[Snyk] Upgrade @supabase/supabase-js from 2.86.0 to 2.90.1

[prateeks007]

Snyk has created this PR to upgrade @supabase/supabase-js from 2.86.0 to 2.90.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 37 versions ahead of your current version.

• The recommended version was released 24 days ago.

Release notes

Package name: @supabase/supabase-js

• 2.90.1 - 2026-01-08
  

  2.90.1 (2026-01-08)

  🩹 Fixes

  • postgrest: prevent shared state between query builder operations (#1978)
  • realtime: validate table filter in postgres_changes event dispatch (#1999)

  ❤️ Thank You

  • Vaibhav @ 7ttp
• 2.90.1-canary.1 - 2026-01-08
  

  2.90.1-canary.1 (2026-01-08)

  🩹 Fixes

  • postgrest: prevent shared state between query builder operations (#1978)

  ❤️ Thank You

  • Vaibhav @ 7ttp
• 2.90.1-canary.0 - 2026-01-07
  

  2.90.1-canary.0 (2026-01-07)

  🩹 Fixes

  • realtime: validate table filter in postgres_changes event dispatch (#1999)

  ❤️ Thank You

  • Vaibhav @ 7ttp
• 2.90.0 - 2026-01-07
  

  2.90.0 (2026-01-07)

  🚀 Features

  • realtime: expose heartbeat latency on heartbeat callback (#1982)

  🩹 Fixes

  • auth: add banned_until property to user type (#1989)
  • auth: add last_challenged_at property to factor type (#1990)
  • auth: clear initial setTimeout in stopAutoRefresh (#1993)
  • auth: preserve session when magic link is clicked twice (#1996)
  • auth: add configurable lock acquisition timeout to prevent deadlocks (#1962)
  • functions: auto-stringify object body when custom Content-Type header is provided (#1988)
  • postgrest: use post with return minimal for rpc head requests with object args (#1994)
  • supabase: split type-only exports to avoid unused import warnings (#1979)
  • supabase: inline string literal in databasewithoutinternals type (#1986)
  • supabase: avoid edge runtime warnings in next.js (#1998)

  ❤️ Thank You

  • Eduardo Gurgel
  • Nico Kempe @ nicokempe
  • Vaibhav @ 7ttp
  • yoshifumi kondo @ yoshifumi-kondo
• 2.89.1-canary.8 - 2026-01-07
  

  2.89.1-canary.8 (2026-01-07)

  🩹 Fixes

  • auth: add configurable lock acquisition timeout to prevent deadlocks (#1962)

  ❤️ Thank You

  • yoshifumi kondo @ yoshifumi-kondo
• 2.89.1-canary.7 - 2026-01-07
  

  2.89.1-canary.7 (2026-01-07)

  🩹 Fixes

  • functions: auto-stringify object body when custom Content-Type header is provided (#1988)
  • postgrest: use post with return minimal for rpc head requests with object args (#1994)

  ❤️ Thank You

  • Vaibhav @ 7ttp
• 2.89.1-canary.6 - 2026-01-05
  

  2.89.1-canary.6 (2026-01-05)

  🩹 Fixes

  • auth: preserve session when magic link is clicked twice (#1996)

  ❤️ Thank You

  • Vaibhav @ 7ttp
• 2.89.1-canary.5 - 2026-01-05
  

  2.89.1-canary.5 (2026-01-05)

  🩹 Fixes

  • auth: clear initial setTimeout in stopAutoRefresh (#1993)

  ❤️ Thank You

  • Vaibhav @ 7ttp
• 2.89.1-canary.4 - 2026-01-05
  

  2.89.1-canary.4 (2026-01-05)

  🩹 Fixes

  • supabase: avoid edge runtime warnings in next.js (#1998)

  ❤️ Thank You

  • Vaibhav @ 7ttp
• 2.89.1-canary.3 - 2026-01-05
  

  2.89.1-canary.3 (2026-01-05)

  🩹 Fixes

  • supabase: inline string literal in databasewithoutinternals type (#1986)

  ❤️ Thank You

  • Vaibhav @ 7ttp
• 2.89.1-canary.2 - 2026-01-05
• 2.89.1-canary.1 - 2025-12-23
• 2.89.1-canary.0 - 2025-12-23
• 2.89.0 - 2025-12-18
• 2.88.1-canary.1 - 2025-12-17
• 2.88.1-canary.0 - 2025-12-17
• 2.88.0 - 2025-12-16
• 2.87.4-canary.5 - 2025-12-16
• 2.87.4-canary.4 - 2025-12-16
• 2.87.4-canary.3 - 2025-12-16
• 2.87.4-canary.2 - 2025-12-16
• 2.87.4-canary.1 - 2025-12-16
• 2.87.4-canary.0 - 2025-12-15
• 2.87.3 - 2025-12-15
• 2.87.3-canary.1 - 2025-12-15
• 2.87.3-canary.0 - 2025-12-15
• 2.87.2 - 2025-12-15
• 2.87.2-canary.0 - 2025-12-15
• 2.87.1 - 2025-12-09
• 2.87.1-canary.1 - 2025-12-08
• 2.87.1-canary.0 - 2025-12-08
• 2.87.0 - 2025-12-08
• 2.86.3-canary.0 - 2025-12-05
• 2.86.2 - 2025-12-04
• 2.86.2-canary.0 - 2025-12-04
• 2.86.1 - 2025-12-04
• 2.86.1-canary.0 - 2025-12-04
• 2.86.0 - 2025-11-26

from @supabase/supabase-js GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
pulse-watch	Ready	Preview, Comment	Feb 8, 2026 2:05am

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• 🔍 Trigger a full review

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch snyk-upgrade-cf7cc91f6acd2172f0bebc4a410e87bf

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}