Bump tar and supabase in /apps/web

[dependabot]

Removes tar. It's no longer used after updating ancestor dependency supabase. These dependencies need to be updated together.

Removes tar

Updates supabase from 1.226.4 to 2.109.1

Release notes

Sourced from supabase's releases.

v2.109.1

Supabase CLI v2.109.1 — 2026-07-07

This patch release includes bug fixes for database and sync operations, improvements to error messaging, and corrections to flag handling.

Bug fixes

• db pull no longer hangs in non-interactive mode — fixed hang when using db pull without interactive prompts. (#5725)
• CSV flag parsing for sso and postgres-config — flags now correctly split multiple values. (#5764)
• Function deploy path resolution — fixed path handling in function deployments. (#5755)
• db diff respects schema order — schema_paths order is now maintained in diff output. (#5706)
• db unban-ip validation — project ref resolution now works correctly. (#5769)
• Declarative sync hanging — fixed hang when edge-runtime container exits. (#5714)
• Query command output formatting — fixed output formatting issues. (#5763)
• Eszip bundling errors — improved error handling. (#5747)

Improvements

• Error messages guide flag placement — the CLI suggests correct subcommand placement when flags are misplaced. (#5751)
• Shell completion customization — --no-descriptions flag suppresses descriptions in shell completions. (#5771)
• Non-TypeScript type generation — gen types now works for JavaScript and other languages. (#5622)
• Custom image registry support — gen types respects the SUPABASE_INTERNAL_IMAGE_REGISTRY env var. (#5786)
• Status command power-user flags — hidden --exclude and --ignore-health-check flags for advanced usage. (#5770)

TypeScript port progress

• db pull — ported to use PostgreSQL's native pg_dump for faster, more reliable snapshots. Behavior matches the Go CLI. (#5725)

---

Plus internal improvements including service version alignment and experimental feature gating enhancements, plus dependency and Docker image updates.

Full changelog: supabase/cli@v2.109.0...v2.109.1

v2.109.1-beta.22

2.109.1-beta.22 (2026-07-07)

Bug Fixes

• docker: bump supabase/postgres from 17.6.1.142 to 17.6.1.143 in /apps/cli-go/pkg/config/templates (#5807) (6d4c198)
• docker: bump the docker-minor group in /apps/cli-go/pkg/config/templates with 3 updates (#5806) (1cbf45a)

v2.109.1-beta.21

2.109.1-beta.21 (2026-07-07)

Bug Fixes

• deps: bump github.com/posthog/posthog-go from 1.16.2 to 1.17.2 in /apps/cli-go in the go-minor group across 1 directory (#5805) (60c2d17)

... (truncated)

Changelog

Sourced from supabase's changelog.

Release Process

This document is the operational playbook for releasing the Supabase CLI TypeScript build. It covers three environments ("rings"):

1. Ring 1 — Local Verdaccio. Fastest feedback loop. Build and install the CLI from a local npm registry on your own machine. No network side-effects; no repo pushes.
2. Ring 2 — User-owned PoC repos. End-to-end validation through the exact same Homebrew / Scoop / GitHub-Release code paths production uses, but pointed at a reviewer's own GitHub account and a non-supabase artifact name. This is how ADR 0011 gates 2 and 3 are validated without risking the real production channels.
3. Ring 3 — Production. The real supabase npm package + supabase/homebrew-tap + supabase/scoop-bucket + GitHub Releases on supabase/cli. Driven by GitHub Actions (release.yml, which dispatches three channels — alpha, beta, stable — into the shared release-shared.yml).

flowchart LR
    local["Ring 1: Local Verdaccio<br/>pnpm cli-release<br/>--next or --legacy"]
    poc["Ring 2: User-owned PoC repos<br/>avallete/supabase-cli-release-poc<br/>avallete/homebrew-supabase-shim-poc<br/>avallete/scoop-bucket<br/>--name supabase-shim-poc"]
    prod["Ring 3: Production<br/>supabase/cli<br/>supabase/homebrew-tap<br/>supabase/scoop-bucket<br/>(default name: supabase)"]
local --&gt; poc --&gt; prod

Loading

Move outward one ring at a time. Only promote to production after Ring 2 has exercised the full channel end-to-end on a fresh machine.

See ADR 0011 for the decision record behind this process (why Bun SFE, why npm optionalDependencies, why nfpm, why no hosted apt/rpm repo, why unsigned).

---

Ring 1 — Local Verdaccio

Use this loop while iterating on build scripts, the Node shim, or anything that changes what gets packed into supabase or @supabase/cli-<platform>. It installs the CLI into a local npm registry and lets you npx --registry http://localhost:4873 supabase as if you'd installed from npm.

Start the registry in one terminal:

pnpm local-registry

Publish the CLI into it from another terminal (current platform only, faster than a cross-platform build):

# TS-native shell only ("next"):
pnpm cli-release --next
Legacy shell (TS shim + Go sidecar — requires Go on PATH and pnpm repos:install):
pnpm cli-release --legacy

Test it:

npx --registry http://localhost:4873 supabase@<printed-version> --version

[tools/release/local-release.ts](https://github.com/supabase/cli/blob/develop/tools/release/local-release.ts) does the heavy lifting: it builds the platform SFE (+ Go binary for --legacy) and the umbrella supabase package, materialises them in a tmp dir (so no workspace package.json is modified), and publishes both to Verdaccio. The cleanup is automatic even on failure.

... (truncated)

Commits

• 2b8eeea fix(deps): bump the npm-major group with 8 updates (#5808)
• 1439680 fix(cli): honor SUPABASE_INTERNAL_IMAGE_REGISTRY in gen types (#5786)
• 28b17f6 fix(cli): add hidden --exclude and --ignore-health-check flags to status (#5770)
• f28efed fix(cli): run --experimental gate before storage's mutex check (#5768)
• 4efa0df fix(cli): add --no-descriptions flag to completion subcommands (#5771)
• c62b558 fix(cli): resolve network-bans project ref before validating --db-unban-ip (#...
• 28cc844 fix(cli): wire --experimental gate into 7 ungated native leaves (#5766)
• 31d6fb9 fix(cli): generate non-TypeScript types from project refs (#5622)
• 5a0e4a9 fix(deps): bump the npm-major group with 3 updates (#5782)
• 9bb97be fix(db): respect schema_paths order in diff (#5706)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for supabase since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 174e3b26eb

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Restore the picomatch entry for npm 11 clean installs

In apps/web with npm 11.4.2, npm ci now exits before installation with Missing: picomatch@ from lock file. This lock refresh removes node_modules/svelte-check/node_modules/picomatch, even though the nested fdir package still declares the optional peer picomatch: ^3 || ^4 and the only remaining root entry is v2.3.1; npm 11's clean-install validation therefore treats the lockfile as inconsistent. Restore or regenerate the nested peer entry so Node 20 environments using npm 11 can install dependencies.

Useful? React with 👍 / 👎.

[dependabot]

Superseded by #206.