[7ttp]

TL;DR

adds require_current_password under [auth.email] so local stacks and linked projects can require the current password for password changes.

whats introduced?

supabase start now passes the value to auth as GOTRUE_SECURITY_UPDATE_PASSWORD_REQUIRE_CURRENT_PASSWORD.

config push, config pull and config diff map it to the linked project's security_update_password_require_current_password.

it defaults to off and supabase init writes it commented out.

config push leaves the project toggle alone when config.toml does not set it.

a project with the toggle on and no key in config.toml now shows up in config diff, so config diff --exit-code exits 2 until config.toml sets it to true.

visual rep:

flowchart LR
  T["[auth.email]<br/>require_current_password = true"] --> S["supabase start"]
  T --> P["config push"]
  S -- before --> S0["key dropped<br/>a wrong current_password still changes the password"]
  S -- now --> S1["auth gets the key<br/>a wrong current_password gets 400 current_password_invalid"]
  P -- before --> P0["key ignored<br/>nothing sent"]
  P -- now --> P1["sends security_update_password_require_current_password = true"]

Loading

ref:

• closes: Expose GoTrue UpdatePasswordRequireCurrentPassword toggle in config.toml #5846

[github-actions]

🤖 AI Review

Both independent reviews reported no findings. Inspection of the checked-out code found no actionable issues: the setting is consistently wired through schemas, hosted config mapping, and both local Auth paths, with backward-compatible defaults. Tests were inspected but not executed.

Findings

No issues found.

Stats

Claude findings: 0 · Codex findings: 0 · Confirmed: 0 · Refuted: 0 · Uncertain: 0

---

Models: claude-opus-5-5 + gpt-6.1-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.

[github-actions]

CLI benchmark (Lightweight Commands): no changes found

Commit c626d94 against develop at c9473a7 · 10 runs each · report only, never blocks merging

Command	Workload	Before	After	Change
supabase --version	version	237 ms	241 ms	no real change
supabase --help	help	257 ms	268 ms	no real change
supabase init	init	233 ms	221 ms	no real change (-5%, within normal variation)
supabase migration new bench	migration-new	330 ms	301 ms	no real change (-9%, within normal variation)
supabase gen types --lang typescript --project-id replayfixtureprojref	gen-types	387 ms	392 ms	no real change
supabase projects list	projects-list	347 ms	373 ms	no real change (+7%, within normal variation)
supabase functions list --project-ref replayfixtureprojref	functions-list	375 ms	376 ms	no real change

API calls: unchanged for all 7 commands.

Binary size: 134.0 MB, up 4.0 KB from 134.0 MB.

Details: timing ranges, API calls per command, slowest phases

Timing ranges

Command	Workload	Before range	After range	Change	Verdict
supabase --version	version	224-277 ms	191-295 ms	+4 ms (+2%)	within noise
supabase --help	help	226-373 ms	225-340 ms	+11 ms (+4%)	within noise
supabase init	init	205-323 ms	207-448 ms	-12 ms (-5%)	within noise
supabase migration new bench	migration-new	234-428 ms	249-429 ms	-29 ms (-9%)	within noise
supabase gen types --lang typescript --project-id replayfixtureprojref	gen-types	266-495 ms	311-462 ms	+5 ms (+1%)	within noise
supabase projects list	projects-list	293-480 ms	288-495 ms	+26 ms (+7%)	within noise
supabase functions list --project-ref replayfixtureprojref	functions-list	310-405 ms	312-526 ms	+1 ms (+0%)	within noise

API calls per command

Command	Workload	Before	After	Endpoint changes
supabase --version	version	0	0
supabase --help	help	0	0
supabase init	init	0	0
supabase migration new bench	migration-new	0	0
supabase gen types --lang typescript --project-id replayfixtureprojref	gen-types	2	2
supabase projects list	projects-list	1	1
supabase functions list --project-ref replayfixtureprojref	functions-list	2	2

Slowest phases

No command moved beyond noise, so there are no phase deltas.

Workflow run

Comment /bench to run the lightweight benchmark (this comment) again on the latest commit, or /bench full to also run the integration-heavy benchmark, which posts in its own comment.