercard">#2419</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Claude Opus 4.7 (1M context)</li>
<li>Claude Sonnet 4.6</li>
<li>Eduardo Gurgel</li>
<li>Guilherme Souza</li>
<li>Katerina Skroumpelou <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/mandarini/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/mandarini">@ mandarini</a></li>
<li>Omar Al Matar <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Bewinxed/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/Bewinxed">@ Bewinxed</a></li>
<li>youcef zr <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/youcefzemmar/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/youcefzemmar">@ youcefzemmar</a></li>
<li>youcefzemmar</li>
</ul>
      </li>
      <li>
        <b>2.107.0-canary.6</b> - <a href="https://redirect.github.com/supabase/supabase-js/releases/tag/v2.107.0-canary.6">2026-06-02</a></br><h2>2.107.0-canary.6 (2026-06-02)</h2>
<p>This was a version bump only, there were no code changes.</p>
      </li>
      <li>
        <b>2.107.0-canary.5</b> - <a href="https://redirect.github.com/supabase/supabase-js/releases/tag/v2.107.0-canary.5">2026-06-02</a></br><h2>2.107.0-canary.5 (2026-06-02)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>release:</strong> publish gotrue-js legacy mirror via pnpm (<a href="https://redirect.github.com/supabase/supabase-js/pull/2419" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2419/hovercard">#2419</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Katerina Skroumpelou <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/mandarini/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/mandarini">@ mandarini</a></li>
</ul>
      </li>
      <li>
        <b>2.107.0-canary.4</b> - <a href="https://redirect.github.com/supabase/supabase-js/releases/tag/v2.107.0-canary.4">2026-06-02</a></br><h2>2.107.0-canary.4 (2026-06-02)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>release:</strong> pin workspace:* sibling deps before JSR publish (<a href="https://redirect.github.com/supabase/supabase-js/pull/2418" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2418/hovercard">#2418</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Katerina Skroumpelou <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/mandarini/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/mandarini">@ mandarini</a></li>
</ul>
      </li>
      <li>
        <b>2.107.0-canary.3</b> - <a href="https://redirect.github.com/supabase/supabase-js/releases/tag/v2.107.0-canary.3">2026-06-02</a></br><h2>2.107.0-canary.3 (2026-06-02)</h2>
<p>This was a version bump only, there were no code changes.</p>
      </li>
      <li>
        <b>2.107.0-canary.2</b> - <a href="https://redirect.github.com/supabase/supabase-js/releases/tag/v2.107.0-canary.2">2026-06-02</a></br><h2>2.107.0-canary.2 (2026-06-02)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>auth): revert fix(auth:</strong> encode client-id in oauth requests (<a href="https://redirect.github.com/supabase/supabase-js/pull/2383" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2383/hovercard">#2383</a>, <a href="https://redirect.github.com/supabase/supabase-js/pull/2417" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2417/hovercard">#2417</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Katerina Skroumpelou <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/mandarini/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/mandarini">@ mandarini</a></li>
</ul>
      </li>
      <li>
        <b>2.107.0-canary.1</b> - <a href="https://redirect.github.com/supabase/supabase-js/releases/tag/v2.107.0-canary.1">2026-06-01</a></br><h2>2.107.0-canary.1 (2026-06-01)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>auth:</strong> remove navigator.locks-based mutex; introduce commit guard + dispose() (<a href="https://redirect.github.com/supabase/supabase-js/pull/2392" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2392/hovercard">#2392</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Katerina Skroumpelou</li>
<li>Omar Al Matar <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Bewinxed/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/Bewinxed">@ Bewinxed</a></li>
</ul>
      </li>
      <li>
