## What
Studio + docs support for two **non-blocking** upgrade-eligibility
warnings for the PG 15.18 / 17.10 release:
- **`ltree_reindex_required`** — ltree indexes on a multibyte / non-libc
database must be `REINDEX`ed after upgrade.
- **`operator_estimator_gate`** — operators referencing a non-built-in
selectivity estimator (CVE-2026-2004) can't be recreated by a
non-superuser.
## Changes
- `UpgradeWarnings.tsx` — title/description/link for both types;
unrecognized warning types are skipped rather than rendering an empty
admonition.
- `apps/docs/.../platform/upgrading.mdx` — two upgrade-guide sections
(with detection + remediation SQL) that the warnings link to.
- `api-types` — the two types added to
`ProjectUpgradeEligibilityResponse.warnings`.
## Server side
Detection/emission lives in the platform repo:
**supabase/platform#34161**. Both warnings are version-gated there (only
fire when upgrading to ≥ 15.16 / 17.8).
Refs: PSQL-1247
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Upgrade warnings now support additional warning types, with
type-specific titles, descriptions, and optional “Read upgrade notes”
links.
* The project upgrade eligibility response now returns these additional
warning types.
* **Bug Fixes**
* Upgrade warnings are rendered consistently for all warning entries (no
special-casing).
* **Documentation**
* Added Postgres `ltree` upgrade warnings, including detection queries
and `REINDEX INDEX CONCURRENTLY` remediation guidance.
* Added operator selectivity estimator warnings, including superuser
requirements and how to detect affected operators.
* **Chores**
* Updated spelling lint exceptions for common terms.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
Based on the contents from: @kallebysantos
https://github.com/kallebysantos/play.supabase.unit-tests
## What kind of change does this PR introduce?
Bug fix, feature, docs update, ...
## What is the current behavior?
Please link any relevant issues here.
## What is the new behavior?
Feel free to include screenshots if it includes visual changes.
## Additional context
Add any other context or screenshots.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Documentation**
* Completely redesigned the unit and integration testing guide for
Deno-based Supabase Edge Functions using a concrete example
* Added a recommended test folder structure and example business-rule
module
* Introduced BDD-style unit testing patterns with runnable commands
* Expanded end-to-end integration testing guidance, including mocking of
outgoing REST calls
* Updated test utilities for environment setup and JWT generation
* Refreshed best practices and resources sections
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Kalleby Santos <kalleby_santos@hotmail.com>
Co-authored-by: Kalleby Santos <105971119+kallebysantos@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the Queues quickstart guide for improved clarity, including
revised “Create queue” button labeling, allowed queue-name character
guidance, and refreshed light/dark screenshots.
* Reworked the “What happens when you create a queue?” section,
including Data API exposure guidance and required RLS enablement
details.
* Expanded the permissions section with a clearer enabled-vs-blank role
table and strengthened warnings against client-side exposure.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Rodrigo Mansueli <rodrigo@mansueli.com>
This updates the remaining stale auth hook references after the auth
hooks guide moved from hash anchors to dedicated subpages.
It switches the RBAC guide to the current custom access token hook page,
updates the MFA verification hook reference in both the docs error-code
source and the shared-data export, and fixes the matching custom access
token hook comments in the Slack Clone SQL examples.
Testing: not run. Link-target updates only.
Refs #46947
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Documentation**
* Updated error code and auth hook documentation reference links to
point to more specific canonical documentation pages, improving accuracy
of references for developers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Bug fix (documentation) — fixes#43920.
## What is the current behavior?
The Drizzle connection example (`db.ts`) at
[`apps/docs/content/guides/database/drizzle.mdx`](https://github.com/supabase/supabase/blob/master/apps/docs/content/guides/database/drizzle.mdx)
does not compile or run as written:
```ts
let connectionString = process.env.DATABASE_URL
if (connectionString.includes('postgres:postgres@supabase_db_')) {
const url = URL.parse(connectionString)!
url.hostname = url.hostname.split('_')[1]
connectionString = url.href
}
// ...
export const db = drizzle(client);
```
- `process.env.DATABASE_URL` is `string | undefined`, so
`.includes(...)` errors with **"Object is possibly 'undefined'"** —
copy-pasting the snippet fails to type-check (the core of #43920).
- `URL.parse()` is a very recent static method (Node 22.1+/modern
runtimes only) and isn't portable for a docs example.
- The final line ends with a stray `;`, which violates this repo's
prettier config (`semi: false`).
