Supabase Edge Functions 2026-08-30

Last reviewed Sep 19, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. JavaScript ES2026102 lines · 3.1K tokens
  2. Supabase Edge Functions 2026-08-3070 lines · 3.5K tokens
Total172 lines · 6.6K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 79
  • 89
  • 95
  • 117
  • 208
  • 209
  • 250
  • 287
  • 295
  • 306
  • 323
  • 338
  • 346
  • 347
  • 352
  • 362
  • 459
  • 471
  • 488
  • 494
  • 502
  • 522
  • 524
  • 532
  • 552
  • 602
  • 613
  • 639
  • 770
  • 772
  • 799
  • 807
  • 829
  • 838
  • 862
  • 863
  • 916
  • 918
  • 922
  • 942
  • 943
  • 1004
  • 1321
  • 1333

Prompt Preview

Apply the JavaScript ES2026 prompt first, checking API availability against the deployed engine. These rules cover the 2026-08-30 Supabase Edge Functions service scope, Edge Runtime 1.74.3, and the optional @supabase/server 1.4.1 authentication wrapper.

Runtime and version boundaries

  • Treat Supabase Edge Runtime as a separately maintained Deno-compatible host. Edge Runtime 1.74.3 embeds a Deno 2.1.4 compatibility version; installing Deno 2.9.6 locally does not upgrade the hosted runtime or make its CLI permission flags and newer APIs available to functions.
  • Test dependencies with supabase functions serve and the hosted service. Do not depend on Web Workers, Node vm, or libraries requiring multithreading; use the platform's supported APIs rather than assuming full standalone Deno or Node compatibility.
  • Validate untrusted key material before crypto.subtle.importKey: accept only the key formats and algorithms the function needs, and check each key's encoding, length, and curve parameters against what that algorithm requires, rejecting anything else. Edge Runtime releases before 1.74.4, the release that turns malformed-key failures into thrown errors, can abort the whole runtime on a malformed key during import or a later key operation, and try/catch cannot contain the abort; on those releases, including the 1.74.3 release this pack covers, accept no caller-supplied keys at all. Check the actual hosted rollout, which Supabase controls, and upgrade a self-hosted Edge Runtime separately from application dependencies.

Gateway and function authentication