        <b>2.107.0-canary.0</b> - <a href="https://redirect.github.com/supabase/supabase-js/releases/tag/v2.107.0-canary.0">2026-06-01</a></br><h2>2.107.0-canary.0 (2026-06-01)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>realtime:</strong> allow httpSend to send binary payload (<a href="https://redirect.github.com/supabase/supabase-js/pull/2400" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2400/hovercard">#2400</a>)</li>
<li><strong>supabase:</strong> update X-Client-Info to structured metadata format (<a href="https://redirect.github.com/supabase/supabase-js/pull/2359" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2359/hovercard">#2359</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>auth:</strong> recognize ?error= redirects in implicit grant gate (<a href="https://redirect.github.com/supabase/supabase-js/pull/2407" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2407/hovercard">#2407</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Claude Sonnet 4.6</li>
<li>Eduardo Gurgel</li>
<li>Guilherme Souza</li>
<li>Katerina Skroumpelou <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/mandarini/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/mandarini">@ mandarini</a></li>
</ul>
      </li>
      <li>
        <b>2.107.0-beta.7</b> - <a href="https://redirect.github.com/supabase/supabase-js/releases/tag/v2.107.0-beta.7">2026-06-02</a></br><h2>2.107.0-beta.7 (2026-06-02)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>auth:</strong> remove navigator.locks-based mutex; introduce commit guard + dispose() (<a href="https://redirect.github.com/supabase/supabase-js/pull/2392" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2392/hovercard">#2392</a>)</li>
<li><strong>realtime:</strong> allow httpSend to send binary payload (<a href="https://redirect.github.com/supabase/supabase-js/pull/2400" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2400/hovercard">#2400</a>)</li>
<li><strong>supabase:</strong> update X-Client-Info to structured metadata format (<a href="https://redirect.github.com/supabase/supabase-js/pull/2359" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2359/hovercard">#2359</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>auth:</strong> return AuthInvalidJwtError from getClaims for expired JWT (<a href="https://redirect.github.com/supabase/supabase-js/pull/2395" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2395/hovercard">#2395</a>)</li>
<li><strong>auth:</strong> recognize ?error= redirects in implicit grant gate (<a href="https://redirect.github.com/supabase/supabase-js/pull/2407" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2407/hovercard">#2407</a>)</li>
<li><strong>auth): revert fix(auth:</strong> encode client-id in oauth requests (<a href="https://redirect.github.com/supabase/supabase-js/pull/2383" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2383/hovercard">#2383</a>, <a href="https://redirect.github.com/supabase/supabase-js/pull/2417" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2417/hovercard">#2417</a>)</li>
<li><strong>postgrest:</strong> return a structured error for non-JSON body on successful responses (<a href="https://redirect.github.com/supabase/supabase-js/pull/2398" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2398/hovercard">#2398</a>)</li>
<li><strong>release:</strong> pin workspace:* sibling deps before JSR publish (<a href="https://redirect.github.com/supabase/supabase-js/pull/2418" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2418/hovercard">#2418</a>)</li>
<li><strong>release:</strong> publish gotrue-js legacy mirror via pnpm (<a href="https://redirect.github.com/supabase/supabase-js/commit/8f5c54db">8f5c54db</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Claude Opus 4.7 (1M context)</li>
<li>Claude Sonnet 4.6</li>
<li>Eduardo Gurgel</li>
<li>Guilherme Souza</li>
<li>Katerina Skroumpelou <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/mandarini/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/mandarini">@ mandarini</a></li>
<li>Omar Al Matar <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Bewinxed/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/Bewinxed">@ Bewinxed</a></li>
<li>youcef zr <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/youcefzemmar/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/youcefzemmar">@ youcefzemmar</a></li>
<li>youcefzemmar</li>
