Skip to content

Conversation

@zenoUsman
Copy link

@zenoUsman zenoUsman commented Jan 6, 2026

Changes

  • Upgraded supabase studio to 2026.01.05-sha-1077b50
  • fix(service): supabase studio fails to load schemas

React2Shell improvement according to 2025-55182 / CVE-2025-66478 the version of supabase studio 15.5.2 still effected needed to upgrade to 16.0.10 2026.01.05-sha-1077b50
@ShadowArcanist ShadowArcanist changed the base branch from v4.x to next January 6, 2026 07:12
@ShadowArcanist
Copy link
Member

The CVE is already fixed by #7711 no?

@ShadowArcanist ShadowArcanist added 💤 Waiting for feedback Issues awaiting a response from the author. ⚙️ Service Issues requesting or PRs adding/fixing service templates. labels Jan 6, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Jan 6, 2026

Hi @zenoUsman! 👋

It appears to us that you are either adding a new service or making changes to an existing one.
We kindly ask you to also review and update the Coolify Documentation to include this new service or it's new configuration needs.
This will help ensure that our documentation remains accurate and up-to-date for all users.

Coolify Docs Repository: https://github.com/coollabsio/coolify-docs
How to Contribute a new Service to the Docs: https://coolify.io/docs/get-started/contribute/service#adding-a-new-service-template-to-the-coolify-documentation

@zenoUsman
Copy link
Author

zenoUsman commented Jan 6, 2026

The CVE is already fixed by #7711 no?

no the CVE still exist in 15.5.2 version according to article of next js, the current supabase studio on coolify runs on 15.5.2 the CVE fixed in 15.5.9 version and current version of official supabase studio image is running on 16.0.10 with cli version 2.67.1. so updating the image version needed to fix CVE.
Screenshot 2026-01-06 121638

@ShadowArcanist
Copy link
Member

The CVE is already fixed by #7711 no?

no the CVE still exist in 15.5.2 version according to article of next js, the current supabase studio on coolify runs on 15.5.2 the CVE fixed in 15.5.9 version and current version of official supabase studio image is running on 16.0.10 with cli version 2.67.1. so updating the image version needed to fix CVE. Screenshot 2026-01-06 121638

I just deployed a brand new supabase using the template we currently have at Coolify and studio is using "next": "^16.0.10", so the PR I mentioned on my previous comment actually patched the CVE with image: supabase/studio:2025.12.17-sha-43f4f7f.
image

@ShadowArcanist ShadowArcanist changed the title React2Shell version upgradation in Supabase Studio fix(service): Supabase Studio fails to load schemas Jan 6, 2026
@zenoUsman
Copy link
Author

Okay mine when update to that version it's install 15.5.2 then I added latest version after that 16.0.10 appeared.

@zenoUsman
Copy link
Author

zenoUsman commented Jan 6, 2026

Second problem without new two variables the supabase studio can't communicate with database which shows schema error when you visit supabase dashboard

@Cinzya Cinzya linked an issue Jan 6, 2026 that may be closed by this pull request
@ShadowArcanist
Copy link
Member

Okay mine when update to that version it's install 15.5.2 then I added latest version after that 16.0.10 appeared.

I again tried deploying supabase in a completely different Coolify instance using the service template and it was using Nextjs 16.0.10 so our current template is not vulnerable to react2shell CVE. You have updated the docker image tag to new version which is a good thing ^^

So this PR mainly fixes the issue with db schema!

@ShadowArcanist ShadowArcanist added Ready to merge and removed 💤 Waiting for feedback Issues awaiting a response from the author. labels Jan 7, 2026
@peaklabs-dev peaklabs-dev changed the title fix(service): Supabase Studio fails to load schemas fix(service): supabase studio fails to load schemas Jan 7, 2026
@peaklabs-dev
Copy link
Member

Thanks for the PR. I fixed this on next ccda7db.

Next time make sure variables are named the same and also that you do not open a PR from your v4.x branch.

@github-actions github-actions bot removed ⚙️ Service Issues requesting or PRs adding/fixing service templates. Ready to merge labels Jan 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants