Skip to content

fix(realtime): update phoenix to fix presence issue#2532

Merged
mandarini merged 1 commit into
masterfrom
update/phoenix
Jul 16, 2026
Merged

fix(realtime): update phoenix to fix presence issue#2532
mandarini merged 1 commit into
masterfrom
update/phoenix

Conversation

@edgurgel

@edgurgel edgurgel commented Jul 16, 2026

Copy link
Copy Markdown
Member

🔍 Description

Update phoenix due to https://cna.erlef.org/cves/CVE-2026-56812.html

What changed?

phoenix-js had to be updated to address CVE

Why was this change needed?

📸 Screenshots/Examples

🔄 Breaking changes

  • This PR contains no breaking changes

📋 Checklist

  • I have read the Contributing Guidelines
  • My PR title follows the conventional commit format: <type>(<scope>): <description>
  • I have run pnpm nx format to ensure consistent code formatting
  • I have added tests for new functionality (if applicable)
  • I have updated documentation (if applicable)

📝 Additional notes

@edgurgel
edgurgel requested review from a team as code owners July 16, 2026 00:03
@github-actions github-actions Bot added the realtime-js Related to the realtime-js library. label Jul 16, 2026
@coderabbitai

coderabbitai Bot commented Jul 16, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 136293ba-0bc4-40b8-b48d-b8146a9e087d

📥 Commits

Reviewing files that changed from the base of the PR and between 130fa11 and 3d76baa.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (2)
  • packages/core/realtime-js/package.json
  • packages/core/realtime-js/test/phoenix/presenceAdapter.test.ts
📝 Walkthrough

Summary by CodeRabbit

  • Bug Fixes

    • Improved resilience when processing presence data with keys that could conflict with built-in object properties.
    • Updated the real-time messaging dependency to include the latest patch-level fixes.

  • Tests

    • Added regression coverage for presence state and synchronization updates involving potentially unsafe keys.

Walkthrough

The Phoenix dependency is upgraded from 0.4.4 to 0.4.5. Presence adapter tests now import Vitest’s expect and add regression cases confirming that Presence.syncState and Presence.syncDiff do not throw when presence data contains keys such as constructor.

Possibly related PRs

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@pkg-pr-new

pkg-pr-new Bot commented Jul 16, 2026

Copy link
Copy Markdown

Open in StackBlitz

@supabase/auth-js

npm i https://pkg.pr.new/@supabase/auth-js@2532

@supabase/functions-js

npm i https://pkg.pr.new/@supabase/functions-js@2532

@supabase/postgrest-js

npm i https://pkg.pr.new/@supabase/postgrest-js@2532

@supabase/realtime-js

npm i https://pkg.pr.new/@supabase/realtime-js@2532

@supabase/storage-js

npm i https://pkg.pr.new/@supabase/storage-js@2532

@supabase/supabase-js

npm i https://pkg.pr.new/@supabase/supabase-js@2532

commit: 3d76baa

@coveralls

coveralls commented Jul 16, 2026

Copy link
Copy Markdown

Coverage Status

coverage: 80.57%. remained the same — update/phoenix into master

@mandarini
mandarini merged commit e8fe48a into master Jul 16, 2026
35 checks passed
@mandarini
mandarini deleted the update/phoenix branch July 16, 2026 12:11
@supabase-supabase-autofixer supabase-supabase-autofixer Bot mentioned this pull request Jul 16, 2026
Merged
This was referenced Jul 16, 2026
Merged
Merged
@supabase-supabase-autofixer supabase-supabase-autofixer Bot mentioned this pull request Jul 16, 2026
Open
mandarini pushed a commit to supabase/ssr that referenced this pull request Jul 16, 2026
@supabase-libs-pr-manager @supabase-workflow-trigger
chore: update @supabase/supabase-js to v2.110.7 (#267)
55a3007 
This PR updates `@supabase/supabase-js` to v2.110.7.

**Source**: supabase-js-stable-release

---

## Release Notes

## v2.110.7

## 2.110.7 (2026-07-16)

### 🩹 Fixes

- **postgrest:** correct self-reference inference
([#2525](supabase/supabase-js#2525))
- **realtime:** trigger set auth on INITIAL_SESSION event
([#2531](supabase/supabase-js#2531))
- **realtime:** update phoenix to fix presence issue
([#2532](supabase/supabase-js#2532))

### ❤️ Thank You

- Eduardo Gurgel
- Filipe Cabaço @filipecabaco
- Vaibhav @7ttp

This PR was created automatically.

Co-authored-by: supabase-workflow-trigger[bot] <266661614+supabase-workflow-trigger[bot]@users.noreply.github.com>
@supabase-supabase-autofixer supabase-supabase-autofixer Bot mentioned this pull request Jul 21, 2026
Merged
mandarini pushed a commit to supabase/supabase that referenced this pull request Jul 22, 2026
@supabase-supabase-autofixer @supabase-workflow-trigger
feat: update @supabase/*-js libraries to v2.110.8 (#48156)
d847c48 
This PR updates @supabase/*-js libraries to version 2.110.8.

**Source**: supabase-js-stable-release

**Changes**:
- Updated @supabase/supabase-js to 2.110.8
- Updated @supabase/auth-js to 2.110.8
- Updated @supabase/realtime-js to 2.110.8
- Updated @supabase/postgest-js to 2.110.8
- Refreshed pnpm-lock.yaml

---

## Release Notes

## v2.110.8

## 2.110.8 (2026-07-21)

### 🩹 Fixes

- **auth:** downgrade aborted/transient fetch failures from
console.error to warn
([#2544](supabase/supabase-js#2544))
- **functions:** clean up cross-signal abort listener on invoke() return
([#2487](supabase/supabase-js#2487))
- **functions:** match response Content-Type case-insensitively
([#2515](supabase/supabase-js#2515))
- **storage:** url-encode object key in CDN purge methods
([#2545](supabase/supabase-js#2545))
- **supabase:** skip Node warning in Deno
([#2541](supabase/supabase-js#2541))

### ❤️ Thank You

- Franco Kaddour @FrancoKaddour
- Katerina Skroumpelou @mandarini
- Pedro Henrique
- Vaibhav @7ttp
## v2.110.7

## 2.110.7 (2026-07-16)

### 🩹 Fixes

- **postgrest:** correct self-reference inference
([#2525](supabase/supabase-js#2525))
- **realtime:** trigger set auth on INITIAL_SESSION event
([#2531](supabase/supabase-js#2531))
- **realtime:** update phoenix to fix presence issue
([#2532](supabase/supabase-js#2532))

### ❤️ Thank You

- Eduardo Gurgel
- Filipe Cabaço @filipecabaco
- Vaibhav @7ttp

This PR was created automatically.

Co-authored-by: supabase-workflow-trigger[bot] <266661614+supabase-workflow-trigger[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@filipecabaco filipecabaco filipecabaco approved these changes
@mandarini mandarini mandarini approved these changes

Assignees

No one assigned

Labels

realtime-js Related to the realtime-js library.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@edgurgel @coveralls @filipecabaco @mandarini