## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update
## What is the current behavior?
We do not discuss the current settings in the configuration docs:
- max_logical_replication_workers
- max_sync_workers_per_subscription
## What is the new behavior?
Shows users they can update the following pg_settings with the CLI:
- max_logical_replication_workers
- max_sync_workers_per_subscription
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the custom PostgreSQL configuration guide with additional
CLI-supported parameters.
* Added documentation for logical replication and subscription
synchronization worker settings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added pre-release pages for Supabase Pipelines’ new destinations,
including early-access signup, thank-you confirmation, and related
resources.
* Added destination options for ClickHouse, Snowflake, and DuckLake.
* **Bug Fixes**
* Improved form validation for grouped required checkboxes.
* Added clearer checkbox labels and descriptions.
* Forms now explain which required option groups still need a selection.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Ana <30495040+ana1337x@users.noreply.github.com>
## Summary
1. **Extract pure logic** out of the 1056-line `SQLEditor.tsx` monolith
into unit-tested functions in `SQLEditor.utils.ts`.
2. **Remove `rawSql()` from the SQL editor** and tighten the
untrusted→safe boundary per the `safe-sql-execution` model.
## Extracted functions (+ tests)
- `getEditorSql(editor, snippetContent?)` — selection → full value →
snippet fallback. Returns an **`UntrustedSqlFragment`** so
editor/snippet SQL keeps its provenance.
- `computeErrorHighlightLine(error, startLineNumber)` — parses the `LINE
n:` marker + selection offset.
- `assembleCompletionDiff(meta, text)` — before/selection/after assembly
for the AI completion diff.
- `buildExplainSql(sql, impersonatedRoleState)` — takes an already-safe
fragment; EXPLAIN ANALYZE + role impersonation + rollback wrapping.
- `buildDebugPromptText(sql, errorMessage)` — the assistant debug prompt
string.
## Safe-SQL boundary
- `rawSql()` is no longer used anywhere in the SQL editor.
- `executeQuery` / `executeExplainQuery` now **require a
`SafeSqlFragment`** — safe by construction, so they can never auto-run
untrusted SQL.
- `acceptUntrustedSql` promotion happens **only in the small run/explain
gesture handlers** (`executeQueryFromButton`, `handleRunShortcut`,
`handleRunExplain`, and the warning-modal confirm handlers), never
buried in the long helpers.
## Verification
- `vitest` — 156 pass (11 characterization + 145 utils, incl. new cases)
- `pnpm --filter studio typecheck` — clean for all SQL editor files (two
unrelated `@sentry/tanstackstart-react` module-resolution errors exist
on current master pre-install; not touched by this PR)
- `eslint` — 0 errors
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Enhancements**
* Improved SQL execution and EXPLAIN workflows with safer handling at
run and analysis actions.
* Enhanced SQL selection and snippet handling in the editor.
* Improved error highlighting to more accurately identify affected
lines.
* Refined completion previews and debugging prompts for clearer results.
* EXPLAIN ANALYZE now supports rollback-wrapped execution and avoids
duplicate wrapping.
* **Bug Fixes**
* Improved behavior when working with selected, empty, or missing SQL
content.
* Prevented existing EXPLAIN statements from being unnecessarily
modified.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix / polish
## What is the current behavior?
Unified logs row selection checkboxes only respond to clicks on the
checkbox itself, so it's easy to miss. Log type icons in the table also
don't match the ServiceFlow panel (16px / muted vs 14px / lighter /
strokeWidth 1.5).
## What is the new behavior?
- Expand the select checkbox tap target with `hit-area-2`, and add a
visible `hover:border-foreground-muted` affordance (matching the older
logs explorer intent; the base Checkbox hover is a no-op after the
colour-system token collapse).
- Align log type icons with ServiceFlow: 14px,
`text-foreground-lighter`, `strokeWidth={1.5}` on both the table column
and ServiceFlow section headers.
## Additional context
Older logs used an `absolute inset-0` wrapper for the same hit-area
problem; unified logs uses the design-system `hit-area` utility instead.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Refined unified log visuals with more consistent icon sizing, stroke
weight, and muted coloring.
* Improved checkbox hover styling and expanded its clickable area for
easier selection.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
UI polish
## What is the current behavior?
Unified logs row chrome is slightly misaligned (checkbox vs filter
toggle, uneven gaps around the level dot), success grey is too dark and
doesn’t match the Level key, and log-type icons read a bit heavy.
## What is the new behavior?
- Aligns the row checkbox with the filter sidebar toggle and spaces the
level dot evenly between checkbox and timestamp
- Drops the checkbox `translate-y` nudge in favour of normal middle
alignment
- Introduces `--chart-success` so the chart and Level key/dots share a
lighter grey
- Softens log-type icon colour on each row
| Before | After |
| --- | --- |
| <img width="1024" height="759" alt="1293"
src="https://github.com/user-attachments/assets/af7ab83f-8917-41cb-99f3-1c1f92df769e"
/> | <img width="1024" height="759" alt="52159"
src="https://github.com/user-attachments/assets/9b859308-2101-4a02-bdc1-75e5750f84fa"
/> |
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Improved Unified Logs table spacing and alignment, including narrower
selection and level columns.
* Refined checkbox and date-cell presentation for a cleaner layout.
* Updated log type icons to use muted foreground styling.
* **Bug Fixes**
* Success statuses and chart indicators now consistently use the
dedicated success color across light and dark themes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The Multigres log type is available in the legacy logs collections but
was missing from the new unified logs, so Multigres logs could not be
selected or viewed there.
## Fix
Wire the `multigres_logs` source into unified logs the same way the
other single-source types (Realtime, Supavisor, PgBouncer) are: a
display label, a filter condition, the derived `log_type` expression, a
display-casing entry, and a sidebar icon.
## How to test
- Open a project with Multigres logs and go to the new unified logs view
- Open the Log Type filter and confirm "Multigres" appears as an option
- Select "Multigres" and confirm rows from the `multigres_logs` source
are returned and labeled "Multigres" with the network icon
- Expected result: Multigres logs are filterable and display correctly,
matching the legacy logs behavior
## Notes
Level/severity uses the shared `severity_text` fallback that all
non-HTTP sources rely on. If Multigres rows come back always classified
as success, the OTEL pipeline may not populate `severity_text` for this
source (legacy logs read the level from a JSON `event_message`), which
would need a source-specific level branch.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for the **Multigres** log type in Unified Logs (labels,
icon, and derived filtering/grouping/counting).
* Unified Logs now renders Multigres **event_message** by extracting the
`msg` field from valid JSON, with correct capitalization.
* Unified Logs row click telemetry now recognizes **Multigres**.
* The **Multigres** log type option is hidden when the selected project
is not high-availability.
* **Tests**
* Added/updated unit tests for Multigres event-message parsing and
shared event-message display behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
## What kind of change does this PR introduce?
Bug fix / polish
## What is the current behavior?
On the add-destination sheet for read replicas, “Learn more” sits as a
stray sibling next to the cost copy.
## What is the new behavior?
Cost copy and “Learn more” are one paragraph, with the link inline and
styled like `InlineLink` (underline, pointer cursor, hover colour):
> New replica will cost an additional $16.25/month. Learn more
| Before | After |
| --- | --- |
| <img width="1258" height="120" alt="CleanShot 2026-07-10 at 12 21
21@2x"
src="https://github.com/user-attachments/assets/bb47461e-e856-4cf2-b81a-f8e9aa9ebf75"
/> | <img width="1256" height="114" alt="CleanShot 2026-07-10 at 12 23
48@2x"
src="https://github.com/user-attachments/assets/094332be-ad2e-4782-94ac-08c8775a4665"
/> |
_Note that the grey icon square is being fixed separately in
https://github.com/supabase/supabase/pull/47794._
## To test
On the staging preview, open Database → Replication → Add destination →
Read replica, and check the footer cost line in light and dark mode —
“Learn more” should sit inline, show a pointer cursor, and change colour
on hover.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* Added estimated monthly pricing to the read replica pricing dialog
trigger (“additional {cost}/month”).
* **UI Improvements**
* Moved the pricing/cost impact messaging from the form footer to the
pricing dialog area.
* Refined the “Learn more” link/button styling and layout for a cleaner
presentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Two related docs changes for debugging Supabase, consolidated into one
PR.
## 1. New "Debugging" guide (`guides/telemetry/debugging`)
A methodology and entry page for debugging any Supabase issue, added
next to Logging in the Telemetry nav. It covers:
- **The debugging loop** — read the exact error, isolate the failing
layer, gather evidence, fix, verify.
- **The Supabase request stack** — the gateway fans out to PostgREST,
GoTrue, Storage, and Realtime as parallel services (not a chain), with
Postgres underneath. Explains why an API-layer permission or
empty-result error is usually a Postgres RLS/privilege issue.
- **Reading logs** — the narrow-query discipline (one source, bounded
window, widen along an anchor), linking the Logs Explorer guide rather
than duplicating query syntax.
- **Symptom to guide routing table** — maps each symptom to its layer
and the specific troubleshooting guide, acting as a front door to the
troubleshooting collection. All 47 links verified live.
This puts the debugging methodology in docs (owned and updatable)
instead of only in the agent skill.
## 2. Log-query best practices (`guides/telemetry/logs`)
Adds the three practices the existing Best practices list was missing,
all engine-agnostic: query one source at a time, follow a request across
sources with an anchor, and reference only confirmed field names.
## Follow-up (not in this PR)
The Logs Explorer now defaults to **ClickHouse** (single `logs` table,
`log_attributes` map), but `guides/telemetry/logs.mdx` and the two logs
troubleshooting guides still document the legacy **BigQuery** dialect
(`cross join unnest(metadata)`). They need a coordinated BigQuery to
ClickHouse migration pass:
- `guides/telemetry/logs.mdx`
-
`troubleshooting/how-to-interpret-and-explore-the-postgres-logs-OuCIOj.mdx`
-
`troubleshooting/discovering-and-interpreting-api-errors-in-the-logs-7xREI9.mdx`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a new “Debugging” guide with a step-by-step workflow for
identifying where issues originate versus where they appear.
* Added a symptom-to-layer troubleshooting mapping and linked it from
Telemetry navigation.
* **Documentation**
* Updated Logs Explorer guidance to note its ClickHouse default and that
examples use legacy BigQuery syntax.
* Expanded Logs Explorer best practices, including querying one source
at a time, correlating with anchors, and using only confirmed field
names.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Jeremias Menichelli <jmenichelli@gmail.com>
## Summary
Add some tests for the SQL editor so I can refactor it without
regressions. Tests are not best practice because they are intended to be
temporary and improving them would require refactoring first (currently
they are over-mocking and asserting on internal details).
Stacked on top of #47792 (`charislam/sql-editor-top-bar-controls`).
## What this adds
`apps/studio/tests/components/SQLEditor/SQLEditor.test.tsx` (11 tests):
- Run success → `addResult` + Results tab; EXPLAIN-shaped result
auto-switches to the explain tab; a non-EXPLAIN run switches back.
- Run error with `position` → error-highlight line math +
`deltaDecorations` + `revealLineInCenter`; the next run clears the
highlight.
- Run button refocuses the editor; disabled + short-circuits while a
diff is open.
- Diff request queued before mount drains exactly once (one-shot; no
re-apply on remount).
- Ask-AI widget renders only while the prompt is open (render-time
`editorRef.current` read).
- Destructive query → warning modal → confirm forces the re-run;
confirm-with-RLS appends enable-RLS statements.
## Test approach
Real Monaco / DiffEditor are replaced with lightweight fakes exposing a
controllable editor; child panels + orthogonal context hooks are
stubbed; the execute mutation runs for real against an MSW-mocked
`/platform/pg-meta/:ref/query`. Tests assert on public behavior so they
survive the internal refactor unchanged.
## Verification
- `pnpm --filter studio exec vitest run
tests/components/SQLEditor/SQLEditor.test.tsx` — 11/11 pass (stable
across repeated runs)
- `pnpm --filter studio typecheck` — clean
- `eslint` — 0 errors
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added comprehensive coverage for SQL editor behavior, including query
execution, result and explain views, error highlighting, editor focus,
and diff mode.
* Added validation for destructive-query confirmations, including RLS
confirmation flows.
* Added coverage for queued diff requests and conditional AI prompt
display.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Original intention was to fix the PITR UI for smaller viewports, but
realised that the layout of the UI could be improved as well. (Tbh this
UI could do with a bit of revisiting, but just making patches for now to
improve what's existing)
Fixes also apply to the restore to new project page since they share the
same component
## Changes involved
- Am opting to change the layout of the UI a little such that date
selection is on the left, and time selection is up top
- Fits the user flow a bit better - you select the parameters you want,
and the final message at the bottom is the summary
<img width="1033" height="525" alt="image"
src="https://github.com/user-attachments/assets/614c0327-f5db-4e1f-a2a1-ae8a9ea89978"
/>
- In the confirmation dialog, we were originally showing the top label
as "Local time" which I feel is inaccurate especially if the user has
selected a different timezone from where they're located at.
- Opting to display the full name of the selected timezone instead
<img width="546" height="261" alt="image"
src="https://github.com/user-attachments/assets/cd8838a1-8476-4492-bc86-cac229685e5a"
/>
- RE mobile layout - am currently just opting to have them in a column
fashion although I feel like this isn't ideal either (requires
revisiting of the UI as a whole to adjust the layout on desktop too)
- e.g the Date picker here could be a popover like Unified Logs to
streamline what is essentially a form
<img width="507" height="831" alt="image"
src="https://github.com/user-attachments/assets/c8e055bd-49c3-4d0a-9d8c-e54f53e9fcb4"
/>
- Also fixed the CTA URL for read replicas, was still pointing to
/settings/infrastructure, should point to database/replication
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Point-in-time recovery now includes the selected timezone throughout
the restore workflow.
