---
title: "Supabase PostgreSQL 15.19 / 17.11 minor release may require action for ltree, pgcrypto, btree_gist and custom operators: 2026-09-25 | Harbyn"
description: "Supabase PostgreSQL 15.19 / 17.11 minor release may require action for ltree, pgcrypto, btree_gist and custom operators, announced Sep 25, 2026."
canonical: "https://harbyn.com/changes/supabase/2026-09-25-postgresql-15-19-17-11-minor-release-action-may-be-required-for-ltree-pgcrypto-b"
last-updated: 2026-09-29
---

# Supabase PostgreSQL 15.19 / 17.11 minor release may require action for ltree, pgcrypto, btree\_gist and custom operators

Markdown version of <https://harbyn.com/changes/supabase/2026-09-25-postgresql-15-19-17-11-minor-release-action-may-be-required-for-ltree-pgcrypto-b>.

Breaking change - Supabase. medium severity. In effect.

Supabase is rolling out PostgreSQL 15.19 / 17.11 (from 15.14 / 17.6), closing 44 CVEs. After upgrading, ltree indexes and btree\_gist indexes on float columns may need REINDEX, pgcrypto no longer decrypts PGP data encrypted with bf, blowfish or cast5 by default, and recreating custom operators with non-built-in selectivity estimators needs superuser. New projects use these versions from 2026-09-28; existing projects upgrade from the dashboard.

## Facts

| Fact | Value |
| --- | --- |
| Vendor | [Supabase](https://harbyn.com/vendors/supabase.md) |
| Kind | Breaking change |
| Severity | medium |
| Status | In effect |
| Announced | Sep 25, 2026 |
| Added to Harbyn | Sep 29, 2026 |
| Lead time | No dated deadline |
| Vendor page | <https://supabase.com/changelog/postgres-15-19-17-11-breaking-changes> |
| Review | Reviewed by a person, extracted by a deterministic parser |

## Find it in your code

```sh
npx harbyn scan
```

This change names no identifier the scanner can match line by line, so the scan tells you whether your repository uses Supabase, from its packages and API hosts. Nothing leaves your machine.

## Sources

Where this event comes from: the page we read, when we read it, and the hash of that snapshot.

- <https://supabase.com/changelog-rss.xml> (changelog, fetched 2026-09-29 02:31 UTC, sha256 `17f0d313bf86dab9154c9e2b94fd0dc427271fd094e4c861f6aeaf10d458dd0c`)

## Related changes

### More from Supabase

- [@supabase/server framework adapters are deprecated and will be removed on December 1, 2026](https://harbyn.com/changes/supabase/2026-10-05-framework-adapters-in-supabase-server-are-deprecated.md) (Deprecation, effective Dec 1, 2026)
- [Status page moves to incident.io and drops webhook and SMS notifications](https://harbyn.com/changes/supabase/2026-10-08-status-page-moves-to-incident-io.md) (Breaking change, announced Oct 8, 2026)
- [four CBC-mode TLS 1.2 cipher suites will be removed from project HTTP APIs](https://harbyn.com/changes/supabase/2026-10-12-an-outdated-subset-of-tls-1-2-ciphers-will-be-disabled-on-project-http-apis.md) (Breaking change, effective Nov 10, 2026)

### Changes at other vendors

- [Amazon Selling Partner API: October listing attribute usage and enumeration value updates](https://harbyn.com/changes/amazon-sp-api/2026-10-14-sp-api-updates-new-listings-items-api-ivp-values-in-eu5-jp-and-ca-stores-oct-2.md) (effective Oct 26, 2026)
- [Google Workspace APIs: OAuth clients must be marked as agentic to call Google Workspace MCP servers](https://harbyn.com/changes/google-workspace/2026-10-12-oauth-clients-must-be-marked-as-agentic-to-call-google-workspace-mcp-servers.md) (effective Nov 11, 2026)
- [Bitbucket Cloud API: Git Credential Manager upgrade required for OAuth 2.0 Git authentication](https://harbyn.com/changes/bitbucket/2026-10-13-git-credential-manager-upgrade-required-for-oauth-2-0-git-authentication.md) (effective Nov 30, 2026)
- [LinkedIn Marketing API: Publisher lists require a surface field](https://harbyn.com/changes/linkedin/2026-10-14-publisher-lists-require-a-surface-field.md) (effective Dec 15, 2026)

[All upcoming deadlines](https://harbyn.com/deadlines.md)