## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update.
*
https://docs-git-docs-wire-server-v1-reference-supabase.vercel.app/docs/reference/server/introduction
*
<img width="417" height="628" alt="Screenshot 2026-07-06 at 6 13 33 PM"
src="https://github.com/user-attachments/assets/9fc27b04-038b-4434-8855-94051f898b5d"
/>
## What is the current behavior?
`@supabase/server` has no reference documentation page in the Supabase
docs. The library publishes a TypeDoc spec to GitHub Pages but the docs
pipeline was not wired up to consume it.
## What is the new behavior?
- Adds `spec/reference/server/v1/` with a `config.json` (category order:
Middleware, Primitives, Adapters, Errors, Types) and `partials/` for the
introduction and installing pages.
- Adds a `download.server.v1` Makefile target that fetches
`https://supabase.github.io/server/spec.json` into
`spec/reference/server/v1/server.json`, and wires it into the top-level
`download` target so it runs with the rest.
- Registers `server-v1` in `SUPPORTS_NEW_REFERENCE_PROCESS` so the build
pipeline picks up the new spec directory and generates
`content/reference/server/v1/` at build time.
- Seeds the generated `docs/ref/server/` partials (introduction and
installing) that the reference router serves.
## Additional context
The TypeDoc spec is produced by `@supabase/server`'s `docs.yml` workflow
on every push to `main`, so `make download.server.v1` will always pull
the latest published API surface. The companion PR in the server repo
([supabase/server#95](https://github.com/supabase/server/pull/95)) adds
the `@category` tags that the pipeline requires for symbols to appear in
navigation.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a new **Server SDK** item under **Reference**, linking to
`/reference/server` and marked with a **New** badge.
* Published **Server Reference v1** documentation for
`@supabase/server`, including **Introduction** and **Installing** pages.
* **Chores / Improvements**
* Enhanced the reference documentation generation to include Server v1
content.
* Improved reference detail handling (including clearer TypeDoc output
such as **Deprecated** notes).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## Problem
Screen reader users don't need to be told how to use a button: _Press
Enter to copy project name_
## Solution
Simplify the button labels: _Copy project name_
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Accessibility**
* Updated screen-reader text in the dropdown menu so uncopied items now
announce “Copy” more clearly, improving clarity for assistive technology
users.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The _Copy_ button is difficult to understand for screen reader users:
- They don't know what it copies
- They have no clear indication about what each dropdown item does
- They have no confirmation a value has been copied to their clipboard
## Solution
- Make sure the button that triggers the popover has a clear label for
screen readers
- Make sure each item has a clear label: _Press Enter to copy ..._
- Make sure each item label changes to confirm the value has been copied
## How to test
- Activate the OS VoiceOver
- Navigate to a project home page
- Tab to the _Copy_ button. It should announce _Copy project URL and API
keys_
- Press Enter then use Arrow keys to move through the items. It should
announce _Press Enter to copy_ the item label
- Press Enter to copy an item. It should announce item label _Press
Enter to copy_
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved clipboard copy feedback so the “copied” state now resets when
the popover closes, making copy confirmations more consistent.
* Enhanced accessibility for copy actions by refining screen-reader text
to indicate whether an item is ready to copy (“Press Enter to copy”) or
has already been copied.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Feature / content update to the Legal Hub (`apps/www`).
## What is the current behavior?
The `/legal` hub page (`apps/www/pages/legal/index.tsx`) has a single
section, "Partner Legal Resources." The customer-facing legal documents
(Terms of Service, Support Policy, Service Level Agreement) are only
reachable from the footer "Company" column, which is cluttered.
## What is the new behavior?
- Adds a new **"Customer Legal Resources"** section to the `/legal` hub,
placed **above** "Partner Legal Resources," with links to:
- Terms of Service → `/terms`
- Support Policy → `/support-policy`
- Service Level Agreement → `/sla`
These use the same formatting (document icon + link) as the existing
"Master Partner Program Agreement" entry.
- Removes those same three links (Terms of Service, Support Policy,
Service Level Agreement) from the footer **"Company"** column
(`apps/www/data/Footer.ts`) to declutter it. The "Legal" hub link,
Privacy Policy, Privacy Settings, and Acceptable Use Policy all remain.
The `/terms`, `/support-policy`, and `/sla` URLs are unchanged and
continue to operate exactly as they do today — this only changes where
they're surfaced in navigation.
Note: per discussion, the hidden `/enterprise-terms` page was
intentionally **not** linked from the public hub; it remains
`noindex/nofollow` and reachable only by direct URL.
## Additional context
Visual result (Customer section above Partner section, three matching
links) and footer cleanup match the requested design. No routing,
redirect, or page-content changes.
