## Summary
- Replaces the outdated command palette (`Authentication: Remove Dynamic
Authentication Providers`) troubleshooting step with the new Antigravity
flow: Agent Settings (Cmd+,/Ctrl+,) → Customizations tab → Authenticate
button next to the server.
<img width="1507" height="625" alt="image"
src="https://github.com/user-attachments/assets/b92e9fd2-5bc3-4bf5-a16e-1e241a10b2ec"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated Antigravity UI help text for authentication with clearer
step-by-step guidance to open Agent Settings and use the Authenticate
button for Supabase; included a screenshot showing where the button
appears.
* **Chores**
* Added support for PNG asset imports so image files used in the UI are
recognized and handled correctly.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Following up on #45361 — instead of keeping the control, we're baking in
the `multi_project` variant from the original A/B experiment (#44293) as
the new default for Pro/Team plan cards.
**Change:** On Pro and Team plan cards, the warning area now reads:
> First project included. Additional projects from \$10/mo.
> See how pricing scales →
Replacing the previous control copy (`plan.warning` + "Need more
compute?" link). Free and Enterprise plans still show their original
`plan.warning` text.
No A/B test infrastructure restored — the variant is the new default.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated pricing card messaging to display consistent information about
included projects and additional project pricing for premium plans
* Enhanced visibility of compute add-on scaling details with improved
link labeling
* Adjusted warning message display logic for standard plans
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Studio UI copy and visual polish for the Stripe Projects connect flow.
- Resolves DEPR-428
- Resolves DEPR-429
## What is the current behaviour?
- The Stripe Projects connect flow copy is awkward in request, linked,
wrong-account, and success states.
- The API authorisation layout logo is slightly misaligned.
- The bundled Stripe icon is outdated.
## What is the new behaviour?
- Tightens Stripe Projects copy and CTA text around authorising the
request.
- Keeps the real `ar_id` account-request flow intact without local
preview shortcuts.
- Centres the logo link in `APIAuthorizationLayout`.
- Updates the Stripe icon SVG.
- Note that this affects other areas too, such as Stripe integrations
([more](https://supabase.slack.com/archives/C0429V78ACX/p1777268209661729)).
- Fixes CLI login copy capitalisation.
| Before | After |
| --- | --- |
| <img width="1380" height="856" alt="CleanShot 2026-04-29 at 15 10
26@2x"
src="https://github.com/user-attachments/assets/4ad242c2-1e9e-4128-9661-ef8deee111c1"
/> | <img width="1486" height="892" alt="CleanShot 2026-04-29 at 15 10
36@2x"
src="https://github.com/user-attachments/assets/f6aa4d0a-e5a7-40ff-87b7-845a22ef1c50"
/> |
## Verification
- `pnpm exec eslint pages/partners/stripe/projects/login.tsx`
- `git diff --check`
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
## What kind of change does this PR introduce?
Dashboard cleanup and docs update.
## What is the current behaviour?
Project Settings > General still shows a legacy "Project usage" section
explaining that usage statistics moved to organisation settings. One
troubleshooting page also links to the old project billing usage page.
## What is the new behaviour?
The legacy Project Settings usage callout is removed, while the existing
old usage route redirect remains in place for stale links. The MAU
troubleshooting page now points users to the organisation usage page and
tells them to select a specific project from the dropdown.
| Before | After |
| --- | --- |
| <img width="1450" height="1314" alt="CleanShot 2026-04-30 at 16 11
16@2x"
src="https://github.com/user-attachments/assets/3ad8c41f-2eab-406c-bfd8-f5737ae9a5a3"
/> | <img width="1474" height="1004" alt="CleanShot 2026-04-30 at 16 11
04@2x-7CACB175-B6A9-4811-968F-030745F685AE"
src="https://github.com/user-attachments/assets/f541ee60-0c24-49e4-9446-3bd58c516797"
/> |
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated Monthly Active Users (MAU) documentation to reflect accessing
usage data from the organization-level page instead of project settings
* **Refactor**
* Removed project-level usage viewing option from project settings
interface
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
docs update
## What is the current behavior?
I am not in the docs
## What is the new behavior?
I am in the docs
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated credits list to include a new contributor.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
add myself to humans.txt
## What is the current behavior?
doesn't have my name
## What is the new behavior?
has my name
## Additional context
just onboarding!
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated documentation contributors list.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated compute instance sizing guidance to clarify that scale-to-zero
pricing applies to Nano instances
* Refreshed documentation sections describing compute instance options
and pricing tiers
* Removed outdated information about Pico instance capabilities
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Wen Bo Xie <wenbox323@gmail.com>
## What kind of change does this PR introduce?
Minor UI and copywriting change.