</ul>
      </li>
      <li>
        <b>2.107.0-beta.6</b> - <a href="https://redirect.github.com/supabase/supabase-js/releases/tag/v2.107.0-beta.6">2026-06-02</a></br><h2>2.107.0-beta.6 (2026-06-02)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>auth:</strong> remove navigator.locks-based mutex; introduce commit guard + dispose() (<a href="https://redirect.github.com/supabase/supabase-js/pull/2392" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2392/hovercard">#2392</a>)</li>
<li><strong>realtime:</strong> allow httpSend to send binary payload (<a href="https://redirect.github.com/supabase/supabase-js/pull/2400" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2400/hovercard">#2400</a>)</li>
<li><strong>supabase:</strong> update X-Client-Info to structured metadata format (<a href="https://redirect.github.com/supabase/supabase-js/pull/2359" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2359/hovercard">#2359</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>auth:</strong> return AuthInvalidJwtError from getClaims for expired JWT (<a href="https://redirect.github.com/supabase/supabase-js/pull/2395" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2395/hovercard">#2395</a>)</li>
<li><strong>auth:</strong> recognize ?error= redirects in implicit grant gate (<a href="https://redirect.github.com/supabase/supabase-js/pull/2407" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2407/hovercard">#2407</a>)</li>
<li><strong>auth): revert fix(auth:</strong> encode client-id in oauth requests (<a href="https://redirect.github.com/supabase/supabase-js/pull/2383" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2383/hovercard">#2383</a>, <a href="https://redirect.github.com/supabase/supabase-js/pull/2417" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2417/hovercard">#2417</a>)</li>
<li><strong>postgrest:</strong> return a structured error for non-JSON body on successful responses (<a href="https://redirect.github.com/supabase/supabase-js/pull/2398" data-hovercard-type="pull_request" data-hovercard-url="/supabase/supabase-js/pull/2398/hovercard">#2398</a>)</li>
<li><strong>release:</strong> pin workspace:* sibling deps before JSR publish (<a href="https://redirect.github.com/supabase/supabase-js/commit/be5cd5f9">be5cd5f9</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Claude Opus 4.7 (1M context)</li>
<li>Claude Sonnet 4.6</li>
<li>Eduardo Gurgel</li>
<li>Guilherme Souza</li>
<li>Katerina Skroumpelou <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/mandarini/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/mandarini">@ mandarini</a></li>
<li>Omar Al Matar <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Bewinxed/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/Bewinxed">@ Bewinxed</a></li>
<li>youcef zr <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/youcefzemmar/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/youcefzemmar">@ youcefzemmar</a></li>
<li>youcefzemmar</li>
</ul>
      </li>
      <li>
        <b>2.107.0-beta.1</b> - 2026-05-27
      </li>
      <li>
        <b>2.107.0-beta.0</b> - 2026-05-26
      </li>
      <li>
        <b>2.106.3-canary.2</b> - 2026-05-28
      </li>
      <li>
        <b>2.106.3-canary.1</b> - 2026-05-28
      </li>
      <li>
        <b>2.106.3-canary.0</b> - 2026-05-28
      </li>
      <li>
        <b>2.106.2</b> - 2026-05-25
      </li>
      <li>
        <b>2.106.2-canary.1</b> - 2026-05-22
      </li>
      <li>
        <b>2.106.2-canary.0</b> - 2026-05-22
      </li>
      <li>
        <b>2.106.2-beta.2</b> - 2026-05-22
      </li>
      <li>
        <b>2.106.2-beta.0</b> - 2026-05-21
      </li>
      <li>
        <b>2.106.1</b> - 2026-05-20
      </li>
      <li>
        <b>2.106.1-canary.1</b> - 2026-05-20
      </li>
      <li>
        <b>2.106.1-canary.0</b> - 2026-05-20
      </li>
      <li>
        <b>2.106.1-beta.3</b> - 2026-05-20
      </li>
      <li>
        <b>2.106.1-beta.2</b> - 2026-05-20
      </li>
      <li>
        <b>2.106.1-beta.1</b> - 2026-05-19
      </li>
      <li>
        <b>2.106.1-beta.0</b> - 2026-05-19
      </li>
      <li>
        <b>2.106.0</b> - 2026-05-18
      </li>
      <li>
        <b>2.106.0-canary.4</b> - 2026-05-15
      </li>
      <li>
        <b>2.106.0-canary.3</b> - 2026-05-15
      </li>
