gotrue

• FIX(gotrue): parse expires_in as num in Session.fromJson (#1719). (6c8047ee)

• REFACTOR(supabase_common): share the local stack test configuration (#1640). (a08f06d3)

• FIX(gotrue): OAuth server throws FormatException instead of ArgumentE… (#1535). (da0f6e02)
• FEAT(gotrue): add custom OAuth providers admin API with custom_claims_allowlist (#1519). (122e5cf2)
• BREAKING FIX(gotrue): handle already-consented OAuth authorization responses (#1536). (22d41234)

Note: This release has breaking changes.

• FIX(gotrue): OAuth server throws FormatException instead of ArgumentE… (#1535). (da0f6e02)
• FEAT(gotrue): add custom OAuth providers admin API with custom_claims_allowlist (#1519). (122e5cf2)
• BREAKING FIX(gotrue): handle already-consented OAuth authorization responses (#1536). (22d41234)

• FEAT(gotrue): add shouldSoftDelete option to admin deleteUser (#1513). (30e9f22f)

• FIX(gotrue): handle access token without amr claim in getAuthenticatorAssuranceLevel (#1478). (63a91f2e)
• FIX(gotrue): allow TOTP MFA enrollment without an issuer (#1501). (3a84e4e5)
• FEAT(gotrue): add user-facing OAuth 2.1 server authorization API (#1499). (4f98f493)

• REFACTOR(gotrue): extract PKCE code challenge generation into a helper (#1460). (3252ca71)
• FIX(gotrue): copy request header/query maps before mutating them (#1476). (fe8a84d0)
• FIX(auth): recognize error query parameter in auth callback redirects (#1472). (cb7e7e62)
• FIX(gotrue): avoid duplicate auth error on recoverSession with invalid refresh token (#1450). (a154852f)
• FIX(gotrue): include code challenge in resend with PKCE flow (#1469). (33402e80)
• FIX(gotrue): don't throw in verifyOTP when secure email/phone change returns no session (#1448). (44300aca)
• FIX: correctness fixes across gotrue, postgrest, storage, supabase and supabase_flutter (#1445). (bf31389d)
• FEAT(gotrue): surface the sign-out reason on the signedOut event (#1453). (a182b204)
• DOCS(gotrue): clarify Session.expiresAt is in seconds (#1447). (9dffae17)

• FIX(gotrue): support asymmetric JWTs in getClaims (#1410). (cc3137f9)
• FIX: raise min Dart SDK to 3.4.0 across all packages (#1409). (311f883f)
• FIX(auth): update session on email change links in PKCE flow (#1395). (6b7871d9)
• FIX(gotrue): prevent stale token refresh from overwriting concurrent session changes (#1351). (368609ab)
• FIX(auth): avoid reusing a stale refresh token in recoverSession (#1391). (de2adf99)
• FEAT(gotrue): add passkey (WebAuthn) support (#1392). (3e890b57)

• FEAT: rename anon key → publishable key, service role key → secret key (#1360). (d4e23707)
• DOCS(gotrue): require onError handler in onAuthStateChange (#1355). (74bb1725)

• FIX(types): improve JSON decoding resilience (#1301). (1523f5d6)
• FEAT(postgrest): add automatic retry for transient failures (#1338). (fb1da8b2)
• FEAT(auth): add optional accessToken parameter to setSession() (#1327). (a95d1c01)
• FEAT(gotrue): convert OAuthProvider from enum to class for custom provider support (#1339). (8966c6e9)
• DOCS(gotrue): document the _refreshTokenCompleter concurrent-request deduplication pattern (#1342). (fad2bb75)

• FIX(auth): fix getClaims() crash with asymmetric JWTs on first call (#1300). (207ed5f7)
• FIX(auth): fix verifyOTP parameter validation for OtpType.recovery with tokenHash (#1295). (0719e55b)
• FEAT(auth): add X (OAuth 2.0) provider (#1290). (c2305388)

