[supabase-py-releaser]

🤖 I have created a release beep boop

3.0.0-a2 (2026-11-11)

⚠ BREAKING CHANGES

• supabase: share one lazily connecting realtime client per AsyncClient (#2034)
• realtime: rename RealtimeClient.close() to aclose() (#2036)
• realtime: move to protocol 2.0.0 with binary broadcast (#2033)
• add a shared retry policy with Retry-After, jitter and per-client configuration (#2030)
• postgrest: type text_search options and the response shape (#2028)
• postgrest: require a filter or all() on update() and delete() (#2025)
• postgrest: make the request builders immutable (#2023)
• auth: typed auth state changes and a single-flight session refresh core (#2021)
• add a root SupabaseError and wrap transport errors in every package (#2018)
• functions: remove FunctionsError.to_dict and FunctionsApiErrorDict (#2015)
• supabase: replace ClientOptions with keyword arguments and per-service options (#2011)
• add configurable request timeouts for every service (#2010)
• realtime: raise send failures instead of writing to a failed connection (#2007)
• realtime: honor heartbeat intervals below 15 seconds and accept float durations (#2006)
• raise the minimum python version to 3.12 (#2002)
• supabase: freeze the option and parameter dataclasses (#2000)
• supabase: share one client implementation between AsyncClient and Client (#1998)
• storage: take upsert as a bool in upload and create_signed_upload_url (#1997)
• storage: treat object keys as literal strings (#1987)
• spell out abbreviations in public names (#1981)
• functions,postgrest: stop importing httpx outside the httpx adapter (#1977)

Features

• add a root SupabaseError and wrap transport errors in every package (#2018) (ac8950f)
• add a shared retry policy with Retry-After, jitter and per-client configuration (#2030) (885bfc5)
• add configurable request timeouts for every service (#2010) (50354b6)
• auth: typed auth state changes and a single-flight session refresh core (#2021) (1f56185)
• postgrest: require a filter or all() on update() and delete() (#2025) (29843bd)
• postgrest: type text_search options and the response shape (#2028) (d3dd14b)
• realtime: move to protocol 2.0.0 with binary broadcast (#2033) (92d524c)
• realtime: rename RealtimeClient.close() to aclose() (#2036) (6eca35f)
• supabase: add close() and aclose() to the top-level client (#2035) (1ab137d)
• supabase: add with_token() for per-request clients (#2032) (236b2a1)
• supabase: pull the realtime access token from the auth session (#2038) (73a65b4), closes #1210
• supabase: replace ClientOptions with keyword arguments and per-service options (#2011) (797f938)

Bug Fixes

• auth: make the sync test generator reproduce the committed sync tests (#1971) (5523e0b)
• auth: start refresh token retry backoff at 200 milliseconds (#1978) (394a690)
• deps: raise the pyjwt floor to 2.15.1 and install pyiceberg with pyarrow (#1993) (14e4d9a)
• functions,postgrest: stop importing httpx outside the httpx adapter (#1977) (5331957)
• postgrest: make the request builders immutable (#2023) (eb983ef), closes #1208
• postgrest: reject filters and transforms after insert() and upsert() (#2022) (1166a75)
• realtime: honor heartbeat intervals below 15 seconds and accept float durations (#2006) (c66e48e)
• realtime: raise send failures instead of writing to a failed connection (#2007) (7f6add1)
• realtime: redact API keys and access tokens from debug logs (#1992) (2b20207)
• realtime: send the access token on every join and push it on every session change (#2037) (20d29b6)
• storage: take upsert as a bool in upload and create_signed_upload_url (#1997) (0331c57), closes #1996
• storage: treat object keys as literal strings (#1987) (b54cba4)
• supabase: freeze the option and parameter dataclasses (#2000) (7bcf067)
• supabase: keep the session token on every auth event that has one (#1989) (0c07c58)
• supabase: share one client implementation between AsyncClient and Client (#1998) (76f31e2)
• supabase: share one lazily connecting realtime client per AsyncClient (#2034) (60ce545)
• supabase: stop sending new-format api keys as bearer to edge functions (#2005) (213ae34)
• utils: drop credential headers on cross origin redirects (#1994) (72bf760)
• utils: keep name, docstring and signature of handle_http_io methods (#1976) (68cb2b8)
• utils: keep the request's Authorization header over injected httpx client auth (#1990) (8b6b049)

Documentation

• clarify contribution policy for v3 and v2 (#1958) (84b919e)
• restore support policy and service compatibility from v2 (#1964) (05fa93e)
• update the READMEs to the v3 API and type-check their snippets in CI (#2029) (9a5870d)
• utils: document request timeouts and redirects in the adapter guide (#2017) (16b72eb)

Miscellaneous Chores

• raise the minimum python version to 3.12 (#2002) (1333baa)

Code Refactoring

• functions: remove FunctionsError.to_dict and FunctionsApiErrorDict (#2015) (4184f96)
• spell out abbreviations in public names (#1981) (cdd399f)

---

This PR was generated with Release Please. See documentation.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: df25b830-9117-4db0-8be9-93e8bc164c8f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn