Breaking Change: pg_graphql no longer enabled automatically (within approx 3 weeks from today)

[samrose]

In a forthcoming release within approximately 3 weeks, pg_graphql will be disabled by default on new Supabase projects.

This change aligns pg_graphql with our security-first approach of minimizing exposed API surface area by default. Services and extensions that expose schema metadata are now opt-in rather than opt-out, reducing the default attack surface for new projects.

Who is affected:

New projects will no longer have pg_graphql enabled automatically

Existing projects older than 30 days with zero graphql requests will also have the extension disabled (where previously it was enabled by default). Existing projects with requests will be unaffected.

Action required: If your application relies on GraphQL, you can enable pg_graphql manually via the Database Extensions page in your dashboard. You can also add create extension pg_graphql to your migrations as well if you wish to keep using pg_graphql

We continue to fully support pg_graphql for projects that need it. This change simply ensures it's an intentional choice rather than a default.

We'll follow up on this thread with links to relevant documents for actions required.

EDIT: We've inadvertently disabled pg_graphql on some projects with recent pg_graphql usage. We apologize for the mistake. Please follow this incident for guidance.

[mrodrice-afk]

Im tired i want to connect my google superbase not allow me

[samrose]

@mrodrice-afk if you can please follow one of these support routes, we'll be sure to help you that way https://supabase.com/support

[samrose]

We are behind schedule on this change. An update will be posted here soon and likely link to new announcement.

[erik-beus]

@samrose it appears pg_graphql was disabled automatically in our Supabase project even though we did have plenty of graphql requests. Was that somehow related to this initiative?
It was disabled around 11.45PM CET on Apr 26.

[KaterynaKateryna]

Same happened to our project, and we also had graphql requests. I don't know for sure when it got disabled, but I noticed it on April 27 around 11:00 UTC. Turning it back on was easy, but I did not expect the change.

[erik-beus]

I received this from Supabase support 🤷‍♂️

We recently deployed a new Security Advisor lint to warn about pg_graphql introspection making table structure visible to anyone holding the public anon key. This update was expected to only issue a flag from the Security Advisor for projects where the anon role has SELECT privilege on a non-system table, view, or materialized view. However, it appears there have been edge cases where the pg_graphql extension was disabled by mistake. Our team has been made aware and this should not happen again. We apologize for the inconvenience this may have caused.

[samrose]

Yes from Los our apologies per the message Erik quoted above: this operation did result in some errant edge cases being turned off. Our teams are working to identify and restore those now. In the meantime if you do know for sure you desire to have pg _graphql on in our project, you can turn it back on in the extensions interface. We really do apologize if it was turned unexpectedly and it was in use. We’ll update this communication when we have more information. Thank you for making us aware of the issue you experienced around this operation.

[atraining]

Thank you for your work @samrose and your fellows!