Breaking change in pg_graphql 1.6.0 — GraphQL introspection disabled by default

[utkarash2991]

Edit 2026-06-13: Rollout date pushed from 2026-06-15 to 2026-06-29 to allow additional AMI build verification. No other changes to the rollout plan.

Starting with pg_graphql 1.6.0 (shipping in new Supabase projects from 2026-06-29), GraphQL introspection is disabled by default.

Who is affected

• New projects created on or after 2026-06-29 will run pg_graphql 1.6.0+ and have introspection disabled by default.
• Existing projects are not affected unless and until you upgrade pg_graphql to 1.6.0+ (e.g. by upgrading your project's Postgres version). Older projects keep their current behaviour.

What's changing

Previously, __schema and __type queries worked without any configuration. From 1.6.0, they return an error unless you explicitly opt in:

{ "errors": [{ "message": "Unknown field \"__schema\" on type Query" }] }

If your project uses any of the following, you'll need to opt in before relying on introspection:

• Supabase Studio GraphQL explorer (GraphiQL) — uses introspection to display your schema and provide autocomplete
• External GraphiQL or GraphQL Playground
• Apollo DevTools
• Relay compiler
• Code generators (e.g. graphql-codegen)
• Any tool that calls __schema or __type directly

Regular data queries are not affected. accountCollection, insertIntoAccountCollection, etc. continue to work normally regardless of this setting.

How to opt in

Run this SQL once per schema you want to expose introspection on:

comment on schema public is e'@graphql({"introspection": true})';

If you already have a comment on your schema (e.g. for inflect_names), combine the keys:

comment on schema public is e'@graphql({"inflect_names": true, "introspection": true})';

Why this change

Introspection exposes your full API surface — all types, fields, and relationships — to anyone who can reach the endpoint. Disabling it by default reduces the risk of API enumeration and makes it easier to keep private schemas private.

Further reading

• Configuration docs — Introspection
• pg_graphql changelog

[utkarash2991]

Date update — rollout moved from 2026-06-15 to 2026-06-29.

Pushed by 2 weeks to allow additional AMI build verification. No other changes — the opt-in SQL, who's affected, and what's changing all remain the same. The original post has been updated with the new date.

[mmlb]

We had some hiccups yesterday but we're back on the release train. This new version and behavior will be available on the next platfrom deploy.