## What is the new behavior?
Three surgical fixes to the snippet:
```ts
let connectionString = process.env.DATABASE_URL!
if (connectionString.includes('postgres:postgres@supabase_db_')) {
const url = new URL(connectionString)
url.hostname = url.hostname.split('_')[1]
connectionString = url.href
}
// ...
export const db = drizzle(client)
```
- `DATABASE_URL!` — the example assumes the env var is set (it's set in
the step above), matching Drizzle's own docs.
- `new URL(connectionString)` — standard and portable.
- Dropped the trailing semicolon to satisfy `semi: false`.
No prose changes; the docker hostname-rewrite logic is unchanged.
## Validation
The corrected snippet is **prettier-clean** under this repo's config
(`semi: false`, `singleQuote: true`, `printWidth: 100`) — verified
idempotent
with `prettier --parser typescript`. The change is a single code block
in one
MDX file.
## Additional context
Fixes#43920. The undefined-variable / type-unsafe form was introduced
in #40288.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated Drizzle database quickstart: added explicit validation for the
DATABASE_URL environment variable and improved connection-string parsing
to better handle Docker/Supabase hostnames, plus clarified client/DB
initialization steps.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Committer: Divya Sharma <divya.sharma@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
docs update
## What is the current behavior?
Current doc link :
https://github.com/supabase/supabase/blob/master/apps/docs/content/guides/platform/upgrading.mdx
## What is the new behavior?
Changed the doc to reflect the upgrade process
## Additional context
- Added pre-upgrade and post-upgrade best practices
- Document upgrade pre-requisites
- Re-arranged the sections
- removed outdated info
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Restructured the database upgrade guide into a single, explicit
step-by-step “How we upgrade” flow
* Added new pre-upgrade and post-upgrade best practices sections
* Expanded upgrade prerequisites, including read-replica requirements,
`pg_upgrade` limitations, and deprecated/unsupported extension guidance
* Updated Postgres 17 upgrade guidance, including handling deprecated
extensions and `pg_cron`-related implications
* Refreshed caveats with updated disk sizing, timing-window details, and
restore guidance
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Divya Sharma <divyasharma@Divyas-MacBook-Pro.local>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated documentation links in Realtime guides and troubleshooting
sections to reflect new URL structure.
* Reorganized internal navigation paths for channel management, error
handling, and performance monitoring resources.
* Improved link consistency across multiple Realtime documentation
sections.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Contributes to DOCS-1052
Contributes to DOCS-1057
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Resolves linting warning for "let's" and adds an exception for product
name.
## Tophatting
1. Read the diff and see if changes make sense in context.
2. Run `pnpm lint:mdx`, search for "let's" and see no instances.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated instructional copy across multiple AI, authentication,
database, functions, realtime, storage, and troubleshooting guides to
improve clarity and consistency.
* Replaced conversational phrasing (for example, “Let’s…/Let’s see…”)
with direct imperatives, tightened example lead-ins, and adjusted a few
step explanations for readability.
* Refreshed some tutorial text and code-sample presentation in guides
(no behavioral changes).
* Added/adjusted minor MDX lint guidance in a couple of documents.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Nik Richers <nrichers@gmail.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Resolves utilize lint warnings.
## What is the current behavior?
Utilize lint warnings are present.
## Tophatting
To see that this issue is resolved:
1. See the diff for content clarity.
2. Run `pnpm lint:mdx` to see no more remaining utilize errors.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Documentation
- Improved documentation clarity and consistency across platform guides,
including AI going-to-prod, custom claims/RLS RBAC, authentication
(anonymous, Web3, social login), and database connection/configuration.
- Refined technical wording throughout database, realtime, storage,
billing, performance, telemetry, and troubleshooting guides (for
example, standardizing phrasing like “use” vs “utilize”).
- Updated select guidance for clearer wording on database pre-warming
and clarified the scope of the Postgres logging note.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
Allow `android:apk-key-hash:<base64url SHA-256>` entries in
`WEBAUTHN_RP_ORIGINS` alongside https/localhost-http origins.
Non-http(s) origins are matched as-is downstream and Android is
responsible to binding the origin to the RP ID via digital asset links.
Sweeps the example code that creating-a-client.mdx and other auth docs
pull via $CodeSample, so the rendered pages match the "use getClaims()"
guidance. Also adds Database type stubs and parameterizes
SupabaseClient<Database> across SvelteKit and Hono examples.
