supabase · jgoux · Jun 3, 2026 · Jun 3, 2026
@@ -9,6 +9,10 @@ updates:
  actions-major:
  patterns:
  - "*"
+ ignore:
+ - dependency-name: "supabase/setup-cli"
+ update-types:
+ - "version-update:semver-major"
  cooldown:
  default-days: 7
  - package-ecosystem: "gomod"

diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml
@@ -24,7 +24,7 @@ jobs:
  - name: Generate token
  id: app-token
  if: ${{ steps.meta.outputs.update-type == null || steps.meta.outputs.update-type == 'version-update:semver-patch' || (!startsWith(steps.meta.outputs.previous-version, '0.') && steps.meta.outputs.update-type == 'version-update:semver-minor') }}
- uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+ uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
  with:
  client-id: ${{ vars.GH_APP_CLIENT_ID }}
  private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

diff --git a/.github/workflows/build-cli-artifacts.yml b/.github/workflows/build-cli-artifacts.yml
@@ -80,7 +80,7 @@ jobs:
  ls -la dist/
 
  - name: Upload build artifacts
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
  with:
  name: cli-build-${{ inputs.shell }}-${{ inputs.version }}
  path: |

diff --git a/.github/workflows/cli-go-api-sync.yml b/.github/workflows/cli-go-api-sync.yml
@@ -39,7 +39,7 @@ jobs:
 
  - name: Generate token
  id: app-token
- uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+ uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
  with:
  client-id: ${{ vars.GH_APP_CLIENT_ID }}
  private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

diff --git a/.github/workflows/cli-go-ci.yml b/.github/workflows/cli-go-ci.yml
@@ -70,7 +70,7 @@ jobs:
  # Linter requires no cache
  cache: false
 
- - uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
+ - uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1
  with:
  args: --timeout 5m --verbose
  version: latest

diff --git a/.github/workflows/cli-go-codeql.yml b/.github/workflows/cli-go-codeql.yml
@@ -69,7 +69,7 @@ jobs:
 
  # Initializes the CodeQL tools for scanning.
  - name: Initialize CodeQL
- uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+ uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
  with:
  languages: ${{ matrix.language }}
  build-mode: ${{ matrix.build-mode }}
@@ -97,7 +97,7 @@ jobs:
  exit 1
 
  - name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+ uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
  with:
  category: "/language:${{matrix.language}}"
 defaults:

diff --git a/.github/workflows/cli-go-mirror-image.yml b/.github/workflows/cli-go-mirror-image.yml
@@ -34,14 +34,14 @@ jobs:
  run: |
  echo "image=${TAG##*/}" >> $GITHUB_OUTPUT
  - name: configure aws credentials
- uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+ uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
  with:
  role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
  aws-region: us-east-1
- - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+ - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
  with:
  registry: public.ecr.aws
- - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+ - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
  with:
  registry: ghcr.io
  username: ${{ github.actor }}

diff --git a/.github/workflows/cli-go-pg-prove.yml b/.github/workflows/cli-go-pg-prove.yml
@@ -13,8 +13,8 @@ jobs:
  outputs:
  image_tag: supabase/pg_prove:${{ steps.version.outputs.pg_prove }}
  steps:
- - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
- - uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+ - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+ - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
  with:
  load: true
  context: https://github.com/horrendo/pg_prove.git
@@ -44,15 +44,15 @@ jobs:
  image_digest: ${{ steps.build.outputs.digest }}
  steps:
  - run: docker context create builders
- - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+ - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
  with:
  endpoint: builders
- - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+ - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
  with:
  username: ${{ secrets.DOCKER_USERNAME }}
  password: ${{ secrets.DOCKER_PASSWORD }}
  - id: build
- uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+ uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
  with:
  push: true
  context: https://github.com/horrendo/pg_prove.git
@@ -68,8 +68,8 @@ jobs:
  - build_image
  runs-on: ubuntu-latest
  steps:
- - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
- - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+ - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+ - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
  with:
  username: ${{ secrets.DOCKER_USERNAME }}
  password: ${{ secrets.DOCKER_PASSWORD }}