## What is the current behavior?
- Vague dialog copy for pausing a project
- Plain pause icon looks like two Tim Tams
## What is the new behavior?
- Clearer dialog copy
- More standard pause button
## Additional context
| Before | After |
| --- | --- |
| <img width="912" height="502" alt="11317"
src="https://github.com/user-attachments/assets/55a64d01-8171-498e-a03f-2e0060995400"
/> | <img width="850" height="476" alt="67001"
src="https://github.com/user-attachments/assets/054a8ca0-e06c-417c-9668-c3847013bbe2"
/> |
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Enhanced pause project confirmation dialog to clearly communicate the
90-day resume timeframe and backup availability after this period.
* **Style**
* Updated pause icon display.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Bug fix.
## What is the current behaviour?
The integrations listing links tiles to short partner URLs such as
`/partners/vercel`, while the canonical integration pages live at
`/partners/integrations/vercel`.
Those short URLs are handled by the legacy `/partners/[slug]` route,
which is meant to redirect technology partners to
`/partners/integrations/[slug]`. However, that route currently
pre-renders partner slugs and returns `notFound` when
`npm_lifecycle_event === 'build'`, which can bake and cache static 404s
for URLs that are meant to redirect.
This was reportedly working as recently as last week, and the relevant
partners page code has not changed recently. The most likely explanation
is that old legacy-route behaviour was surfaced by a recent production
build/deployment/prerender cache interaction, rather than a fresh change
to the integrations tile code itself.
## What is the new behaviour?
Integration tiles now link directly to the canonical
`/partners/integrations/[slug]` URL, so the listing no longer depends on
the legacy short-url redirect.
The legacy short partner URL route also no longer pre-renders partner
slugs as build-time 404s. It remains as a blocking fallback redirect for
old external links, bookmarks, search results, and historical references
that may still point at `/partners/[slug]`.
## Testing
This URL:
```
https://zone-www-dot-com-git-dnywh-fix-partner-integrat-b3fb68-supabase.vercel.app/partners/integrations/vercel
```
...should resolve to:
```
https://zone-www-dot-com-git-dnywh-fix-partner-integrat-b3fb68-supabase.vercel.app/partners/vercel
```
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Fix alignment
## What is the current behavior?
N/A
## What is the new behavior?
Align How To Enter section
## Additional context
N/A
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Adjusted the "How to enter" section layout to improve visual balance
and centering across breakpoints.
* Intro sentence and legal/CTA paragraph now centered for clearer
emphasis.
* Option and deadline blocks resized to remove forced full-width
styling, yielding a cleaner, more consistent flow.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Ana <ana1337x@users.noreply.github.com>
## What kind of change does this PR introduce?
Fixes FE-2526.
Adds a global Feature Preview badge to pages enabled via Feature
Previews, improving visibility and making it clearer to users that the
feature can be managed (or disabled) from the Feature Previews settings.
## Why
Previously, once a feature preview was enabled, there was no clear
indication within the UI that:
- the feature was still in preview, or
- where to go to disable it
This lead to confusion and made the feature feel “permanent”.
## What’s included
New FeaturePreviewBadge UI component
<img width="417" height="80" alt="CleanShot 2026-04-29 at 17 20 10"
src="https://github.com/user-attachments/assets/6fbc96e3-35ef-46d1-893a-2188c4d237a3"
/>
</br>
Added badge across pages enabled via Feature Previews:
- Webhooks
- Unified Logs
- JIT DB Access
- Column Privileges
- Policies
- Merge page
- Advisor Rules
Consistent placement and styling.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Feature preview badges now appear across the platform on preview
features, including Platform Webhooks, Database functionality, Unified
Logs, Advisor Rules, and other features, providing quick identification
and access to manage preview settings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Fixing alignment on contest page
## What is the current behavior?
The "Both options must be completed by Monday, May 11, 2026 at 12:00 PM
PST." deadline note added in
https://github.com/supabase/supabase/issues/44861 renders centered
instead of left-aligned, because the <p> element doesn't have w-full and
the parent flex container uses items-center.
## What is the new behavior?
The deadline note is left-aligned, consistent with the Option 1 and
Option 2 blocks above it.
## Additional context
N/A
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Improved deadline message layout to utilize full available width for
optimal display.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Ana <ana1337x@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Contest page update
## What is the current behavior?
N/A
## What is the new behavior?
Replaces the simple numbered list with Option 1 (Stripe Projects CLI)
and Option 2 (Stripe Sync Engine), including CLI commands code block and
link to the integrations dashboard.
