mirror of
https://github.com/supabase/supabase.git
synced 2026-10-12 04:45:08 +03:00
autovacuum_docs
39004
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 TheOtherBrian1
|
08add1847d | Fix typos in Postgres wraparound troubleshooting guide | ||
|
TheOtherBrian1
|
68a2528424 |
Fix index name condition in SQL query
Corrected SQL query to include '_ccold' in index name check. |
||
|
TheOtherBrian1
|
a1cf5ebfc0 | Merge branch 'master' into autovacuum_docs | ||
|
Brian
|
70a0f0797e | addressed CodeRabbit concerns | ||
|
kemal.earth
|
329b0a0156 |
fix(studio): animation gradient on log drains empty state (#51403)
## Problem Animation had values that became deprecated after colour migration. ## Solution Updated to use the same background colour as everywhere else. To test, on a free organization navigate to Settings > Log Drains. | Before | After | |--------|--------| | <img width="764" height="356" alt="Screenshot 2026-10-07 at 18 20 21" src="https://github.com/user-attachments/assets/eb07c4fa-e089-4558-83fe-01ff189eeae4" /> | <img width="760" height="342" alt="Screenshot 2026-10-07 at 18 24 06" src="https://github.com/user-attachments/assets/dc7b3998-df1c-4df0-ae15-e23286787cf4" /> | |
||
|
Alaister YoungandAlaister Young
|
a8b2f23091 |
fix(studio): restore deployment update metadata (#51048)
Deployment update checks now receive a timestamp from GitHub’s documented commit API instead of silently falling back to `unknown` when its website response changes. Valid deployment metadata is cached for ten minutes; development and failed lookups are uncached so they can recover. **Changed:** - Validate and normalize the committer date in the shared Next/TanStack handler, preserving the existing response shape and `unknown` fallback. - Exclude only the exact deployment-metadata endpoint from TanStack’s private API cache default; authenticated APIs and server functions retain it. - Keep the client update query unpinned and its existing toast threshold unchanged. **Added:** - Shared-handler tests through both Next and the TanStack adapter for dates, malformed payloads, upstream failures, and recovery. - Tests using the installed Vercel route compiler for root and `/dashboard` cache rules, security headers, and empty Next configuration. ## To test - On the TanStack preview, request `/dashboard/api/get-deployment-commit`; compare its SHA and UTC timestamp with the deployed commit’s GitHub committer date. - Repeat the request to check CDN caching. Vercel consumes `s-maxage`, so use cache-hit/age evidence as well as client-visible headers. - Confirm another API route and a server-function path retain `private, no-store`. - Open an existing project, reload it while clean, and inspect the untouched support form for metadata-related errors. Validation: 60 focused tests, Studio typecheck, scoped ESLint, formatting, knip, and both framework production builds passed. Live unauthenticated GitHub lookup with the configured API version returned the expected committer date. Full source lint ratchet also passed, excluding only generated build directories. Local TanStack browser checks passed for clean project/reload, general settings, untouched support form, and naturally emitted development metadata formatting; no errors or unexpected update toast appeared. The positive two-deployment toast and submitted support-version formatting were not exercised. Deployed native Next previews returned the exact commit SHA and expected UTC timestamp; repeated metadata requests produced CDN HIT responses (ages 26 and 100 seconds). Build logs establish that the staging preview also ran Next, so it does not validate TanStack edge header behavior. A separate preview-only redeployment with a deployment-scoped TanStack override was confirmed to run Vite. It returned the same correct SHA/timestamp, a repeat CDN cache HIT, and private, no-store on the neighboring UTC API. No project settings or production aliases were changed. Installed Vercel compiler tests cover the remaining root/base-path and server-function rules. No new environment variable, token, or dependency is required. Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Alaister YoungandAlaister Young
|
8d08198cb4 |
fix(studio): preserve TanStack server source maps (#51051)
TanStack server maps now preserve original TypeScript locations through both Nitro build stages. Sentry can upload those maps before final server and public maps are removed; intermediate SSR maps remain available for composition. **Changed:** - Enable Nitro server maps with original source content and compose adjacent SSR maps through a build-only Vite loader scoped to the Nitro environment. - Keep intermediate maps until Nitro consumes them. Apply Sentry’s bundler plugin to client and final server outputs, preventing intermediate SSR IDs from overriding the final uploaded map ID. Remove final server maps after eligible uploads; skipped or unauthenticated uploads retain private maps. - Preserve the existing Sentry release, project, credentials, middleware, and separate Next configuration. **Added:** - Real two-stage Node and Vercel build regressions for original TypeScript positions, runtime debug-ID matching against the installed Sentry SDK, map cleanup timing, malformed maps, and loader boundaries. ## To test - Build an actual TanStack preview with the existing Sentry upload settings. Confirm client and final server uploads include maps, intermediate SSR maps remain available for composition, final/public maps are removed, and the deployed function remains within its size limit. - Inspect a public JavaScript asset's map URL; it should not expose a source map. - Build with uploads skipped or credentials absent; private server maps should remain, with no public maps. - Reload an existing project and navigate through general settings and an existing Edge Function without editing or submitting anything. - Before production rollout, confirm browser and server events resolve to useful original source locations in the intended Sentry project. Validation: 22 focused tests, Studio typecheck, scoped ESLint, formatting, knip, full source lint ratchet, and both framework production builds passed. Full-app artifact tracing resolves a compiled handler to its original TypeScript line with exact source content. The skipped-upload Vercel build contains zero public maps and no function symlinks. Local TanStack browser checks passed for project/reload, untouched general settings and support, and an existing function editor/reload; a final retest after the runtime-ID fix passed with no module or Sentry errors. A previously observed devtools support-lifecycle warning remains unattributed. An explicit TanStack preview of this commit reached READY: client and final Nitro uploads succeeded, with no intermediate SSR upload. A shell-referenced JavaScript asset returned 200 with immutable caching and its map URL returned 404. Upload reports still contain unmapped files; original app TypeScript mapping and runtime-ID association are established by build artifacts/fixtures, while real event deobfuscation remains rollout QA. Deployment acceptance confirms this preview fits its configured function limits; exact deployed size and post-upload server contents were not independently downloaded. No package patch, dependency, or new environment variable is required. Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Chris Gwilliams
|
ccb1c60166 | fix: show dialog to prevent restoring larger projects to nano compute (#51309) | ||
|
Alaister YoungandAlaister Young
|
690d67e372 |
fix(studio): hash TanStack deployment pins in build cache (#51054)
Studio builds now hash `VERCEL_DEPLOYMENT_ID` because TanStack embeds it in server-function request pins. Cached output cannot retain an earlier deployment ID when redeploying the same commit. **Changed:** - Move the ID from `passThroughEnv` into `build.env`, keeping runtime pinning and Skew Protection settings intact. - Turbo-managed Next builds with a new ID also invalidate the Studio cache; upstream package caches remain reusable. ## To test - Run strict Turbo dry runs with two deployment IDs for each framework: Studio hashes should differ, an unchanged ID should remain stable, and upstream hashes should remain unchanged. - Build Next and TanStack. With skew protection enabled, confirm the TanStack client/server output includes the current deployment pin. - Reload an existing project and function editor and navigate through settings without edits. Validation: actual Turbo dry runs reproduced identical hashes before the fix and verified distinct/stable hashes afterward for both frameworks. Studio typecheck, full source lint ratchet, knip, formatting, and both production builds passed. Emitted TanStack client/server artifacts contain the synthetic validation ID and deployment header. Local TanStack checks passed for overview/reload, untouched settings plus Back, functions list, existing function source/reload, and final clean return; no console errors or backend changes. Cache-key and genuine server-function routing claims are separate from this UI coverage. No new environment variable, dependency, or package patch is required. Current Vercel app builds invoke the framework directly through the Studio dispatcher; this change applies when Studio builds run through Turbo. --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Alaister YoungandAlaister Young
|
55c297655e |
fix(studio): keep project sidebar navigation accessible (#51055)
Project sidebars now expose enabled navigation on fixed-width pages, and the mobile project menu has an accessible dialog name. Fixed sidebar sizing and editor resize controls remain intact. **Changed:** - Remove the disabled state from the shared sidebar panel while retaining 256px fixed sizing, the disabled resize handle, and existing editor resize limits. - Add a screen-reader-only Project menu title inside the mobile project sheet without changing other sheets or their titles. **Added:** - Tests using the actual resizable wrappers for enabled navigation and handle semantics, and the actual mobile sheet for its accessible name through menu navigation. ## To test - Navigate through Database and Settings sidebar links with ordinary clicks and Tab/Enter. Enabled links should have no disabled ancestor. - Confirm fixed sidebars remain 256px wide, including an ordinary drag of their disabled handle. - In SQL Editor, verify keyboard resizing stays within 256–512px and collapse/expand still works; restore the original width and visibility without editing or executing anything. - Open the mobile project menu. Confirm its dialog name is Project menu, navigate through Tables, and close it without a missing-title warning. Restore the viewport. Validation: real regressions reproduce disabled navigation inheritance and the unnamed mobile dialog before their fixes. All 26 focused layout/menu/utility tests and source checks passed. Initial full browser checks passed normal mouse/keyboard navigation, fixed-handle drag resistance, editor resize limits, collapse/expand, and mobile navigation, with viewport/state restored and no backend writes. Both Next and TanStack production rebuilds passed. The focused mobile retest passed the linked Project menu title through sections, closing, navigation, and reopening with no new missing-title warnings, followed by desktop sidebar and editor controls; viewport, width, and visibility were restored. Unrelated development React mount/ref warnings remain separately recorded; native Next local browser and catalog data were not verified. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Project sidebar links remain available when sidebar resizing is turned off; the resize handle stays unavailable in that setting. * The mobile project menu retains the “Project menu” name as you navigate between sections. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Alaister YoungandAlaister Young
|
46b7382d50 |
fix(studio): serve Deno declarations as TypeScript (#51057)
## Problem TanStack does not preserve Next's `text/typescript` content type for the public Deno declarations. This change restores MIME parity; Monaco already rendered before the fix. ## Solution Add the TypeScript header for `/deno/*.ts` at root and configured base-path URLs. Dynamic API and server-function responses keep their own content types, security headers and cache rules. Next retains its existing configuration. Tests use the installed Vercel routing compiler to cover both declarations, suffix boundaries, dynamic routes, security headers, the flags endpoint and the empty Next configuration. ## Review instructions 1. On a TanStack deployment, request `/deno/edge-runtime.d.ts` and `/deno/lib.deno.d.ts` at root and `/dashboard`. Expect 200, `text/typescript` and unchanged file contents. 2. Check missing `.ts.map`, `.tsx` and similar paths return 404 without the TypeScript override. API and server-function responses should retain their own content types. 3. Open an existing function editor and reload it without editing or deploying. Confirm the file tree and source still render. 4. Build Next and TanStack. Confirm Next retains its existing configuration. Validation: the routing compiler reproduces four declaration-header failures before the fix; all 30 content-type cases and 10 SPA route tests pass afterward. Typecheck, knip, the source lint ratchet, scoped lint, formatting and both production builds passed with uploads disabled. Built declarations are byte-identical to their public sources. Local TanStack checks passed the function list, existing source view, exact editor reload and clean project return without edits or backend writes. Native Next UI was not tested locally. The combined TanStack preview at QA commit `f35b3c42d8ba6a714299b148d797b09107a7a6fe` returned 200, `text/typescript`, nosniff and byte-identical contents for both declarations at root and `/dashboard`. Missing `.ts.map` and `.tsx` paths returned 404 without the override; neighboring dynamic API responses retained JSON content type and private caching. This preview evidence covers the combined original fixes, not the subsequent dependency upgrade. ## Checklist - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md). - [x] No docs content changed; docs authoring skills are not required. --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Alaister YoungandAlaister Young
|
820ff0f2d2 |
fix(studio): handle invalid TanStack API request bodies (#51046)
Malformed JSON now returns `400 Invalid JSON` from the TanStack API
adapter instead of an unhandled 500. Empty JSON bodies and undecodable
cookies follow the existing Next parser behavior.
**Changed:**
- Handle JSON parsing failures before invoking the API handler, while
preserving body-read and downstream handler errors.
- Recognize exact JSON and JSON-LD media types, including case and
charset parameters.
- Keep raw cookie values when URI decoding fails.
**Added:**
- 43 adapter tests covering valid and invalid bodies, cookies, handler
isolation, response headers, streaming, and abort events.
## To test
- POST malformed JSON to `/api/parse-query` with `Content-Type:
application/json`; expect 400 with `Invalid JSON`. Repeat with JSON-LD.
- POST `{"sql":"select 1"}` to the same endpoint; expect 200. This
parses SQL without executing it against a database.
- Repeat the valid request with an undecodable cookie value; expect the
same successful result.
- Open an existing project and database settings; verify normal API
consumers remain usable.
Validation: 59 focused tests, 29 differential body cases plus malformed
cookies against installed Next parsers, Studio typecheck, lint ratchet,
scoped ESLint, formatting, knip, and both framework production builds
passed. Direct local HTTP checks passed for malformed, empty, valid, and
malformed-cookie requests. Next handlers, routes, environment files, and
dependencies are unchanged. Local TanStack browser checks passed for
signed-in project rendering, clean reload, and the untouched support
form. Database settings rendered its error state, but the banned-IP
service returned an upstream connection-timeout payload, so successful
list coverage remains unverified. Chrome blocked direct API-document
navigation; malformed-input behavior is covered by the separate HTTP and
parser checks.
The automatic staging preview ran native Next (confirmed from its build
output), providing an additional Next regression check: malformed JSON
and JSON-LD returned exact `400 Invalid JSON`; valid SQL parsing
returned 200; an undecodable cookie preserved the same valid response.
No SQL was executed. The local TanStack runtime and in-process adapter
checks passed; the combined TanStack deployment results follow.
The combined rollout preview (TanStack, QA commit
`f35b3c42d8ba6a714299b148d797b09107a7a6fe`) also passes deployed
malformed JSON/JSON-LD 400, valid SQL parsing 200, and
undecodable-cookie 200 with the same valid response. No SQL is executed
against a database.
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
|
||
|
Shane AdamsandClaude Sonnet 5.5
|
6c150d26d9 |
docs(mgmt-api): clarify rate limits are per endpoint (#51379)
## Problem The Management API rate limits docs said limits are per user and per project or organization. They didn't say that each endpoint also has its own limit, or how requests without a project or organization, and tokens versus OAuth apps, are counted. The partial also had a typo, a repeated example, and a tracking-key sentence that listed endpoint as a scope. ## Solution Edits to `apps/docs/content/_partials/api_rate_limits.mdx`, in one commit per change type: 1. `docs(mgmt-api): clarify rate limits are per endpoint`: the content change. It adds the per-endpoint model, the user scope, the `POST /v1/projects` scoping, and who the limit applies to. 2. **Style**: fixes the `enpoint` typo and the table alignment, removes the repeated Project A/B paragraph and the `database/context` note that restated its table rows, unwraps hard-wrapped lines, and aligns bold labels and wording with the style guide. 3. **Structure**: moves "Rate limit response headers" after "Who the limit applies to", so the concept sections come before the reference sections. No headings were renamed, and no inbound anchors to them exist in `apps` or `packages`. 4. **Technical**: the tracking-key sentence now reads "scope (project or organization) and the endpoint". It previously listed endpoint as a scope, which contradicted the scope list. Not verified against the rate limiter, which isn't in this repo. A reviewer with access should confirm: - Requests without a project or organization count against the user. - `POST /v1/projects` is organization-scoped via `organization_slug`. - Personal access tokens share the user's limit, and OAuth apps share the app's limit. - The tracking-key wording in commit 4 is inferred from the page, not from code. ## Preview links | Site | Live | Preview | Search for | | ---- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | ------------------------------ | | Docs | [/docs/reference/api/introduction](https://supabase.com/docs/reference/api/introduction) | [/docs/reference/api/introduction](https://docs-git-docs-mgmt-api-rate-limits-per-endpoint-supabase.vercel.app/docs/reference/api/introduction) | `Who the limit applies to` | ## Review instructions 1. Open the live and preview links side by side and scroll to "Rate limits". 2. Check that the section order is: Standard rate limit, Rate limit scope, How rate limits are tracked, Who the limit applies to, Rate limit response headers, Endpoint exceptions, Best practices. 3. Check that the scope table and the endpoint exceptions tables render correctly. 4. Review commit by commit, since each commit is one change type. 5. If you can read the rate limiter code, check the unverified claims listed above. ## Checklist Check all before review: - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) - [x] If I wrote a new docs topic or edited an existing topic, I used the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs [style guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide) 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com> |
||
|
supabase-supabase-autofixer[bot]andsupabase-workflow-trigger[bot]
|
dc4830c480 |
feat: update @supabase/*-js libraries to v2.117.3 (#51392)
This PR updates @supabase/*-js libraries to version 2.117.3. **Source**: supabase-js-stable-release **Changes**: - Updated @supabase/supabase-js to 2.117.3 - Updated @supabase/auth-js to 2.117.3 - Updated @supabase/realtime-js to 2.117.3 - Updated @supabase/postgest-js to 2.117.3 - Refreshed pnpm-lock.yaml --- ## Release Notes ## v2.117.3 ## 2.117.3 (2026-10-07) ### 🩹 Fixes - **deps:** bump next to patch RCE in realtime-js example ([#2733](https://github.com/supabase/supabase-js/pull/2733)) - **functions:** send a Blob or File with its own content type ([#2714](https://github.com/supabase/supabase-js/pull/2714)) - **postgrest:** treat TimeoutError as an abort in retry guard ([#2732](https://github.com/supabase/supabase-js/pull/2732)) - **storage:** send multipart fields before files ([#2736](https://github.com/supabase/supabase-js/pull/2736)) ### ❤️ Thank You - Bruno Gale @fresh55 - Ferhat Elmas - Katerina Skroumpelou @mandarini ## v2.117.2 ## 2.117.2 (2026-09-25) ### 🩹 Fixes - **postgrest:** avoid instantiation depth errors for large relationship unions ([#2701](https://github.com/supabase/supabase-js/pull/2701)) ### ❤️ Thank You - Han Qiao @sweatybridge ## v2.117.1 ## 2.117.1 (2026-09-23) ### 🩹 Fixes - **auth:** return stored session when a refresh loses to another tab ([#2698](https://github.com/supabase/supabase-js/pull/2698)) ### ❤️ Thank You - Katerina Skroumpelou @mandarini ## v2.117.0 ## 2.117.0 (2026-09-22) ### 🚀 Features - **auth:** forward options.mediation to navigator.credentials.get in signInWithPasskey ([#2675](https://github.com/supabase/supabase-js/pull/2675)) - **auth:** enable passkey API by default and deprecate experimental passkey opt-in ([#2695](https://github.com/supabase/supabase-js/pull/2695)) ### ❤️ Thank You - fadymak - James Argarin - Katerina Skroumpelou This PR was created automatically. Co-authored-by: supabase-workflow-trigger[bot] <266661614+supabase-workflow-trigger[bot]@users.noreply.github.com> |
||
|
|
6ef729cb5c |
feat(storage): versioning bucket modals (FE-4161) (#49205)
| # | Branch | Base | | - | ------ | ---- | | 1 | `feat/storage-versioning-private-alpha` — merged | `master` | | 2 | `feat/storage-versioning/002-bucket-form-fields` | `master` | | 3 | `feat/storage-versioning/003-bucket-modals` ◀ | 2 | | 4 | `feat/storage-versioning/004-object-versions-data` | 3 | | 5 | `feat/storage-versioning/005-file-preview-versions` | 4 | | 6 | `feat/storage-versioning/006-billing-storage-retention` | 5 | | 7 | `feat/storage-versioning/007-archived-objects-data` | 6 | | 8 | `feat/storage-versioning/008-archived-rows` | 7 | | 9 | `feat/storage-versioning/009-archived-preview-pane` | 8 | | 10 | `feat/storage-versioning/010-replace-file` | 9 | ## [3/10] Storage object versioning: wire into the bucket modals **Base:** `feat/storage-versioning/002-bucket-form-fields` (PR 2) ### This PR Mounts the object-versioning form section in the create and edit bucket modals behind the feature preview, and saves it. - create and edit bucket modals spread `bucketVersioningFormFields` into their existing form schema - lifecycle defaults to 30 days / 10 versions - edit adds a confirmation before suspending an actively versioned bucket ## Enabling object versioning on a new bucket and setting lifecycle policies https://github.com/user-attachments/assets/194f8319-4929-432e-8a50-206f180a77a8 ## Edit and suspend object-versioning https://github.com/user-attachments/assets/f31e1d34-9840-4f5a-a269-6a911214742d ## To reproduce 1. Make sure storage versioning is enabled under feature previews > Storage Versioning 2. Open Storage Bucket File explorer 3. create new bucket and enable Object Versioning 4. set lifecycle policy - Noncurrent version expiration: can be either empty or >1 - Retained noncurrent versions: can be either empty or between 1 and 100 and can't exist without "Noncurrent version expiration" 5. Open new bucket with object versioning and test changing lifecycle policies 6. Disabling object-versioning shows proper warning and updates `versioning_status` to SUSPENDED (it can never go back to DISABLED once it has been enabled on a bucket) --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com> |
||
|
Ivan VasilovandClaude Sonnet 5.5
|
075c611463 |
chore: bump vulnerable dependencies (#51381)
## Summary - Bumps vulnerable transitive dependencies flagged by `pnpm audit`, one commit per dependency (lockfile only, no permanent overrides): proxy-addr, shell-quote, @fastify/busboy, @graphql-tools/executor-legacy-ws, @modelcontextprotocol/sdk, compression, http-cache-semantics, source-map-js, smol-toml, dompurify. - Updates `scripts/fix-audit-vulnerability.ts` to be agent-friendly: accepts a dependency name argument, adds `--json` (single JSON object on stdout, logs on stderr, never prompts) and `--help`. ## Not fixed The remaining audit findings could not be resolved by this script. Some are blocked by `minimumReleaseAge` (braces, node-forge, sprintf-js); others stay vulnerable even with an override and need a parent dependency update or scoped override. ## Test plan - [ ] CI passes (typecheck, lint, prettier) - [ ] `pnpm audit` shows fewer findings than on master 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com> |
||
|
claude[bot]andClaude
|
6c6b19c6c6 |
chore(studio): report empty-body GET 200s to Sentry with a no-store probe (#51123)
<!-- ccr-slack-attribution --> _Requested by **Ivan Vasilov** · [Slack thread](https://supabase.slack.com/archives/C063LNYJJKS/p1790710416069689?thread_ts=1790710416.069689&cid=C063LNYJJKS)_ **Before:** When a Studio API GET comes back as a 200 with an empty body, openapi-fetch hands the caller `{}` and we only see the downstream crash, with no record of the response that caused it. **After:** The first time this happens for an endpoint in a page session, Studio sends one Sentry warning, `Empty response body on successful API request`. It carries the response metadata, browser state, resource timing, and the result of a single `cache: 'no-store'` refetch. What the caller receives is unchanged. ## Problem Studio crashes trace back to GET requests that return 200 with an empty body, which openapi-fetch turns into `{}`. They are heavily skewed to Firefox and Safari. The leading hypothesis is browser cache revalidation (Express weak ETags, no `Cache-Control` on api.supabase.com), but nothing confirms it yet. The `no-store` probe tells the two cases apart: if the refetch has a body, the browser cache is the likely culprit; if it is also empty, the server or the edge is sending empty bodies. This data should show whether the fix belongs on the API side or the Cloudflare side. Context: #51041 (closed) tried to guard the crashing call sites instead. ## Needs API-side change to be fully useful Cross-origin, Studio can only read CORS-safelisted response headers, and resource timing sizes read as zero. If api.supabase.com sends `Access-Control-Expose-Headers: ETag, cf-ray, cf-cache-status, x-request-id` and `Timing-Allow-Origin: <studio origin>`, this event will also carry the ETag, cf-ray, and cache status, plus the real transfer and body sizes and the negotiated protocol. Until then, those fields read as `null` or `0`. ## Solution - `data/empty-body-diagnostics.ts` (new): `reportEmptyBodyResponse({ request, response, schemaPath })`. - Runs only for `GET` and only when `IS_PLATFORM`. Empty POST/201 bodies are legitimate. - Reports at most once per templated endpoint per page session (module-level `Set`). - Endpoint: openapi-fetch's `schemaPath` (e.g. `/platform/projects/{ref}/settings`), passed through `templateEndpointPath`. That function drops the query string and hash, replaces the segment after `projects`/`organizations`/`branches` with `{ref}`/`{slug}`/`{branch}`, and replaces UUIDs, numeric IDs, and 20+ character alphanumeric IDs with `{id}`. I used `schemaPath` rather than the request URL so user-chosen names (bucket names, function slugs) never end up in tags or fingerprints. - Probe: one plain `fetch(new Request(request, { cache: 'no-store', ... }))` with a fresh `X-Request-Id` and a 10s `AbortController` timeout. `AbortSignal.timeout` isn't available in older Safari. The probe bypasses the openapi-fetch middleware, so it can't recurse. Only the body's byte length is recorded, never its contents. - Event: `level: 'warning'`, `fingerprint: ['empty-body-response', endpoint]`, `tags: { endpoint, probe_has_body, empty_body_diagnostic: 'true' }`, where `probe_has_body` is `true` / `false` / `error`. `extra` holds: - the request: method, status, `response.type`, `redirected`, and the original `X-Request-Id` (for API log lookup) - response headers: `content-type`, `cache-control`, `last-modified`, `expires`, `content-length`, `etag`, `cf-ray`, `cf-cache-status`, `x-request-id` - browser state: `visibilityState`, `navigator.onLine`, the navigation type, ms since navigation start, and whether the page was restored from bfcache - the latest `PerformanceResourceTiming` for the URL (transfer, encoded, and decoded size, `nextHopProtocol`, `responseStatus`) - the probe: status, request ID, body length, `content-length`, `content-type`, or the error name - Fire-and-forget: everything is wrapped in a `try`/`catch`, and the caller does not await it. - `data/fetchers.ts`: the `onResponse` middleware passes `{ request, schemaPath }` to `normalizeEmptyBodyResponse`, which calls the reporter in its empty-body branch and also for a 200 that carries `Content-Length: 0`. openapi-fetch short-circuits that case to `{}` the same way, so it is the same symptom. The return value is unchanged in every branch. - `packages/common/sentry.ts`: `filterSentryEvent` normally keeps only 1% of events that aren't page crashes. It now sends events tagged `empty_body_diagnostic` unsampled, with `codeSampleRate: '1'`. A once-per-session warning would barely show up at 1%. Consent and platform gating and the third-party filter still apply. www and docs also use `filterSentryEvent`, but only Studio's reporter sets this tag, so sampling for them and for every other Studio event is unchanged. Sentry config: Studio's `beforeSend` doesn't otherwise drop this message. It has no exception values, so the no-stack-trace filter doesn't apply, and it matches no `ignoreErrors` entry. ## Review instructions 1. Check `normalizeEmptyBodyResponse` in `data/fetchers.ts`: the reporter is `void`-called and its return value is untouched. 2. Check `probe()` in `data/empty-body-diagnostics.ts`: only `byteLength` is read from the body. The probe reuses the original request's headers and credentials (same auth as the original GET). 3. Check `filterSentryEvent` in `packages/common/sentry.ts`: only the `empty_body_diagnostic` tag skips sampling. 4. Tests: `data/empty-body-diagnostics.test.ts` and `packages/common/sentry.test.ts`. ## Verification - Unit tests (`data/empty-body-diagnostics.test.ts`, new): - path templating cases - `probe_has_body` `true` / `false` / `error` - the secret body content never appears in the Sentry call - one report per endpoint - non-GET and non-platform requests are skipped - no throw when `fetch` or Sentry throws - end-to-end through `client.GET`: still resolves `{}` and reports the `schemaPath`, for both a missing `Content-Length` and `Content-Length: 0` - `packages/common/sentry.test.ts`: tagged diagnostics are sent unsampled, untagged or false-tagged ones are still sampled, and they're still dropped without consent. These tests, plus the existing `normalizeEmptyBodyResponse.test.ts`, `handleError.test.ts`, and the rest of `sentry.test.ts`, pass (67 tests) under vitest 5 + jsdom. I ran them in a minimal harness, not the full `pnpm install` workspace, because the local checkout is sparse. - I ran TypeScript 7.0.2 (`--strict`) on the five touched files against the real `api-types`, with stubbed `common`/Sentry types. No errors in the touched files. - Prettier `--check` with the repo config passes, with and without `SORT_IMPORTS=false`. - Not run locally: the full studio typecheck, `lint:ratchet`, and knip. CI covers them. The change adds no `any`, no default exports, and no deps. ## Checklist - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01UefDak8XYLMi9aiEjDPXc5 --------- Co-authored-by: Claude <noreply@anthropic.com> |
||
|
Yuvraj Singh
|
d1205a05e9 |
fix(studio): default cron HTTP timeout when timeout_milliseconds is omitted (#51385)
## Problem
`parseCronJobCommand` reads the timeout of an `net.http_get` /
`net.http_post` cron command like this:
```ts
const timeout = timeoutMatch?.[1] || ''
// ...
timeoutMs: Number(timeout ?? 1000),
```
When the command has no `timeout_milliseconds` argument, `timeout` is
`''`, which isn't nullish, so the `?? 1000` fallback never applies and
`timeoutMs` becomes `Number('') === 0`.
`timeout_milliseconds` is optional in pg_net, so this is common for jobs
created in SQL, e.g.:
```sql
select cron.schedule('ping', '* * * * *', $$ select net.http_get(url:='https://example.com/health') $$);
```
Opening such a job in the cron editor shows a timeout of **0 ms**, and
saving fails validation (the field requires 1000 to 5000 ms) until the
user edits a value they never set.
## Solution
Use the parsed value when present, and otherwise fall back to pg_net's
default for `timeout_milliseconds` (5000 ms in current pg_net). That's
what the job actually runs with, so opening and saving it in Studio
doesn't change its behavior. It's also within the form's allowed range.
Added tests for the Edge Function and HTTP request paths without
`timeout_milliseconds`. Both fail on `master` (`timeoutMs: 0`), and the
existing cron tests still pass.
## Review instructions
1. In the SQL editor, run:
```sql
select cron.schedule('ping', '0 * * * *', $$ select
net.http_get(url:='https://example.com') $$);
```
2. Open Integrations > Cron > `ping` > Edit.
3. Before: the timeout field shows `0` and saving shows a validation
error. After: it shows `5000` and saves.
4. `pnpm --filter studio test
components/interfaces/Integrations/CronJobs/CronJobs.utils.test.ts`
## Checklist
- [x] I have read
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
- [ ] If I wrote a new docs topic or edited an existing topic, I used
the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs
[style
guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide)
|
||
|
Charis
|
22886fd304 |
feat(studio): add flag-gated general region selection (#51274)
## Problem
We want to be able to show free-plan organizations a simplified region
selector that only lists general regions (Americas, Europe,
Asia-Pacific), controlled per organization through ConfigCat.
## Solution
- ConfigCat flags are now evaluated with `organization_slug` and
`organization_created_at` (Unix seconds) custom attributes, so flags can
target and bucket by organization.
- `organization_created_at` is read from `GET
/platform/organizations/{slug}`, fetched only for free-plan
organizations, since the organization list response doesn't include it.
- Two flags:
- `freeTierGeneralRegionEnrollment`: the organization is enrolled
(control or test).
- `freeTierGeneralRegionSelection`: the organization sees only general
regions.
- For enrolled free organizations, the region selector stays in its
loading state until flags have been evaluated with the organization's
creation time, so specific regions aren't shown and then removed.
- In the test variant, the selector hides specific regions and shows a
footer linking to the plan upgrade panel. High Availability keeps its
own region list.
- Telemetry: new `free_tier_general_region_experiment_exposed` and
`free_tier_general_region_upgrade_clicked` events, and
`freeTierGeneralRegionExperiment` / `regionSelectionType` properties on
`project_creation_simple_version_submitted`.
- `created_at` is added to `OrganizationSlugResponse` in the generated
platform types, matching the API.
## Review instructions
1. With both flags off, open `/new/[slug]` for a free organization and
confirm the region selector is unchanged.
2. Using the dev toolbar, set `freeTierGeneralRegionEnrollment` and
`freeTierGeneralRegionSelection` to `true`. Confirm only general regions
are listed and the footer links to the billing plan panel.
3. Set `freeTierGeneralRegionSelection` to `false` and confirm the full
selector is shown.
