The Supabase MCP repo transferred from `supabase-community/supabase-mcp`
-> `supabase/mcp`. This updates links on docs and www to point to the
new location: https://github.com/supabase/mcp
The main one needing this change is the MCP docs page at `mcp.mdx`:
https://supabase.com/mcp
I also updated links in the changelog / blog for good measure, though I
can remove those changes if desired since the old URL redirects to the
new location.
Related: https://github.com/supabase/mcp/pull/295
Ref: AI-792
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated Supabase MCP server repository references across all
documentation guides, blog articles, changelog entries, and supporting
materials to direct users to the current official location.
* Refreshed documentation links including feature groups, setup
instructions, abilities documentation, and GitHub issue tracking URLs
for consistency.
* Updated MCP server release links in changelog.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
Sustained memory overcommitment is one of the failure patterns that most
often leads to databases being killed when the system runs out of
memory. Today the database report only shows used memory against total
RAM, which hides the kernel's commit accounting: a project can sit far
above its commit limit (RAM plus swap, adjusted by the overcommit ratio)
and the dashboard gives no signal until something breaks.
A combined chart with swap, overcommitment, and main memory was
considered too dense, and a standalone swap chart was not useful enough
on its own.
Linear: [DEBUG-119](https://linear.app/supabase/issue/DEBUG-119)
## Fix
Adds a separate "Memory commitment" chart between the existing memory
usage and swap charts. It plots `ram_commit_used` (Committed_AS) as the
main series with `ram_commit_limit` (CommitLimit) as the max-value
threshold line, so values approaching or crossing the limit are visually
obvious. Backend support for the two new metric attributes ships in
supabase/platform#33321.
## How to test
- Wait for the platform PR (supabase/platform#33321) to deploy so the
two new attributes are accepted by the infra monitoring endpoint.
- Open any project, navigate to Database -> Reports.
- Confirm the new "Memory commitment" chart appears between "Memory
usage" and "Swap usage".
- Confirm the chart shows two series: the committed memory bars/area and
a max line for the commit limit.
- Hover the legend and the chart to confirm the tooltips read clearly.
- Confirm the time range selector and chart sync (`syncId:
'database-reports'`) keep this chart aligned with the others.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added comprehensive guide for interpreting memory commitment patterns
in telemetry reports, including component breakdown, chart pattern
guidance, and actionable recommendations.
* **New Features**
* Added memory commitment chart to database observability dashboard,
displaying RAM commitment usage and limits.
* Extended monitoring API to support new RAM commitment metrics.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update
## What is the current behavior?
Currently, this doc outlines how to restore a dashboard backup which
only applies to projects that still use logical backups. Newer projects
cannot follow this process.
## What is the new behavior?
Adds an admonition to direct users with projects that use physical
backups to the correct guide.
Keeping the legacy guide content for now for older projects that may
still be using logical backups.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added clarification that dashboard backups are only available for
Supabase projects using logical backups. Projects using physical backups
are directed to refer to the CLI backup and restore guide instead.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Consolidated API key deprecation guidance into a reusable notice for
consistent messaging across docs. Announces deprecation of legacy
anon/service_role JWT-secret keys by end of 2026, instructs switching to
sb_publishable_xxx / sb_secret_xxx, and provides steps to locate and
copy both new and legacy keys. Applied across auth, getting-started,
API, and realtime guides.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: fadymak <dev@fadymak.com>
## What
Adds a getting-started guide for migrating an existing project from the
legacy JWT-based `anon` and `service_role` keys to the new publishable
(`sb_publishable_...`) and secret (`sb_secret_...`) keys.
The guide walks through the migration step by step:
- **Before you start** — maps legacy keys to their replacements.
- **Step 1** — create the new `default` keys.
- **Step 2 / 3** — swap the publishable key in client code and the
secret key in backend code.
- **Database Webhooks and `pg_net`** — move the key from the
`Authorization: Bearer` header to the `apikey` header (the new keys
aren't JWTs and are rejected on `Authorization`), with a Vault note for
not inlining secrets.
- **Step 4** — update Edge Functions, with two options: read the new env
vars (`SUPABASE_PUBLISHABLE_KEYS` / `SUPABASE_SECRET_KEYS`) and set
`verify_jwt = false`, or adopt the `@supabase/server` SDK.