• FIX(gotrue): allow refreshSession with refreshToken when no current session exists (#1263). (1d142c12)
• FEAT(oauth): add updateClient method to admin OAuth API (#1262). (36d73343)
• DOCS: update signInWithIdToken provider documentation (#1264). (b10d0c88)

• REFACTOR(supabase_common): share the local stack test configuration (#1640). (a08f06d3)
• REFACTOR(supabase): rename stream regex filters and cover stream filters with tests (#1639). (b9c31bb2)
• FIX(functions): never send new-format API key as Bearer; warn on unrecognized sb_ key subtype (#1615). (1e5a379b)
• FEAT: support more realtime filters and multiple filters for stream (#1610). (54470639)

• FEAT(gotrue): add OAuth 2.1 client admin endpoints (#1244). (ebc4c208)

• REFACTOR(supabase): convert private stream-builder holders to records (#1575). (58c2dad4)
• REFACTOR: modernize dart syntax across client packages (#1574). (b74fdfee)
• REFACTOR: extract shared code into supabase_common package (#1573). (46601bbb)
• REFACTOR(supabase): drop rxdart dependency (#1569). (51dcf0f4)
• FIX(supabase_common): align platform stats casing with other SDKs (#1596). (97a6fa6e)
• FIX(realtime_client): faster channel rejoin on web (#1471). (bc06a310)
• FEAT(realtime): defer socket disconnect when channels become empty (#1589). (0055d1dc)
• FEAT(postgrest): configurable auto-retry and request timeout (#1560). (59d4b3af)
• FEAT(client): add opt-in trace context propagation headers (#1564). (85780e60)
• FEAT(auth): add async getSession() with on-demand refresh (#1563). (0b1d9b6b)

• FEAT(gotrue): Implement linkIdentityWithIdToken method (#1206). (53a2427a)

• FEAT(realtime_client): support new postgres changes filter operators, multi-filter, column selection, and replication-ready events (#1526). (1f9d2951)

• REFACTOR(gotrue): Remove unused _currentUser field and update currentUser documentation. (#1168). (88ed5d88)
• FIX(auth): Validate uuid params in admin methods (#1171). (369dcc24)
• FEAT(gotrue): Remove client-side provider validation for signInWithIdToken (#1209). (e8d40d64)
• FEAT(gotrue): Add phone mfa enrollment (#1188). (944afcde)
• DOCS: Update auth error codes link (#1215). (86330d19)

• REFACTOR(supabase_common): share the local stack test configuration (#1640). (a08f06d3)
• FIX(realtime): forward all caller opts from track() to send() (#1620). (64298be1)
• FIX(realtime): UTF-8 encode broadcast header fields in serializer (#1618). (86afeb2c)
• FIX(realtime_client): stop throwing internally when converting null cell values (#1612). (42068e47)
• FEAT(realtime): block adding postgres_changes listener after subscribe (#1617). (3592fda3)

• REFACTOR(gotrue): Remove unused _currentUser field and update currentUser documentation. (#1168). (88ed5d88)
• FIX(auth): Validate uuid params in admin methods (#1171). (369dcc24)
• FEAT(gotrue): Add phone mfa enrollment (#1188). (944afcde)

• REFACTOR: modernize dart syntax across client packages (#1574). (b74fdfee)
• REFACTOR: extract shared code into supabase_common package (#1573). (46601bbb)
• FIX(realtime_client): faster channel rejoin on web (#1471). (bc06a310)
• FIX(realtime): patch channel join payloads with access token before flushing (#1553). (e5de0c07)
• FEAT(realtime): defer socket disconnect when channels become empty (#1589). (0055d1dc)

• Require Dart >=3.3.0
• FIX: Dispose supabase client after flutter web hot-restart (#1142). (ce582e3e)
• FIX(gotrue): AuthException .toString method (#1148). (42fdc910)
• FIX(gotrue): Handle empty error response (#1143). (591bb82f)
• FEAT(gotrue,supabase,supabase_flutter,realtime_client): Use web package to access web APIs (#1135). (dfa71c9a)