4. Repeat with a paid organization and confirm the full selector is
always shown.
|
||
|
Charis
|
ffe1ebc940 |
fix(studio): do not ignore requested model if available in base (#51388)
## Problem The model selection logic in `generate-v4.ts` was incorrectly ignoring the requested model even when it was available in the base model set. The condition checked for access to advanced models or throttling in a way that would force fallback to the default base model even when the requested model was already a base model. ## Solution Reordered the logical condition to first check if the effective model is a base model ID, and only apply the access/throttle checks when the requested model is not already a base model. This ensures the requested model is respected when it's available. Also threaded the `effectiveModel` parameter through to the assistant response generator for better telemetry and debugging context. ## Review instructions 1. Check the logic change in `apps/studio/pages/api/ai/sql/generate-v4.ts` line 164 2. Verify the condition now correctly checks `isAssistantBaseModelId(effectiveModel)` first 3. Confirm `effectiveModel` is now passed to `generateAssistantResponse` for proper telemetry ## Checklist - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) 🤖 Generated with [Claude Code](https://claude.com/claude-code) |
||
|
Alaister YoungandAlaister Young
|
16bd06dfb8 |
fix(studio): silence status page errors when incident.io isn't configured (#51315)
Running Studio locally without the incident.io env vars produces a 500 from `/api/status-page` on every fetch, plus a server-side log and a client `console.error`. Retries and the 5-minute refetch keep repeating them, so the dev console stays noisy. **Changed:** - `lib/api/status-page.ts` – when `INCIDENT_IO_WIDGET_URL` is unset outside production, return an empty (degraded, short-cached) status page instead of throwing. The missing API key / status page ID log is also limited to production. Production behavior is unchanged. - `data/platform/status-page-query.ts` – remove the client-side `console.error`, which repeated the error that React Query already exposes **Added:** - Tests for the missing widget URL in dev (empty payload, no error log) and in production (still throws) ## To test - Run Studio locally in platform mode without `INCIDENT_IO_*` set: no status page errors in the terminal or the browser console, and `/api/status-page` returns 200 with empty arrays - Support form and project creation still render normally (no status banner, status page link points to status.supabase.com) Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
|
454a232947 |
feat(studio): scoped oauth interstitial ui (#50090)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? The scoped OAuth consent interstitial: scope display, org/project selection, consent screen assembly, success screen, and post-submit role-validation error state. Consolidates the former stacked PRs #49481, #49484, #49486, #49489, #49951 into one reviewable unit (each contained the last; no code was dropped). - Entirely behind `useFlag('oauthAppScopedGrants')` — no reachable UI with the flag off. - Runs on the mock data layer from #49476 (`USE_MOCKS`-gated); no real endpoints are called. - Covers PROD-626, PROD-627, PROD-628, PROD-629, PROD-653. Base is #49476 (data contracts + mocks); will retarget to master once it merges. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com> |
||
|
David McNeil
|
8083226229 |
chore: add David McNeil to humans.txt (#51376)
Add David McNeil to humans.txt |
||
|
Alexis Aguilar
|
7d47e3bf80 |
chore(docs): add Alexis Aguilar to humans.txt (#51369)
## Problem Alexis Aguilar is a new hire and isn't in the `humans.txt` file yet. ## Solution Adds Alexis Aguilar to the `apps/docs/public/humans.txt` file :) <!-- ## Preview links If relevant, include links to changed pages for easy review access. Copy the preview base URL from the Vercel bot comment on this PR. Use the following table as an example template. | Site | Live | Preview | Search for | | -------------- | ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | ----------------------------- | | WWW | [/blog/your-post](https://supabase.com/blog/your-post) | [/blog/your-post](https://zone-www-dot-com-git-branch-name-supabase.vercel.app/blog/your-post) | unique phrase from the change | | Docs | [/docs/guides/your-page](https://supabase.com/docs/guides/your-page) | [/docs/guides/your-page](https://docs-git-branch-name-supabase.vercel.app/docs/guides/your-page) | unique phrase from the change | | Studio | [/dashboard](https://supabase.com/dashboard) | [/dashboard](https://studio-git-branch-name-supabase.vercel.app/dashboard) | unique phrase from the change | | Design system | [/design-system](https://supabase.com/design-system) | [/design-system](https://design-system-git-branch-name-supabase.vercel.app/design-system) | unique phrase from the change | | UI library | [/library](https://supabase.com/library) | [/library](https://ui-library-git-branch-name-supabase.vercel.app/library) | unique phrase from the change | | Knowledge base | [/kb/guides/your-page](https://supabase.com/kb/guides/your-page) | [/kb/guides/your-page](https://kb-git-branch-name-supabase.vercel.app/kb/guides/your-page) | unique phrase from the change | --> <!-- ## Additional context Optionally add any other context or screenshots. --> ## Checklist Check all before review: - [X] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) |
||
|
Danny White
|
a4910196b8 |
fix(studio): use Badge for auth provider enabled state (#51310)
## Problem
Auth Providers uses a bespoke Enabled/Disabled chip that mixes brand
tokens with primary colour. Custom Auth Providers already uses the
standard `Badge` for the same meaning.
## Solution
Replace the bespoke chip with the existing `Badge`:
```tsx
<Badge variant={isActive ? 'success' : 'default'}>
{isActive ? 'Enabled' : 'Disabled'}
</Badge>
```
No new status primitive in this PR. Built-in providers now match Custom
Providers.
| Before | After |
| --- | --- |
| <img width="958" height="1568" alt="CleanShot 2026-10-06 at 17 19
40@2x"
src="https://github.com/user-attachments/assets/08850f4e-528a-4e47-958f-207e72783b16"
/> | <img width="934" height="1482" alt="CleanShot 2026-10-07 at 11 46
41@2x"
src="https://github.com/user-attachments/assets/232903f7-86bd-4c5c-ae1d-d873cddcf67b"
/> |
## Review instructions
1. Open Auth → Providers (built-in list). Confirm each provider shows a
small `Enabled` / `Disabled` Badge, with no brand/primary token mash-up
or oversized pill.
2. Optional: open Auth → Providers → Custom and compare the Enabled
column; it should feel like the same Badge treatment.