## Additional context
N/A
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Reworked contest entry flow into two qualifying paths: "Stripe
Projects" (includes terminal provisioning steps and account-link note)
and "Stripe Sync Engine" (direct integration link).
* Updated page layout with centered, max-width container and
introductory line; contest deadline and rules/disclaimer remain
unchanged.
* **Documentation**
* Shortened SEO description to "Enter for a 1-in-10 chance…"
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Ana <ana1337x@users.noreply.github.com>
## Problem
The current
[multi-select](https://supabase.com/design-system/docs/fragments/multi-select)
does not work inside a dialog. The dropdown list is hidden.
## Solution
Fix it using the `Popover` component which also handle repositioning
above the input when there's not enough space below.
## How to test
- [Demo on
design-system](https://design-system-git-chore-fix-multi-select-supabase.vercel.app/design-system/docs/fragments/multi-select#inside-a-dialog)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added a new example demonstrating multi-select usage within a dialog
component with inline search capabilities.
* Enhanced multi-select component with improved stability and
interaction handling.
* **Documentation**
* Added "Inside a dialog" section to multi-select documentation with
usage guidelines for inline search in dialog contexts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Adds the first batch of keyboard shortcuts for the SQL editor, following
the registry pattern established for the table editor.
## Shortcuts
| Shortcut | Action | Notes |
| --- | --- | --- |
| `Esc` | Blur the SQL editor | Registered as a Monaco command with a
context-key precondition so inline widgets keep owning `Esc` (suggest,
find, parameter hints, snippet/rename mode, accessibility help, inline
suggestions, and selection cancellation). |
| `Shift+E` | Focus the SQL editor | Pairs with `Esc` for mouse-free
round-trip. |
| `Alt+Shift+F` | Prettify SQL | Now wired through the registry; the
tooltip and dropdown badge in `UtilityActions` read the keybind from the
same source of truth. Works from inside the editor (Monaco action) and
from anywhere on the page (`useShortcut`). |
| `Mod+Shift+Enter` | Run EXPLAIN ANALYZE | Routes results into the
Explain tab. Surfaces in the Monaco context menu next to "Run Query". |
| `Shift+N` | Open a new SQL snippet | Navigates to `/sql/new?skip=true`
to avoid the redirect-to-last-visited effect that fires on plain
`/sql/new`. |
All entries appear in the command menu (`Mod+P`) under "Shortcuts" while
their host components are mounted. None are surfaced in Account →
Preferences → Keyboard shortcuts yet (`showInSettings: false`), matching
how the table editor shortcuts shipped.
## Notes
- The blur shortcut intentionally lives on the Monaco instance rather
than the document-level hotkey listener — the document listener can't
preempt Monaco's own `Esc` handling. Other shortcuts that need to fire
while the editor has focus (run, save, format, explain) are registered
as Monaco actions; everything else uses `useShortcut`.
- Format and explain are double-registered (Monaco action +
`useShortcut`) so they fire whether the editor is focused or not. The
Monaco actions don't read the user's enable/disable preference yet —
same asymmetry as the existing run/save actions.
- `Shift+N` is scoped to the SQL editor route. To make it work globally
we'd register it at a higher layout level.
## Test plan
- [x] Inside editor: `Esc` blurs; suggest/find/parameter hints still
close on `Esc`; multi-cursor selection collapses on first `Esc`, blurs
on second.
- [x] Outside editor: `Shift+E` returns focus to the editor.
- [x] `Alt+Shift+F` formats from inside and outside the editor; tooltip
+ dropdown badge show the correct keybind.
- [x] `Mod+Shift+Enter` runs EXPLAIN ANALYZE and switches to the Explain
tab.
- [x] `Shift+N` opens a fresh snippet without bouncing back to the
previous one.
- [x] All five shortcuts appear in `Mod+P` with the right badges.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Keyboard shortcuts for SQL editor: format SQL, run EXPLAIN ANALYZE,
focus/blur editor, and open a new SQL snippet.
* Added "Prettify SQL" and "Run EXPLAIN ANALYZE" actions to the editor
context menu with shortcuts.
* Centralized registration of SQL editor shortcuts so they appear across
the app.
* **UX Improvements**
* Escape key blurs editor focus when appropriate to allow easy exit
without disrupting editor widgets.
* **Style**
* Adjusted success toast capitalization for copied Markdown.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com>
- change changelog.md formatting
- make changelog entries slugs more descriptive (eg
/changelog/123-new-change)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Updated changelog entry URLs to use slug-based identifiers instead of
numeric IDs for improved readability and SEO-friendliness, with
automatic redirects for existing links.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Reverts the pricing page flexibility/visibility A/B experiment from
#44293. We decided to keep the control (original pricing page).