• FIX: Ignore email and phone assertions when token hash is being verified (#1097). (c9717861)

• FEAT(realtime_client): support new postgres changes filter operators, multi-filter, column selection, and replication-ready events (#1526). (1f9d2951)

• FIX: Add equality to user attributes classes (#1070). (7e7bc0ca)
• FIX: Updated gotrue types.dart to include slackOidc (#1066). (12007b32)
• FIX: Send metadata inviteUserByEmail() (#1061). (598540d2)
• FEAT: Add Keycloak Provider on signInWithIdToken (#1068). (be998fda)

• FIX(realtime): preserve nested empty maps in Message.toJson() (#1518). (1777a225)
• FIX(realtime): escape quotes and backslashes in in filter values (#1506). (30349e22)
• FEAT(realtime): add onHeartbeat stream to RealtimeClient (#1517). (d8c66cb0)

• FIX: Rename logger from gotrue to auth (#1055). (eea1ea6c)
• FEAT: Add logging (#1042). (d1ecabd7)

• REFACTOR: modernize dart syntax across client packages (#1574). (b74fdfee)
• REFACTOR: extract shared code into supabase_common package (#1573). (46601bbb)
• FEAT(postgrest): configurable auto-retry and request timeout (#1560). (59d4b3af)
• FEAT(postgrest): abort requests (#1368). (c267e4fa)
• FEAT(database): add dryRun and stripNulls query modifiers (#1559). (896bc1f7)

• FIX: Support all mfa auth methods (#1030). (773b7de7)
• FEAT: Broadcast auth events to other tabs on web (#1005). (8f473f1a)

• FIX: Allow null to be returned from accessToken function when the user is not signed in (#1099). (d04d9e63)
• DOCS: Fix typos (#1108). (46b483f8)

2025-01-01

Changes

Packages with breaking changes:

• There are no breaking changes in this release.

Packages with other changes:

• postgrest - v2.4.1
• supabase - v2.6.2
• supabase_flutter - v2.8.3

Packages with dependency updates only:

Packages listed below depend on other packages in this workspace that have had changes. Their versions have been incremented to bump the minimum dependency versions of the packages they depend upon in this project.

• supabase - v2.6.2
• supabase_flutter - v2.8.3

• FIX: Added missing error codes for AuthException (#995). (4e0270a0)
• FIX: Upgrade web_socket_channel for supporting web: ^1.0.0 and therefore WASM compilation on web (#992). (7da68565)

• FIX: Add error_code from url to AuthException (#968). (c741fe9d)
• FIX: Add magiclink as authenticaiton method in mfa (#967). (4a871773)

• FIX: Store actual error in AuthException (#959). (aa6c2183)

2024-06-17

Changes

Packages with breaking changes:

• There are no breaking changes in this release.

Packages with other changes:

• gotrue - v2.8.1
• supabase - v2.2.2
• supabase_flutter - v2.5.6

Packages with dependency updates only:

Packages listed below depend on other packages in this workspace that have had changes. Their versions have been incremented to bump the minimum dependency versions of the packages they depend upon in this project.

• supabase - v2.2.2
• supabase_flutter - v2.5.6

• FIX: Store actual error in AuthException (#959). (aa6c2183)

• FIX: Support custom access token (#1073). (fc9ad2c9)

2024-10-07

Changes

Packages with breaking changes:

• There are no breaking changes in this release.

Packages with other changes:

• functions_client - v2.4.0
• gotrue - v2.10.0
• postgrest - v2.3.0
• realtime_client - v2.4.0
• storage_client - v2.2.0
• supabase - v2.5.0
• supabase_flutter - v2.8.0

• FIX: Make token in verifyOtp nullable (#950). (0e69c58f)

• REFACTOR(supabase_common): share the local stack test configuration (#1640). (a08f06d3)
• FEAT(storage): add purgeCache to invalidate CDN cache for a single object (#1607). (4acd0a01)

• FIX(gotrue): Signing in does not remove the session unless the operation succeeds. (#945). (b2854c56)
• FEAT: Add zoom as a OAuth provider (#944). (98718b13)

• REFACTOR: extract shared code into supabase_common package (#1573). (46601bbb)
• FEAT(functions): add request cancellation to invoke via abortSignal (#1593). (b994dabd)
• FEAT(functions): expose FunctionsFetchException/FunctionsRelayException/FunctionsHttpException subtypes (#1545). (2d3a7202)

• FEAT(goture): Allow OAuthProvider.kakao for signInWithIdToken (#922). (e21db454)

• FIX: raise min Dart SDK to 3.4.0 across all packages (#1409). (311f883f)

• FIX: Add newEmail to admin generateLink method (#904). (5697e206)
• FIX: Weak password throws AuthWeakPasswordException. (#897). (4f5b853c)

• FEAT(storage): add download option to signed and public URLs (#1514). (2c0370c1)
• FEAT(storage): add upsert option to createSignedUploadUrl (#1515). (6f6ea5cd)

• FIX: Typos in gotrue_client.dart (#882). (54a0b979)
• FEAT(gotrue): Add signInAnonymously() method (#883). (2e636131)
• FEAT(gotrue,supabase_flutter): New auth token refresh algorithm (#879). (99931681)

• FIX(storage): make dedicated storage host opt-in via useNewHostname flag (#1329). (a6640823)

• FIX: Correct the id value passed to .unlinkIdentity() method (#841). (0585cdde)
• FIX(gotrue,supabase_flutter): Throw error when parsing auth URL that contains an error description. (#839). (afc4ce51)

• FEAT(storage): add setHeader method for custom HTTP headers (#1313). (99231538)
• FEAT(storage): add queryParams support to download method (#1291). (6f56c193)
• FEAT(storage_client): use dedicated storage host for storage lib (allows >50GB uploads) (#1285). (8e0993c6)

2025-12-10

Changes

Packages with breaking changes:

• There are no breaking changes in this release.

Packages with other changes:

• gotrue - v2.18.0
• postgrest - v2.6.0
• realtime_client - v2.7.0
• supabase_flutter - v2.12.0
• supabase - v2.10.2

Packages with dependency updates only:

Packages listed below depend on other packages in this workspace that have had changes. Their versions have been incremented to bump the minimum dependency versions of the packages they depend upon in this project.

• supabase - v2.10.2

• FEAT: Add token hash to verifyOtp (#813). (a789d795)

• REFACTOR: Remove unnecessary parentheses in Bucket.fromJson (#1201). (d729fa46)
• FIX(storage): Resolve MultipartRequest finalization error in retry mechanism (#1208). (2b818e08)

• FIX(gotrue): Set _currentUser when setting initial session (#806). (042f3c6d)

• FEAT(storage_client): Custom-metadata, exists, info methods (#1023). (4d3f4bf5)

• FEAT(gotrue,supabase_flutter): Add signInWithSSO method (#798). (87c16327)

• FEAT: Support mime 2.0.0 (#1079).

• FEAT: Add linkedin_oidc OAuthProvider (#791). (09664281)

• FEAT: Add logging (#1042). (d1ecabd7)

• FIX(gotrue): Fix the issue where verfiyOTP emits signIn instead of passwordRecovery auth event. (#774). (fc426134)
• FEAT(gotrue,supabase_flutter): Add identity linking and unlinking methods. (#760). (6c0c922d)

• FEAT: Add debugName parameter to YAJsonIsolate. (#1118). (23ffc0e9)

2025-02-24

Changes

Packages with breaking changes:

• There are no breaking changes in this release.

Packages with other changes:

• functions_client - v2.4.1
• realtime_client - v2.4.2
• storage_client - v2.3.1
• supabase - v2.6.3
• supabase_flutter - v2.8.4

• FEAT: add getUser() method. (62dcb8c6)

2023-12-05

Changes

Packages with breaking changes:

• realtime_client - v2.0.0-dev.3
• postgrest - v2.0.0-dev.2
• supabase - v2.0.0-dev.4

Packages with other changes:

• gotrue - v2.0.0-dev.2
• supabase_flutter - v2.0.0-dev.4

• Graduate package to a stable release. See pre-releases prior to this version for changelog entries.