Fixes#40985
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Documentation**
* Updated OAuth server getting-started guide to use a claims-based
consent/auth gate and preserve the authorization identifier on redirect.
* Added the `auth_methods` partial across framework sections in the
server-side “creating a client” guide.
* **Refactor**
* Updated authentication examples for Hono, Next.js, and SvelteKit to
rely on JWT claims for logged-in checks and protected routes.
* Streamlined example auth state and UI rendering to use claims-derived
information.
* **Type Updates**
* Improved TypeScript typing for Supabase clients and app auth data
across examples, including generated database type stubs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
Resolves four docs gaps surfaced in #40985.
The Nuxt SSR example in `creating-a-client.mdx` now uses `getClaims()`
instead of `getUser()`, matching the file's own guidance at `:253`. The
SvelteKit tutorial drops a stale `event.locals.safeGetSession` reference
whose linked `app.d.ts` no longer declares one. The Nuxt and SolidJS
tutorials each gain a new server-route section using `@supabase/server`
(h3 adapter for Nuxt, `createSupabaseContext` for SolidStart),
addressing the original complaint that those tutorials had no server
setup at all.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Enhanced Nuxt 3 getting-started tutorial with new guidance on adding
server routes, validating auth sessions, and using Supabase middleware
for protected (and optional public) endpoints.
* Updated the Nuxt Server route Supabase SSR example to validate
authentication using token claims during server-side refresh.
* Added a SolidJS → SolidStart SSR/API migration section, including an
example protected profile route and how to make it public.
* Refined SvelteKit tutorial wording around TypeScript-related session
handling and updated terminology.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Updates docs based on stable releases in `supabase/supabase-swift`.
## Changes analyzed
- **SDK**: swift
- **Repo**: https://github.com/supabase/supabase-swift
- **Stable tag range**: `v2.47.2...v2.48.0`
- **Commits**:
`716e0de6e7e0ec8eba54c6c4dfb8e980b3d51370...e5020ae5a1d01c46cc60fb5eb01157666d7214b6`
## Documentation updates
### `apps/docs/spec/supabase_swift_v2.yml`
- Added `sign-in-with-passkey` entry —
`signInWithPasskey(presentationAnchor:)` high-level helper (iOS
16+/macOS 13+, experimental)
- Added `register-passkey` entry —
`registerPasskey(presentationAnchor:)` high-level helper (iOS 16+/macOS
13+, experimental)
- Added `passkey-api` group stub with 7 lower-level method entries:
- `passkey-list` — `listPasskeys()`
- `passkey-update` — `renamePasskey(id:friendlyName:)`
- `passkey-delete` — `deletePasskey(id:)`
- `passkey-start-registration` — `getPasskeyRegistrationOptions()`
- `passkey-verify-registration` —
`verifyPasskeyRegistration(challengeId:credentialResponse:)`
- `passkey-start-authentication` — `getPasskeyAuthenticationOptions()`
- `passkey-verify-authentication` —
`verifyPasskeyAuthentication(challengeId:credentialResponse:)`
- Updated `auth-mfa-api` overview notes to mention WebAuthn MFA
(experimental)
- Updated `mfa-enroll` notes and added `enrollWebAuthnFactor` example
- Updated `mfa-verify` notes and added `verifyWebAuthnFactor` example
### `apps/docs/content/guides/auth/passkeys.mdx`
- Added Swift tabs to: Enable in the client, Register a passkey, Sign in
with a passkey, Two-step API, Manage passkeys
- Updated SDK version note to include `supabase-swift` v2.48.0
- Updated reference links to include Swift
All new Swift passkey APIs are gated behind `@_spi(Experimental) import
Supabase`.
---
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Documentation
* Expanded Swift SDK passkeys documentation to cover enabling,
registering, signing in, managing, and Admin-related notes.
* Added experimental Swift guidance for WebAuthn/passkeys, including
updated minimum SDK version requirements.
* Extended MFA to support WebAuthn/passkeys enrollment and verification
(in addition to existing methods).
* Added reference documentation for low-level passkey APIs to support
custom authentication flows.
## Chores
* Updated documentation linting spell-check allow list to include
**visionOS**.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude <noreply@anthropic.com>
## Summary
Updates docs based on stable releases in `supabase/supabase-flutter`.
