December 2024 Summaries

We recently conducted our first publicly accessible hack-the-base challenge, which saw over 290 participants. The challenge involved finding nine hidden flags within a Supabase project's database, requiring various techniques such as HTML inspection, DNS queries, and exploiting schema vulnerabilities. Participants had to navigate through a series of hoops, including client-side validation, using tools like Burp Suite and cURL, to uncover the flags. The final flag required connecting to an EC2 instance in AWS, installing a Postgres client, and querying a database table to retrieve the last piece of information. Overall, the challenge provided a comprehensive introduction to web application security testing and exploitation techniques.

Launch Week 13 brought an incredible array of new Supabase features that got developers' creative engines revving. The Launch Week 13 Hackathon was a huge success, with submissions showcasing exceptional technical skill and creativity. The team thoroughly enjoyed reviewing each project, making it challenging to select winners from such a strong pool of entries. Several projects stood out for their innovative use of AI, multiplayer capabilities, and visually appealing designs. The winners were selected based on various criteria, including the best overall project, best use of AI, most fun or Easter egg, most visually pleasing, best project built with bolt.new, and more. The prizes included Supabase swag kits and hoodies for the winners and runner-ups. The hackathon also highlighted the potential of bolt.new in building innovative projects.

Foreign Data Wrappers for Cal.com allow developers to create event bookings directly from Postgres, simplifying signup forms and reducing transactions. Cal.com is an open-source scheduling platform that integrates well with various use cases and has a great developer toolkit. To set up the Foreign Data Wrappers, users need to sign up on Cal.com and Supabase, enable wrappers in their Supabase account, create a Wasm wrapper and foreign server, and set up foreign tables for Event Types and Bookings. Users can then query data from Cal.com using SQL queries, making it easy to extract scheduling information such as event types, bookings, and attendee details. The process also involves inserting booking records directly from Postgres, which are verified to appear on the upcoming list in Cal.com. The Foreign Data Wrappers for Cal.com are built with Wrappers, a framework for Postgres Foreign Data Wrappers, supporting Wasm for simplified development of API-based services.

Over 150 participants from around the world, including top US universities, gathered at Y Combinator in San Francisco for an AI hackathon. The event featured over 40 teams and 47 projects ready to demo, with a semi-final round of judging and final presentations on stage. A diverse set of judges selected winners across several categories, including Overall Winner, Most Entertaining, Most Technically Impressive, and Most Novel Use of Supabase. The winning teams showcased innovative AI-powered solutions, such as a Twitter assistant, an app to find potential college dropouts, and a Supabase-powered rover that can dance. The event concluded with a celebration of the community and gratitude to hosts Y Combinator and sponsor Anthropic.

DBOS is a durable workflow engine that leverages the features of Postgres to store state in a lightweight and fast manner. It offers a unique approach to workflows by storing state in the user's own Postgres database, allowing for deterministic execution and exactly-once execution. DBOS provides several benefits over other workflow engines, including performance, idempotency, and the use of familiar Postgres tooling. The engine uses decorators to add logic to functions, allowing users to create workflows with a "save point" feature that can resume from the last checkpoint if a function fails. This design aligns with Supabase's philosophy of "just using Postgres", making it an attractive option for developers looking to build robust and efficient workflows.

Supabase is hosting its first Capture the Flag (CTF) challenge called "Hack the Base". This cybersecurity competition is open to participants of all skill levels. The objective is to find flags in an education partner's news site by identifying vulnerabilities and secrets. Participants can win prizes, gain recognition, and learn about common security issues. Challenges are designed for both beginners and advanced hackers, with hints released throughout the week. The competition will run from December 8th to December 14th, and participants can submit their flags via a dedicated CTF website. Additionally, Supabase offers a year-round Bug Bounty Program for security researchers interested in finding vulnerabilities on its platform.

Supabase introduces "Restore to a New Project," a tool for copying data from an existing project to a new one seamlessly. It integrates with daily physical backups and Point-in-Time Recovery (PITR) for flexible restoration options. The feature requires physical backups to be enabled and is available to all customers on a paid plan. Users can clone projects as many times as needed, making it ideal for testing and development environments. New projects created with this process will incur the usual compute and disk costs. Currently, cloning from an already cloned project is not supported but is being worked on.

The past week saw significant updates and launches from Supabase, including Supabase Cron for managing recurring tasks, an overhauled AI Assistant with additional capabilities, Edge Functions supporting WebSockets, Background Tasks, and ephemeral storage, a new version of the CLI with Configuration as Code support, high-performance disks offering increased durability and IOPS provisioning, the ability to restore projects from backups, and more. Additionally, Supabase partnered with over 20 other devtools for Launch Week, featuring events like Hack the Base Capture the Flag and a virtual hackathon with prizes for the best Supabase-based projects.

Database.build, an in-browser Postgres sandbox with AI assistance, has introduced new features including Bring-your-own-LLM (Large Language Model). Users can now connect their own LLMs via any OpenAI-compatible provider, allowing for more control and flexibility. The platform also offers live share capabilities, enabling users to connect to in-browser PGlite databases from outside the browser using any PostgreSQL client. Additionally, deployments have been added, allowing users to easily deploy their databases to cloud database providers such as Supabase.

Supabase introduces high performance disks that can store up to 60 TB of data with 100x improved durability, and provision up to 5x more IOPS than the default disks. The company tackles disk scalability from two angles: software improvements through Oriole DB's index-organized tables and infrastructure enhancements via new disk options for Postgres databases. These high performance disks offer increased storage capacity, improved IOPS (up to 80,000), and enhanced durability (99.999%). The company also redesigned its disk management interface to coexist with the compute upgrade UI, providing real-time cost updates and clear breakdowns of billing changes. Pricing for high performance disks starts at $0.195 per GB, with additional IOPS provisioning available at $0.119 per IOPS.

Supabase Queues is a durable Message Queue designed to improve the scalability and resilience of applications by managing background task processing. Built on the pgmq extension by Tembo, it works seamlessly with the entire Supabase platform. Key features include Postgres native support, granular authorization, guaranteed message delivery, exactly once message delivery, queue management and monitoring, and message durability and archival. Queues can be used for asynchronous task processing, communication between services, and load balancing. The functionality runs entirely in the database with no additional costs.

Supabase Cron, a new Postgres module, has been released to simplify and streamline recurring jobs within databases. Built on the pg_cron extension by Citus Data, it seamlessly integrates with the entire Supabase platform. Users can create jobs to run SQL snippets, call database functions, and execute remote webhooks. The module supports four types of jobs: SQL Snippets, Database Functions, HTTP Requests (webhooks), and Supabase Edge Functions. Jobs can be created via the Dashboard or SQL, with options for scheduling using standard cron syntax or natural language. Users can also view job history and logs in the Dashboard.

Supabase has released version 2 of its Command Line Interface (CLI), adding support for Configuration as Code. This feature allows users to commit the configuration for all their projects and branches into version control systems like Git, ensuring reproducible environments for their entire team. The CLI is now focused on deployment tools, with popular use cases including migrating production databases, deploying functions, and running pgTAP tests. Supabase's Configuration as Code feature uses a human-readable config.toml file to make deployments consistent and repeatable across different environments.

The text introduces three new features: Background Tasks, Ephemeral File Storage, and WebSockets for Edge Functions. These features enable developers to execute long-running workloads, access temporary storage, and establish inbound and outbound WebSocket connections. Examples of real-world applications using these features are provided, such as processing a batch of files and uploading the results to Supabase Storage, extracting a zip file and uploading its content to Supabase Storage, and building an authenticated relay to OpenAI Realtime API. The text also mentions performance and stability improvements made to Edge Functions in recent months and hints at customizable compute limits as part of their upcoming roadmap for 2025.

Supabase Assistant v2 has been released with new features such as Postgres schema design, data queries and charting, error debugging, Postgres RLS Policies creation and editing, Postgres Functions creation and editing, Postgres Triggers creation and editing, and SQL to supabase-js conversion. The new version is more extensible and uses a flexible system of components, tools, and APIs. It can provide context manually or automatically based on the page being visited in the Dashboard. The Supabase Assistant v2 also helps with schema design, writing SQL queries, debugging database errors, discovering data insights through natural language queries, converting SQL to REST using the supabase-js library, and creating/editing RLS Policies, Postgres Functions, and Triggers.

Today, Supabase is releasing the Public Alpha of OrioleDB, a storage extension designed as a drop-in replacement for Postgres' default Heap storage. However, this initial release has limitations and should not be used for Production workloads. It is currently only available to Free organizations and supports only B-Tree index type. The goal of adding OrioleDB to the platform is to gather feedback from testers. To get started with OrioleDB, choose "Postgres with OrioleDB" under the "Advanced Configuration" section when launching a new database on database.new.