Bump tar and supabase in /apps/web

[dependabot]

Removes tar. It's no longer used after updating ancestor dependency supabase. These dependencies need to be updated together.

Removes tar

Updates supabase from 1.226.4 to 2.110.0

Release notes

Sourced from supabase's releases.

v2.110.0

Supabase CLI v2.110.0 — 2026-07-27

Core database commands are now on the native TypeScript shell, with fixes for Edge Function bundling, type generation, and local stack recovery. Most of this release is quality improvements and stability fixes.

Highlights

• Recover your local stack from interruptions — supabase start can now recover a stopped database instead of requiring a clean restart. (#5953)

Improvements

• Edge Function bundling works again — Docker-based bundling restored for Edge Functions. (#5875)
• Type generation without config.toml — supabase gen types now works even without supabase/config.toml. (#5881)
• Storage seeding skips OS junk files — macOS .DS_Store and similar files no longer clutter seeded buckets. (#5938)
• Better error messages — Removed redundant "Expected" prefixes and aligned formatting with Go CLI. (#5831, #5804, #5832)
• Functions deploy validates --jobs — Invalid job counts are caught early. (#5797)
• Telemetry resilience — No more hangs when endpoints are blocked. (#5880)
• API keys redacted in output — Credentials no longer appear in error messages. (#5891)

Bug fixes

• Local migrations no longer sync to remote projects via db push. (#5951)
• db pull works correctly with per-connection role step-down and pg-delta. (#5895)
• Config validation runs before destructive db reset --local. (#5840)
• secrets set tolerates malformed config.toml. (#5796)
• config-push handles dotenvx encrypted secrets. (#5842)
• functions download defaults to Docker. (#5793)
• Project size enum no longer offers "nano" tier. (#5799)
• Windows credential logout works properly. (#5913)
• Auth templates preserved during supabase init. (#5906)
• Malformed project refs don't hang remote calls. (#5802)
• db lint detects local API exposure. (#5887)

TypeScript port progress

• Now served by the TypeScript shell: db push, db reset, db start, supabase start, supabase stop, supabase status. Behavior matches the Go CLI. (#5715, #5847, #5765)
• pg-delta catalog cache integrated in the TypeScript shell. (#5932)

---

Plus 20+ internal improvements, CLI behavior fixes, and dependency updates.

Full changelog: supabase/cli@v2.109.1...v2.110.0

v2.110.0-beta.41

2.110.0-beta.41 (2026-07-27)

Bug Fixes

• cli: resolve CodeQL and Go codegen CI failures blocking #5874 (#5957) (71ecf66)

v2.110.0-beta.40

2.110.0-beta.40 (2026-07-27)

... (truncated)

Changelog

Sourced from supabase's changelog.

Release Process

This document is the operational playbook for releasing the Supabase CLI TypeScript build. It covers three environments ("rings"):

1. Ring 1 — Local Verdaccio. Fastest feedback loop. Build and install the CLI from a local npm registry on your own machine. No network side-effects; no repo pushes.
2. Ring 2 — User-owned PoC repos. End-to-end validation through the exact same Homebrew / Scoop / GitHub-Release code paths production uses, but pointed at a reviewer's own GitHub account and a non-supabase artifact name. This is how ADR 0011 gates 2 and 3 are validated without risking the real production channels.
3. Ring 3 — Production. The real supabase npm package + supabase/homebrew-tap + supabase/scoop-bucket + GitHub Releases on supabase/cli. Driven by GitHub Actions (release.yml, which dispatches three channels — alpha, beta, stable — into the shared release-shared.yml).

flowchart LR
    local["Ring 1: Local Verdaccio<br/>pnpm cli-release<br/>--next or --legacy"]
    poc["Ring 2: User-owned PoC repos<br/>avallete/supabase-cli-release-poc<br/>avallete/homebrew-supabase-shim-poc<br/>avallete/scoop-bucket<br/>--name supabase-shim-poc"]
    prod["Ring 3: Production<br/>supabase/cli<br/>supabase/homebrew-tap<br/>supabase/scoop-bucket<br/>(default name: supabase)"]
local --&gt; poc --&gt; prod

Loading

Move outward one ring at a time. Only promote to production after Ring 2 has exercised the full channel end-to-end on a fresh machine.

See ADR 0011 for the decision record behind this process (why Bun SFE, why npm optionalDependencies, why nfpm, why no hosted apt/rpm repo, why unsigned).

---

Ring 1 — Local Verdaccio

Use this loop while iterating on build scripts, the Node shim, or anything that changes what gets packed into supabase or @supabase/cli-<platform>. It installs the CLI into a local npm registry and lets you npx --registry http://localhost:4873 supabase as if you'd installed from npm.

Start the registry in one terminal:

pnpm local-registry

Publish the CLI into it from another terminal (current platform only, faster than a cross-platform build):

# TS-native shell only ("next"):
pnpm cli-release --next
Legacy shell (TS shim + Go sidecar — requires Go on PATH and pnpm repos:install):
pnpm cli-release --legacy

Test it:

npx --registry http://localhost:4873 supabase@<printed-version> --version

[tools/release/local-release.ts](https://github.com/supabase/cli/blob/develop/tools/release/local-release.ts) does the heavy lifting: it builds the platform SFE (+ Go binary for --legacy) and the umbrella supabase package, materialises them in a tmp dir (so no workspace package.json is modified), and publishes both to Verdaccio. The cleanup is automatic even on failure.

... (truncated)

Commits

• 71ecf66 fix(cli): resolve CodeQL and Go codegen CI failures blocking #5874 (#5957)
• 81af5f0 fix(cli): recover stopped local stack (#5953)
• a820425 fix(cli): keep migration recovery local (#5951)
• 3368ab0 feat(cli): port supabase start command to native TypeScript (#5847)
• 3ad3b87 feat(cli): port pg-delta catalog cache (#5932)
• 621aaff fix(cli): skip OS junk files when seeding storage buckets (#5938)
• e044333 fix(cli): ensure temp directory (#5904)
• 82dc21b fix(cli): windows logout credentials (#5913)
• 92330c5 fix(cli): preserve auth templates (#5906)
• 3fa5a9d fix(cli): stop telemetry hangs and errors on blocked networks (#5880)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for supabase since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.