diff --git a/.github/workflows/cli-go-publish-migra.yml b/.github/workflows/cli-go-publish-migra.yml
@@ -13,8 +13,8 @@ jobs:
  outputs:
  image_tag: supabase/migra:${{ steps.version.outputs.migra }}
  steps:
- - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
- - uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+ - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+ - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
  with:
  load: true
  context: https://github.com/djrobstep/migra.git
@@ -44,15 +44,15 @@ jobs:
  image_digest: ${{ steps.build.outputs.digest }}
  steps:
  - run: docker context create builders
- - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+ - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
  with:
  endpoint: builders
- - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+ - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
  with:
  username: ${{ secrets.DOCKER_USERNAME }}
  password: ${{ secrets.DOCKER_PASSWORD }}
  - id: build
- uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+ uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
  with:
  push: true
  context: https://github.com/djrobstep/migra.git
@@ -68,8 +68,8 @@ jobs:
  - build_image
  runs-on: ubuntu-latest
  steps:
- - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
- - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+ - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+ - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
  with:
  username: ${{ secrets.DOCKER_USERNAME }}
  password: ${{ secrets.DOCKER_PASSWORD }}

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -18,7 +18,7 @@ jobs:
  fetch-depth: 0
  persist-credentials: false
  - id: app-token
- uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+ uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
  with:
  client-id: ${{ vars.GH_APP_CLIENT_ID }}
  private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

diff --git a/.github/workflows/publish-preview-cli-packages.yml b/.github/workflows/publish-preview-cli-packages.yml
@@ -45,7 +45,7 @@ jobs:
  uses: ./.github/actions/setup
 
  - name: Download preview build artifacts
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
  with:
  name: cli-build-legacy-${{ env.PREVIEW_VERSION }}
 

diff --git a/.github/workflows/release-shared.yml b/.github/workflows/release-shared.yml
@@ -88,7 +88,7 @@ jobs:
  uses: ./.github/actions/setup
 
  - name: Download build artifacts
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
  with:
  name: cli-build-${{ inputs.shell }}-${{ inputs.version }}
 
@@ -108,7 +108,7 @@ jobs:
 
  - name: Setup QEMU for cross-platform Docker
  if: runner.os == 'Linux'
- uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+ uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
 
  # Cache the smoke-test base images across runs. Without this, eight
  # parallel `docker run` calls in smoke-test-linux.ts race on first-time
@@ -118,7 +118,7 @@ jobs:
  - name: Cache smoke-test docker images
  if: runner.os == 'Linux'
  id: smoke-docker-cache
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+ uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
  with:
  path: ~/.cache/smoke-docker-images.tar
  key: smoke-docker-images-debian-bookworm-slim-amazonlinux-2023-alpine-3.21-v1
@@ -188,7 +188,7 @@ jobs:
  steps:
  - name: Generate release repository token
  id: app-token
- uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+ uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
  with:
  client-id: ${{ vars.GH_APP_CLIENT_ID }}
  private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
@@ -205,7 +205,7 @@ jobs:
  uses: ./.github/actions/setup
 
  - name: Download build artifacts
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
  with:
  name: cli-build-${{ inputs.shell }}-${{ inputs.version }}
 
@@ -277,7 +277,7 @@ jobs:
  done
 
  - name: Create draft GitHub Release
- uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
+ uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
  with:
  tag_name: v${{ inputs.version }}
  name: v${{ inputs.version }}
@@ -340,13 +340,13 @@ jobs:
  uses: ./.github/actions/setup
 
  - name: Download build artifacts
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
  with:
  name: cli-build-${{ inputs.shell }}-${{ inputs.version }}
 
  - name: Generate Homebrew tap token
  id: app-token
- uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+ uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
  with:
  client-id: ${{ vars.GH_APP_CLIENT_ID }}
  private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
@@ -385,13 +385,13 @@ jobs:
  uses: ./.github/actions/setup
 
  - name: Download build artifacts
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
  with:
  name: cli-build-${{ inputs.shell }}-${{ inputs.version }}
 
  - name: Generate Scoop bucket token
  id: app-token
- uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+ uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
  with:
  client-id: ${{ vars.GH_APP_CLIENT_ID }}
  private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -51,7 +51,7 @@ jobs:
  contents: write
  steps:
  - id: app-token
- uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+ uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
  with:
  client-id: ${{ vars.GH_APP_CLIENT_ID }}
  private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
@@ -90,7 +90,7 @@ jobs:
  # same App used for fast-forward + brew/scoop pushes.
  - id: app-token
  if: github.event_name == 'push'
- uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+ uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
  with:
  app-id: ${{ secrets.APP_ID }}
  private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -90,7 +90,7 @@ jobs:
 
  - name: Set base and head SHAs for affected
  if: github.event_name == 'pull_request'
- uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4.4.0
+ uses: nrwl/nx-set-shas@afb73a62d26e41464e9254689e1fd6122ee683c1 # v5.0.1
 
  - name: Setup
  uses: ./.github/actions/setup