---
_Generated by [Claude
Code](https://claude.ai/code/session_015kQyGkM9s9XEbA3HSLpeku)_
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a **“Customer Legal Resources”** section to the legal resources
page with links to **Terms of Service**, **Support Policy**, and
**Service Level Agreement**.
* **UI Updates**
* Updated the legal page branding from **“Legal”** to **“Legal Hub”**
and adjusted the layout to a more spacious two-column presentation.
* Updated the footer **Company** links by replacing **“Legal”** with
**“Legal Hub”** and removing the Terms/Support/Service Level links from
that set.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude <noreply@anthropic.com>
## Summary
- Fix unreadable "Large ranges may result in memory errors" warning text
in the Logs date picker — a stray `text-warning-foreground` class (dark
ink) was winning over `text-warning` on the dark `bg-warning-300` fill.
- Fix "Search collections..." sidebar wrapper background mismatch —
`bg-background-200` now resolves to the elevated `--card` surface
instead of `--background`, so it no longer matches the sidebar's
`bg-dash-sidebar`.
- Fix the Unified Logs "Live" toggle button rendering blue text instead
of white when active — a leftover `border-info text-info` override was
fighting the `primary` variant's own text color, now that `--info`
resolves to a more distinct blue.
All three are contrast/color regressions surfaced by the recent
design-system color token changes.
## Test plan
- [ ] Open a project's Logs Explorer, pick a large date range, confirm
the warning text is readable
- [ ] Check the Logs sidebar "Search collections..." box background
matches the rest of the sidebar in both light and dark mode
- [ ] Toggle "Live" mode in Unified Logs and confirm the button text is
white/legible on the green background
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Updated the large-range warning banner appearance in Logs settings.
* Refined the Logs sidebar header background styling for a more
consistent look.
* Simplified the DataTable live button styling behavior by removing
conditional class composition while preserving the existing live-mode
visuals.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
- Cleaning of partial affecting all frameworks first steps for database
setup.
- Removed unnecessary and somehow broken accordion.
- Improved copy.
- Removed unnecessary button.
As a result instruction for both LLMs and humans are inline, though
encoded link is not produce, the instructions are below for agents to
pick.
<img width="889" height="797" alt="Screenshot 2026-07-06 at 17 27 22"
src="https://github.com/user-attachments/assets/91a4fda0-5be9-4452-bcf9-93540f4c88f7"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Simplified the “Set up your database” quickstart into a clearer,
single-step flow.
* Embedded the complete setup SQL directly in the guide for easy
copy/paste.
* Replaced the prior prefill button and accordion/manual steps with a
tip containing a prefilled-SQL link, plus optional guidance to run the
SQL as needed.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## Problem
People using screen readers can't find how to navigate back to the
organization dashboard.
## Solution
- Add an invisible label for screen readers
- Add a tooltip for all users
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a tooltip to the home navigation icon on hover (“Back to
organization home”).
* Enhanced app layout dropdowns to accept custom trigger content,
improving accessibility with updated labels for branches, organizations,
and projects.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
docs update
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the site’s public people listing to include Barry Roodt in the
team section.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
https://github.com/user-attachments/assets/fba86c42-a122-4eb5-8531-db663d022100
Makes a few style and content changes focused on our quickstarts,
starting with
- docs/guides/getting-started/quickstarts/reactjs
- docs/guides/getting-started/quickstarts/nextjs.
Changes
- Reduced container size and increased x padding for more breathing room
- Adjusted header padding and spacing
- Stripped non critical content from guides
- Merged steps where possible e.g. one sql blocks to run instead of
multiple
- Moved shadcn/supabase ui components into a next step
- Introduced a step for installing agent skills (in future can be
plugin)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated multiple quickstarts to add an **“Open Connect panel”**
primary action for environment-variable setup.
* Removed extra UI CTA partials from several “Query” sections.
* Added **Next steps** links to drop-in UI components and extended the
database flow with an optional **agent skills** step.
* **UI / Guide Layout**
* Refreshed guide spacing/typography (breadcrumb spacing, header
margins, and removed subtitle divider).
* Adjusted guide/table-of-contents sizing and tightened step/details and
code section alignment.
* Updated main layout width and padding for docs pages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added new public MCP base URL environment variables for hosted and
self-hosted setups.
* Introduced reusable MDX components to render custom MCP configuration
content.
* **Documentation**
* Updated the MCP guide to reference shared MCP server template values
for examples.
* Swapped the CI configuration example for a component-rendered snippet
for consistency.
* **Bug Fixes**
* Improved self-hosted MCP base URL fallback so it prefers the new
non-platform URL when no custom API URL is provided.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
## Description
Fix typo in URL: `RLS-Perfomance` → `RLS-Performance` in troubleshooting
documentation.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Corrected a broken link in the troubleshooting documentation so the
“Sample results” section now points to the proper page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
UI bug fix
## What is the current behavior?
After the colour system migration (#47288), `--warning-default` was
removed in light mode in favour of the semantic `--warning` token.