## Changes analyzed
- **SDK**: dart
- **Repo**: https://github.com/supabase/supabase-flutter
- **Stable tag range**:
`supabase_flutter-v2.14.1...supabase_flutter-v2.15.0`
- **Commits**:
`81c1590728a5e08bebdc152bd59a7c1e7644c8b2...9030650b74e253020f8c614b3bfb2c993b6061af`
## Documentation updates
`apps/docs/spec/supabase_dart_v2.yml` — adds entries for the new passkey
APIs landed in `supabase_flutter-v2.15.0`
([gotrue#1392](https://github.com/supabase/supabase-flutter/pull/1392),
[supabase_flutter#1408](https://github.com/supabase/supabase-flutter/pull/1408)):
- `signInWithPasskey()` / `registerPasskey()` — high-level helpers on
`supabase_flutter` that drive the full WebAuthn ceremony.
- `auth.passkey.*` — server side of the WebAuthn ceremony: `list`,
`update`, `delete`, `startRegistration`, `verifyRegistration`,
`startAuthentication`, `verifyAuthentication`.
- `auth.admin.passkey.*` — admin endpoints: `listPasskeys`,
`deletePasskey`.
`apps/docs/content/guides/auth/passkeys.mdx` — adds Dart code examples
to every passkey section (Enable in the client, Register, Sign in,
Two-step API, Manage, Admin API) and points the reference links at both
the JavaScript and Dart specs. Bumps the "Requires" admonition to
include `supabase_flutter v2.15.0`.
Other v2.14.2 / v2.15.0 changes that did not require doc updates:
- `feat(realtime): protocol format 2.0.0` — protocol versions are
already documented in `realtime/protocol.mdx`; the SDK now defaults to
v2.0.0 but exposes a `version: RealtimeProtocolVersion.v1` opt-out,
which is an SDK detail rather than a docs change.
- `fix(gotrue): support asymmetric JWTs in getClaims` — bug fix to the
existing `auth.getClaims` (no new API).
- The rest are bug fixes and internal refactors (storage
`createSignedUrls` null handling, postgrest stack traces, gotrue
refresh-token races, PKCE email-change, realtime deaf-socket guards,
lint/test/CI hygiene).
`common-client-libs-sections.json` already contains entries for every
new spec `id`, so the sidebar nav picks them up automatically.
---
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added Dart language examples to passkey authentication guide covering
client initialization, user registration, sign-in workflows, two-step
ceremony flows, and passkey management operations
* Updated Dart client specification to document new passkey
authentication functions and admin-level passkey management capabilities
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
Our `<Button>` component breaks the default `button` contract by
redefining the `type` prop to set its variant (`primary`, `default`,
etc) instead of the button type (`submit`, `button`, etc).
This is confusing and forces to write more code when using it with
shadcn components that expect/inject the standard button props.
## Solution
- rename the `type` prop to `variant`
- rename the `htmlType` prop to `type`
- propagate the changes where necessary
- format code
## How to test
As this is just prop renaming, if it builds it's ok
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
Contributes to DOCS-1052
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Resolves MDX linting errors related to "simple" where it applies.
There was a couple cases that did not apply. For example, a product with
"Simple" in the name.
These changes are made in context, either by removing or using a more
descriptive synonym like "minimal" or "basic".
## Tophatting
1. Read each of the diffs.
2. See that the text still makes sense in context.
For extra due diligence, you can run `pnpm lint:mdx` locally and see the
'simple' errors that remain and whether they are worth addressing.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **Documentation**
* Updated many guide, tutorial, and troubleshooting pages with clearer
“basic”/“minimal” wording across setup steps, local testing
instructions, security cautions, and RLS guidance.
* Refined headings, example descriptions, and inline comments for
consistency (including deployment, MCP, metrics API, and search/function
phrasing).
* Improved readability with small snippet formatting tweaks (whitespace
plus import/comment ordering) and added a self-hosting debugging note
for Envoy admin endpoints via a short-lived `curl` container.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
Co-authored-by: Nik Richers <nrichers@gmail.com>
This PR syncs the latest troubleshooting guides from the
supabase/troubleshooting repository.
---------
Co-authored-by: github-docs-bot <github-docs-bot@supabase.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Agent Plugin, Agent Skills, and Prompts menu items added to navigation
(now feature-gated).
* **Documentation**
* AI Prompts and Agent Skills sections are now conditionally shown in
the docs based on feature flags.
* **Chores**
* New feature flags for docs (Agent Plugin, Agent Skills, Prompts) added
and enabled in config/schema.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
docs update
## What is the new behavior?
Moving the new `error-codes` page to "Debugging" section.