- **Step 5 / 6** — verify nothing uses the legacy keys, then deactivate
them (reversible).
- **Next steps** — clarifies that JWT signing keys are a separate,
independent migration.
## Notes
While writing this we found Studio issues to fix separately (the Invoke
Function cURL snippet and the Database Webhooks editor both put the new
keys on the `Authorization` header).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a comprehensive migration guide for moving from legacy JWT-based
API keys to the new publishable and secret keys with zero‑downtime
steps, verification, limitations, and next steps.
* Clarified API key behavior and recommended migration actions in the
getting‑started docs.
* Added a navigation entry linking to the new migration guide.
* **Style**
* Relaxed documentation lint rules to allow expected wording/phrases
(e.g., "backends", "Database Webhooks").
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Include the v2 mgmt API spec in the official docs. This PR merges the v1
and v2 specs when generating the reference, with v2 taking precedence on
conflicts.
Fixes API-1215
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Docs now include API v2 reference: log-drain management
(list/create/update/delete) and project transfer (preview/transfer).
* **Documentation**
* Generated API reference now merges v1 and v2 specs so both appear in
the docs and section listings.
* New v2 operations added to Analytics and Projects documentation
sections.
* **Chores**
* Docs generation pipeline updated to accept and process multiple API
spec inputs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Removed Alan De Los Santos and Fabrizio Cataldo from the list.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Humans update
## What is the current behavior?
Humans
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated team roster in public documentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Four pages in `apps/docs` have a mismatch between the `pathname` in
`generateMetadata` and the `pathname` in `GuideTemplate`. The
`generateMetadata` pathname is what generates the `<link
rel="canonical">` and `<link rel="alternate" type="text/markdown">` tags
— so both tags point to the wrong URL on all 4 pages.
The wrong canonical destinations either loop back to the source page
(308 → source) or end in a 404, meaning Google is being told the
authoritative URL is somewhere it can't reliably reach.
## Changes
One-line fix in each file — update `pathname` in `generateMetadata` to
match the `pathname` already correctly set in `GuideTemplate`:
- `apps/docs/app/guides/database/database-advisors/page.tsx` —
`/guides/database/database-linter` →
`/guides/database/database-advisors`
- `apps/docs/app/guides/local-development/cli/config/page.tsx` —
`/guides/cli/config` → `/guides/local-development/cli/config`
- `apps/docs/app/guides/deployment/ci/[slug]/page.tsx` —
`/guides/cli/github-action/${slug}` → `/guides/deployment/ci/${slug}`
- `apps/docs/app/guides/deployment/terraform/[[...slug]]/page.tsx` —
`/guides/platform/terraform` → `/guides/deployment/terraform`
## Verification
Before fix — view source on any of these pages and search for
`canonical`:
- https://supabase.com/docs/guides/database/database-advisors
- https://supabase.com/docs/guides/local-development/cli/config
- https://supabase.com/docs/guides/deployment/ci/testing
- https://supabase.com/docs/guides/deployment/terraform
After fix — canonical on each page should be self-referencing.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed documentation routing paths across multiple guides to align with
proper navigation structure:
* Database advisors guide
* CI/deployment guide
* Terraform deployment guide
* Terraform provider reference guide
* Local development CLI configuration guide
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
Edge Function examples that use the new publishable/secret API keys read
them with a double lookup:
```ts
const SUPABASE_SECRET_KEYS = JSON.parse(Deno.env.get('SUPABASE_SECRET_KEYS')!)
const secretKey = Deno.env.get(SUPABASE_SECRET_KEYS['default']) // ❌ returns undefined
```
`SUPABASE_SECRET_KEYS` / `SUPABASE_PUBLISHABLE_KEYS` are a JSON object
that maps a key name to the **actual key value** (e.g.
`{"default":"sb_secret_..."}`), confirmed by:
- the self-hosted injection in `docker/docker-compose.yml`
(`SUPABASE_SECRET_KEYS: "{\"default\":\"${SUPABASE_SECRET_KEY:-}\"}"`)
- the `@supabase/server` SDK README
So `SUPABASE_SECRET_KEYS['default']` is already the key. Wrapping it in
another `Deno.env.get(...)` looks up an env var named `sb_secret_...`,
which doesn't exist, so the value is `undefined` and the examples fail
at runtime.
