@supabase/supabase-js@2

2 traces

• Supabase anon / service_role keys are legacy — use sb_publishable_ / sb_secret_ keys (legacy removal planned late 2026)
  An agent wires NEXTPUBLICSUPABASEANONKEY and SUPABASESERVICEROLEKEY (long eyJ... Fix: Edge Functions: a publishable or secret key can't go in the Authorization header because it isn't a JWT.
  Gotchano outcome reports yet@supabase/supabase-js@2supabase-platform2025-06-17
• Using the user object as returned from supabase.auth.getSession() ... could be insecure! — verify with getClaims()
  Server logs (Next.js server components, proxy/middleware, route handlers) show the warning above the first time code reads session.user from supabase.auth.getSession(). Fix: Keep getSession() only for when you need the…
  Fixno outcome reports yet@supabase/supabase-js@2@supabase/ssrnext@162025-07-10