
Security News
OWASP 2025 Top 10 Adds Software Supply Chain Failures, Ranked Top Community Concern
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.
@grammyjs/storage-supabase
Advanced tools
Database storage adapter that can be used to store your session data in Supabase database when using sessions.
npm install @grammyjs/storage-supabase --save
To get started, you first need to
Have both @supabase/supabase-js and grammy installed
Have a defined table for sessions in supabase will the following informations:
id as a primary key of type varchar, cannot be nullsession as text. Make it nullable.You could also add created_at and updated_at to keep track of changes. ( See below )
You can check examples folder for full blown usage, or see a simple use case below:
import { Bot, Context, session, SessionFlavor } from 'grammy';
import { supabaseAdapter } from '@grammyjs/storage-supabase';
import { createClient } from '@supabase/supabase-js';
interface SessionData {
counter: number;
}
type MyContext = Context & SessionFlavor<SessionData>;
const URL = 'http://localhost:3000';
const KEY = 'some.fake.key';
// supabase instance
const supabase = createClient(URL, KEY);
//create storage
const storage = supabaseAdapter({
supabase,
table: 'session', // the defined table name you want to use to store your session
});
// Create bot and register session middleware
const bot = new Bot<MyContext>(''); // <-- put your bot token here
bot.use(
session({
initial: () => ({ counter: 0 }),
storage,
}),
);
// Display total stats of images uploaded so far
bot.command('stats', (ctx) => ctx.reply
(`Already got ${ctx.session.counter} images!`));
// Collect statistics of photos uploaded
bot.on(':photo', (ctx) => ctx.session.counter++);
bot.start();
You can alter table manually or just execute this SQL snippet in SQL editor (don't forget to replace YOUR_TABLE_NAME with your table name):
-- Add new columns to table named `created_at` and `updated_at`
ALTER TABLE YOUR_TABLE_NAME
ADD COLUMN created_at timestamptz default now(),
ADD COLUMN updated_at timestamptz default now();
-- Enable MODDATETIME extension
create extension if not exists moddatetime schema extensions;
-- This will set the `updated_at` column on every update
create trigger handle_updated_at before update on YOUR_TABLE_NAME
for each row execute procedure moddatetime (updated_at);
Database -> Extensions in your Supabase dashboardMODDATETIME extensioncreated_at, with type timestamptz, and default value now()timestamptz, and default value now()YOUR_TABLE_NAME with the name of your table):create trigger handle_updated_at before update on YOUR_TABLE_NAME
for each row execute procedure moddatetime (updated_at);
Using the anon public key will lead to unexpected behaviour since RLS (Row Level Security) is enabled by default when creating the table, and will lock writing unless explicit permissions.
When RLS is enabled without configuration, a default-deny policy is used.
You can use service_role secret, but be aware that this will bypass RLS.
2.5.0 (2025-02-24)
FAQs
Supabase database storage
The npm package @grammyjs/storage-supabase receives a total of 34 weekly downloads. As such, @grammyjs/storage-supabase popularity was classified as not popular.
We found that @grammyjs/storage-supabase demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.