Adding link reference to it under `status-codes` page.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Documentation**
* Reorganized Error Codes guide navigation to the Debugging section for
improved discoverability
* Enhanced status codes guide with details on HTTP status codes and
error response headers in Edge Functions
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The Supabase Functions documentation shows examples that send a
publishable key in the `Authorization: Bearer` header. This causes
`UNAUTHORIZED_INVALID_JWT_FORMAT` errors because publishable keys are
not JWTs.
Per the [Understanding authorization
headers](/docs/guides/functions/auth#understanding-authorization-headers)
guide:
> A common mistake is sending a publishable or secret key as a bearer
token: `Authorization: Bearer sb_pub.....`. The new API keys are not
JWTs. The platform check can't validate them, and your handler can't
verify them as JWTs either. Instead, put API keys in the `apikey`
header.
## Fix
Updated three documentation files to use the `apikey` header instead of
`Authorization: Bearer` when calling Edge Functions with a publishable
key:
- **quickstart-dashboard.mdx**: Changed fetch example from
`Authorization: 'Bearer YOUR_PUBLISHABLE_KEY'` to `apikey:
'<SUPABASE_PUBLISHABLE_KEY>'`
- **recursive-functions.mdx**: Changed fetch example from
`Authorization: \`Bearer ${SUPABASE_DEFAULT_PUBLISHABLE_KEY}\`` to
`apikey: SUPABASE_DEFAULT_PUBLISHABLE_KEY`
- **schedule-functions.mdx**: Changed SQL cron example from
`'Authorization', 'Bearer ' || ...` to `'apikey', ...`
## Related
-
[supabase/supabase#45993](https://github.com/supabase/supabase/issues/45993)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated Function guide examples for invoking Edge Functions to send
the publishable key in an `apikey` request header instead of using an
`Authorization: Bearer ...` header.
* Aligned both `fetch` and scheduled-invocation examples with the
updated authentication snippet.
* Refreshed an example output comment to match the updated response
text.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Kalleby Santos <105971119+kallebysantos@users.noreply.github.com>
Towards FUNC-308
## What kind of change does this PR introduce?
Docs update
## What is the current behavior?
Missing error codes definitions for Edge Functions
## What is the new behavior?
This PR adds maps the possible error codes that Edge Functions can
return
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a new “Error Codes” guide for Edge Functions, explaining how to
use the `sb-error-code` response header and covering error categories
(bad implementation, authentication, request, server) with causes and
solutions.
* **New Features**
* Updated site navigation to include a direct “Error Codes” link under
the functions menu for quicker access.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update (stale internal links / dead anchors).
## What is the current behavior?
The Metrics guide moved from `/docs/guides/platform/metrics` to
`/docs/guides/telemetry/metrics` and was split into sub-pages, but 15
internal links across the docs still use the old path:
1. **Redirect chain** — non-anchored links to
`/docs/guides/platform/metrics` only resolve via a two-hop permanent
redirect (`platform/metrics` → `monitoring-troubleshooting/metrics` →
`telemetry/metrics`, in `apps/www/lib/redirects.js`).
2. **Dead anchors** — `#accessing-the-metrics-endpoint` and
`#deploying-supabase-grafana` no longer exist on the restructured page,
so those links currently land at the top of the page instead of the
intended section.
## What is the new behavior?
- Non-anchored links now point directly at the canonical
`/docs/guides/telemetry/metrics` (relative links use
`../telemetry/metrics`), avoiding the redirect chain.
- `#accessing-the-metrics-endpoint` links →
`/docs/guides/telemetry/metrics` (the Metrics API endpoint access
content lives on that page).
- `#deploying-supabase-grafana` links →
`/docs/guides/telemetry/metrics/grafana-self-hosted`, the page that now
holds the Prometheus/Grafana installation instructions those links
referenced.
15 files changed, links only — no content changes.
## Additional context
Pure documentation link cleanup. Affected files include several guides
(`database/connection-management`, `database/inspect`,
`platform/performance`, `platform/read-replicas`) and troubleshooting
entries that reference the Metrics/Grafana setup guide.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update (stale internal links).
## What is the current behavior?
The Logs guide moved from `/docs/guides/platform/logs` to
`/docs/guides/telemetry/logs`, but five internal links still use the old
path. They only resolve through a two-hop permanent redirect
(`platform/logs` → `monitoring-troubleshooting/logs` → `telemetry/logs`,
in `apps/www/lib/redirects.js`).
