[Coly010]

Two things have been turning develop's checks red.

1. The hourly API Package Sync has failed every run since 20 Oct. The Management API spec now sets contentEncoding: "binary" on the ESZIP upload body, and Effect's OpenAPI 3.0 converter rejects contentEncoding and contentMediaType because they'd become active keywords in Draft 2020-12. Both are only annotations and format: binary already says the same thing, so sanitizeOpenApiSchema now drops them. Once this lands, the next sync run should open the backlog PR for @supabase/api.
2. CodeQL flags js/incomplete-sanitization in apps/cli/scripts/publish.ts, because name.replace("/", "%2F") only replaces the first slash. It shows up on every develop commit through the production deploy PR. It's replaceAll now - no package name has more than one slash, so there's no behaviour change.

v2.x has the same publish.ts line. With no behaviour change I don't think it needs a backport, unless we want the alert cleared there too.

🤖 Generated with Claude Code

[github-actions]

CLI benchmark: no changes found

Commit e5146c0 against develop at 8c8f5a7 · 10 runs each · report only, never blocks merging

Command	Before	After	Change
supabase --version	175 ms	179 ms	no real change
supabase --help	185 ms	182 ms	no real change
supabase init	185 ms	186 ms	no real change
supabase migration new bench	190 ms	192 ms	no real change
supabase gen types --lang typescript --project-id replayfixtureprojref	233 ms	230 ms	no real change
supabase projects list	196 ms	194 ms	no real change
supabase functions list --project-ref replayfixtureprojref	206 ms	208 ms	no real change

API calls: unchanged for all 7 commands.

Binary size: 134.0 MB, unchanged.

Details: timing ranges, API calls per command, slowest phases

Timing ranges

Command	Before range	After range	Change	Verdict
supabase --version	165-189 ms	159-205 ms	+4 ms (+3%)	within noise
supabase --help	170-227 ms	172-212 ms	-3 ms (-2%)	within noise
supabase init	171-198 ms	173-192 ms	+1 ms (+0%)	within noise
supabase migration new bench	172-206 ms	178-214 ms	+2 ms (+1%)	within noise
supabase gen types --lang typescript --project-id replayfixtureprojref	209-262 ms	210-268 ms	-3 ms (-1%)	within noise
supabase projects list	178-209 ms	188-210 ms	-2 ms (-1%)	within noise
supabase functions list --project-ref replayfixtureprojref	195-220 ms	199-223 ms	+1 ms (+1%)	within noise

API calls per command

Command	Before	After	Endpoint changes
supabase --version	0	0
supabase --help	0	0
supabase init	0	0
supabase migration new bench	0	0
supabase gen types --lang typescript --project-id replayfixtureprojref	2	2
supabase projects list	1	1
supabase functions list --project-ref replayfixtureprojref	2	2

Slowest phases

No command moved beyond noise, so there are no phase deltas.

Comment /bench to run it again on the latest commit.

Workflow run

[github-actions]

🤖 AI Review

Both independent reviews reported no findings. After reading every diff hunk and the surrounding PR code, I agree: package-name encoding remains compatible, and content annotation removal preserves user-defined property names and binary format annotations. Tests were not run because dependencies are unavailable.

Findings

No issues found.

Stats

Claude findings: 0 · Codex findings: 0 · Confirmed: 0 · Refuted: 0 · Uncertain: 0

---

Models: claude-opus-5-5 + gpt-6.1-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.