**Changes:**
- `PricingPlansSection.tsx`: removed all experiment logic (PostHog flag
evaluation, exposure tracking, flexibility section)
- `PricingContent.tsx`: removed `PricingPageExperimentVariant` type
export
- `PricingPlans.tsx`: removed `experimentVariant` prop and all
variant-conditional rendering
- `telemetry-constants.ts`: removed `PricingPageExperimentExposedEvent`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Consolidated pricing page component variants and simplified the
component hierarchy by removing conditional experiment-dependent UI
branches.
* Removed pricing page experiment tracking and associated telemetry
event definitions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Replaced legacy "Anon"/"Service Role" key terminology with
"Publishable Keys" and "Secret Keys" across Edge Functions guides
* Updated authentication examples and request headers (client-side vs
server-side) to reflect publishable/secret key usage
* Standardized environment-variable examples to use parsed secret-key
maps with a selectable default
* Removed guidance for bypassing JWT verification via the deprecated CLI
flag
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Kalleby Santos <kalleby_santos@hotmail.com>
Splits the Edge Function secrets page into two sections so reserved
Supabase env vars are always visible, even on new projects without any
user secrets created.
<img width="1605" height="1006" alt="Screenshot 2026-04-29 at 12 20
43 PM"
src="https://github.com/user-attachments/assets/fc74f10e-557d-45bb-b0f0-66a706a9facb"
/>
**Added:**
- `DefaultEdgeFunctionSecrets` component — a read-only reference list
(Name + Description) of every `SUPABASE_*`, `SB_*`, and `DENO_*` env var
available in every project, sourced from [the
docs](https://supabase.com/docs/guides/functions/secrets#default-secrets)
- `isInternalEdgeFunctionSecret` helper used to filter the custom
secrets table
**Changed:**
- The custom secrets section now renders first (more actionable), with
the educational default secrets section below it
- Custom secrets table now filters out anything matching `SUPABASE_*` or
any of the hardcoded default names
**Removed:**
- `isReservedSecret` regex check + its tooltip branches in
`EdgeFunctionSecret.tsx` — dead code now that the custom table never
receives an internal secret
Addresses
[FE-3096](https://linear.app/supabase/issue/FE-3096/split-edge-function-secrets-into-internal-and-user-defined-views).
## To test
- Open `/project/_/functions/secrets` on a fresh project (no custom
secrets)
- "Default secrets" section is visible and lists all 9 env vars with
descriptions
- "Custom secrets" section shows the empty state
- Create a custom secret — appears in the Custom section, not the
Default section
- Edit/delete dropdown still works on custom secrets
- Search input only filters the custom secrets table
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a "Default secrets" section showing built-in edge-function
secrets with names, descriptions, and a "Deprecated" badge where
applicable.
* Secret names are clickable to copy to clipboard with a success
notification; secret names/values use inline code styling.
* UI now separates "Custom secrets" and "Default secrets" with distinct
empty states.
* **Bug Fixes**
* Edit/Delete controls reflect actual permission state (no longer
disabled for default/reserved secrets).
* **Tests**
* Added tests for default-secret detection and visibility rules.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update
## What is the new behavior?
Updates troubleshooting guide with additional context on why database
region change involves creating a new project and migrating data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Enhanced troubleshooting documentation to clarify that Supabase
projects are region-bound at the infrastructure level.
* Updated guidance on changing project regions to align with the
standard project migration workflow.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes two indefinite-article grammar errors where 'an' is used before a
consonant-starting word:
-
`apps/docs/content/troubleshooting/how-postgres-chooses-which-index-to-use-_JHrf4.mdx`:
"an traversable" → "a traversable"
- `apps/docs/content/guides/ai/examples/nextjs-vector-search.mdx`: "an
remote procedure" → "a remote procedure"
Pure docs grammar fix — no functional changes.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Fixed a grammar typo in the AI vector search guide to improve clarity
in the “Perform similarity search” step.
* Normalized trailing whitespace in the PostgreSQL indexing
troubleshooting guide’s “Postgres internals” table to tidy formatting
and ensure consistent display.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Updates humans.txt to include my name.
## What is the current behavior?
N/A
## What is the new behavior?
N/A
## Additional context
N/A
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added new team member to the contributor list.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Instructed granting least-privilege table permissions for anon,
authenticated, and service roles prior to enabling Row Level Security
across multiple guides and quickstarts.
* Clarified SQL examples and inline comments, added explicit GRANT steps
and RLS SELECT policies, rephrased policy guidance, and adjusted example
ordering and section numbering for clearer setup and testing.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Updates the Auth Signing Keys and JWTs pages to align on the new keys
while still leaving the relevant information about the legacy keys until
post-deprecation.
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
Updates the marketplace DB query to use the new `publish_dashboard`
column that was added in https://github.com/supabase/marketplace/pull/49
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated internal marketplace integration query and database type
definitions to streamline listing management logic.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Add `SUPABASE_JWKS` to the default secrets list, noting it matches the
public JWKS endpoint
- Update the example in "Accessing environment variables" to use
`SUPABASE_PUBLISHABLE_KEYS` / `SUPABASE_SECRET_KEYS` (matches the
pattern in `functions/auth.mdx`)
- Add an inline note that `'default'` can be swapped for another key
name
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Documentation**
* Updated Edge Functions secrets guide with improved code examples.
* Introduced `SUPABASE_JWKS` environment variable for JWT verification.
* Enhanced examples demonstrating environment variable configuration and
Supabase client initialization.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Cleanup.
## What is the current behavior?
Temporary access still has a couple of leftover JIT fallback messages
and an unnecessary local unavailable-reason type after the Platform
response types were split into `JitAccessResponse` and
`JitStateResponse`.
## What is the new behavior?
Studio relies on the generated `JitStateResponse` discriminated union
for the toggle warning and uses temporary access copy consistently in
the remaining fallback toasts.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Improvements**
* Refined error messaging for temporary database access grant and revoke
operations.
* Enhanced condition detection for toggle failure warnings in database
access configuration.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<img width="2652" height="830" alt="image"
src="https://github.com/user-attachments/assets/3c3921e7-c255-4e59-a9c3-c5f97da87788"
/>
Adds a full screen alert behind a feature flag `projectNeedsSecuring`
that prompts for fixing RLS issues.
Adjusts a few other small styles to add more prominence to critical
advisor issues.
To test:
- Enable the flag
- Make sure you have a table with RLS disabled
- Open project home and note the fade in of full page review
- Click "copy prompt" or "fix" and note the prompt
- Click skip to home and refresh the page, note it doesn't appear
anymore
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Project-level security gate on project home with AI assistant prompts,
table details, per-project dismissible notice, and a new telemetry event
for CTA interactions.
* **Improvements**
* Stronger visual treatment for critical advisor items and advisor CTA
when critical issues exist.
* Assistant dropdown supports a copy-prompt callback; added
local-storage key and utilities/types to support project security
workflows.
* **Tests**
* Added tests covering gate behavior, navigation, and dismissal logic.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
The Realtime policies editor was showing a warning banner on
`realtime.messages` saying the schema isn't exposed through PostgREST.
This is incorrect — the `realtime` schema is intentionally excluded from
PostgREST (it's in `INTERNAL_SCHEMAS` and filtered out of the exposed
schema picker), so the warning is always false in this context.
**Changed:**
- Removed `useProjectPostgrestConfigQuery` from `RealtimePolicies` — it
was only used to derive `exposedSchemas`
- Hardcode `exposedSchemas` as `['realtime']` since this editor is for
Realtime auth, not PostgREST access
## To test
- Go to the Realtime policies editor (`/project/_/realtime/policies`)
- Confirm the yellow "schema not exposed" warning banner no longer
appears on `realtime.messages`
- Confirm policy rows still render correctly and other admonitions (e.g.
publicly-readable if RLS is off) still show as expected
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved stability of Realtime Policies schema handling by simplifying
configuration logic to consistently use the realtime schema.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
## Summary
Wires up database advisor rule `0012_auth_allow_anonymous_sign_ins` in
the Studio Linter so it shows up with the right title, icon, action
link, and docs link instead of falling back to a generic display.
The rule entry navigates to `/auth/providers` (where the "Allow
anonymous sign-ins" toggle lives), modeled after rule 0019
(`auth_otp_long_expiry`) which uses the same target.
## Test plan
- [x] Trigger rule 0012 on a test project (enable anonymous sign-ins on
a project with RLS-protected tables)
- [x] Verify the lint appears in Security Advisor with title "Anonymous
Sign-Ins Allowed" and User icon
- [x] Verify the "View settings" CTA navigates to
`/project/<ref>/auth/providers`
- [x] Verify the "Learn more" link points to the 0012 docs section
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a new authentication lint rule that identifies anonymous sign-in
configuration issues and provides integrated guidance to the auth
providers settings page with relevant documentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Refactor of the pg-meta test setup scripts.
## What is the current behavior?
The test command runs multiple sequential npm-run-s scripts (`db:clean`,
`db:run`, `test:run`, `db:clean`) with a hardcoded port 5432, causing
container name and port collisions when running tests across multiple
git worktrees in parallel.
## What is the new behavior?
A single `test/run-tests.sh` wrapper script handles the full test
lifecycle: it finds an available port dynamically (scanning 5432–5531),
sets a unique Docker Compose project name based on a hash of the package
directory path, starts the DB, runs the test command, and tears down on
exit. This allows pg-meta tests to run in parallel across multiple
worktrees without conflicts.
## Additional context
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Streamlined test execution to centralize setup and teardown for
reliable runs.
* Made the test database port configurable with automatic local port
discovery and fail-fast behavior.
* Created isolated test environments per workspace to avoid
container/name collisions and improve cleanup.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the CONTRIBUTING.md file.
YES
## What kind of change does this PR introduce?
Bug fix
## What is the current behavior?
When updating a table with `replica_identity = 'INDEX'`, it is possible
to omit the `replica_identity_index`.
This results in invalid SQL being generated:
`REPLICA IDENTITY USING INDEX`
PostgreSQL requires an index name for this operation.
No existing issue found. This PR fixes a validation gap discovered
during development.
## What is the new behavior?
- Throws an error if `replica_identity` is set to `INDEX` without
providing `replica_identity_index`
- Ensures generated SQL is always valid
## Additional context
- Added validation in `pg-meta-tables.ts`
- Added test case to verify an error is thrown when the index name is
missing
This aligns pg-meta behavior with PostgreSQL requirements for `REPLICA
IDENTITY USING INDEX`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Enhanced validation for database replica identity configuration to
prevent incomplete or invalid configurations.
* **Tests**
* Added test coverage for replica identity validation scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Fixes
[FE-3095](https://linear.app/supabase/issue/FE-3095/compute-size-hover-card-shows-badge-and-cpumemory-from-out-of-sync).
The compute size hover card on the project home dashboard was sourcing
its badge and its CPU/memory rows from two different cached responses,
which can disagree:
| Field shown | Previous source |
|---|---|
| Badge ("XLARGE") | `project.infra_compute_size` (project-detail query)
|
| Cores / memory | `selected_addons[compute_instance].variant.meta`
(project-addons query) |
A customer reported seeing an **XLARGE** badge next to **2-core ARM
(Shared) / 1 GB** — the micro-tier specs — and asked whether their
upgrade had actually been applied. The upgrade was applied; only the
rendered card was contradictory.
## Fix
Source both the badge and the CPU/memory rows from the same logical
fact: look up the variant in `available_addons` whose identifier matches
`ci_${infra_compute_size}` and read its `meta`. `available_addons` is
essentially a static catalog of variant specs, so once it's loaded the
card cannot show specs that disagree with the badge.
This also collapses the special-cased `INSTANCE_MICRO_SPECS` fallback
into the existing `getAvailableComputeOptions` helper (which already
provides micro/nano fallbacks). The nano UX text ("Shared / Up to 0.5
GB") is preserved by switching that JSX branch to key on `computeSize
=== 'nano'`.
## Out of scope
- `useProjectAddonUpdateMutation` does not invalidate
`projectKeys.detail`. That's hygiene worth doing later, but
project-detail has a 30s `staleTime` and the resize already drives 5s
polling via the `RESIZING` status path, so the badge refreshes naturally
and this fix doesn't depend on it.
## Test plan
- [ ] Hover the compute badge on a project at each compute size (nano,
micro, small, ..., 16xlarge) and confirm CPU and memory rows match the
badge.
- [ ] Resize a project from micro → large; on completion, confirm the
hover card shows large specs (no transient micro values).
- [ ] Open the dashboard for a free-tier project on micro that has no
`compute_instance` entry in `selected_addons` and confirm the card still
shows micro specs (i.e. `getAvailableComputeOptions` micro fallback is
engaged).
- [ ] Confirm the "Unlock more compute" CTA still appears for
non-highest sizes and disappears at the highest size.
## Context
As per PR title - will make the RLS tester available for CLI / self-host
(still as a feature preview)
## To test
- [x] Verify briefly locally that the RLS tester is available for use,
and works as expected
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved user search error handling to display appropriate failure
messages when search encounters issues.
* **Refactor**
* Simplified RLS Tester feature availability logic by consolidating
enablement checks across components and removing redundant feature flag
dependencies.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update
## What is the current behavior?
Current docs are wrong and yield `ERROR: parameter "pg_net.ttl" cannot
be changed now`
## What is the new behavior?
Additional permissions required, setting should be at the system level
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated pg_net setup guidance to require system-level configuration,
added note that changing pg_net parameters requires superuser privileges
(with grant example), and clarified applying parameter changes via
system-level set followed by restarting the pg_net background worker.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Nimbus search is broken because it expects the page section to be joined
with the page table, but this table is called page_nimbus in Nimbus
mode.
