[supabase-py-releaser]

🤖 I have created a release beep boop

2.34.0 (2026-10-28)

Features

• postgrest: add strip_nulls() (#1760) (c86ec9f)

Bug Fixes

• auth: accept oauth clients without a name (#1830) (936458e)
• auth: avoid cancelling the running refresh callback (#1716) (606e0ac)
• auth: emit PASSWORD_RECOVERY from verify_otp (#1743) (b571cc2)
• auth: emit SIGNED_IN when set_session keeps a valid token (#1749) (9c092db)
• auth: handle empty OAuth client lists (#1736) (7d68e6b)
• auth: map httpx transport errors to AuthRetryableError (#1808) (901f00d)
• auth: normalize trailing slash in base URL (#1766) (de040ec)
• auth: preserve phone numbers in MFA factor responses (#1837) (0e1cf4c)
• auth: preserve the server error message on retryable 5xx responses (#1833) (c1727d5)
• auth: require pyjwt>=2.15.1 for security fixes (#1820) (f41e80e)
• auth: send one refresh request per auto-refresh tick (#1854) (bc29bc6)
• auth: send PKCE challenges for email and SSO flows (#1682) (66cd7ee)
• auth: stop the admin API from sharing the client's header dict (#1645) (6b53131)
• make the capability matrix verifiable (#1867) (804e7e2)
• postgrest: apply normalized timeout to internal httpx clients (#1758) (774e996)
• postgrest: clear basic auth when selecting bearer auth (#1713) (32e748b)
• postgrest: make APIError fields optional so partial error bodies keep their message (#1732) (18bd628)
• postgrest: omit columns for empty bulk inserts and upserts (#1815) (62a4e4d)
• postgrest: preserve chaining after text search (#1708) (9588283)
• postgrest: preserve injected HTTPX client authentication (#1838) (79d14d9)
• postgrest: quote rpc array elements sent on GET and HEAD (#1762) (1bb870e)
• postgrest: replace conflicting max-affected preferences (#1827) (5f989e1)
• postgrest: send rpc list args as array literals on GET and HEAD (#1752) (50e7a4c)
• preserve functions timeout when replacing client options (#1722) (7fac036)
• realtime: call late timeout handlers without a payload (#1831) (b6ddb74)
• realtime: cap reconnect backoff at 60 seconds (#1768) (23ddbca)
• realtime: deliver every broadcast to "*" listeners, ignoring case (#1818) (eae2838)
• realtime: honor the WebSocket opening timeout (#1839) (46efa11)
• realtime: notify subscribers of channel errors and closure (#1846) (bcecfc3)
• realtime: redact api key and access tokens from debug logs (#1750) (17147f2)
• realtime: restart timeout after resending push (#1654) (da3a353)
• realtime: use the client timeout for join and leave pushes (#1685) (198396d)
• storage: allow null metadata in list_v2 (#1804) (9d2f19c)
• storage: merge a partial sortBy with the default in list (#1817) (3fb5620)
• supabase: keep postgrest and storage timeouts in replace() (#1809) (795cad4)
• supabase: keep the session token on every auth event that has one (#1856) (ca2fb99)
• supabase: replace() preserves postgrest and storage timeouts (#1840) (772ee24)

Documentation

• Clarify when get_user() returns None (#1569) (3d8417f)
• document SDK compatibility with Supabase services (#1870) (1ff1e4a)

---

This PR was generated with Release Please. See documentation.