Affected:
- `guides/database/extensions/pgaudit.mdx`
- `guides/platform/read-replicas.mdx`
- `guides/storage/cdn/metrics.mdx` (`#logs-explorer`)
-
`troubleshooting/how-to-interpret-and-explore-the-postgres-logs-OuCIOj.mdx`
- `troubleshooting/http-status-codes.mdx` (`#logs-explorer`)
## What is the new behavior?
Links now point directly at `/docs/guides/telemetry/logs` (relative
links use `../telemetry/logs`), avoiding the redirect chain. The
`#logs-explorer` anchor is preserved and still resolves (`## Logs
Explorer` in `guides/telemetry/logs.mdx`).
5 files changed, links only — no content changes.
## Additional context
Pure documentation link cleanup, analogous to the Metrics-guide link
fixes.
## Problem
The Memory usage chart now includes a Swap series, but the telemetry
reports docs do not mention it. Swap is shown alongside Used, Cache +
buffers, and Free in the same chart, not as a standalone chart.
## Fix
- Add **Swap** to the Memory usage component table
- Add a short note that the Swap series only appears when the system is
swapping, with a brief explanation of what swap means for performance
- Add a swap-activity row to the Memory usage "How it helps debug
issues" table
No standalone Swap section and no separate entry in the charts summary
table, since swap is part of the Memory usage chart.
## How to test
- Run the docs site and open the Reports guide
(`/docs/guides/telemetry/reports`)
- Confirm the Memory usage section lists Swap as a component and the
tables render correctly
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated Advanced Telemetry (Database) to include "Swap" in the
memory-usage breakdown, explain what swap is, and note its impact when
RAM is exhausted.
* Added "Swap activity monitoring" to troubleshooting guidance as a
signal of sustained paging to disk and its effect on database
performance, plus recommended mitigation actions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
A handful of code samples in the guides either don't run or contradict
the surrounding text. I found these reading through the docs.
- `database/debugging-performance`: `insert into books` targets a table
that's never created. The table made just above is `instruments`.
- `database/drizzle`: the `db.ts` snippet references an undefined
`host`. The variable in scope is `connectionString`.
- `database/postgres/column-level-security`: the `create table` is
missing a comma after `created_at ... now()`, so it won't parse.
- `database/postgres/first-row-in-group`: `distinct on (team)` with
`order by id, ...` is rejected by Postgres (the DISTINCT ON column has
to lead the ORDER BY). Ordered by `team, points desc` so it returns one
row per team.
- `database/postgres/data-deletion`: reversed markdown link
`(text)[url]`, plus "parititioning" misspelled.
- `database/extensions/pg_plan_filter`: prose says
`statement_cost_filter`, but the real parameter (used everywhere else in
the file) is `statement_cost_limit`.
- `auth/auth-hooks/mfa-verification-hook`: the insert and on-conflict
update use `last_refreshed_at`, but the table column is
`last_failed_at`.
- `telemetry/advanced-log-filtering`: the "ends with" example writes
`'$port=12345'`. The `$` anchor needs to come after the literal:
`'port=12345$'`.
- `ai/examples/headless-vector-search`: uses `${projectURL}` but the
const is `projectUrl`.
- `getting-started/quickstarts/redwoodjs`: prose says
`scripts/seeds.ts`, but the code block and Redwood use
`scripts/seed.ts`.
- `getting-started/tutorials/with-flutter`: two code-fence headers have
a stray trailing `"`.
- `local-development/cli/testing-and-linting`: stray backtick in "Edge`
Functions".
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Corrected code examples across multiple guides including vector
search, authentication hooks, database guides, and quickstarts
* Fixed SQL syntax errors, variable names, and table references in
example snippets
* Resolved typos, broken links, and formatting inconsistencies in guide
text
* Clarified parameter names and script references in documentation
* Updated code fence syntax in tutorials for proper rendering
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## Summary
Updates the PyIceberg installation instruction to use the
`supabase[iceberg]` extras instead of listing dependencies separately.
## Change
**`apps/docs/content/guides/storage/analytics/examples/pyiceberg.mdx`**
— Replace `pip install pyiceberg pyarrow` with `pip install
"supabase[iceberg]"`. The `pyiceberg` dependency is optional in
`supabase-py` v2.31.0 and is now declared under
`[project.optional-dependencies]` in the package — users should use the
extras syntax rather than installing dependencies outside of the
`supabase` package.