• FIX: PKCE flow not emitting password recovery event (#744). (65859bd2)
• FIX: sign out on already used refresh token (#740). (72ffb9ee)
• FIX(gotrue): signing in with pkce flow fires two signedIn auth event (#734). (6dee1660)
• FEAT(gotrue): add Figma to OAuth provider. (#743). (f5b72d47)

• FIX: issue where .range() not respecting the offset given. (#722). (e3541a46)
• FEAT: adds geojson support for working with the PostGIS extension (#721). (60a25153)
• FEAT: adds .explain() for debugging performance issues on Supabase client generated queries. (#719). (f6e41578)

• FIX(gotrue): allow empty session response for verifyOtp method (#680). (dc6146dc)

• FIX(functions_client): use header for response parsing (#616). (e413acbb)
• BREAKING REFACTOR: use Dart 3 (#598). (02c4071a)
• BREAKING FIX: throw exception on non 2xx status (#629). (db5ec824)
• BREAKING FEAT: use Object? instead of dynamic (#606). (0c6caa00)

Note: This release has breaking changes.

• FIX: token refresh doesn't block on ClientException (#660). (a5ef8b71)
• FIX(gotrue,supabase): allow refreshSession after exception (#633). (8853155f)
• FEAT(supabase_flutter): use SharedPreferences for access token (#608). (9d72a59d)
• BREAKING REFACTOR: many auth breaking changes (#636). (7782a587)
• BREAKING REFACTOR: use Dart 3 (#598). (02c4071a)

• FIX(gotrue): allow empty session response for verifyOtp method (#680). (dc6146dc)

2023-10-23

Changes

Packages with breaking changes:

• There are no breaking changes in this release.

Packages with other changes:

• realtime_client - v2.0.0-dev.1
• supabase - v2.0.0-dev.1
• supabase_flutter - v2.0.0-dev.1

Packages with dependency updates only:

Packages listed below depend on other packages in this workspace that have had changes. Their versions have been incremented to bump the minimum dependency versions of the packages they depend upon in this project.

• supabase - v2.0.0-dev.1
• supabase_flutter - v2.0.0-dev.1

• FIX(gotrue): allow empty session response for verifyOtp method (#680). (dc6146dc)

• FIX(gotrue): remove import of dart:io from gotrue_client.dart (#659). (7280b490)
• FIX: compile with webdev (#653). (23242287)
• FIX(gotrue,supabase): allow refreshSession after exception (#633). (8853155f)

• FIX(gotrue): remove import of dart:io from gotrue_client.dart (#659). (7280b490)

2023-10-05

Changes

Packages with breaking changes:

• There are no breaking changes in this release.

Packages with other changes:

• gotrue - v1.12.3
• storage_client - v1.5.3
• supabase - v1.11.8
• supabase_flutter - v1.10.21

Packages with dependency updates only:

Packages listed below depend on other packages in this workspace that have had changes. Their versions have been incremented to bump the minimum dependency versions of the packages they depend upon in this project.

• supabase - v1.11.8
• supabase_flutter - v1.10.21

• FIX(gotrue): remove import of dart:io from gotrue_client.dart (#659). (7280b490)

• FIX: compile with webdev (#653). (23242287)

• FIX(gotrue,supabase): allow refreshSession after exception (#633). (8853155f)

• FIX(gotrue): export everything in constants.dart and hide what we want to hide instead of using show (#617). (24df174f)

2023-09-04

Changes

Packages with breaking changes:

• There are no breaking changes in this release.

Packages with other changes:

• gotrue - v1.12.0
• storage_client - v1.5.2
• supabase - v1.11.2
• supabase_flutter - v1.10.15

Packages with dependency updates only:

Packages listed below depend on other packages in this workspace that have had changes. Their versions have been incremented to bump the minimum dependency versions of the packages they depend upon in this project.

• supabase - v1.11.2
• supabase_flutter - v1.10.15

• FIX(gotrue): export everything in constants.dart and hide what we want to hide instead of using show (#617). (24df174f)

• FEAT(gotrue): add WhatsApp support for OTP login (#613). (40da5be2)

• FIX(gotrue): export SignOutScope (#576). (2bd6e459)

• FIX(realtime_client,supabase): pass apikey as the initial access token for realtime client (#596). (af8e368b)

• FIX(supabase): get jwt on http call (#540). (e044d3ca)
• FIX(gotrue): remove OtpType deprecation and add assertion to check type for resend method (#567). (d4509de3)

• FEAT: add logLevel parameter to RealtimeClientOptions (#592). (76e9fc20)

• FEAT(gotrue): add reauthenticate and resend method (#517). (35a924b9)

• FEAT(postgrest,supabase): add useSchema() method for making rest API calls on custom schema. (#525). (40a0f090)

2023-08-01

Changes

Packages with breaking changes:

• There are no breaking changes in this release.

Packages with other changes:

• gotrue - v1.11.2
• realtime_client - v1.1.3
• supabase - v1.9.9
• supabase_flutter - v1.10.11

Packages with dependency updates only:

Packages listed below depend on other packages in this workspace that have had changes. Their versions have been incremented to bump the minimum dependency versions of the packages they depend upon in this project.

• supabase - v1.9.9
• supabase_flutter - v1.10.11

• REFACTOR(gotrue): add email otptype (#534). (b5fe3d32)
• FIX(gotrue): add pkce to signup (#533). (5b3308a4)
• FEAT(gotrue): add scope to signOut (#530). (94a1cceb)

• FEAT(gotrue): add accessToken to signInWithIdToken method (#520). (4dcd5968)

2023-06-19

Changes

Packages with breaking changes:

• There are no breaking changes in this release.

Packages with other changes:

• gotrue - v1.8.4
• supabase - v1.9.4
• supabase_flutter - v1.10.4

Packages with dependency updates only:

Packages listed below depend on other packages in this workspace that have had changes. Their versions have been incremented to bump the minimum dependency versions of the packages they depend upon in this project.

• supabase - v1.9.4
• supabase_flutter - v1.10.4

• FEAT(gotrue): add accessToken to signInWithIdToken method (#520). (4dcd5968)

• FIX(gotrue): Add missing members on User json serialization (#512). (70cc835b)
• FIX(gotrue): only remove session in otp verification if it's not email change or phone change (#514). (23bed82c)

2023-06-12

Changes

Packages with breaking changes:

• There are no breaking changes in this release.

Packages with other changes:

• functions_client - v1.3.2
• gotrue - v1.8.3
• postgrest - v1.3.2
• realtime_client - v1.1.1
• storage_client - v1.5.1
• supabase - v1.9.3
• yet_another_json_isolate - v1.1.1
• supabase_flutter - v1.10.3

Packages with dependency updates only:

Packages listed below depend on other packages in this workspace that have had changes. Their versions have been incremented to bump the minimum dependency versions of the packages they depend upon in this project.

• supabase_flutter - v1.10.3

• FIX(gotrue): Add missing members on User json serialization (#512). (70cc835b)
• FIX(gotrue): only remove session in otp verification if it's not email change or phone change (#514). (23bed82c)

• REFACTOR: bump minimum Dart SDK version to 2.17.0 (#510). (ed927ee0)

• FIX(gotrue): catch some errors in signOut (#501). (03fa8be7)

• FIX: Update http dependency constraints (#491). (825d0737)

• FIX: reformat Provider type to be ordered alphabetically (#471). (c3a1dbb3)
• FEAT: update dependency constraints to sdk < 4.0.0 (#474). (7894bc70)
• FEAT: Add kakao provider enum type (#470). (9a1bb334)

• chore: move the repo into supabase-flutter monorepo