Several studio call sites still referenced
`hsl(var(--warning-default))`, which resolves to an invalid colour in
light mode.
This caused warning segments in stacked bar charts (e.g. Realtime on
project overview v2) to render black instead of amber, with missing
tooltip swatches. The colour appeared to "fix itself" on hover because
the dimmed state used `--warning-500`, which is still defined.
## What is the new behaviour?
Studio consumers that referenced the removed token now point at tokens
that still resolve in light mode. Chart warnings use new app-level
`--chart-warning` / `--chart-warning-muted` variables (stepped scale,
theme-aware) rather than the removed `--warning-default`.
We only update **Studio app consumers** that were still calling the old
token:
- `LogsBarChart` → `--chart-warning` tokens
- `apps/studio/styles/globals.css` → defines those chart tokens + fixes
`--sidebar-primary-foreground`
- A handful of chart/tooltip call sites in Studio
(`EdgeFunctionOverview`, `UnifiedLogs`, etc.)
- Table editor dirty cell text → `--warning-600` (still on the stepped
scale)
## To test
Use a hosted project that already has warnings on project home (e.g.
Realtime with a non-zero warnings count). Switch Studio to **light
mode**.
1. Open **Project home** (`newHomepageUsageDeltas` flag enabled).
2. Find a service card with warnings in **Project usage**.
3. Confirm warning bar segments are amber/orange (not black), tooltip
swatches show amber, and hover does not flip them black.
4. Quick dark mode sanity check. Should look unchanged.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Standardized warning-series and highlight colors across charts, logs,
countdown timers, and interface indicators using the shared theme tokens
(`--chart-warning` / `--chart-warning-muted`).
* Refreshed warning-related theme wiring for both light and dark modes,
including sidebar foreground color.
* **Bug Fixes**
* Updated “dirty” table cell text color to align with the revised
warning palette.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Added a landing page for Vercel Ship Sydney
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a new contest landing page for Vercel Ship Sydney 2026 with
event details, entry steps, and a sign-up form.
* Added a thank-you page with confirmation messaging and quick links to
the dashboard and Supabase.
* Included the new contest pages in the site’s marketing page list,
making them live for the event.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Previously, uncaught permission errors were bubbling up and preventing
the marketplace UI from rendering at all. This is a problem because
users might have access to the integrations tab, but not permissions to
view all the connected resources on a particular integration. In that
scenario, we want to degrade gracefully and show them only those
resources they have access to.
Closes DOCS-1087
<img width="1493" height="688" alt="Screenshot 2026-06-30 at 4 50 52 PM"
src="https://github.com/user-attachments/assets/39267c8a-befb-4419-8fa8-4e987f82781e"
/>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## Problem
The Network Restrictions docs contain an incorrect curl example that,
when followed, restricts the entire database instead of adding only the
specified IP/CIDR — causing production outages for users.
## Solution
Fix the incorrect curl command in the Network Restrictions docs so that
it correctly adds only the specified CIDR rather than restricting the
entire database.
This PR solves the problem by adding an `--append` CLI procedure.
Additionally, the document is improved:
- All procedures are put in procedure format for easier readability and
clear action steps
- Wording is simpler
- Headers follow convention
- A "This topic..." intro paragraph is added
## Tophatting
1. Go to the preview link at
`/docs/guides/platform/network-restrictions`.
2. Verify that the new `--append` section corrects the original issue.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Reworked the network restrictions guide into clearer “dashboard” and
“CLI” setup flows.
* Expanded the intro with IPv4/IPv6 CIDR allowlisting guidance,
including exceptions for IPv6 migration extensions and when the IPv4
add-on is installed.
* Updated the CLI instructions with structured examples for checking,
replacing, appending, and fully removing restrictions (including the
“never applied” case when allowed lists are empty).
* Clarified scope/limitations: restrictions apply to Postgres and its
pooler (not HTTPS APIs or client libraries), and enabling restrictions
blocks Edge Function direct database access.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>
Co-authored-by: Jeremias Menichelli <jmenichelli@gmail.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix.
## What is the current behavior?
In the docs site, **bold** text inside `.prose` content no longer
renders as bold — it is indistinguishable from normal body text in light
mode, and only a faint step heavier in dark mode.
Root cause: the recent font work added a docs-only rule in
`apps/docs/styles/globals.css`:
```css
.prose :where(p, a, code, pre):not(...),
.prose :where(ol > li):not(...)::marker {
font-weight: inherit;
}
```
This makes prose body text inherit the page base weight set on `html`
(`font-weight: 500` in light, `450` in dark). But the shared typography
config (`packages/config/typography.config.js`) defines `strong: {
fontWeight: '500' }`. So:
- **Light mode:** body copy is now `500` and `<strong>` is also `500` →
bold is visually identical to normal text.