## Fix
Unwrap the outer `Deno.env.get(...)` so the key is read directly:
```ts
const SUPABASE_SECRET_KEYS = JSON.parse(Deno.env.get('SUPABASE_SECRET_KEYS')!)
const secretKey = SUPABASE_SECRET_KEYS['default'] // ✅
```
Applied across 23 files (example functions, the
`examples/prompts/edge-functions.md` codegen guidance, and two docs
guides). The correct `JSON.parse(Deno.env.get('SUPABASE_SECRET_KEYS')!)`
declaration line is untouched. The generated `apps/docs/examples/` copy
regenerates from `examples/` at build time.
## Notes
- Docs context:
[#46600](https://github.com/supabase/supabase/pull/46600), which
documents the same key model.
- Follow-up (not in this PR): a few examples send the secret key on the
`Authorization: Bearer` header, which the new keys reject. Worth a
separate audit.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Clarified examples and guides for correctly reading parsed Supabase
secret and publishable key maps.
* **Examples**
* Standardized credential usage across Edge Functions and samples so
Supabase clients consistently receive keys from the parsed key maps
rather than indirect lookups.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Behavior Changes**
* Partial directives now render unprovided variables as empty strings
instead of throwing validation errors
* Escaped placeholders (preceded by backslash) are preserved and not
substituted
* Unused provided variables are silently ignored
* **Tests**
* Updated test coverage to validate the new permissive variable
substitution behavior and removed prior error-focused assertions
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
New guide at `/guides/api/handling-errors-in-supabase-js` that leads
with `error.hint` as the most useful field on a Postgres error. When the
database knows the fix (a `GRANT` statement to run for a `42501`, a
column name you probably meant), it puts the literal SQL in `hint`.
Logging only `error.message` hides it.
The guide covers the `PostgrestError` shape (fields ordered by
usefulness: hint first, message last), branching on `error.code`, and
parallel patterns for Auth, Storage, Edge Functions, and Realtime.
Linked from the API > Guides sidebar next to the existing PostgREST
error codes reference.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a comprehensive guide on handling errors in supabase-js,
explaining the {data, error} pattern and recommending logging full error
objects.
* Provides a recommended error-handling pattern, guidance to branch on
error codes, and example error fields.
* Adds component-specific advice for Auth, Storage, Edge Functions, and
Realtime, plus a “Related” links section.
* Added a navigation entry so the guide appears in the API guides
submenu.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update
## What is the current behavior?
The access-control permissions matrix shows Developer-role users can
create development branches, but doesn't mention the implicit
production-branch registration step that runs on the first "Create
branch" click for a gitless project — which is
Owner/Administrator only. Customers reading the matrix conclude
Developers can branch from the start; in reality, an
Owner/Administrator has to perform the first branch creation to register
the production branch.
## What is the new behavior?
Adds a footnote on the "Development Branches → Create" row that flags
the one-time first-branch admin requirement and links to the
dashboard branching guide for the full explanation. Short cross-link
only — long-form mechanism explanation lives on the dashboard
branching guide (companion PR #46471).
## Additional context
- Companion PR adding the long-form admonition on the branching guide
page: #46471
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Clarified branching permissions for dashboard (gitless) workflows: the
first branch creation (one-time) without a GitHub integration requires
Owner or Administrator to register the production branch; after that
initial step, Developers may create, update, and delete branches as
normal.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
The embeddings workflow started failing after #46163 with `ENOENT: ...
content/reference/javascript/v2/sections.json`. That PR routed the JS v2
search ingest through the new reference pipeline
(`loadClientLibReferenceFromNewPipeline` in
`apps/docs/scripts/search/sources/reference-doc.ts`), and updated
`predev` and `prebuild` to run both `codegen:references` and
`codegen:references:new`, but missed `preembeddings`. This chains
`codegen:references:new` into `preembeddings` so `pnpm run embeddings`
(and the `:nimbus` / `:refresh` variants that fan out to it) produces
the new pipeline output before the search ingest reads it.