---
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated installation instructions for the Iceberg storage analytics
integration guide to reflect the recommended package installation
method.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update
## What is the nee current behavior?
Added new section to explain how vector buckets works locally
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a "Local Development" guide for Vector Buckets covering
alpha-status cautions, local vs hosted behavior, steps to enable local
vector storage, declarative bucket configuration, and how to create
buckets for local testing.
* Updated site navigation to include the new Local Development guide in
the Storage → Vector docs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
This PR syncs the latest troubleshooting guides from the
supabase/troubleshooting repository.
---------
Co-authored-by: github-docs-bot <github-docs-bot@supabase.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated navigation links in the getting started guide to direct users
to the correct documentation pages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated CLI installation guidance to recommend “global CLI usage”
phrasing and link to platform-specific installation pages
* Removed duplicate legacy note in the npm install guidance
* Reworded CLI update guidance to state updates use the “same channels”
* Expanded “Running Supabase locally” walkthrough with clear post-init
steps, start instructions, and clarified credentials output
* Clarified analytics schema wording from “will be stored” to “are
stored”
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This PR syncs the latest troubleshooting guides from the
supabase/troubleshooting repository.
Co-authored-by: github-docs-bot <github-docs-bot@supabase.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the database size guide to link read-only mode management
instructions to the correct documentation section for improved
navigation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Guide to troubleshoot a warning that can be emitted by Realtime DB
broadcast.
Ref: https://github.com/supabase/realtime/pull/1941
Preview:
https://docs-git-docs-realtime-warn-send-supabase.vercel.app/docs/guides/troubleshooting/realtime-warn-sending-broadcast-message
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a troubleshooting guide for a broadcast-message warning observed
in Postgres logs.
* Explains why messages may be dropped when partitions/replication
streaming aren’t yet available and when they become available.
* Provides diagnostic steps and remediation (ensure a subscriber/client
is connected) and guidance for when repeated warnings indicate a real
issue requiring error inspection.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update
## What is the current behavior?
Documenting limited regional availability which is no longer the case
## What is the new behavior?
Section about regional availability limits removed
## Additional context
Privatelink is now available in `eu-central-2`
## What
Migrates the Edge Functions **documentation** from the legacy
`Deno.serve` + manual `createClient` pattern to the
[`@supabase/server`](https://github.com/supabase/server) `withSupabase`
wrapper. This is the part of
[COM-269](https://linear.app/supabase/issue/COM-269) that AI coding
assistants index, so it's split out to ship first; the standalone
`examples/` functions follow in a second PR.
## Canonical pattern
```ts
import { withSupabase } from 'npm:@supabase/server@1'
export default {
fetch: withSupabase({ auth: 'user' }, async (req, ctx) => {
const { data } = await ctx.supabase.from('countries').select('*')
return Response.json({ data })
}),
}
```
- `export default { fetch }` object shape (not `Deno.serve`, not a bare
default export), versioned `npm:@supabase/server@1`.
- `auth` mode picks the caller: `user` → `ctx.supabase` (RLS);
`secret`/`publishable`/`none` → set `verify_jwt = false`, `secret` uses
`ctx.supabaseAdmin`.
- `Response.json(...)` over `new Response(JSON.stringify(...))`.
## Changes
- **AI prompt** (`examples/prompts/edge-functions.md`) — rewritten to
lead with `withSupabase` as the default; `auth`-mode table;
`@supabase/server@1`. Highest AI-indexing impact.
- **connect-to-postgres** — "Using supabase-js" now uses `ctx.supabase`
(+ its CodeSample deps `postgres-on-the-edge`, `drizzle`).
- **Example pages** — semantic-search, push-notifications,
amazon-bedrock, cloudflare-turnstile, og-image, send-emails,
slack-bot-mention, auth-send-email-hook.
- **Guides** — ai-models, background-tasks, routing (+ `restful-tasks`
dep), kysely-postgres, sentry-monitoring, upstash-redis, elevenlabs ×2,
websockets, cors (reframed: CORS is automatic with `withSupabase`).
## Notable fixes
- **websockets**: the JWT-auth examples had a latent bug — handler
wasn't `async` and called `getClaims()` without the extracted token. Now
`await supabase.auth.getUser(jwt)`. (`withSupabase` can't authenticate
WebSocket clients since they can't send headers — noted in the page.)
- **restful-tasks**: fixed a broken `npm:supabase-js` import →
`npm:@supabase/supabase-js`.
## Follow-ups (not in this PR)
- The ~42 standalone `examples/` edge functions → second PR.
