Nextbase Supabase Starter

Dependency freshness

Declared = lowest version the kit's dependency file (package.json, pyproject.toml or requirements.txt) allows. Latest = the npm "latest" tag or the newest PyPI release. TypeScript, the Stripe SDK, FastAPI and other 0.x packages are shown but not counted in the verdict.

What's in the stack

Framework

Next.js

Auth

Supabase Auth

Database / ORM

Supabase

UI

Tailwind CSS, Radix UI

API layer

TanStack Query

Testing

Vitest, Playwright

Detected from declared dependencies. A listed package means it's installed, not necessarily fully wired up.

What the README says you get

• API
  Type-safe server actionsAll mutating endpoints are Zod-validated, typed end-to-end
• API
  Trust-boundary data layerQueries are partitioned by trust boundary
• Auth
  Supabase SSR authSupabase Auth, SSR-correct
• Auth
  Protected route middlewareA single source of truth for protected routes
• Data
  Row Level Security policiesEvery user-owned table ships with SELECT/INSERT/UPDATE/DELETE policies
• Data
  Versioned SQL migrationsReal timestamped SQL migrations under apps/database/supabase/migrations
• Data
  Generated database typesregenerate database.types.ts so every query is end-to-end typed
• Deploy
  Turborepo monorepoTurborepo monorepo (apps/*, packages/*) with pnpm workspaces
• Testing
  pgTAP RLS test harnessA test scaffold under apps/database/supabase/tests
• Testing
  Vitest and PlaywrightVitest + Testing Library for unit, Playwright for E2E
• UI
  shadcn/ui componentsshadcn/ui pre-installed with the full Radix primitive set
• UI
  Tailwind CSS v4Tailwind CSS v4 via @tailwindcss/postcss

Extracted from the kit's README by a local AI model (deepseek-flash) on Sep 29, 2026. Every item is checked against an exact README quote; 2 unverifiable items were discarded. A README claim is the maker's description, not something we tested.