## Checklist
- [x] I have read
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
- [ ] If I wrote a new docs topic or edited an existing topic, I used
the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs
[style
guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide)
|
||
|
Danny White
|
5c4745a117 |
fix(studio): smooth Terms of Service dialog intro copy (#51370)
## Problem Joshen left a copy nit on #51302 after merge: the dialog intro reads awkwardly as two short lines. ## Solution Merge them into one sentence: “We’ve updated our Terms of Service which includes the following:” ## Review instructions 1. Open an organisation landing page (`/organizations` or `/org/<slug>`) in the Studio preview. 2. Click **Learn more** on the Terms of Service notice. 3. Confirm the dialog opens with a single intro line before the bullet list, not two separate sentences. ## Checklist Check all before review: - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) - [ ] If I wrote a new docs topic or edited an existing topic, I used the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs [style guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide) |
||
|
Brian
|
9e31b3cfed | Added references to other doc pages. Split troubleshooting section into standalone guides | ||
|
Danny White
|
d95ff5bda9 |
docs(design-system): rewrite sidebar page for monorepo tokens (#51165)
## Problem The design-system Sidebar page was mostly an upstream shadcn paste: first-person voice, a broken `/blocks` link, missing structure images, CLI install steps that do not match this monorepo, and a long changelog / data-fetching tutorial that do not apply here. Separately, it still taught classic shadcn **HSL channel** variables plus `hsl(var(--sidebar-*))`. In this monorepo those tokens are **full colours**. Mixing the two patterns produces invalid CSS. Related call-site cleanup: https://github.com/supabase/supabase/pull/51161 ## Solution - Rewrite the Sidebar docs as a shorter monorepo guide: import from `'ui'`, structure, theming, provider / sidebar props, menu building blocks, controlled mode, state styling. - Move Studio’s `--sidebar-*` aliases into shared `packages/ui` compat CSS so every app on the shared theme gets working `bg-sidebar` utilities. - Drop the duplicate definitions from Studio `globals.css`. Left alone on purpose: brand / destructive channel tokens and docs that correctly use `hsl(var(--brand-…))`. ## Review instructions Design-system preview: [design-system](https://design-system-git-dnywh-docssidebar-full-colour-tokens-supabase.vercel.app/) 1. [Live Sidebar docs](https://supabase.com/design-system/docs/components/sidebar) · [Preview Sidebar docs](https://design-system-git-dnywh-docssidebar-full-colour-tokens-supabase.vercel.app/design-system/docs/components/sidebar). Confirm the page is no longer the upstream essay: no broken images, no `/blocks` link, imports from `'ui'`, theming shows full-colour aliases. 2. Smoke Studio: left nav should look unchanged (same aliases, now from compat.css). 3. Optional: in DevTools, confirm `--sidebar-background` resolves to a full `oklch(...)` colour. ## Checklist - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) - [ ] If I wrote a new docs topic or edited an existing topic, I used the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs [style guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide) |
||
|
Danny White
|
272bb26635 |
fix(studio): remove duplicate status page link in incident banner (#51305)
## Problem During active incidents, the Studio status banner read: > We are investigating a technical issue · Follow the status page for updates Status page The trailing "Status page" goes alongside plain-text copy that already mentioned "status page". ## Solution Match the emergency-override and legacy banners: make "status page" the inline link inside the sentence, and drop the trailing link. Added a regression test covering the link text and href. | Figure | | --- | | <img width="1280" height="288" alt="6696" src="https://github.com/user-attachments/assets/e267f0d0-5484-45a5-969f-03e184b903dd" /> | | _Before_ | | <img width="1280" height="288" alt="47231" src="https://github.com/user-attachments/assets/2beee89e-3674-43f5-9d13-6dc04d153549" /> | | _After_ | ## Review instructions As of writing this: we have an active indident so you could just log in to the [staging preview](https://studio-staging-git-dnywh-dd493a51-supabase.vercel.app/). Otherwise: 1. Open `apps/studio/components/layouts/AppLayout/StatusBanner.tsx` and confirm the incident description is `Follow the [status page] for updates` with no trailing "Status page" link. 2. Optionally run `pnpm --filter studio exec vitest run components/layouts/AppLayout/StatusBanner.test.tsx`. 3. If you have a local Studio with an active incident (or `ongoingIncident` override), confirm the banner shows a single linked "status page" and no duplicate trailing link. |
||
|
Danny White
|
b5c865521f |
feat(studio): notify users about the Terms of Service update (#51302)
## Problem Dashboard users need a notice about the Terms of Service update alongside #51106 and #51107. ## Solution Reuse the organisation landing-page notice pattern from #50397. A compact “We've updated our Terms of Service.” notice opens the explanation and agreement link through **Learn more**. Closing the notice or choosing **Got it** remembers dismissal in the browser with a new version-specific key. ```text Organisation landing page Notice → Learn more → Explanation and Terms of Service link Close / Got it → Remember dismissal ``` | After | | --- | | <img width="628" height="444" alt="CleanShot 2026-10-06 at 14 47 46@2x" src="https://github.com/user-attachments/assets/72922712-321f-4972-b20c-1a075e0745d0" /> | | _Banner_ | | <img width="1078" height="718" alt="CleanShot 2026-10-06 at 16 58 18@2x" src="https://github.com/user-attachments/assets/2109c2ab-e9b7-4855-8acb-42d5232cd002" /> | | _Dialog_ | ## Review instructions 1. Open `/organizations` or an organisation's `/org/<slug>` landing page in the hosted Studio preview. Expect the compact notice. 2. Click **Learn more**. Expect the explanation and a link to the Terms of Service. Escape closes the dialog without dismissing the notice. 3. Choose **Got it**, then reload. The notice stays dismissed. Repeat in a fresh browser profile using **Close banner**. 4. Open a project or an organisation settings page. The notice should not appear. |
||
|
claude[bot]andClaude
|
fb382b3018 |
Add Terms of Service v4 (effective October 5, 2026) (#51107)
<!-- ccr-slack-attribution --> _Requested by **Nicole Kramer** · [Slack thread](https://supabase.slack.com/archives/C0161K73J1J/p1790784371448999)_ ## Problem Commercial & Product Counsel supplied a new version of the Supabase Terms of Service to be published as Version 4, effective October 5, 2026 (the same date the Enterprise Terms v4 update takes effect, once the code freeze lifts). ## Solution Adds `apps/www/data/legal/terms/v4.mdx` with the new agreement text (transcribed from the supplied source document) and registers it as the newest version in `apps/www/pages/terms.tsx`'s versions array, dated October 5, 2026. Versions 1-3 are untouched. The new text also defines "Supplemental Terms" and links it, at the one point the source hyperlinks it, to `/legal/customer-resources/supplemental-terms`. ## Review instructions 1. Open the Vercel preview link for `/terms` below. 2. Confirm "Version 4" appears as the newest tab/version, dated October 5, 2026, with the updated agreement text. 3. Do not merge — this PR is held until the code freeze lifts on October 5, 2026 (see PRs #51100 and #51106 for the related Enterprise Terms / Supplemental Terms work landing the same day). ## Checklist - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01K2vqszbsJiMJPABAnLMgaC --- _Generated by [Claude Code](https://claude.ai/code/session_01K2vqszbsJiMJPABAnLMgaC)_ Co-authored-by: Claude <noreply@anthropic.com> |
||
|
claude[bot]andClaude
|
c006499d48 |
Add Enterprise Terms v4 (effective October 5, 2026) (#51106)
<!-- ccr-slack-attribution --> _Requested by **Nicole Kramer** · [Slack thread](https://supabase.slack.com/archives/C0161K73J1J/p1790784371448999)_ ## Problem The Enterprise SaaS Subscription Agreement at `/enterprise-terms` needed a new version reflecting legal's latest draft, which introduces a "Supplemental Terms" defined term, a standalone "Supabase" contracting-entity definition (to support marketplace purchases), a new Beta Releases warranty carve-out, and related marketplace billing/refund language. ## Solution Before: `/enterprise-terms` had three versions (v1–v3), with v3 dated August 1, 2026, and no concept of "Supplemental Terms" anywhere in the agreement. After: adds **Version 4, effective October 5, 2026** as the newest entry in the page's `versions` array (v1–v3 untouched): - `apps/www/data/legal/enterprise-terms/v4.mdx` — new versioned MDX, transcribed from legal's source document and following this directory's existing formatting conventions (bold section numbers/defined terms, `##`/`###` headings, no frontmatter or h1 — the h1 is rendered by `PageHeader`). - `apps/www/pages/enterprise-terms.tsx` — imports `v4.mdx` and adds it to the front of the `versions` array with `effectiveDate: 'October 5, 2026'`. How: the new v4 text is a faithful transcription of legal's draft onto the existing v3 structure, so the diff is easy to review against v3 — the substantive additions are the "Supabase" entity definition (1.9), the "Supplemental Terms" defined term (1.13) and its references in Section 2.1 (license scope) and Section 14.1 (order of precedence), a new Section 10.5 (Beta Releases), and marketplace-related payment/refund language in Section 5.1. The "Supplemental Terms" defined term is a live markdown link to the new `/legal/customer-resources/supplemental-terms` page (shipped separately in #51100) at its point of definition (Section 1.13), matching how the source document hyperlinks it. ## Review instructions 1. Open the `zone-www-dot-com` preview's `/enterprise-terms` page and confirm the version selector defaults to "Version 4 — October 5, 2026". 2. Confirm Section 1.13 "Supplemental Terms" renders as a live link to `/legal/customer-resources/supplemental-terms`. 3. Confirm Version 3 (and v1–v2) still render unchanged via the version selector. ## Checklist - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) - [ ] N/A — no docs topic edited (this is versioned legal content, not `apps/docs`) --- 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01K2vqszbsJiMJPABAnLMgaC --------- Co-authored-by: Claude <noreply@anthropic.com> |