      <li>
        <b>2.106.0-canary.2</b> - 2026-05-14
      </li>
      <li>
        <b>2.106.0-canary.1</b> - 2026-05-13
      </li>
      <li>
        <b>2.105.5-beta.10</b> - 2026-05-14
      </li>
      <li>
        <b>2.105.5-beta.9</b> - 2026-05-13
      </li>
      <li>
        <b>2.105.5-beta.8</b> - 2026-05-13
      </li>
      <li>
        <b>2.105.5-beta.5</b> - 2026-05-13
      </li>
      <li>
        <b>2.105.5-beta.0</b> - 2026-05-11
      </li>
      <li>
        <b>2.105.4</b> - 2026-05-08
      </li>
      <li>
        <b>2.105.4-canary.2</b> - 2026-05-08
      </li>
      <li>
        <b>2.105.4-canary.1</b> - 2026-05-08
      </li>
      <li>
        <b>2.105.4-canary.0</b> - 2026-05-08
      </li>
      <li>
        <b>2.105.3</b> - 2026-05-04
      </li>
      <li>
        <b>2.105.2</b> - 2026-05-04
      </li>
      <li>
        <b>2.105.2-canary.4</b> - 2026-05-04
      </li>
      <li>
        <b>2.105.2-canary.3</b> - 2026-05-04
      </li>
      <li>
        <b>2.105.2-canary.2</b> - 2026-05-04
      </li>
      <li>
        <b>2.105.2-canary.1</b> - 2026-05-04
      </li>
      <li>
        <b>2.105.2-canary.0</b> - 2026-04-28
      </li>
      <li>
        <b>2.105.1</b> - 2026-04-28
      </li>
      <li>
        <b>2.105.1-canary.2</b> - 2026-04-28
      </li>
      <li>
        <b>2.105.1-canary.1</b> - 2026-04-28
      </li>
      <li>
        <b>2.105.1-canary.0</b> - 2026-04-28
      </li>
      <li>
        <b>2.105.0</b> - 2026-04-27
      </li>
      <li>
        <b>2.104.2-canary.4</b> - 2026-04-27
      </li>
      <li>
        <b>2.104.2-canary.3</b> - 2026-04-27
      </li>
      <li>
        <b>2.104.2-canary.2</b> - 2026-04-27
      </li>
      <li>
        <b>2.104.2-canary.1</b> - 2026-04-24
      </li>
      <li>
        <b>2.104.2-canary.0</b> - 2026-04-24
      </li>
      <li>
        <b>2.104.1</b> - 2026-04-23
      </li>
      <li>
        <b>2.104.1-canary.3</b> - 2026-04-23
      </li>
      <li>
        <b>2.104.1-canary.2</b> - 2026-04-23
      </li>
      <li>
        <b>2.104.1-canary.1</b> - 2026-04-22
      </li>
      <li>
        <b>2.104.1-canary.0</b> - 2026-04-22
      </li>
      <li>
        <b>2.104.0</b> - 2026-04-20
      </li>
      <li>
        <b>2.104.0-canary.2</b> - 2026-04-17
      </li>
      <li>
        <b>2.104.0-canary.1</b> - 2026-04-17
      </li>
      <li>
        <b>2.104.0-canary.0</b> - 2026-04-02
      </li>
      <li>
        <b>2.103.3</b> - 2026-04-16
      </li>
      <li>
        <b>2.103.3-canary.1</b> - 2026-04-16
      </li>
      <li>
        <b>2.103.3-canary.0</b> - 2026-04-15
      </li>
      <li>
        <b>2.103.2</b> - 2026-04-15
      </li>
      <li>
        <b>2.103.2-canary.3</b> - 2026-04-15
      </li>
      <li>
        <b>2.103.2-canary.2</b> - 2026-04-15
      </li>
      <li>
        <b>2.103.2-canary.1</b> - 2026-04-15
      </li>
      <li>
        <b>2.103.2-canary.0</b> - 2026-04-15
      </li>
      <li>
        <b>2.103.1</b> - 2026-04-15
      </li>
      <li>
        <b>2.103.1-canary.0</b> - 2026-04-15
      </li>
      <li>
        <b>2.103.1-beta.0</b> - 2026-04-09
      </li>
      <li>
        <b>2.103.0</b> - 2026-04-09
      </li>
      <li>
        <b>2.103.0-canary.2</b> - 2026-04-09
      </li>
      <li>
        <b>2.103.0-canary.1</b> - 2026-04-09
      </li>
      <li>
        <b>2.103.0-canary.0</b> - 2026-04-02
      </li>
      <li>
        <b>2.102.2-canary.0</b> - 2026-04-08
      </li>
      <li>
        <b>2.102.1</b> - 2026-04-07
      </li>
      <li>
        <b>2.102.1-canary.0</b> - 2026-04-07
      </li>
      <li>
        <b>2.102.0</b> - 2026-04-07
      </li>
      <li>
        <b>2.102.0-canary.5</b> - 2026-04-07
      </li>
      <li>
        <b>2.102.0-canary.4</b> - 2026-04-07
      </li>
      <li>
        <b>2.102.0-canary.3</b> - 2026-04-06
      </li>
      <li>
        <b>2.102.0-canary.2</b> - 2026-04-03
      </li>
      <li>
        <b>2.102.0-canary.1</b> - 2026-04-03
      </li>
      <li>
        <b>2.102.0-canary.0</b> - 2026-04-02
      </li>
      <li>
        <b>2.102.0-beta.0</b> - 2026-03-31
      </li>
      <li>
        <b>2.101.1</b> - 2026-03-31
      </li>
      <li>
        <b>2.101.1-canary.0</b> - 2026-03-31
      </li>
      <li>
        <b>2.101.0</b> - 2026-03-30
