---
slug: extension-version-pinning-ignored
published: 2026-07-22
change_type: breaking-change
affected_products:
  - Database
  - Security
page: https://supabase.com/changelog/extension-version-pinning-ignored
---

# Extension version pinning is deprecated in favor of default versions

Starting **2026-08-05**, specifying an explicit version when creating or updating a Postgres extension on Supabase is deprecated. Statements like:

```sql
create extension pgvector version '0.7.0';
alter extension pg_graphql update to '1.5.9';
```

will still succeed, but the requested version is now ignored: the extension is installed at (or updated to) its **current default version** on your project's Postgres instance, and the statement emits a warning:

```
WARNING:  only superusers can specify extension versions, ignoring version "0.7.0" and installing the default version
```

In a future release, announced separately in advance, these statements will be **rejected with an error** instead.

### Why we're making this change

Supabase instances ship multiple versions of some extensions side by side. Allowing any role to install or downgrade to an older version means projects can end up running extension versions with known security issues — including reintroducing vulnerabilities that were already patched in the default version. Pinning versions is now reserved for platform operations.

### What's not affected

- Extensions you've already installed — nothing changes on running databases.
- `create extension` / `alter extension ... update` without a version clause.
- Database backups and restores (`pg_dump` output never includes version clauses).
- Installing extensions from the dashboard.