# Changelog

## Score

- CAI 64 → 66 (+1.8)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 64 → 87 (+22.9)
- Architecture 98 → 98 (+0.0)
- Maturity 62 → 61 (-0.5)
- Readiness 63 → 63 (+0.0)
- Security 65 → 65 (+0.0)
- Domain Modelling 100 → 100 (+0.0)
- Performance 65 → 78 (+13.4)

## Resolved (5)

- Change coupling: auth_client.dart ↔ mfa.dart (packages/supabase_auth/lib/src/auth_client.dart)
- Hotspot: packages/supabase/lib/src/supabase_stream_builder.dart (packages/supabase/lib/src/supabase_stream_builder.dart)
- Off-boarding risk: anonymized user #1
- PostgrestBuilder._executeWithRetry (cognitive 18) (packages/postgrest/lib/src/postgrest_builder.dart)
- TodoComment (packages/supabase_auth/lib/src/types/jwt.dart)

## New (17)

- AuthClient._doRefresh (cyclomatic 17) (packages/supabase_auth/lib/src/auth_client.dart)
- Change coupling: storage_bucket_api.dart ↔ storage_file_api.dart (packages/supabase_storage/lib/src/storage_bucket_api.dart)
- ClassTooLong: StorageFileApi (packages/supabase_storage/lib/src/storage_file_api.dart)
- Documentation: no project overview (README.md)
- Documentation: written for insiders (packages/supabase_test/README.md)
- Duplicated block (5 lines × 2) (packages/supabase_flutter/lib/src/shared_preferences_auth_async_storage.dart)
- FileTooLong: src/postgrest_builder.dart (packages/postgrest/lib/src/postgrest_builder.dart)
- FileTooLong: src/resumable_upload.dart (packages/supabase_storage/lib/src/resumable_upload.dart)
- FileTooLong: src/storage_file_api.dart (packages/supabase_storage/lib/src/storage_file_api.dart)
- Leaked secret: password-hash-credential (supabase/migrations/20240101000002_gotrue_reset.sql)
- Low cohesion: SupabaseClient (LCOM4 4) (packages/supabase/lib/src/supabase_client.dart)
- Off-boarding risk: anonymized user #1
- PostgrestHttpTableExecutor._transforms (cognitive 20) (packages/postgrest/lib/src/postgrest_table_executor.dart)
- PostgrestHttpTableExecutor._transforms (cyclomatic 16) (packages/postgrest/lib/src/postgrest_table_executor.dart)
- ResumableUpload._run (cognitive 67) (packages/supabase_storage/lib/src/resumable_upload.dart)
- ResumableUpload._run (cyclomatic 27) (packages/supabase_storage/lib/src/resumable_upload.dart)
- TooManyMethods: PostgrestBuilder (packages/postgrest/lib/src/postgrest_builder.dart)

## Changes since last survey

- 70 commits — 37 feature/other, 33 fixes

## By area

- packages/postgrest — 16 commits
- packages/supabase_auth — 15 commits
- packages/supabase_typegen — 10 commits
- packages/supabase_storage — 9 commits
- .github/workflows — 6 commits
- packages/supabase — 6 commits
- packages/supabase_realtime — 4 commits
- (root) — 2 commits
- .github/CODEOWNERS — 1 commit
- packages/supabase_common — 1 commit

## Notable commits

- fix: fix!: decode unknown server values for open-set enums instead of throwing (#1953)
- fix: fix!: throw AccessTokenException when the accessToken callback fails (#1989)
- fix: fix(auth)!: decode omitted OAuthClient fields and drop the unused scope (#1957)
- fix: fix(auth)!: throw AuthSessionMissingException when a token response has no session (#1970)
- fix: fix(auth)!: throw when a client has no asyncStorage for the pkce flow (#1971)
- fix: fix(auth)!: verify ES256 tokens in getClaims (#1916)
- fix: fix(auth): check persistSession up front and give examples a storage (#1972)
- fix: fix(auth): decode OAuth clients that omit redirect_uris or grant_types (#1923)
- fix: fix(auth): expire the cached JWKS in getClaims after its TTL (#1946)
- fix: fix(auth): only apply an updateUser response to the session of the same user (#1936)
- fix: fix(auth): refreshing a different invalid token signs out the current session (#1922)
- fix: fix(auth): share JWKS fetches in getClaims and limit refetches for unknown kids (#1948)
- fix: fix(postgrest)!: key aggregates and casts by their own expression (#1988)
- fix: fix(postgrest)!: order() no longer forces NULLS LAST by default (#1912)
- fix: fix(postgrest): address a hinted embed by its table name outside the select list (#1962)
- fix: fix(postgrest): encode null, nested list and map values in rpc GET parameters (#1926)
- fix: fix(postgrest): key long JSON paths by a SHA-256 digest of the expression (#1924)
- fix: fix(postgrest): read a JSON path ending in an array index under the key PostgREST answers with (#1915)
- fix: fix(postgrest): strip nulls on plain and single() responses (#1910)
- fix: fix(realtime): do not flush a join that its channel has since resent (#1986)
- …and 50 more