* Restore confirmations display the chosen timezone and a clear summary
of the target recovery date and time.
* Recovery details now show the earliest and latest available backups
for the selected date, including the two-minute matching window.
* **Bug Fixes**
* Updated the read-replica management link to direct users to database
replication settings.
* **Style**
* Improved restore form layout, calendar presentation, and timezone
selector alignment.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Refactor / UI improvement
## What is the current behavior?
SQL editor controls are split across two rows: a bar between the editor
and results (tabs, download,
run/save/format/db-selector/role/favorite/intellisense) and a separate
footer at the very bottom (row count + limit dropdown).
## What is the new behavior?
All controls are consolidated into a single top bar above the editor (⋮
overflow menu, database selector, role impersonation, limit, save, run).
The bar between the editor and results now holds only result-relevant
information: the Results/Explain/Chart tabs, the row-count summary, and
the Export button. The limit dropdown is now always visible as a
persistent query setting.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
- docs update
Scheduled follow-up to #47252 / DOCS-1080.
## What is the current behavior?
- Docs include a temporary note admonition on five pages: "This default
takes effect for new projects from July 9, 2026." (#47252)
- The `do-not-merge` label blocks CI until this PR is ready to merge.
## What is the new behavior?
- Removes the temporary effective-date admonition partial and all
`$Partial` includes.
- Default-behavior copy from #47199 remains unchanged.
## Additional context
**Do not merge before July 9, 2026.**
### Merge instructions (July 9)
1. Rebase this branch onto `master` after #47252 has merged (should
remain a clean removal-only diff)
2. Remove the `do-not-merge` label
3. Confirm CI is green and merge
Review screenshots live in `.github/pr-screenshots/docs-1080/` on this
branch for PR proof only.
### Test plan
- [ ] After rebase, confirm the five pages no longer show the
effective-date admonition
- [ ] Confirm default-behavior copy from #47199 remains unchanged
- [ ] Remove `do-not-merge` label and merge on July 9, 2026
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Cleaned up several security, compliance, telemetry, and PostgreSQL
logging docs by removing a repeated note about when default connection
logging behavior takes effect.
* Streamlined the affected pages so the guidance now flows more directly
without the extra embedded note.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Nik Richers <nik@validmind.ai>
Adds 21 MSW component tests covering the project creation wizard's
permutations (plan/region/compute/OrioleDB/security
options/GitHub/blocking states/errors). Closes FE-3883; surfaced a real
empty-region submit bug tracked in FE-3884.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added a comprehensive UI/request test suite for the Studio
project-creation wizard.
* Validates paid vs. free plan behavior (including compute sizing rules)
and that region selection submits the correct payload, including the
“Recommended” option.
* Covers blocking and warning states (project limits, overdue invoices
with billing CTA, and feature-flagged disabled creation), plus error
handling when regions fail to load.
* Exercises confirmation modals, database/security option flows,
client-side validation, GitHub gating/repo selection, and toast errors
on API failures.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
blog update
## What is the current behavior?
No embedded link for Server Package video
## What is the new behavior?
Embedded link for Server Package video
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added an embedded video to the “Introducing Supabase Server” blog
post.
* The video uses privacy-focused playback settings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Fixes the Lovable logo in case studies and elsewhere to be the latest
one.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the customer RSS feed’s publication metadata to reflect the
latest content date.
* Refreshed the Lovable customer entry’s publication date and removed
the outdated duplicate entry.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add a `server` entry to the reference-markdown pipeline so it emits
`public/markdown/reference/server.md`, and register the Supabase Server
Library Reference as a source in the www `llms.txt` and `llms-full.txt`
routes.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a new Supabase Server Library Reference covering server-side SDK
usage.
* Included the server reference in generated documentation and plaintext
documentation indexes.
* Made server SDK reference content available through the full
documentation feed.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What
Fixes misaligned day cells in the PITR calendar widget for the first
week of the month.
## Why
The PITR calendar draws a \`border\` on each day cell via
\`classNames.day\`. The day \`<td>\` has no explicit width, so
\`box-sizing: border-box\` doesn't apply and the 1px borders add to its
size (36px → 38px), while the weekday header cells stay pinned at
\`w-9\` (36px). Bordered day cells therefore drift right of their
headers, which is most visible in the first partial week where
unbordered leading cells sit flush next to the wider bordered ones.
## How
Pin each day cell to a fixed \`w-9 box-border\` so the border is drawn
inside the 36px box, and let the day button fill the cell (\`w-full\`).
Column pitch now matches the weekday headers regardless of border state.
Class-only change, no logic touched.
Closes FE-3886
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Improved calendar day cell sizing and layout for more consistent
rendering.
* Ensured day buttons use full-width styling where applicable, while
preserving existing hover, border, background, and corner behavior.
* **Documentation**
* Added documentation for “Calendar with disabled days,” including a new
interactive preview.
* **New Features**
* Introduced a calendar example demonstrating disabled-day behavior with
mid-week month start and restricted date selection.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
Bring the Vercel project connect layout up to date with other connect
screens. Follows up from https://github.com/supabase/supabase/pull/47550
which is required.
| Before | After |
| --- | --- |
| <img width="2368" height="1680" alt="image"
src="https://github.com/user-attachments/assets/f5c0b8ef-8fb5-4176-b0cf-98e33958dcc8"
/> | <img width="848" height="808" alt="image"
src="https://github.com/user-attachments/assets/e64c289f-0b73-4605-ad38-4552d3d6f934"
/> |
<img width="883" height="733" alt="image"
src="https://github.com/user-attachments/assets/7ccd9b72-de6a-4c21-ac8e-abe773bb8116"
/>
## Testing
- Open the deploy preview or staging URL for
`/dashboard/integrations/vercel/acme-production/marketplace/choose-project`
with callback params from a real Vercel Marketplace install redirect
(see _Vercel_ subheading below).
### Vercel
- Run through the [install
flow](https://github.com/supabase/supabase/pull/47550) on a real project
until you get to the project connection screen, copy the url and paste
into staging preview
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* Introduced interstitial-style Vercel integration experiences for both
install and choose-project flows, with improved page titles and clearer
environment-variable guidance (including tooltip details).
* **Bug Fixes**
* Improved Vercel integration matching by configuration id and
strengthened loading/error handling with more specific “not found”
messaging.
* **Refactor**
* Enhanced the Vercel/GitHub project chooser with a dedicated
interstitial mode.