      </li>
      <li>
        <b>2.101.0-canary.0</b> - 2026-03-30
      </li>
      <li>
        <b>2.100.1</b> - 2026-03-26
      </li>
      <li>
        <b>2.100.0</b> - 2026-03-23
      </li>
      <li>
        <b>2.100.0-rc.0</b> - 2026-03-16
      </li>
      <li>
        <b>2.100.0-canary.9</b> - 2026-03-30
      </li>
      <li>
        <b>2.100.0-canary.8</b> - 2026-03-30
      </li>
      <li>
        <b>2.100.0-canary.7</b> - 2026-03-26
      </li>
      <li>
        <b>2.100.0-canary.6</b> - 2026-03-26
      </li>
      <li>
        <b>2.100.0-canary.5</b> - 2026-03-26
      </li>
      <li>
        <b>2.100.0-canary.4</b> - 2026-03-23
      </li>
      <li>
        <b>2.100.0-canary.3</b> - 2026-03-20
      </li>
      <li>
        <b>2.100.0-canary.2</b> - 2026-03-19
      </li>
      <li>
        <b>2.100.0-canary.1</b> - 2026-03-19
      </li>
      <li>
        <b>2.100.0-canary.0</b> - 2026-03-17
      </li>
      <li>
        <b>2.99.3</b> - 2026-03-19
      </li>
      <li>
        <b>2.99.3-canary.0</b> - 2026-03-16
      </li>
      <li>
        <b>2.99.2</b> - 2026-03-16
      </li>
      <li>
        <b>2.99.2-canary.0</b> - 2026-03-13
      </li>
      <li>
        <b>2.99.1</b> - 2026-03-11
      </li>
      <li>
        <b>2.99.1-canary.0</b> - 2026-03-11
      </li>
      <li>
        <b>2.99.0</b> - 2026-03-09
      </li>
      <li>
        <b>2.98.1-canary.1</b> - 2026-03-05
      </li>
      <li>
        <b>2.98.1-canary.0</b> - 2026-02-27
      </li>
      <li>
        <b>2.98.0</b> - 2026-02-26
      </li>
    </ul>
    from <a href="https://redirect.github.com/supabase/supabase-js/releases">@supabase/supabase-js GitHub release notes</a>
  </details>
</details>

---

> [!IMPORTANT]
>
> - Check the changes in this PR to ensure they won't cause issues with your project.
> - This PR was automatically created by Snyk using the credentials of a real user.

---

**Note:** _You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs._

**For more information:** <img src="https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6ImZha2Uta2V5IiwiYW5vbnltb3VzSWQiOiJjMDY0ZmVjNC1jYTNmLTQ3MzQtYjIxMi0wNTM3ZWVhNGRjYTYiLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6ImMwNjRmZWM0LWNhM2YtNDczNC1iMjEyLTA1MzdlZWE0ZGNhNiJ9fQ==" width="0" height="0"/>

> - 🧐 [View latest project report](https://app.eu.snyk.io/org/antigravity-awesome-skills-default/project/e1f199d3-0a16-4ac7-a9a1-528e774fc41f?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;upgrade-pr)
> - 📜 [Customise PR templates](https://docs.snyk.io/scan-using-snyk/pull-requests/snyk-fix-pull-or-merge-requests/customize-pr-templates?utm_source=&utm_content=fix-pr-template)
> - 🛠 [Adjust upgrade PR settings](https://app.eu.snyk.io/org/antigravity-awesome-skills-default/project/e1f199d3-0a16-4ac7-a9a1-528e774fc41f/settings/integration?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;upgrade-pr)
> - 🔕 [Ignore this dependency or unsubscribe from future upgrade PRs](https://app.eu.snyk.io/org/antigravity-awesome-skills-default/project/e1f199d3-0a16-4ac7-a9a1-528e774fc41f/settings/integration?pkg&#x3D;@supabase/supabase-js&amp;utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;upgrade-pr#auto-dep-upgrades)

[//]: # 'snyk:metadata:{"breakingChangeRiskLevel":null,"FF_showPullRequestBreakingChanges":false,"FF_showPullRequestBreakingChangesWebSearch":false,"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"@supabase/supabase-js","from":"2.98.0","to":"2.107.0"}],"env":"prod","hasFixes":false,"isBreakingChange":false,"isMajorUpgrade":false,"issuesToFix":[],"prId":"c064fec4-ca3f-4734-b212-0537eea4dca6","prPublicId":"c064fec4-ca3f-4734-b212-0537eea4dca6","packageManager":"npm","priorityScoreList":[],"projectPublicId":"e1f199d3-0a16-4ac7-a9a1-528e774fc41f","projectUrl":"https://app.eu.snyk.io/org/antigravity-awesome-skills-default/project/e1f199d3-0a16-4ac7-a9a1-528e774fc41f?utm_source=github&utm_medium=referral&page=upgrade-pr","prType":"upgrade","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":[],"type":"auto","upgrade":[],"upgradeInfo":{"versionsDiff":119,"publishedDate":"2026-06-02T14:09:20.056Z"},"vulns":[]}'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

auth-js Related to the auth-js library.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants