feat(repo): remove node-fetch dependency, require Node.js 20+

Author: mandarini

.github/workflows/ci-auth-js-node18.yml

@@ -41,15 +41,26 @@
 
 This monorepo contains the complete suite of Supabase JavaScript SDK:
 
-| Library                                                    | Description                              |
-| ---------------------------------------------------------- | ---------------------------------------- |
+| Library                                                    | Description                           |
+| ---------------------------------------------------------- | ------------------------------------- |
 | **[@supabase/supabase-js](./packages/core/supabase-js)**   | Main isomorphic SDK for Supabase      |
 | **[@supabase/auth-js](./packages/core/auth-js)**           | Authentication SDK                    |
 | **[@supabase/postgrest-js](./packages/core/postgrest-js)** | PostgREST SDK for database operations |
 | **[@supabase/realtime-js](./packages/core/realtime-js)**   | Real-time subscriptions SDK           |
 | **[@supabase/storage-js](./packages/core/storage-js)**     | File storage SDK                      |
 | **[@supabase/functions-js](./packages/core/functions-js)** | Edge Functions SDK                    |
 
+## Requirements
+
+- **Node.js 20 or later** (Node.js 18 support was dropped as of October 31, 2025)
+- For browser support, all modern browsers are supported
+
+> ⚠️ **Node.js 18 Deprecation Notice**
+>
+> Node.js 18 reached end-of-life on April 30, 2025. As announced in [our deprecation notice](https://github.com/supabase/supabase-js/discussions/37217), support for Node.js 18 was dropped on October 31, 2025.
+>
+> If you must use Node.js 18, please use version `2.x.x` of these libraries where `x` is the last version that supported Node.js 18.
+
 > **💡 Note for Package Users:** If you install and use these packages, **nothing has changed**. Continue installing packages normally:
 >
 > ```bash

README.md

@@ -4,6 +4,91 @@
 
 > **📦 Note for Package Users:** If you install and use these packages via npm, **nothing changed**. This guide is for contributors who develop and maintain these libraries.
 
+---
+
+## 🔴 Node.js 18 Support Dropped
+
+**Effective Date:** October 31, 2025
+
+### What Changed
+
+Starting with version `2.XX.0` (where XX is the version where this change is released), all Supabase JavaScript libraries require **Node.js 20 or later**. The `@supabase/node-fetch` polyfill has been removed, and native fetch support is now required.
+
+### Why?
+
+Node.js 18 reached end-of-life on April 30, 2025, and no longer receives security updates or critical fixes. Node.js 20+ includes native fetch support, eliminating the need for polyfills and reducing bundle size.
+
+### Affected Libraries
+
+- `@supabase/supabase-js`
+- `@supabase/auth-js`
+- `@supabase/postgrest-js`
+- `@supabase/realtime-js`
+- `@supabase/storage-js`
+- `@supabase/functions-js`
+
+### Migration Guide
+
+**1. Upgrade Node.js** to version 20 or later:
+
+```bash
+# Check your current version
+node --version
+
+# If < 20.0.0, upgrade Node.js
+# Via nvm (recommended):
+nvm install 20
+nvm use 20
+
+# Or download from https://nodejs.org/
+```
+
+**2. Update your package.json** to use the latest version:
+
+```bash
+npm install @supabase/supabase-js@latest
+# Or for individual packages:
+npm install @supabase/auth-js@latest
+```
+
+**3. No code changes required** - The APIs remain unchanged. Your existing code will work as-is once you upgrade Node.js.
+
+### Supported Environments
+
+✅ **Node.js 20+** - Native fetch support
+✅ **Modern browsers** - Chrome 42+, Firefox 39+, Safari 10.1+, Edge 14+
+✅ **Deno 1.0+** - Native fetch built-in
+✅ **Bun 0.1+** - Native fetch built-in
+✅ **React Native** - With fetch polyfill provided by the framework
+✅ **Expo** - With fetch polyfill provided by the framework
+
+### Troubleshooting
+
+**Error: `fetch is not defined`**
+
+This means you're running Node.js < 20. Solutions:
+
+1. Upgrade to Node.js 20+ (recommended)
+2. If you absolutely cannot upgrade, use an older version of the libraries (see below)
+
+**Using Node.js 18 (Not Recommended)**
+
+If you must use Node.js 18, install the last version that supported it:
+
+```bash
+# Find the last version that supported Node.js 18
+# (This will be version 2.XX.X where XX is one less than the version with this change)
+npm install @supabase/[email protected]
+```
+
+⚠️ **Warning:** Using Node.js 18 is not recommended as it no longer receives security updates.
+
+### Discussion
+
+For more details, see the [deprecation announcement](https://github.com/supabase/supabase-js/discussions/37217).
+
+---
+
 ## 🎯 Who This Guide Is For
 
 **This guide is for contributors**, including:

docs/MIGRATION.md

@@ -30,14 +30,12 @@
     "@nx/vite": "21.6.2",
     "@nx/web": "21.6.2",
     "@nx/webpack": "21.6.2",
-    "@supabase/node-fetch": "2.6.15",
     "@swc/core": "~1.5.7",
     "@swc/helpers": "~0.5.11",
     "@types/faker": "^5.1.6",
     "@types/jest": "^29.5.14",
     "@types/jsonwebtoken": "^8.5.8",
     "@types/node": "20.19.9",
-    "@types/node-fetch": "^2.6.4",
     "@typescript-eslint/eslint-plugin": "^7.18.0",
     "@typescript-eslint/parser": "^7.18.0",
     "@vitest/ui": "^3.0.0",

package.json

@@ -30,6 +30,15 @@
 
 </div>
 
+## Requirements
+
+- **Node.js 20 or later** (Node.js 18 support dropped as of October 31, 2025)
+- For browser support, all modern browsers are supported
+
+> ⚠️ **Node.js 18 Deprecation Notice**
+>
+> Node.js 18 reached end-of-life on April 30, 2025. As announced in [our deprecation notice](https://github.com/supabase/supabase-js/discussions/37217), support for Node.js 18 was dropped on October 31, 2025.
+
 ## Quick start
 
 Install

packages/core/auth-js/README.md

@@ -26,7 +26,6 @@
     "directory": "packages/core/auth-js"
   },
   "scripts": {
-    "build:node18": "npm run build:main && npm run build:module",
     "build": "npm run build:main && npm run build:module",
     "build:main": "tsc -p tsconfig.json",
     "build:module": "tsc -p tsconfig.module.json",
@@ -38,10 +37,12 @@
     "docs:json": "typedoc --json docs/v2/spec.json --excludeExternals --excludePrivate --excludeProtected src/index.ts"
   },
   "dependencies": {
-    "@supabase/node-fetch": "2.6.15",
     "tslib": "2.8.1"
   },
   "devDependencies": {
     "prettier": "^2.8.8"
+  },
+  "engines": {
+    "node": ">=20.0.0"
   }
 }

packages/core/auth-js/package.json

@@ -94,16 +94,10 @@ export function parseParametersFromURL(href: string) {
 type Fetch = typeof fetch
 
 export const resolveFetch = (customFetch?: Fetch): Fetch => {
-  let _fetch: Fetch
   if (customFetch) {
-    _fetch = customFetch
-  } else if (typeof fetch === 'undefined') {
-    _fetch = (...args) =>
-      import('@supabase/node-fetch' as any).then(({ default: fetch }) => fetch(...args))
-  } else {
-    _fetch = fetch
+    return (...args) => customFetch(...args)
   }
-  return (...args) => _fetch(...args)
+  return (...args) => fetch(...args)
 }
 
 export const looksLikeFetchResponse = (maybeResponse: unknown): maybeResponse is Response => {

packages/core/auth-js/src/lib/helpers.ts

@@ -1,6 +1,4 @@
 import { MockServer } from 'jest-mock-server'
-// @ts-ignore
-import fetch from '@supabase/node-fetch'
 import { API_VERSION_HEADER_NAME } from '../src/lib/constants'
 import { AuthUnknownError, AuthApiError, AuthRetryableFetchError } from '../src/lib/errors'
 import { _request, handleError } from '../src/lib/fetch'

packages/core/auth-js/test/fetch.test.ts

@@ -30,6 +30,15 @@
 
 </div>
 
+## Requirements
+
+- **Node.js 20 or later** (Node.js 18 support dropped as of October 31, 2025)
+- For browser support, all modern browsers are supported
+
+> ⚠️ **Node.js 18 Deprecation Notice**
+>
+> Node.js 18 reached end-of-life on April 30, 2025. As announced in [our deprecation notice](https://github.com/supabase/supabase-js/discussions/37217), support for Node.js 18 was dropped on October 31, 2025.
+
 ## Quick Start
 
 ### Installation

packages/core/functions-js/README.md

@@ -35,7 +35,6 @@
   },
   "homepage": "https://github.com/supabase/supabase-js/tree/master/packages/core/functions-js",
   "dependencies": {
-    "@supabase/node-fetch": "2.6.15",
     "tslib": "2.8.1"
   },
   "devDependencies": {
@@ -46,5 +45,8 @@
   },
   "publishConfig": {
     "access": "public"
+  },
+  "engines": {
+    "node": ">=20.0.0"
   }
 }