||
|
|
363dbdf1ad |
Use Flick Games' real logo files (#51364)
## Problem #51285 (Flick Games case study) merged before the customer's actual logo files were in hand. It shipped with a derived black/white wordmark instead. ## Solution Swaps in the real brand assets Ian Masters sent directly (`FLICK_black_2048.png` / `FLICK_white_2048.png`) for `on-light`/`on-dark` at `apps/www/public/images/customers/logos/`. Tracked in [MARKET-2252](https://linear.app/supabase/issue/MARKET-2252/case-study-flick-games-sept-23). ## Review instructions 1. Open the preview link for `/customers/flick-games`. 2. Check the logo renders correctly in both light and dark mode. ## Checklist - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) - [ ] If I wrote a new docs topic or edited an existing topic, I used the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs [style guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Wendie Cheung <wendie.cheung@supabase.io> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> |
||
|
Charis
|
ab383421c5 |
fix(studio): show sign-in banner based on Dashboard component [FE-3443] (#51283)
## Summary * Makes sign-in banner visible on unauthenticated pages * Show only when one of the affected components is Dashboard * Works only when new status page (under feature flag) is being used * Regression fix: Auth pages without the status banner (sign-up, sign-in-mfa, sign-in-recovery-code, sign-in-sso, sign-in-partner, forgot-password, forgot-password-mfa, reset-password) no longer reserve dead space at the top for a banner they don't render ## Test plan - [X] TypeScript: `tsc --noEmit` passes clean, no type errors - [X] Unit tests: All new/existing tests pass in `apps/studio/lib/status-page/status-page.utils.test.ts` and `apps/studio/components/layouts/AppLayout/StatusBanner.utils.test.ts` (697 files / 7833 tests, no regressions) - [X] Manual verification: Sign-in page still renders the banner correctly when an incident affecting Dashboard is active; no layout regression **Related:** [FE-3443](https://linear.app/supabase/issue/FE-3443/only-show-sign-in-incident-banner-when-relevant) |
||
|
Charis
|
28f59449c3 |
[FE-4543] fix(studio): remove outdated resize downtime warning (#51344)
## Summary Removes the "Resizes may require more downtime than normal on this project." warning from the disk/compute review dialog. This warning was added for cross-architecture migrations during resize operations, which are no longer performed, and has caused unnecessary customer support inquiries. ## Closes FE-4543 https://linear.app/supabase/issue/FE-4543 |
||
|
Connor Davis
|
32b16b7397 | Add Connor Davis to humans.txt (#51360) | ||
|
Lovro Mažgon
|
1a992761c1 |
chore(docs): Add Lovro Mažgon to humans.txt (#51354)
Add myself to humans.txt |
||
|
John Jarvis
|
9a4ab14be2 |
chore: add John Jarvis to humans.txt (#51182)
## Problem John Jarvis is missing from `humans.txt`. ## Solution Add John Jarvis to `apps/docs/public/humans.txt`. ## Review instructions Confirm the name is spelled correctly in the team list. ## Checklist Check all before review: - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added John Jarvis to the team list. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ivan VasilovandClaude Sonnet 5.5
|
9d1661dec1 |
chore: Reorganize the Files buckets code (#51350)
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com> |
||
|
Jordi Enric
|
c0c51dc168 |
test(logs): stabilize pathname refresh assertion DEBUG-230 (#51351)
## Problem The Studio unit test added in #51112 failed on master because the `/after` element returned by `findByText` was detached by a rerender before `toBeInTheDocument` ran. The failure repeated across all three test attempts in [this job](https://github.com/supabase/supabase/actions/runs/37480673016/job/112327649118). ## Fix Retry the DOM lookup and assertion together with `waitFor`, so each attempt checks the current element synchronously. Keep the existing timeout and assertions covering pathname refresh before the URL updates. ## How to test - Run `pnpm --filter studio exec vitest run components/interfaces/UnifiedLogs/UnifiedLogs.test.tsx`. - Expected result: pathname options refresh after selecting POST and the test passes. - Prettier and `git diff --check` pass. Local Vitest was blocked before assertions by the available dependency tree using React 18 instead of React 19; ESLint was blocked by a missing `@eslint/compat` dependency. CI validation is pending. |
||
|
Jordi Enric
|
d2ffd76395 |
perf(logs): load pathname facet counts on demand DEBUG-230 (#51112)
## Problem Unified Logs included a pathname aggregation in every initial sidebar count query, even when the pathname filter was closed. This issue is tracked in [DEBUG-230](https://linear.app/supabase/issue/DEBUG-230/fetch-sidebar-counts-only-when-needed). ## Fix Remove pathname aggregation from the initial ClickHouse and BigQuery count queries while keeping the existing shared count scans. Fetch scoped pathname options through the existing facet query when the filter opens or its search changes. Order limited pathname results by count, validate response rows with Zod, and retain selected paths during loading and validation errors. Use live sidebar filters while their URL update is pending and URL filters after navigation. Cache results by project and filter scope, and wait for feature flags before requesting options. ## How to test - Open Unified Logs, then open Pathname and search. Confirm options load on demand. - Change the time range, another filter, or navigate through browser history. Confirm the options reflect the current scope. - Close and reopen Pathname without changing the scope. Confirm cached options return. - Run the pathname filter component tests and Studio typecheck. |
||
|
Pamela Chia
|
240e954390 | fix(www): fix partners links and 404 redirects (#51294) | ||
|
Joshen Lim
|
eb20a4674d |
getTableDefinitionSql to escape SQL identifiers (#51258)
## Context Similar to domain to https://github.com/supabase/supabase/pull/51256 - `getTableDefinitionSql` doesn't escape SQL identifiers, which generates invalid SQL on the dashboard's table editor for the "Copy table schema" CTA, or the table definition tab. Also fixes the "Copy table schema" CTA which was missing the `scoped` parameter when calling `getTableDefinition` Changes here addresses this issue, can test with a table named like `test"table` |
||
|
K-Dog (Kevin)
|
1da25a7e72 |
chore(hipaa): self-serve PITR (#51342)
There is no reason why HIPAA customers cannot self-serve PITR add-on. Instead of telling customers to reach out to support, let them self-serve it. - Docs also wrongfully stated the need for Small compute add-on. - Ability to self-serve PITR - Only 28-day PITR available - Price is now also correct and displays $0 (pending backend change) When enabled (marked as HIPAA compliant): <img width="1128" height="216" alt="Screenshot 2026-10-06 at 1 53 01 PM" src="https://github.com/user-attachments/assets/d83982e7-c71b-4236-ab29-67f85fc40f39" /> When not enabled (marked as HIPAA compliant): <img width="1132" height="255" alt="Screenshot 2026-10-06 at 1 53 55 PM" src="https://github.com/user-attachments/assets/f182813b-2163-4905-8cdf-9c69983ec1b9" /> <img width="772" height="542" alt="Screenshot 2026-10-06 at 1 56 08 PM" src="https://github.com/user-attachments/assets/2cd59439-74b9-49d6-90d1-47c8d1722c9f" /> |
||
|
Joshen Lim
|
23e7bbcdc6 |
Joshenlim/fe 3359 fix user permission UI for orgs with thousands of projects (#51329)
## Context Adds virtualization to the organization team members page - browser performance was facing issues for organizations with a large amount of members (e.g 1000+), primarily due to some computation within `MemberActions.tsx`, so virtualization addresses this by controlling the number of member rows being rendered in the DOM at any one time. <img width="1182" height="435" alt="image" src="https://github.com/user-attachments/assets/e3da7036-c1c8-4d73-a363-85ecbdb79179" /> ## Unrelated changes - Updated `TeamSettings` to use the `PageContainer` components for UI consistency - Updated user `ProfileImage` to render the first alphabet of the email, rather than a generic user icon <img width="275" height="126" alt="image" src="https://github.com/user-attachments/assets/17eae3b1-c527-4b8f-afcd-c5151bdaf869" /> - Updated row heights of member rows to be more smaller - Updated MFA column to use tooltips with a clearer CTA for members that don't have MFA enabled <img width="332" height="144" alt="image" src="https://github.com/user-attachments/assets/a479af31-7fec-454d-b64e-e6314fd6d55e" /> - Added a filter for MFA status <img width="375" height="177" alt="image" src="https://github.com/user-attachments/assets/fd87105e-524d-4ded-b471-769592be96c7" /> ## To test - Can override the content for the `members` network request with the following sample JSON, main thing is just to test that initial load + searching should not run into any significant browser performance issues. [members-response-1000.json](https://github.com/user-attachments/files/33100317/members-response-1000.json) - Can also test on production that this mock response does indeed cause browser performance issues as well |
||
