@supabase/supabase-js 2.112.2 → 2.112.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supabase/supabase-js",
-  "version": "2.112.2",
+  "version": "2.112.3",
   "description": "Isomorphic Javascript SDK for Supabase",
   "keywords": [
     "javascript",
@@ -77,11 +77,11 @@
     "directory": "packages/core/supabase-js"
   },
   "dependencies": {
-    "@supabase/auth-js": "2.112.2",
-    "@supabase/functions-js": "2.112.2",
-    "@supabase/postgrest-js": "2.112.2",
-    "@supabase/realtime-js": "2.112.2",
-    "@supabase/storage-js": "2.112.2"
+    "@supabase/auth-js": "2.112.3",
+    "@supabase/postgrest-js": "2.112.3",
+    "@supabase/functions-js": "2.112.3",
+    "@supabase/realtime-js": "2.112.3",
+    "@supabase/storage-js": "2.112.3"
   },
   "peerDependencies": {
     "@opentelemetry/api": ">=1.0.0"

package/src/cors.ts

@@ -1,9 +1,10 @@
 /**
  * Canonical CORS configuration for Supabase Edge Functions
  *
- * This module exports CORS headers that stay synchronized with the Supabase SDK.
- * When new headers are added to the SDK, they are automatically included here,
- * preventing CORS errors in Edge Functions.
+ * This module exports CORS headers kept in sync with the headers the Supabase
+ * SDK sends. Using it in Edge Functions prevents CORS preflight errors when the
+ * SDK adds new headers — update SUPABASE_HEADERS whenever the SDK starts
+ * sending one (enforced by the unit tests).
  *
  * @example Basic usage
  * ```typescript
@@ -34,6 +35,9 @@
  * - apikey: Project API key
  * - content-type: Standard HTTP content type
  * - x-retry-count: Retry attempt number sent by postgrest-js on retried requests
+ * - traceparent: W3C trace context sent when `tracePropagation` is enabled
+ * - tracestate: Vendor-specific trace data sent alongside traceparent
+ * - baggage: W3C baggage sent alongside traceparent
  */
 const SUPABASE_HEADERS = [
   'authorization',
@@ -41,6 +45,9 @@ const SUPABASE_HEADERS = [
   'apikey',
   'content-type',
   'x-retry-count',
+  'traceparent',
+  'tracestate',
+  'baggage',
 ].join(', ')
 
 /**

package/src/lib/fetch.ts

@@ -115,6 +115,7 @@ export const fetchWithAuth = (
 }
 
 let warnedMissingTracingRuntime = false
+let warnedNonW3CPropagator = false
 
 /**
  * For tests only. Resets the one-time missing-tracing-runtime warning.
@@ -125,6 +126,15 @@ export function _resetTracingRuntimeWarning(): void {
   warnedMissingTracingRuntime = false
 }
 
+/**
+ * For tests only. Resets the one-time non-W3C-propagator warning.
+ *
+ * @internal
+ */
+export function _resetNonW3CPropagatorWarning(): void {
+  warnedNonW3CPropagator = false
+}
+
 function getTraceHeaders(
   input: RequestInfo | URL,
   targets: TracePropagationTarget[],
@@ -161,13 +171,34 @@ function getTraceHeaders(
   const traceContext = extractTraceContext()
 
   if (!traceContext || !traceContext.traceparent) {
+    // An active propagator that writes vendor headers but no W3C
+    // `traceparent` (e.g. Sentry without `propagateTraceparent: true`) is
+    // otherwise indistinguishable from "no active trace" — warn once so the
+    // user learns why no trace headers are attached. An empty carrier means
+    // no active trace: normal, stay silent.
+    if (traceContext?.carrierKeys?.length && !warnedNonW3CPropagator) {
+      warnedNonW3CPropagator = true
+      const sentryHint = traceContext.carrierKeys.includes('sentry-trace')
+        ? ' Sentry detected: set `propagateTraceparent: true` in Sentry.init() to emit it.'
+        : ' Configure your tracing SDK to emit W3C trace context on outgoing requests.'
+      console.warn(
+        '@supabase/supabase-js: tracePropagation is enabled and a tracing SDK is active, but its ' +
+          `propagator wrote [${traceContext.carrierKeys.join(', ')}] and no W3C traceparent header, ` +
+          'so trace headers will not be attached.' +
+          sentryHint
+      )
+    }
     return null
   }
 
   if (respectSampling) {
     const parsed = parseTraceParent(traceContext.traceparent)
     if (parsed && !parsed.isSampled) {
-      return null
+      // Unsampled traces still carry `traceparent` so Supabase logs get a
+      // trace_id to correlate on; the flag stays `00`, so downstream tracing
+      // never records it as sampled. `tracestate` and `baggage` (the
+      // vendor/application data channels) are withheld on these requests.
+      return { traceparent: traceContext.traceparent }
     }
   }
 

package/src/lib/types.ts

@@ -80,17 +80,20 @@ export interface TracePropagationOptions {
   /**
    * Respect upstream sampling decisions.
    *
-   * When true (the default), trace context is not propagated if the upstream
-   * trace indicates non-sampling (sampled flag = `0` in the `traceparent`
-   * header). This avoids overhead when traces are being recorded but dropped.
+   * When true (the default), requests whose upstream trace is not sampled
+   * (sampled flag = `0` in the `traceparent` header) carry only the
+   * `traceparent` header — the sampled flag is preserved, so downstream
+   * tracing never records them, while Supabase logs still get a `trace_id`
+   * to correlate on. The `tracestate` and `baggage` headers are withheld on
+   * these requests.
    *
-   * Set to `false` to always propagate, regardless of the sampling decision
-   * — useful when you want every Supabase request tagged with a `trace_id`
-   * for log correlation, even if the trace itself will not be exported.
+   * Set to `false` to always propagate the full trace context
+   * (`traceparent`, `tracestate`, `baggage`) regardless of the sampling
+   * decision.
    *
    * @default true
    *
-   * @example Always propagate, ignore sampling
+   * @example Always propagate the full context, ignore sampling
    * ```ts
    * import '@supabase/supabase-js/tracing'
    *

package/src/lib/version.ts

@@ -4,4 +4,4 @@
 // - Debugging and support (identifying which version is running)
 // - Telemetry and logging (version reporting in errors/analytics)
 // - Ensuring build artifacts match the published package version
-export const version = '2.112.2'
+export const version = '2.112.3'