* Updated partner logo rendering to support optional styling
customization.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
Co-authored-by: Alaister Young <alaister@users.noreply.github.com>
## Summary
Since #47293, an API failure on a signup / org-creation /
project-creation form emitted `dashboard_error_created` twice:
`useTrackFunnelError` fired the origin-tagged event and the global
`ToastErrorTracker` independently fired the legacy untagged
`source:'toast'` event for the same toast, each behind its own 10%
sampling draw. I verified the twin rate empirically at 8-11% of
origin-tagged funnel toasts, exactly the floor for two independent 10%
draws, meaning the twin co-fires for effectively every funnel error
([Hex
thread](https://app.hex.tech/supabase/thread/019f3bc1-3a5c-7200-9122-8e3439bfbe8c)).
Any consumer counting funnel errors without an `origin IS NOT NULL`
filter saw ~2x inflation.
The fix makes `ToastErrorTracker` the sole emitter of `source:'toast'`
events, so the duplicate is unrepresentable rather than suppressed.
Funnel call sites pass the id returned by `toast.error()` into
`trackFunnelError`, which registers the funnel properties against that
toast id instead of firing its own event – the tracker then emits a
single `dashboard_error_created` enriched with `origin` /
`errorCategory` / `errorReason` / `errorCode` for registered toasts, and
the plain untagged event otherwise. The `'toast'` overload of
`trackFunnelError` requires the toast id, so a missed pairing is a
compile error rather than a silent double count. Registration is
unconditional and there's only one sampling draw, so suppression can't
lose a sampling race. `'form'`-sourced funnel events are unchanged.
## Changes
- `lib/toast-errors.tsx`: toast-id → funnel-properties registry
(`registerFunnelErrorToast`); `ToastErrorTracker` emits one (optionally
enriched) event per error toast under a single 10% draw, deleting
entries once consumed
- `lib/telemetry/use-track-funnel-error.ts`: overloaded signature –
`'toast'` requires the id returned by `toast.error()` (type-enforced),
`'form'` keeps direct emission with its own sampling
- Update the 7 funnel `toast.error` call sites in `NewOrgForm`,
`SignUpForm`, and `pages/new/[slug]` to pass the toast id
- Component tests for the tracker (previously uncovered), including an
end-to-end test through `useTrackFunnelError`
- Code hygiene (also flagged by CodeRabbit): all four
`dashboard_error_created` emitters (toast, form, `AlertError`,
`ErrorMatcher`) independently encoded the 10% draw – downstream analysis
assumes a uniform sampling multiplier across sources, so one site
drifting would silently skew comparisons. The rate and the draw now live
in one place (`isDashboardErrorSampled()` in
`lib/telemetry/error-sampling.ts`). No behavior change.
- Mount `ToastErrorTracker` in the TanStack root (`routes/__root.tsx`),
mirroring `pages/_app.tsx`. The TanStack tree mounted `Toaster` but
never the tracker, so untagged toast error telemetry has never fired in
that flavour – and with the tracker now the sole emitter, the missing
mount would have silently dropped funnel toast events there too. Side
effect once the TanStack flavour ships: untagged `source:'toast'` volume
from it goes from zero to normal.
## Testing
Component-tested (`apps/studio/lib/toast-errors.test.tsx`):
- [x] Unregistered error toast fires exactly one untagged
`dashboard_error_created {source:'toast'}`
- [x] Registered funnel toast fires exactly one event, enriched with
`origin`/`errorCategory`/`errorReason`/`errorCode`
- [x] `useTrackFunnelError` with a toast id routes through the tracker
as a single enriched event
- [x] Non-error toasts ignored; the 10% sampling gate still applies
Full Studio unit suite passes (392 files / 4371 tests), plus typecheck
and lint.
Also verified end-to-end in a local browser (TanStack flavour, sample
rate temporarily forced to 1): a failed signup produced exactly one
`dashboard_error_created` with `{source:'toast', origin:'signup',
errorCategory:'api', errorReason:'email_already_registered',
errorCode:403}` and no untagged twin (two independent trials); an
unregistered error toast produced exactly one plain `{source:'toast'}`;
a client-side validation failure produced exactly one `{source:'form',
origin:'signup', errorCategory:'validation',
errorReason:'email_invalid'}`; success toasts produced nothing.
Post-deploy I'll re-run the twin-rate query from the Hex thread; the
untagged-twin rate on funnel pages should decay to ~0 as stale bundles
reload over 2-3 days.
## Notes
- Origin-tagged funnel toast events now ride the tracker's single 10%
draw instead of their own independent draw – statistically identical
volume, but the event fires on the tracker's next effect rather than
synchronously at the call site (irrelevant for PostHog)
- Registration must happen in the same synchronous block as
`toast.error()` (documented on the `TrackFunnelError` type) – all
current call sites comply
- The invalid Postgres version toast in `pages/new/[slug].tsx` (~line
416) needs no special-casing: unregistered toasts keep the plain
untagged event, so its telemetry is preserved
- Heads-up for `dashboard_error_created` consumers: overall untagged
`source:'toast'` volume will dip slightly after this deploys, since
funnel-page twins disappear. A volume monitor seeing that drop is this
fix landing, not a tracking regression (same class as the intended
GROWTH-893 sampling-unification drop).
## Linear
- fixes GROWTH-965
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Enhanced error telemetry for organization creation, sign-up, payment,
and project-creation flows by associating failures with toast
identifiers and enriched funnel context.
* Standardized dashboard error sampling logic across error handling
components for consistency.
* **Tests**
* Added comprehensive test coverage for toast error tracking, including
funnel registration, deduplication, filtering, and sampling behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix (accessibility improvement)
## What is the current behavior?
Icon-only button (not visible on widescreen displays) does not have
explicit accessible name for screen readers and tooltip.
## What is the new behavior?
The icon-only button now has explicit accessible name using visually
hidden text (sr-only), ensuring proper screen reader support.
## Additional context
Tooltip text is added for visual users.
No visual changes were introduced
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **UI Improvements**
* Added a tooltip to the SQL editor’s “More actions” dropdown button,
improving discoverability.
* The tooltip now shows “More actions” when hovering over the trigger.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com>
Stacked on #47666 (base `alaister/tanstack-sentry-init`; retarget to
`master` when that merges). **Supersedes #47721** (the manual
`@sentry/node` wrapper). Client stays on #47666's `@sentry/react` setup.
Adopts the official `@sentry/tanstackstart-react` SDK **on the server
only**, after a spike (#47723) evaluating the full unified client+server
SDK. The spike found the SDK's **browser**
`tanstackRouterBrowserTracingIntegration` is a broken no-op stub at
10.59.0/10.64.0 — so the client stays on `@sentry/react` (whose
equivalent integration is a real, working implementation, already
shipped in #47666). The **server** exports, however, are a clear upgrade
and slot in cleanly.
### What this adds (server-side, TanStack build only)
- **`instrument.server.mjs`** — `Sentry.init` from
`@sentry/tanstackstart-react`, mirroring `sentry.server.config.ts` +
`release: VERCEL_GIT_COMMIT_SHA`.
- **`start.ts`** — `sentryGlobalRequestMiddleware` +
`sentryGlobalFunctionMiddleware` at the front of the existing
`createStart(...)` middleware. **This is the win**: it captures request-
and server-function errors *including the ones swallowed into 500s* —
the exact class the manual wrapper (and the Next server SDK) miss.
- **`api/server.js` / `scripts/serve.js`** — gated
(`STUDIO_FRAMEWORK==='tanstack'`) instrument init +
`wrapFetchWithSentry` on the handler.
- **`vite.config.ts`** — `sentryTanstackStart({ …,
autoInstrumentMiddleware: false })` as the last plugin: source-map
upload + release injection (skips gracefully without an auth token).
Middleware is wired explicitly rather than via the plugin's
string-rewrite.
### Guarantees
- **Client untouched** — the `@sentry/nextjs`→`@sentry/react` alias and
#47666's client init are unchanged.
- **Next untouched** — `instrumentation.ts` / `sentry.server.config.ts`
etc. stay as-is; all new code is TanStack-gated.
- **No server SDK in the client bundle** — verified after build: no
`@sentry/node` / server middleware / `wrapFetchWithSentry` in
`dist/client/assets` (`start.ts`'s server import is tree-shaken out).
### Verified
TanStack build exit 0 (past `assertNoChunkCycles`), post-build server
boot served `/api/get-utc-time → 200`, `tsc --noEmit` clean,
prettier/eslint clean. Node smoke: no-DSN init is a clean no-op; wrapped
handler returns 200.
### To test (deploy with a server DSN)
Throw a server error from an `/api/*` route (or a `/_serverFn/*`) —
including one that gets turned into a 500 without rethrowing — and
confirm a server event in Sentry with `release` = the deploy SHA.
Compared to #47721, the swallowed-500 case should now be captured via
the middleware.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Sentry integration for the Studio app’s TanStack Start runtime,
including request and server-function instrumentation.
* Wrapped server request handling to capture errors reliably, with
tracing enabled.
* Updated build tooling to conditionally upload source maps when
credentials are present.
* **Bug Fixes**
* Improved resilience by safely falling back to a no-op Sentry setup if
instrumentation cannot be loaded.
* Ensured existing request protection remains enabled while adding
observability middleware.
* **Chores / Config**
* Added `SKIP_ASSET_UPLOAD` to the build environment list to control
cache/build behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## Context
As per PR title - also adjusts the imports for files consuming
`apiWrapper` to remove the default export for `apiWrapper`
Have tested locally by throwing an error in one of the API routes -
verified that the event shows up on Sentry
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* API errors are now captured in Sentry before returning server error
responses, improving production visibility while keeping endpoint
behavior the same.
* **Tests**
* Added coverage to confirm rejected handler executions are reported to
Sentry and return the expected HTTP 500 JSON payload.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
PR here mainly breaks up the files under `ConnectSheet` to separate the
functional logic so that we can write unit tests.
No behavior changes intended beyond the bug fixes
## Changes involved
- **Test organization:** moved all root-level `ConnectSheet` test files
into `ConnectSheet/__tests__/` for consistency with other parts of the
codebase that use this convention.
- **Bug fix:** read replica label had a stray `}` / missing `)`,
rendering as e.g. `Read Replica (us-east-1 - abc123})` instead of `Read
Replica (us-east-1 - abc123)`.
- **`ConnectSheet.tsx`:** extracted the "hydrate sheet state on open"
`useEffect` logic (mode/field/URL param resolution from URL vs.
localStorage) into a new `ConnectSheet.utils.ts`, with unit tests
- **`useConnectServerEnv.ts`:** fixed two race conditions in the secret
reveal/hide flow:
- `toggle()` and `getValue()` could each fire a separate reveal request
if triggered close together — now deduped to share one in-flight
request.
- `getValue()` could hide a secret that had just been explicitly
revealed by a concurrent `toggle()`, due to reading a stale closure
value — now reads the live state via `useLatest`.
- Also stopped swallowing the original error on reveal failure (now
attached via `cause`).
- Added tests for the above, plus the 10s auto-hide timer (previously
untested).
- **`ConnectStepsSection.tsx`:** extracted `resolveContentPath` and the
three inline "show notice" booleans (IPv4 addon, session pooler,
self-hosted MCP) into `ConnectStepsSection.utils.ts`, matching the
existing pattern for the Data API notice. Added unit tests for all of
them.
## To test
- [ ] Just a basic smoke test of the Connect sheet should do
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Improved connect setup hydration so saved preferences and URL values
are applied more consistently when opening the sheet, including
automatic URL backfilling where needed.
* Refreshed connection guidance notices (IPv4 add-on, session pooler,
and self-hosted MCP) with more consistent logic.
* **Bug Fixes**
* Fixed secret reveal behavior to keep concurrent reveal actions in
sync, handle failures more safely, and ensure auto-hide works reliably.
* Corrected the read-replica option label formatting.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
The `ChatGPT-User` live-fetch agent's user-facing reader hard-fails
(`(400) OK`) on pages we serve it as markdown via user-agent matching,
which made supabase.com blog and product pages unreadable in that
assistant. I root-caused this with a controlled fetch diagnostic
cross-checked against our request logs: the failing fetches never reach
our origin (the failure is cached on their side), pages served as plain
HTML read fine everywhere we tested, and the same failure reproduces on
other major sites that serve UA-matched markdown, so the reader bug is
upstream.
This PR removes user-agent-based markdown serving entirely rather than
special-casing one agent: UA sniffing is a guess about contractless
clients whose fetchers change without notice, and this incident showed
the failure mode is silent (we keep serving 200s while the user-facing
agent breaks). Markdown remains available on every explicit signal —
`Accept: text/markdown` q-value negotiation, explicit `.md` URLs, and
llms.txt — which is the same contract-driven model the Claude fetcher
already uses successfully (it sends `Accept: text/markdown, text/html,
*/*` and keeps receiving markdown after this change).
## Changes
- Remove the `LLM_USER_AGENT` regex and the `userAgent` parameter from
`negotiateMarkdown` in `packages/common/markdown-negotiation.ts`;
decisions now depend only on `Accept`, the `.md` suffix, and the
markdown-variant manifest
- Update both consuming middlewares (`apps/www`, `apps/docs`) to the new
signature; no behavior change for Accept-negotiated or `.md` requests
- Add the missing `Vary: Accept` header to docs guides-md 200 responses
(the www `api-v2/md` route already declares it)
- Fix a pre-existing www bug surfaced in review: explicit changelog
`.md` URLs rewrote to a doubled `.md.md` path (404) under a
markdown-preferring `Accept`, and 406'd on a non-matching `Accept`. The
www middleware now strips the `.md` suffix before slug lookup and passes
`isMarkdownSuffix` into `negotiateMarkdown`, folding the separate
`MD_PAGES` `.md` block into the single negotiation path (same shape as
the docs middleware)
- Rework tests: UA-independence suites replace the per-agent rewrite
tests; a probe Accept header now 406s regardless of user agent
(previously agent UAs were exempt); new changelog `.md` negotiation
coverage
## Testing
Tested locally:
- [x] www middleware suite 36/36, docs middleware suite 17/17
- [x] typecheck green for common, www, docs
Verified on the Vercel previews (www + docs) with curl:
- [x] `ChatGPT-User` and `Claude-User` UA GETs on blog/pricing/guide
pages return `text/html` with a default Accept
- [x] Claude's real Accept (`text/markdown, text/html, */*`) still
returns `text/markdown`; `Accept: text/markdown` and `.md` URLs return
`text/markdown`; probe Accept returns 406
- [x] `/changelog/<slug>.md` with `Accept: text/markdown` returns the
entry markdown as a direct 200 (production today detours through a 308
to the bare URL); changelog index `.md` and bare-entry Accept
negotiation also verified
- [x] docs guides markdown 200s carry `Vary: Accept`
The intermediate commit (ChatGPT-User-only exclusion) was already
verified on the preview: `ChatGPT-User` got HTML while
`Accept`/`.md`/other-UA markdown was unaffected.
Expected effects post-merge: UA-driven markdown volume in the request
logs (~92% of md traffic) collapses to the Accept + `.md` baseline;
named-agent page requests return to prerendered/static serving,
reversing the extra Vercel function invocations the UA rewrite
introduced; user-facing readability in the affected assistant recovers
within ~24h as its fetch cache revalidates. The md-share dashboard gets
a dated annotation; the ratio is not comparable across this change.
## Linear
- fixes GROWTH-973
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Markdown and HTML routing now depends on the request’s `Accept` header
and `.md` links, making content negotiation more predictable.
* Requests that don’t accept available content now consistently return
`406 Not Acceptable`, even for bot-like user agents.
* Guide markdown responses now include an `Accept`-based cache variation
header to improve correct caching behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Before**
<img width="340" height="104" alt="image"
src="https://github.com/user-attachments/assets/48a434de-21c2-4e3f-8cad-3c6408f7348d"
/>
**After**
<img width="508" height="317" alt="image"
src="https://github.com/user-attachments/assets/e52c6ba6-c173-4bb8-a466-1697585286c7"
/>
Fixes
- Rendering issue of the menu toggle on mobile when menu is open
- You can now switch between panels when open (e.g. from help to
advisor). There was previously a bug that would just close the drawer
rather than switch.
**To test**
- Reduce screen size in a project view
- Click top right menu item
- Notice menu item is active in light mode
- Click "Assistant" and notice it switches vs closes the drawer
- Click close or outside the toolbar to close the drawer
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved the mobile menu button’s visual state by updating the menu
icon color when the menu is open.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
There's a chance users may run into tax ID issues when upgrading a plan
as such:
<img width="412" height="120" alt="image"
src="https://github.com/user-attachments/assets/4c559ae0-d942-4c10-b83a-c5944a2a49ee"
/>
Adding a CTA here to guide users and mitigate confusion on how to
proceed to remediate
<img width="399" height="147" alt="image"
src="https://github.com/user-attachments/assets/3bcaca14-bd77-4168-b9ab-cd6b75f79e24"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved billing-profile validation feedback by standardizing error
messaging for tax ID vs. billing address country mismatches.
* Added an in-toast “Update tax ID” action to guide users directly to
the fix.
* Updated the billing dialog’s close behavior so it returns users to the
relevant address section (including scrolling to it automatically).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Add UTM params to CipherStash blog post links
Follow-up to #47751. The [Notion
doc](https://app.notion.com/p/supabase/Blog-Post-CipherStash-partner-drop-3455004b775f81c68712f6a115ee43f8)
now has UTM-tagged outbound links for launch tracking. This applies them
to the three links in the published post.
All three use
`?utm_source=supabase_announcement_post&utm_medium=blog&utm_campaign=launch`:
- Intro: CipherStash integration link
- Intro: cipherstash.com link
- Get started: Add CipherStash to your Supabase project
No content or copy changes.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated CipherStash and Supabase links in the blog post with campaign
tracking parameters.
* Applied tracking to introductory links and the “Get started”
call-to-action.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Adds 8 new investor logos: Accel, Craft, Figma, Georgian, GIC, Peak
XV, Salesforce Ventures, Stripe
- Reorders lead investor grid to match design mockup (3 rows of 4)
- Adds per-logo `scale` field to control logo size within each cell
- Adds `grayscaleOnly` field for Salesforce Ventures to preserve tonal
contrast (prevents wordmark from being hidden by `contrast-0` filter)
## Test plan
- [ ] Visit /company and verify all 12 investor logos render correctly
across 3 rows
- [ ] Check logo sizing and order matches the mockup
- [ ] Verify Salesforce Ventures wordmark is visible inside the cloud
shape
- [ ] Check dark mode
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Expanded and reordered the “Our investors” lead cards with additional
entries (including Stripe, Salesforce Ventures, and others).
* Enhanced logo presentation options for lead cards with per-investor
sizing/positioning controls.
* **Bug Fixes**
* Improved lead investor card image rendering by removing internal
scrolling and using an overflow-hidden container with scale-based
sizing.
* Preserved the existing logo filter behavior (opacity-only when
configured, grayscale-only when selected, otherwise the default contrast
treatment).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com>
## Problem
The new project form has accessibility issues:
- labels are not linked to inputs
- description are not linked to inputs
## How to test
Navigate through the form inputs with voice over and make sure every
input makes sense
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved form field identification consistency across project creation
screens (compute size, database password, project name, PostgreSQL
version, region, and organization).
* Enhanced selector/input accessibility by adding explicit element
identifiers to key controls.
* Updated region and repository UI structure to improve reliable
rendering without changing setup behavior.
* Preserved existing password, version, and routing logic while making
dropdowns and fields easier to locate and interact with.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
FUP to https://github.com/supabase/supabase/pull/47709
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the Next.js Sentry setup guide with clearer wording and a
step-by-step configuration flow.
* Added explicit instructions for instrumenting Supabase clients in
server, browser, and middleware contexts.
* Included guidance for enabling query and mutation data capture so
Supabase activity appears in monitoring as database spans.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Feature
## Summary
Introduce a "Sign in with ChatGPT" option gated by the new
`dashboard_auth:sign_in_with_chatgpt` feature flag and a manual
localStorage rollout switch (`SIGN_IN_CHATGPT_ENABLED`), since the
feature is still WIP.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for signing in with ChatGPT alongside GitHub.
* ChatGPT sign-in now depends on both a feature flag and an additional
rollout setting.
* Updated provider availability so the app can show the correct sign-in
options.
* **Bug Fixes**
* Improved validation and coverage to ensure sign-in options appear only
when fully enabled.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update.
## What is the current behavior?
The Sentry monitoring guide documents the third-party
`@supabase/sentry-js-integration` package. Sentry now ships Supabase
support natively in the JavaScript SDK (v9.14.0+), and the documented
API is incompatible with current `@sentry/*`, so the snippets no longer
work as written.
Fixes#47708.
## What is the new behavior?
All snippets are updated to the built-in API
(`Sentry.supabaseIntegration({ supabaseClient })` and
`Sentry.instrumentSupabaseClient(client)`). The Next.js section is
simplified to a single instrumentation call that covers browser, server,
and edge. The span deduplication example is corrected (supabase-js uses
`fetch`, so it filters `nativeNodeFetchIntegration`). Added a note about
the v9.14.0 requirement with the community package as the fallback for
v7, and removed the now-unnecessary install section.
## Additional context
Verified end-to-end against `@sentry/node` + `@supabase/supabase-js`:
both entry points produce `db` spans for select/insert/update/delete and
capture PostgREST errors.
**Note**: This PR was created entirely through Claude Code Opus 4.8,
with code snippets tested in a sample project.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the telemetry guide to use Sentry’s built-in Supabase support
(`@sentry/*`) instead of a community integration.
* Added explicit setup requirements for Sentry JS SDK version 9.14.0+.
* Provided two enablement options, including instrumentation when
Supabase client setup and Sentry initialization are separate.
* Refreshed guidance for span deduplication and improved Next.js setup
instructions, including operation payload capture.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Kamil Ogórek <kamil.ogorek@gmail.com>
## Summary
- Downgrading to Free tier is blocked server-side when an org has an
active branch, but the resulting error toast in `ExitSurveyModal.tsx`
used the default 4s toast duration, making it easy to miss.
- Adds `duration: 10_000, dismissible: true`, matching the pattern
already used for other important billing error toasts
(`org-subscription-update-mutation.ts`, `NewOrgForm.tsx`).
Fixes FE-3882
## Test plan
- [ ] Attempt to downgrade an org with an active branch to Free tier and
confirm the error toast stays visible for 10s and can be dismissed
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved the downgrade error message to stay visible longer and be
easier to dismiss, making failures clearer for users.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Some customer pages didn't show og-images properly because satori breaks
using svgs.
This PR replaces all customer logos from svgs to pngs.
They're all exported at least 2x to 4x so image quality shouldn't get
worse anywhere.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated several customer story pages and related listings to use PNG
logo assets, improving logo rendering consistency across the site.
* Refreshed the customer RSS feed metadata and removed a duplicate entry
so the feed stays up to date and cleaner.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
- Organizations links are not accessible with keyboard
- Project list buttons are missing labels
- Headings should be sequential
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved keyboard and screen-reader accessibility for project actions
and project reference copy controls.
* Added clearer tooltip guidance for copying a project reference.
* Updated project and organization card interactions for more consistent
click and focus behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What
Adds an opt-in **SQL Editor manual save** feature preview that switches
the SQL Editor from autosaving every edit to saving only on demand, and
hardens the tab-close flow so unsaved edits are handled correctly.
## Changes
**Feature preview**
- New `sqlEditorManualSave` flag + `UI_PREVIEW_SQL_EDITOR_MANUAL_SAVE`
local-storage toggle, wired into the Feature Preview modal with an
explanatory panel.
- `useIsSqlEditorManualSaveEnabled` gates behavior on both the flag and
the user's preview opt-in.
**Editor toolbar**
- Save button (with `Cmd+S`) next to Run, plus an autosave status
indicator showing dirty/saving/saved state and a shortcut to disable
autosave (emits a `sql_editor_autosave_disable_clicked` telemetry
event).
**Discard on close**
- Closing a snippet tab with unsaved edits prompts for confirmation and,
on confirm, actually discards the local edits and evicts the cached
server copy so the snippet reopens clean.
**Decouple tab layout from SQL specifics**
- Tabs store gains a generic per-type close-handler registry
(`registerTabCloseHandler` / `getCloseConfirmation` / `closeTabs`). The
SQL editor registers its discard + confirmation behavior from the save
coordinator.
- Low-level `removeTab`/`removeTabs` (rename/move re-keying, stale
cleanup) intentionally do **not** trigger discard.
- Adds `statusOnDiscard` lifecycle transition and `clearSnippetContent`
store action.
## Testing
- `pnpm --filter=studio typecheck` — clean.
- Added unit tests for the close-handler registry (fires on single/multi
close, skips re-keying/cleanup removals, respects tab type, selects
confirmation copy, unregisters cleanly).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a SQL editor manual-save preview with a “Save” button and
`Cmd+S`, plus a modal option to disable manual-save/preview.
* Added “unsaved changes” tab status indication when manual-save is
enabled.
* Introduced tab-type-specific close confirmations (shown only when
needed).
* **Bug Fixes**
* In manual-save mode, closing a SQL tab with unsaved edits now clears
local snippet content and refreshes it on reopen.
* **Tests**
* Added coverage for tab close handlers and confirmation behavior.
* **Chores**
* Added a persisted setting allowlist entry and tracked autosave-disable
clicks via telemetry.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Upgrades the monorepo to TypeScript 7.0.2, released 2026-07-08. `tsc` is
now the native Go compiler
([announcement](https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/))
— full turbo typecheck drops from ~56s to ~19s locally.
TS 7.0 ships **without a programmatic API** (it lands in 7.1), so this
uses Microsoft's recommended side-by-side setup: the `typescript` name
resolves to `@typescript/typescript6` (the 6.0 API republished) for API
consumers — typescript-eslint and Next.js build typechecking — while
`@typescript/native` (the real `typescript@7.0.2`) owns the `tsc` bin
that typecheck scripts run. Exactly one version of each is in the
lockfile; nothing imports the native package as a library. When 7.1 +
tool support lands we can collapse back to a single `typescript` dep in
the catalog.
**Changed:**
- `pnpm-workspace.yaml`: catalog aliases for `typescript` /
`@typescript/native`
- 17 package.json files: `@typescript/native` added beside each
`typescript` dep so every package's `tsc` is the native binary
- `apps/studio/tsconfig.json`: exclude `dist/` (gitignored build output)
from typechecking
**Fixed** (real type errors TS 6 under-reported):
- `packages/ui-patterns` CodeBlock: `borderLeft: null` → `undefined`
(`CSSProperties` doesn't accept null)
- `apps/www` CodeBlock: removed a JSX `@ts-ignore` comment that tsgo
doesn't honor and fixed what it masked (untyped `.js` theme objects,
possibly-undefined highlighter children)
⚠️ **Merge timing:** the new packages are inside pnpm's 3-day
`minimumReleaseAge` window until ~July 11. Installs from the committed
lockfile are unaffected (resolution is skipped), but anything that
forces a re-resolution before then will fail — hold off merging until
the window passes.
Note for editors: the compat package has no `lib/tsserver.js`, so VS
Code's "Use Workspace Version" won't work — use the bundled TS or the
TypeScript Native Preview extension.
## To test
- `pnpm install && pnpm typecheck` — all 15 tasks green, and
`./node_modules/.bin/tsc --version` prints 7.0.2
- `pnpm lint --filter=studio` — typescript-eslint still parses (resolves
the 6.0 API)
- `pnpm build --filter=design-system` (or any Next app) — Next's
tsconfig validation and build typecheck still work
- CodeBlock rendering on www (syntax highlighting, line highlights
with/without border) — the two fixes are behavior-neutral but worth an
eyeball
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Improvements / New Features**
* Enhanced TypeScript tooling support across the workspace for smoother
development builds and checks.
* **Bug Fixes**
* Code blocks render more reliably when content is empty or missing.
* Highlighted code line styling applies more consistently.
* **Maintenance**
* Studio TypeScript builds now avoid including generated output (such as
`dist`) during compilation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
Stacked on #47657 (base is `alaister/tanstack-migration-fixes`; retarget
to `master` once that merges).
The TanStack runtime never ran `Sentry.init` —
`instrumentation-client.ts` is a Next-convention file nothing imports
under TanStack Start, so every `Sentry.captureException` on that build
(including the `routes/__root.tsx` error-boundary /
`routerErrorComponent` reports) was a silent no-op.
- **Shared config source**: the entire client config moves verbatim from
`instrumentation-client.ts` into `lib/sentry-client-options.ts`
(`buildSentryClientOptions`). Both runtimes build from it, so Next and
TanStack can't drift — the builds differ only in two explicit knobs.
- **TanStack init**: `sentry.tanstack.ts` initializes `@sentry/react`
from `getRouter()` (TanStack Start's real client bootstrap — the
earliest point with the router instance), wiring
`tanstackRouterBrowserTracingIntegration(router)`. Window-guarded +
idempotent; `router.tsx` is TanStack-only so the Next build is
untouched. (Named without `.client.` — Start's import-protection fails
the build for `*.client.*` in the server graph.)
- **Third-party error filter is intentionally Next-only**: without the
bundler-injected `applicationKey` metadata (only `withSentryConfig`
provides it), the SDK tags *every* event `third_party_code: true` and
`beforeSend` would drop them all — recreating the silent no-op with a
DSN set. Follow-up: add `@sentry/vite-plugin` moduleMetadata, then
enable.
- **DSN-less builds stay crash-free**: `vite.config.ts` inlines
`undefined` for unset
`NEXT_PUBLIC_SENTRY_DSN`/`NEXT_PUBLIC_SENTRY_ENVIRONMENT` (a literal
`process.env.*` in the bundle is the exact `process is not defined`
class #47657 fixed). No-DSN → disabled client, plus the existing
`IS_PLATFORM`/consent gates.
- Tests: `instrumentation-client.test.ts` moved to
`lib/sentry-client-options.test.ts` with all 36 assertions kept, plus
integration-gating and Next/TanStack parity tests. `tsc` clean; full
`vite build --mode test` passes.
Follow-up (separate): server-side Sentry for the Start handler
(`server.ts` entry + `@sentry/node`-style init).
## To test
- **Locally (no DSN set)**: load the TanStack build — no Sentry network
requests, no console errors, and crucially no `ReferenceError: process
is not defined` (the define fallback). Forcing an error must not POST to
any `/envelope` endpoint.
- **On a preview/deploy (DSN set, telemetry consent accepted)**: throw a
test error (e.g. crash a route component) → a POST to
`o…ingest.sentry.io/api/…/envelope/` fires, and the event lands in
Sentry with a `codeSampleRate` tag and **no** `third_party_code` tag.
Navigation spans named after TanStack routes appear when the 2% pageload
trace samples in.
- **Next build regression check**: the Next dev/preview still reports
errors exactly as before (`instrumentation-client.ts` now builds its
options from the same shared source).
---
### Review feedback: Sentry `/envelope` never fires on TanStack (Joshen)
Root-caused: `@sentry/core`'s `Client.sendSession` silently drops the
session when the client has no `release`. The Next build gets a release
injected by `withSentryConfig` (the Vercel commit SHA); the Vite build
runs no Sentry bundler plugin, so it had no release → session envelopes
were discarded before transport → zero `/envelope` traffic
(errors/transactions are separate). Fix: inject `release:
NEXT_PUBLIC_VERCEL_GIT_COMMIT_SHA` on the TanStack build (vite.config
re-exposes `VERCEL_GIT_COMMIT_SHA` under the `NEXT_PUBLIC_` name, same
SHA the Next release resolves to). Also switched `integrations` to the
function form so defaults are preserved by contract (not just by current
SDK behavior). 45 unit tests green.
**To test (deploys only — the SHA is unset locally, so this can't be
reproduced on a local dev build):** on this PR's Vercel preview with a
DSN + telemetry consent, load any page and watch the Network tab for a
POST to `…ingest.sentry.io/…/envelope/` — a session envelope should now
fire on load, matching the Next build.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Improved client-side error and performance monitoring for the Studio
app across both router setups.
* Added support for passing release/version information into monitoring
data.
* **Bug Fixes**
* Reduced noisy error reporting by better filtering common browser,
extension, cancellation, and load-related issues.
* Prevented browser bundles from referencing missing environment values
at runtime.
* Made monitoring initialization safer in server-rendered and
client-only environments.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
## Context
Currently when retrieving row counts of a table in the Table Editor,
we're using a `COUNT_ESTIMATE` pg function
([ref](https://github.com/supabase/supabase/blob/master/packages/pg-meta/src/sql/studio/database/get-count-estimate.ts#L5))
to retrieve an estimate (instead of checking `pg_class` -> `reltuples`)
as that would theoretically provide a more accurate representation.
However, in a read only context, that function can't be used - users
will run into `cannot execute CREATE FUNCTION in a read-only
transaction`, so we need to fallback to just checking `pg_class` in this
scenario.
The logic's already set up as we were previously looking into allowing
users to use a read replica to power the dashboard, but we also need to
consider members with read-only roles within the organization, so this
PR updates the logic a little to factor that in.
## To test
- [ ] With a read-only role, open the table editor and verify that we're
not using the count estimate function to retrieve the table row counts
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated the invite member dialog to open in a larger size for better
usability.
* **Bug Fixes**
* Improved table row count behavior so it now respects read-only access
and permission limits more reliably.
* Count estimates should now be shown more consistently across different
database contexts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
As per PR title - also left a comment that this is a short term solution
for now, so we know where to clean up after the long term solution is
implemented
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Added a clear action in the empty organizations state so users can
create an organization directly from the authorization flow.
- **Bug Fixes**
- Improved authorization error messaging for clearer, more consistent
display.
- Refined invalid authorization guidance so the retry prompt and
missing-parameter details are shown more cleanly.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
Fixed the title on one of the case studies.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Content Updates**
* Updated the Lovable customer story headline to put the focus on
Supabase first.
* Aligned the customer RSS entry title with the new headline wording.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Saxon Fletcher