--- title: "Supabase four CBC-mode TLS 1.2 cipher suites will be removed from project HTTP APIs: 2026-11-10 | Harbyn" description: "Supabase four CBC-mode TLS 1.2 cipher suites will be removed from project HTTP APIs, effective Nov 10, 2026." canonical: "https://harbyn.com/changes/supabase/2026-10-12-an-outdated-subset-of-tls-1-2-ciphers-will-be-disabled-on-project-http-apis" last-updated: 2026-10-12 --- # Supabase four CBC-mode TLS 1.2 cipher suites will be removed from project HTTP APIs Markdown version of . Breaking change - Supabase. medium severity. Announced. Upcoming. Starting November 10, 2026 at the earliest, project HTTP APIs (ref.supabase.co and custom domains, covering Auth, Data API, Storage, Realtime and Edge Functions) stop offering four CBC-mode TLS 1.2 cipher suites. Clients that support only these ciphers, typically end-of-life operating systems or embedded devices, will fail to connect. TLS 1.3, direct Postgres, pooler and Management API connections are unaffected. 16 days left: the deadline is Nov 10, 2026. ## Facts | Fact | Value | | --- | --- | | Vendor | [Supabase](https://harbyn.com/vendors/supabase.md) | | Kind | Breaking change | | Severity | medium | | Status | Announced | | Announced | Oct 12, 2026 | | Effective | Nov 10, 2026 | | Added to Harbyn | Oct 12, 2026 | | Lead time | 29 days of warning | | Vendor page | | | Review | Reviewed by a person, extracted by a model | ## Find it in your code ```sh npx harbyn scan ``` This change names no identifier the scanner can match line by line, so the scan tells you whether your repository uses Supabase, from its packages and API hosts. Nothing leaves your machine. ## Sources Where this event comes from: the page we read, when we read it, and the hash of that snapshot. - (changelog, fetched 2026-10-12 21:19 UTC, sha256 `4c43e08c8f533dc48a57ba7832fd7e5a192823112b8a1375fbbaf8f820c00b79`) ## Related changes ### More from Supabase - [Status page moves to incident.io and drops webhook and SMS notifications](https://harbyn.com/changes/supabase/2026-10-08-status-page-moves-to-incident-io.md) (Breaking change, announced Oct 8, 2026) - [@supabase/server framework adapters are deprecated and will be removed on December 1, 2026](https://harbyn.com/changes/supabase/2026-10-05-framework-adapters-in-supabase-server-are-deprecated.md) (Deprecation, effective Dec 1, 2026) - [PostgreSQL 15.19 / 17.11 minor release may require action for ltree, pgcrypto, btree\_gist and custom operators](https://harbyn.com/changes/supabase/2026-09-25-postgresql-15-19-17-11-minor-release-action-may-be-required-for-ltree-pgcrypto-b.md) (Breaking change, announced Sep 25, 2026) ### Changes at other vendors - [Amazon Selling Partner API: October listing attribute usage and enumeration value updates](https://harbyn.com/changes/amazon-sp-api/2026-10-14-sp-api-updates-new-listings-items-api-ivp-values-in-eu5-jp-and-ca-stores-oct-2.md) (effective Oct 26, 2026) - [Google Workspace APIs: OAuth clients must be marked as agentic to call Google Workspace MCP servers](https://harbyn.com/changes/google-workspace/2026-10-12-oauth-clients-must-be-marked-as-agentic-to-call-google-workspace-mcp-servers.md) (effective Nov 11, 2026) - [Bitbucket Cloud API: Git Credential Manager upgrade required for OAuth 2.0 Git authentication](https://harbyn.com/changes/bitbucket/2026-10-13-git-credential-manager-upgrade-required-for-oauth-2-0-git-authentication.md) (effective Nov 30, 2026) - [LinkedIn Marketing API: Publisher lists require a surface field](https://harbyn.com/changes/linkedin/2026-10-14-publisher-lists-require-a-surface-field.md) (effective Dec 15, 2026) [All upcoming deadlines](https://harbyn.com/deadlines.md)