- A dedicated `withSupabase` intro page (today it's only documented
inside the auth-framed "Securing Edge Functions" page).
- `.claude/skills/supabase-server/SKILL.md` is stale (`allow:` vs
`auth:`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated Edge Function examples to the modern withSupabase + exported
fetch handler pattern across guides and examples.
* Standardized JSON response/error handling (uses built-in JSON helpers)
and preserved streaming/SSE behaviors where applicable.
* Clarified auth modes, context clients (user vs admin), and automatic
CORS handling; removed manual preflight boilerplate.
* Updated local serve/deploy instructions to include --no-verify-jwt for
relevant examples.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Reading through the guides and troubleshooting docs I found a set of
code examples that don't parse or run as written. Each is a small,
self-contained fix:
- **troubleshooting/postgres-logs**: the `regexp_contains(...)` call was
missing its closing parenthesis.
- **troubleshooting/rls-performance**: the PL/pgSQL `return` statement
was missing its terminating semicolon.
- **troubleshooting/supavisor-faq**: the `CREATE USER ... WITH PASSWORD`
string literal was unterminated (missing closing quote).
- **troubleshooting/google-auth-fails**: missing comma between
`provider` and `options` in the `signInWithOAuth` object literal.
- **integrations/supabase-for-platforms**,
**database/extensions/pg_graphql**,
**deployment/branching/working-with-branches**: missing commas between
JSON properties.
- **database/extensions/pgjwt**: the default algorithm was written
`'HSA256'`; the real default is `'HS256'` (used in both `sign` and
`verify`).
- **auth/auth-email-passwordless** (Dart): `signinwithotp` should be
`signInWithOtp`.
- **auth/third-party/firebase-auth**: `async function
setRoleCustomClaim() => {` mixed a function declaration with arrow
syntax.
- **storage/management/copy-move-objects**: the storage helper is
`storage.foldername(name)`, not `storage.folder(name)`.
- **troubleshooting/hsnw-index**: prose referred to
`maintance_work_mem`; the setting is `maintenance_work_mem` (the SQL in
the same file spells it correctly).
- **troubleshooting/pgcron-debugging**: a stray double quote inside the
`cron.job_run_details` code span.
13 files, all one-line fixes. Happy to split if you'd prefer.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Corrected code examples across authentication, database, storage, and
troubleshooting guides
* Fixed method naming and syntax errors in code snippets (Dart auth,
Node.js Firebase, SQL functions)
* Updated API signatures and variable names for accuracy
* Improved JSON formatting in example payloads
* Corrected typos in documentation text
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES/
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Documentation
* Updated project variables guidance to include publishable and secret
keys alongside existing options.
* Updated code examples across multiple frameworks to use publishable
keys instead of anon keys.
* Updated tool descriptions to reflect publishable key terminology.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This PR syncs the latest troubleshooting guides from the
supabase/troubleshooting repository.
---------
Co-authored-by: github-docs-bot <github-docs-bot@supabase.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update
## What is the current behavior?
Auth hooks documentation doesn't explicitly state that the hook name
configured in `config.toml` must correspond to available hooks to
prevent errors, which has caused confusion for some users.
## What is the new behavior?
Doc includes mention that hook name must correspond to available hooks.
## Additional context
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added clarification note regarding authentication hook configuration
requirements, specifying that hook names in configuration files must
correspond to available hook types.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
removes three extensions from the list on the Postgres Extensions docs
page because we do not expose those extensions to users. extensions
removed are: amcheck, pg_surgery, pg_freespacemap
also adds a small cosmetic change to clarify that "public" refers to the
`public` schema on the same documentation page
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
docs update
## What is the current behavior?
extensions are listed at
https://supabase.com/docs/guides/database/extensions that will result in
permissions errors should users try to install them themselves, as they
require superuser access to install
## What is the new behavior?
removes those items from the list
## Additional context
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated extensions overview documentation with improved formatting for
better readability
* **Chores**
* Removed three extensions from the available extensions metadata
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Document Realtime broadcast of binary payloads
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Clarified binary payload behavior across SDKs and runtimes, including
version-gated support and which clients silently drop binaries.
* Added examples for sending binary messages via JavaScript, Swift, REST
(including file upload), and database broadcasts.
* Clarified REST payload handling (Content-Type selects JSON vs binary),
private messaging flag, and that batch endpoints accept JSON-only.
* Noted that channel.httpSend() uses REST starting in supabase-js
2.107.0.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
Utkarash Kumar Singh