|
|
6ecf98671a |
docs(platform): add Platform Webhooks guide and event catalog (#51098)
## Problem Platform Webhooks (org- and project-level event notifications over the Management API) has no public documentation. CTRL-1017 asks for a docs page plus a specification of the available event types, so partners can integrate without reading the OpenAPI spec or asking engineering directly. Closes CTRL-1017. ## Solution **New guide covering the Management API path, plus an event catalog.** Adds `apps/docs/content/guides/platform/webhooks.mdx`: concepts and scoping, creating an endpoint, Standard Webhooks signature verification and secret rotation, test events, and delivery/retry/ordering behavior. Adds `apps/docs/content/guides/platform/webhooks/events.mdx`: the events reference. - Full payload documentation for the 8 project-lifecycle event types, and a name-and-trigger table for the 12 branch, member, and billing types whose payload fields aren't documented. - Documents `*` for subscribing to every event. - Access framing states the criterion: available to organizations on an early access allowlist, with the `403` / `access_disabled` response for everyone else. - Nav entry under Platform > Project & Account Management, after Personal Access Tokens, gated by `fullPlatformEnabled`. **The page deliberately omits the dashboard UI.** See the first row of the table below. ## Needs review before merge | Item | Detail | | -------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **The Studio webhooks UI is not wired to the API, so this page documents the Management API only** | `PlatformWebhooksPage.tsx:29` imports `PLATFORM_WEBHOOKS_MOCK_DATA`; `PlatformWebhooks.store.ts` has no async or network code and hardcodes `createdBy: 'mock-user@supabase.io'`; nothing in `apps/studio` references `webhooks/endpoints` or `webhooks/deliveries`, even though `api-types/types/api-v2.d.ts` carries those paths 24 times. #43276 (DEPR-340) described it as "UI-only (with mock data)", and the `DEPR-340-backend-integration-tracker.md` it pointed to is no longer in the tree. A dashboard section can be added once the UI calls the API. | | Possible reference slug collision | Project- and org-scoped operations share identical `summary` values (both "Create endpoint", both "List endpoints"). The page links to the reference introduction and names the **Project webhooks** / **Organization webhooks** tags rather than deep-linking a generated page. | ## Preview links **Verified:** the new page returns 200 on the preview; the same path returns 404 on production, confirming net-new content; the nav entry renders on the preview build. ### Proof: new page renders on the PR preview [Open the new page on preview](https://docs-git-nikrichers-ctrl-1017-set-up-public-doc-fa3960-supabase.vercel.app/docs/guides/platform/webhooks) <img width="2295" height="8039" alt="Screenshot 2026-10-05 at 11-47-06 Platform Webhooks Supabase Docs" src="https://github.com/user-attachments/assets/7b1440d3-207d-4828-8593-77140bdcd73f" /> <img width="2295" height="12000" alt="Screenshot 2026-10-05 at 11-48-49 Platform Webhook Events Supabase Docs" src="https://github.com/user-attachments/assets/2808a88e-558e-4f73-a12a-01382cd3f6a2" /> ## Review instructions 1. Open the [PR preview](https://docs-git-nikrichers-ctrl-1017-set-up-public-doc-fa3960-supabase.vercel.app/docs/guides/platform/webhooks) and confirm the page renders as shown. 2. Confirm **Platform Webhooks** appears under **Platform > Project & Account Management** in the sidebar, after **Personal Access Tokens**. 3. Confirm the five internal-guide values in the second row of the needs-review table. 4. Decide with the Control Plane team whether the Studio UI ships wired to the API, which determines when a dashboard section gets added: Studio UI is slated for Q4, so it will not be shipped together. ## Checklist Check all before review: - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) - [x] If I wrote a new docs topic or edited an existing topic, I used the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs [style guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added a Platform Webhooks guide covering endpoint setup, event delivery, signature verification, test events, retries, retention, idempotency, ordering, and listener best practices. * Documented project and organization event types, payload schemas, event scopes, and versioning, plus access restrictions for organizations outside the allowlist. * **Navigation** * Added Platform Webhooks links, including Overview and Events, to the platform navigation when the full platform is enabled. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Nik Richers <nik@validmind.ai> Co-authored-by: Paweł Gulbinowicz <pawel.gulbinowicz@supabase.io> Co-authored-by: Paweł Gulbinowicz <zamotany@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> |
||
|
|
089133cc2c |
feat(storage): add bucket object versioning form fields (FE-4161) (#49203)
| # | Branch | Base | | - | ------ | ---- | | 1 | `feat/storage-versioning-private-alpha` — merged | `master` | | 2 | `feat/storage-versioning/002-bucket-form-fields` ◀ | `master` | | 3 | `feat/storage-versioning/003-bucket-modals` | 2 | | 4 | `feat/storage-versioning/004-object-versions-data` | 3 | | 5 | `feat/storage-versioning/005-file-preview-versions` | 4 | | 6 | `feat/storage-versioning/006-billing-storage-retention` | 5 | | 7 | `feat/storage-versioning/007-archived-objects-data` | 6 | | 8 | `feat/storage-versioning/008-archived-rows` | 7 | | 9 | `feat/storage-versioning/009-archived-preview-pane` | 8 | | 10 | `feat/storage-versioning/010-replace-file` | 9 | ## [2/10] Storage object versioning: bucket form fields The object versioning + lifecycle policy form section for the create and edit bucket modals. Mounted onto the ui in PR 3 #49205 - `BucketVersioningFields` — the versioning switch and the suspension / public-bucket / retention-tightening warnings - `LifecyclePolicySection` — the retention window and version cap inputs - `ExpirationModeToggle` — how the two conditions combine (and / or) - `BucketVersioningFields.schema.ts` — zod fields the parent modals spread into their own schema, plus `superRefineBucketVersioning` - `BucketVersioningFields.utils.ts` — retention-tightening detection - `StorageVersioning.constants.ts` — versioning state and expiration mode types, the prefill defaults, and `getBucketVersioningState` Note: a single s3 lifecycle policy expects both `version_expiry_days` and `max_noncurrent_versions` and always evaluate the two fields within the same policy with an AND logic. To enable both AND and OR/EITHER logic, we save two distinct s3 policies so we can enforce the OR logic. See demos and how to reproduce in #49205 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary * **New Features** * Eligible projects with the preview enabled can configure object versioning for storage buckets, including version expiration, retained-version limits, and “and/or” lifecycle conditions. * Settings default to 30 days and 10 retained versions, with validation for retention values and requirements for setting a version limit. * Notices highlight public buckets, missing lifecycle conditions, suspending existing versioning, and changes that tighten retention limits. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com> |
||
|
Illia Basalaiev
|
12afe39999 |
Docs/troubleshoot pg net privileges (#51275)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? New troubleshooting guides related to the current pg_net and pg_dump extensions' behaviour. ## What is the current behavior? ## What is the new behavior? Preview: - [Revoking access to pg_net objects has no effect: no privileges could be revoked](https://docs-git-docs-troubleshoot-pg-net-privileges-supabase.vercel.app/docs/guides/troubleshooting/revoking-access-to-pg_net-objects-has-no-effect-0bbc16) - [Database roles can read request headers queued by pg_net](https://docs-git-docs-troubleshoot-pg-net-privileges-supabase.vercel.app/docs/guides/troubleshooting/database-roles-can-read-request-headers-queued-by-pg_net-ad6357) - [pg_dump fails with 'query would be affected by row-level security policy'](https://docs-git-docs-troubleshoot-pg-net-privileges-supabase.vercel.app/docs/guides/troubleshooting/pg_dump-fails-with-query-would-be-affected-by-row-level-security-policy-1d5783) - [Custom role inherits privileges that were not explicitly granted](https://docs-git-docs-troubleshoot-pg-net-privileges-supabase.vercel.app/docs/guides/troubleshooting/custom-role-inherits-privileges-that-were-not-explicitly-granted-ddaa1c) |
||
|
Pamela Chia
|
20d752517f | feat(docs): record search v2 rollout exposure (#51300) | ||
|
Beng Eu
|
53a637a359 |
fix(studio): don't watch Next's .next build output in TanStack dev (#51308)
## Problem Switching a local checkout from `STUDIO_FRAMEWORK=next` to `tanstack` leaves `apps/studio/.next` behind, including a full `node_modules` copy under `.next/standalone`. Vite's dev server watches all of it, logging hundreds of `page reload .next/server/pages/...` lines and wasting file handles. ## Change Add `**/.next/**` to `server.watch.ignored` in `apps/studio/vite.config.ts`. Vite's default ignores (`.git`, `node_modules`) still apply. ## Verification With a stale `.next` present, ran `STUDIO_FRAMEWORK=tanstack pnpm run dev`, touched `.next/server/pages/account/me.html`: no reload logged (previously ~220 `.next` reloads on startup). |