# Second try of making a new better process for SDK automation
Instead of building a new pipeline. We will take the lessons learned
form round 1, plus the good design and improvement on DX quality for
drop-in file as a single step required from SDK team and produce almost
identical set of files as used right now to render using the current
pipeline.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* New reference-content pipeline producing per-library reference
artifacts and integrating into prebuilds, search ingestion, and
rendering (type-aware examples).
* **Documentation**
* Added comprehensive JavaScript SDK v2 reference content and partials
(Auth MFA, passkeys, admin, TypeScript support, filters, modifiers,
Installing, Initializing, Buckets, etc.).
* **Tests & CI**
* Added regression snapshot test and updated workflows to refresh
reference snapshots and ensure spec downloads.
* **Chores**
* Updated ignore rules, build scripts, Makefile targets, and package
lifecycle hooks.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Katerina Skroumpelou <mandarini@users.noreply.github.com>
Co-authored-by: Katerina Skroumpelou <sk.katherine@gmail.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
I am new to Supabase (yay!) and so must declare myself officially as a
human rather than bot.
## What is the current behavior?
My name is not included. ☹️
## What is the new behavior?
My name _is_ included. 😄
## Additional context
None.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated team contributor information.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Adds myself to `humans.txt` per onboarding instructions
## What is the current behavior?
n/a
## What is the new behavior?
n/a
## Additional context
n/a
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated team contributors list with a new team member.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
During the migration to make `PREVIEW` match `PRODUCTION` environment we
got a negation wrong.
With this fix, now wrappers pages are rendered statically on build, so
we can catch errors on MDX syntax on the fly.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix (documentation) — fixes three internal links that currently 404.
## What is the current behavior?
Three docs pages link to internal paths that do not resolve (no matching
page, and no redirect in `apps/www/lib/redirects.js`):
| File | Link | Problem |
| --- | --- | --- |
| `guides/telemetry/reports.mdx` (×3) |
`/docs/content/guides/database/query-optimization` | Stray `content/`
path segment (the content folder name leaked into the public URL) |
| `guides/database/prisma.mdx` |
`/docs/guides/database/prisma-troubleshooting` | Page lives under the
`prisma/` subfolder |
| `guides/database/postgres/data-deletion.mdx` |
`/docs/blog/postgres-bloat` | Blog posts are served from `/blog`, not
`/docs/blog` |
No related issue — these are self-evident broken links found by checking
every internal `/docs/...` link against the actual pages, the redirects
config, and the dynamic doc routes.
## What is the new behavior?
The links now point to the correct, existing pages:
- `/docs/guides/database/query-optimization` (page:
`apps/docs/content/guides/database/query-optimization.mdx`)
- `/docs/guides/database/prisma/prisma-troubleshooting` (page:
`apps/docs/content/guides/database/prisma/prisma-troubleshooting.mdx`)
- `/blog/postgres-bloat` (post:
`apps/www/_blog/2024-04-26-postgres-bloat.mdx`; consistent with the ~30
other `/blog/...` links across the docs)
Docs-only change; no wording changes beyond the URLs. The `reports.mdx`
tables were re-aligned by Prettier as a result of the shortened links.
## Additional context
For each link I confirmed the target page/post file exists, that the
broken path has no rule in `apps/www/lib/redirects.js`, and that it is
not served by a dynamic Next.js route under `apps/docs/app/`.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Adds Lukas Klingsbo to the humans.txt
## What is the current behavior?
There is no Lukas Klingsbo in humans.txt
## What is the new behavior?
There is a Lukas Klingsbo in humans.txt
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated team information with a new team member addition.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Adds my name to the public-facing `humans.txt` endpoint on
`supabase.com`.
## What is the current behavior?
Existing humans listed without me.
## What is the new behavior?
I become listed as another human. 🎉
## Additional context
I think that's enough already. 😈
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated team information in public documentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
After improving error handling on guides loader, of course, an error
emerged about a missing partial that doesn't exist anymore within the
project.
Removing the partial importing within MDX to fix search embedding
script.
**I have read the CONTRIBUTING.md file.**
YES
**What kind of change does this PR introduce?**
Docs update
**What is the current behavior?**
The Prisma quickstart and troubleshooting pages reference Prisma v6
patterns: `prisma-client-js` generator, `datasource db` with
`url`/`directUrl`, CommonJS imports, `ts-node`, and no driver adapter
setup.