Resolves AI-682
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed source reference attribution to use the correct path when using
the alternate search index option.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Feature — a second batch of table editor shortcuts, stacked on top of
#45178.
## What is the current behavior?
Inserts / filters / sort / refresh are all mouse-only. No keyboard
access, and no affordance for discovering what keybinds might exist.
## What is the new behavior?
### New shortcuts
| Keybind | Action | Surface |
|---|---|---|
| `I` then `R` | Insert row | hotkey + Cmd+K + inline keybind in Insert
dropdown |
| `I` then `C` | Insert column | hotkey + Cmd+K + inline keybind in
Insert dropdown |
| `I` then `U` | Import data from CSV | hotkey + Cmd+K + inline keybind
in Insert dropdown |
| `Shift+F` | Focus filters | hotkey + Cmd+K — focuses the new filter
bar's freeform input |
| `F` then `C` | Clear filters | hotkey + Cmd+K — gated on
`filters.length > 0` |
| `S` then `C` | Clear sort | hotkey + Cmd+K — gated on `sorts.length >
0` |
| `Shift+R` | Refresh table | hotkey + Cmd+K + hover tooltip on the
Refresh button |
All are `ignoreInputs: true` so they don't fire while typing. The insert
/ clear-filters / clear-sort shortcuts use two-step chords so they don't
clobber single-letter keys users might reach for elsewhere; Focus
filters and Refresh keep their Shift-prefixed single-step bindings.
### Infrastructure
- **New `<ShortcutBadge>`** (`components/ui/ShortcutBadge.tsx`) — inline
keybind display. Reads the sequence straight from the registry, so the
ID is the single source of truth. Renders multi-step chords with a
"then" separator between steps. Defaults to `variant="inline"` (the flat
`text-foreground/40` style used across the app in `RunButton`,
`ActionBar`, `OperationQueueSidePanel`, etc.) with `variant="pill"`
available if someone needs the boxed style.
- **Insert dropdown restyled** — each `DropdownMenuItem` in
`HeaderNew`'s Insert menu now shows its keybind inline on the right
(centered vertically, with `pr-4` + `shrink-0` so long table names in
the description never crowd the badge).
- **`RefreshButton`** swapped from `ButtonTooltip` to `<Shortcut>` so
the keybind tooltip renders automatically from the registry.
- **`FilterPopoverPrimitive` untouched** — the old filter bar is being
deleted, so Shift+F is scoped to the new filter bar only. The handler
focuses `[data-testid="filter-bar-freeform-input"]` (the existing
freeform input in the ui-patterns `FilterBar` → `FilterGroup`).
## Additional context
Stacked on #45178 (FE-3057 — initial table editor shortcuts). Rebase
after that one merges.
### Test plan
- [x] Open a table → Insert dropdown shows keybind to the right of each
item, no wrap encroachment even with long table names
- [x] `I` then `R` opens the Row editor; `I` then `C` opens the Column
editor; `I` then `U` opens the CSV import flow
- [x] `Shift+F` focuses the new filter bar's freeform input
- [x] Add a filter → `F` then `C` clears it; shortcut disabled in Cmd+K
when no filters are applied
- [x] Sort a column → `S` then `C` clears sort; shortcut disabled when
no sorts
- [x] `Shift+R` refreshes the table (spinner shows on the Refresh
button); hover the button → keybind tooltip
- [x] All seven new entries show up in Cmd+K when their gates are
satisfied
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added keyboard shortcuts for table actions: insert row, insert column,
import CSV, refresh, focus filters, clear filters, and clear sorts.
* Shortcuts are available in the command menu and show visual keyboard
hints.
* **UI**
* Menu entries now display shortcut badges.
* Refined dropdown spacing/layout and updated the refresh control to
surface its shortcut.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Improve the "Errors since last deploy" panel on the new edge function
overview page.
- **Error column**: stop showing the function URL. Pull the actual error
from the related runtime logs, trim the stack trace to a one-line
summary, and use that for the cell text and tooltip.
- **Troubleshoot column**: rename "Assistant" to "Troubleshoot" and add
a "View troubleshooting guide" item to the dropdown that opens
`supabase.com/docs/guides/troubleshooting` prefilled with `edge function
<ErrorType> <statusCode>`.
- **Runtime log block**: restyle the expanded per-row log section.
Monospace rows with structured timestamp / level badge / count /
message, a divider between entries, and destructive tinting only on
error rows. The previous layout ran text together with no separation.
## Test plan
- [x] `pnpm test:studio` for `EdgeFunctionRecentErrors.utils.test.ts`
(10 passing, including new cases for `summarizeErrorMessage`,
`getDisplayErrorMessage`, and `buildTroubleshootingDocsUrl`)
- [x] `pnpm typecheck` clean
- [x] `eslint` clean for changed files
- [ ] Visual check of the panel: Error cell shows the runtime error
summary, Troubleshoot dropdown opens docs in a new tab, log rows render
with the new structure
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a "View troubleshooting guide" action that opens a
status-code-specific docs page for each recent error.
* Errors now show level badges and repetition counts in the logs for
clearer scanning.
* **Bug Fixes**
* Error text is summarized and normalized for concise, single-line
display with clearer per-line styling.
* **Tests**
* New tests validate error-summary, display-fallback, and
troubleshooting-URL behaviors.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Feature — a set of new keyboard shortcuts for the table editor, along
with infrastructure to register, gate, and surface them.
## What is the current behavior?
Clicking into the grid "traps" the keyboard: Escape doesn't pop out,
there are no shortcuts for row selection / deletion / navigation, and
the search-tables input grabs focus on page load.
## What is the new behavior?
### New shortcuts (all scoped to the table editor)
| Keybind | Action | Surface |
|---|---|---|
| `Esc` | Exit grid selection — clears the highlighted cell and drops
focus back to the page | hotkey |
| `↑` / `↓` | Start grid navigation from the first cell when no cell is
selected | hotkey |
| `Shift+Space` | Toggle selection on the current row | hotkey +
checkbox tooltip |
| `Mod+A` | Toggle selection on all displayed rows (matches Excel) |
hotkey + header-checkbox tooltip + Cmd+K |
| `Mod+Shift+A` | Toggle selection on all rows in the table | hotkey +
"Select all rows in table" button tooltip + Cmd+K |
| `Mod+Backspace` | Delete selected rows | hotkey + delete-button
tooltip + Cmd+K |
### Infrastructure
- **Split registry** — table-editor shortcuts moved to
`state/shortcuts/registry/table-editor.ts`, spread into `SHORTCUT_IDS`.
Makes it easy to scope a runtime check to a specific surface.
- **`eventMatchesAnyShortcut`** (`state/shortcuts/matchEvent.ts`) —
queries the hotkey library's live `SequenceManager` so gated shortcuts
(`enabled: false`) are correctly excluded. Covered by
`matchEvent.test.ts`.
- **`handleCellKeyDown`** now calls `event.preventGridDefault()`
whenever the keystroke matches an active table-editor shortcut, so rdg's
"start editing on key press" default doesn't compete with shortcut
actions (e.g. typing `Shift+X` no longer opens edit mode with `X` as
input).
- **`<Shortcut>` / `<ShortcutTooltip>`** used on the header checkbox,
the per-row checkbox, the "Select all rows in table" button, and the
delete button — keybinds show up on hover (Linear-style) so users can
discover them without reading docs.
- **CSS** — `.rdg:not(:focus-within) .rdg-cell[aria-selected='true']`
drops the selected-cell outline whenever focus leaves the grid,
reinforcing the "you're out" feedback after `Esc`.
- **`useShortcut`** wraps the Cmd+K-registered action to close the
command menu after firing (previously menu stayed open after selecting
an action).
- **Search-tables input** no longer auto-focuses on load, so arrow
shortcuts work immediately without clicking out first.
## Additional context
Linear: FE-3057
### Test plan
- [x] Open any table → `↓` selects the first cell; subsequent arrows
navigate rows
- [x] `Esc` drops focus out of the grid and re-enables `↓` to re-enter
- [x] Click a cell → `Shift+Space` toggles that row's selection
(checkbox)
- [x] `Mod+A` toggles all displayed rows
- [x] With pagination + some rows selected → `Mod+Shift+A` toggles
"Select all rows in table"
- [x] With rows selected → `Mod+Backspace` deletes them (existing
confirmation flow)
- [x] Hover the header checkbox / per-row checkbox / delete button →
keybind tooltip after ~500ms
- [x] Cmd+K with selection → the relevant action shows up; selecting it
closes the palette and runs
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added table editor keyboard shortcuts for navigation, row selection,
and cell actions, with command-menu integration and visible shortcut
tooltips.
* **Improvements**
* Better keyboard handling in grid cells allowing external shortcuts to
override default behavior.
* Select-all/deselect-all toggle and improved select-row UX;
selected-cell styling no longer shows when grid loses focus.
* Command menu now reliably closes before executing shortcut actions.
* Removed autofocus on the table editor search input for consistent
focus behavior.
* **Tests**
* Added unit tests covering shortcut matching and command-menu shortcut
behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
humans.txt update
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated team roster information.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Ryan Senior <ryan@Ryans-MacBook-Pro.local>
Ivan Vasilov