**What is the new behavior?**
Updated for Prisma ORM v7:
- Install steps use `tsx`, `@prisma/adapter-pg`, `dotenv`, and `pg`
- New step for `prisma.config.ts` with `dotenv/config` and `DIRECT_URL`
- Schema uses `prisma-client` generator with explicit output,
provider-only `datasource db`
- Removed old `datasource db { url, directUrl }` block from serverless
tab
- Test file uses ESM imports from `./generated/prisma/client` and
`PrismaPg` driver adapter
- Troubleshooting cross-schema example updated to match v7 patterns
**Additional context**
Prisma v7 requires driver adapters, moves datasource config to
`prisma.config.ts`, and deprecates the `prisma-client-js` generator in
favor of `prisma-client`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated Prisma quickstart: refreshed install and setup steps, added a
new runtime configuration step, adjusted migration + generate workflow,
and replaced the test API example with an ESM-style, dotenv-powered
snippet.
* Refined troubleshooting examples: clarified schema configuration
syntax and improved multi-schema guidance.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46082?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
This PR is add missing docs for the newly added wrappers:
- Cal
- Calendly
- Cloudflare D1
- DynamoDB
- Gravatar
- Hubspot
- Infura
- MySQL
- OpenApi
- Orb
- Shopify
- Slack
## What is the current behavior?
Those wrappers was added to Wrappers extension but docs links are not
updated.
## What is the new behavior?
- The missing wrappers docs are added.
- Removed the repetitive `Connecting to` title prefix in the Navigation.
- Collapse the lengthy wrappers list into a `Sources` sub navigation
item to make the UI tidy.
## Additional context
N/A
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added guides for new federated data wrappers: Cal, Calendly,
Cloudflare D1, Gravatar, Infura, MySQL, OpenAPI, Shopify, and Slack.
* Reorganized Foreign Data Wrappers navigation menu with an improved
hierarchical structure for easier discovery of available vendor
integrations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update.
## What is the current behavior?
The troubleshooting entry
`edge-functions-worker-timeouts-and-websocket-drops.mdx` includes
frontmatter fields that are not part of the troubleshooting
template/schema, so it does not conform to the expected metadata shape.
## What is the new behavior?
The document now matches the supported troubleshooting template
metadata.
- **Frontmatter cleanup**
- Removed unsupported `teams` and `types` fields.
- Kept the existing supported metadata (`title`, `topics`, `keywords`)
unchanged.
- **Template alignment**
- Brings the page in line with
`/apps/docs/content/troubleshooting/_template.mdx`.
- Avoids schema drift for troubleshooting content.
```mdx
---
title = "Edge Functions worker timeouts and WebSocket drops"
topics = [ "functions" ]
keywords = [ "websocket", "timeout", "earlydrop", "wall clock", "cpu limit", "streaming", "cold start" ]
---
```
## Additional context
This is a surgical docs-only change to make the page consistent with the
troubleshooting content schema used by the docs app.
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Rodrigo Mansueli <rodrigo@mansueli.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Simplified the local setup instructions for running the docs site
during development.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
docs update
## What is the current behavior?
Storage RLS polices unintentionally allow list access to buckets
potentially setting a bad example for people starting a new project.
## What is the new behavior?
Use more restrictive RLS polices that only allow the intended operations
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated Supabase Storage access-control policies and examples across
docs and starter projects.
* Tightened avatar image access rules to require explicit operation
checks for public reads.
* Clarified guidance and added explanatory comments in migration and
README examples to illustrate the updated access patterns.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46172?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update
## What is the current behavior?
The dashboard branching guide doesn't mention that the first "Create
branch" action on a project requires Owner/Administrator access.
Combined with cosmetic UI behavior: the branch dropdown displays `main /
PRODUCTION` on every project from day one, even though the backend
hasn't registered a production branch yet. Developer-role users hit a
403 with a generic "Not authorized to enable preview branching" toast on
their first branch attempt, with no docs or UI hint that an implicit
production-branch registration step is happening.
Customer-reported in
[SU-383693](https://supabase.frontapp.com/open/cnv_1mz95u3i?key=wbyHQkruuZ_KYRGnRPB5_yHzm5-fr_k4)
## What is the new behavior?
Adds an admonition under the "Creating a branch" heading in the
dashboard-branching guide explaining:
- The cosmetic UI vs. backend state mismatch (`main / PRODUCTION` shown
before any row exists)
- That the first "Create branch" click is what technically enables
branching on the project (populates `preview_branches` with`is_default =
true`)
- This step requires Owner/Administrator access
- After that one-time step, anyone with the Developer role can create,
update, and delete preview branches
Scoped to the gitless dashboard flow only. The GitHub-integrated path
bootstraps automatically during admin-only integration setup.
## Additional context
- Mechanism confirmed with the team in
[Slack](https://supabase.slack.com/archives/C02BJ2239GA/p1779978863774239)
"the first time branching is used we populate the preview_branches table
with the base project and have is_default set as true. This is
technically what enables branching. A developer role can't do that."
- Related FE improvement being escalated separately (clearer error
message and/or disabling the Create branch button for Developers when
the production branch hasn't been registered yet)
- The [Branching 2.0
announcement](https://supabase.com/blog/branching-without-git-is-now-the-default)
(May 2026) made gitless branching the default for new projects, and more
customers can walk into the dashboard flow without ever touching GitHub
integration.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added clarification on dashboard branching behavior when GitHub
integration is not configured, including details on branch dropdown
display and initial setup requirements with permission levels.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46471?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update
## What is the current behavior?
Currently, we have a doc that was created to provide details about
platform audit logs (organization level)
## What is the new behavior?
This adds a detail about account audit logs, which provide the same
details as the platform audit log. The difference is account audit logs
only show logs for the specific user account.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Enhanced Platform Audit Logs guide to clarify that each account has
access to separate Account Audit logs for tracking individual user
activity.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46467?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Removes the preemptive 301 redirects from `/docs/llms.txt` and
`/docs/llms-full.txt` to root, and switches the docs homepage
`rel=alternate` to an absolute URL. The `/docs/*` paths never had a
producer in `apps/docs` (no route handler, no static file at
`public/llms.txt` or `public/llms-full.txt`); the redirects were cruft
from before the root paths were canonical. Now `/docs/llms*` cleanly
404s and the only advertised path is the root canonical per llmstxt.org.
## Changes
- Delete `/docs/llms.txt` and `/docs/llms-full.txt` 301 entries from
`apps/www/lib/redirects.js`
- Switch `apps/docs/app/page.tsx` rel=alternate `text/markdown` from
relative `/llms-full.txt` to absolute
`https://supabase.com/llms-full.txt`, so `basePath: '/docs'` does not
reconstruct the now-dead `/docs/llms-full.txt` path
## Testing
Verify on Vercel preview:
- [ ] `curl -sI -L <preview>/docs/llms.txt` returns 404 (no producer,
redirect removed)
- [ ] `curl -sI -L <preview>/docs/llms-full.txt` returns 404
- [ ] `curl -sI -L <preview>/llms.txt` returns 200 with `content-type:
text/plain`
- [ ] `curl -sI -L <preview>/llms-full.txt` returns 200, ~9 MB body
- [ ] `curl -s <preview>/docs/ | grep 'rel="alternate".*llms-full'`
shows the absolute `https://supabase.com/llms-full.txt` href (no
`/docs/` prefix)
Caveat: the absolute alternate URL points at production from preview
deploys. Acceptable because Vercel previews are `noindex` by default and
the existing `canonical: BASE_PATH` already crosses environments via
basePath resolution.
## Linear
- fixes GROWTH-881
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated documentation URL references to use absolute Supabase-hosted
paths
* Reorganized legacy product documentation redirects to new
markdown-based routes
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46468?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Adds details about error handling in the protocol and what users can
expect when handling them in client libs
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Expanded Realtime protocol "Error handling": describes four error
delivery paths, client lifecycle and recovery behaviors, and which
errors close or preserve channels.
* Clarifies join rejection parsing and retry/backoff guidance for join
error codes, plus special-case join reasons.
* Details channel-level system errors, Postgres subscription
degraded-state and ID-consistency rules, broadcast/presence error
shapes, in-band access_token refresh, and reconnection sequencing.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46292?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Jeremias Menichelli