- **Dark mode:** body copy is `450` vs `<strong>` `500` → barely
perceptible.
This is docs-specific: the other apps (`www`, etc.) never added the
`font-weight: inherit` override, so their prose body stays at `400` and
`strong: 500` still reads as bold. Changing the shared config would
over-bolden those apps, so the fix is scoped to the docs stylesheet.
## What is the new behavior?
Adds a docs-scoped override keeping bold text clearly heavier than the
inherited body weight:
```css
.prose :where(strong, b):not(:where([class~='not-prose'], [class~='not-prose'] *)) {
font-weight: 600;
}
```
`<strong>`/`<b>` now render at `600`, giving clear contrast against the
`500`/`450` body weight in both light and dark modes, and matching the
semibold weight used by prose headings. The other apps are untouched.
## Additional context
- Single-file change in `apps/docs/styles/globals.css`.
- Uses the same `:where(... :not(.not-prose) ...)` pattern as the
surrounding prose rules to preserve `not-prose` opt-outs and keep
zero-specificity behavior.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_01RaT19RpEWwDFtzmVwmsPHo
---
_Generated by [Claude
Code](https://claude.ai/code/session_01RaT19RpEWwDFtzmVwmsPHo)_
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved documentation typography so emphasized (bold) text is more
clearly distinguishable from regular body copy.
* Added a targeted prose styling override for `strong`/`b` to ensure
consistent bold weight, while preserving sections that opt out of prose
styling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Miranda Limonczenko <miranda.limonczenko@supabase.io>
## Problem
The per-service logs pages (e.g. `/project/[ref]/logs/auth-logs`)
crashed with `RangeError: Invalid time value` (Sentry issue 7580074952).
`calcChartStart` guarded `iso_timestamp_start` only against falsy
values, so a truthy-but-unparseable timestamp (a malformed value in the
URL query params) produced an Invalid Date, which propagated through
`.add()` and threw when `startOffset.toISOString()` was called.
The bug is on the legacy (non-OTEL) chart query path. The OTEL bucket
helper had the same unguarded pattern; it did not crash but could skew
the chart bucket size.
## Fix
Validate parsed timestamps with `dayjs().isValid()` and fall back to
now, matching the existing empty-param behavior. Applied to both
`calcChartStart` (legacy) and `otelChartTruncFn` (OTEL).
- Valid params produce identical output (existing tests unaffected)
- Empty params still fall back to now
- Malformed input no longer throws
Added regression tests to `Logs.utils.test.ts` and
`Logs.utils.otel.test.ts`.
## How to test
- Run the logs unit tests: `pnpm test:studio` (or target
`Logs.utils.test.ts` and `Logs.utils.otel.test.ts`)
- In the dashboard, open a service logs page with a malformed timestamp
in the URL, e.g. `/project/<ref>/logs/auth-logs?its=not-a-date`
- Expected result: the page renders without crashing and the chart falls
back to the default (now-based) time range
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved log chart time-range handling by safely resolving missing or
invalid ISO timestamps via a shared timestamp resolver.
* Updated chart bucketing and timestamp conflict logic to use the
resolved endpoints, preventing errors and ensuring correct fallback
granularity (including minute-level bucketing when needed).
* **Tests**
* Added regression coverage to confirm chart query generation (including
OTEL queries) does not throw for unparseable start/end timestamps.
* Verified fallback behavior to minute-level bucketing and non-throwing
behavior for timestamp conflict handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Adds a PR-time reminder to mirror any edit to `apps/studio/pages/**`
into the corresponding `apps/studio/routes/**` file, since the Next.js
pages router and the TanStack Start route tree ship side-by-side during
the migration and can silently drift.
**Added:**
- A CodeRabbit `path_instructions` rule (`.coderabbit.yaml`) scoped to
`apps/studio/pages/**` that prompts authors to check whether a page
change needs mirroring into `routes/**`. It encodes the migration's
nuance so it isn't noise — pure body edits on re-export (Path A) pages
propagate automatically, but layout/`getLayout`, `staticData` props,
`withAuth`, redirect-path, or new-page changes must be mirrored by hand.
Framed as verify-not-block, and explicitly tells authors *not* to delete
the `pages/**` file.
**Changed:**
- `apps/studio/TANSTACK_MIGRATION.md` — documents the guardrail under
the Runtime model section, and adds a cleanup-checklist line to remove
it once `pages/**` is deleted (FE-3106).
This is temporary scaffolding — it comes out with the final `pages/**`
cleanup pass.
## To test
- This needs to land on `master` first, then open a throwaway PR that
touches a file under `apps/studio/pages/**` and confirm CodeRabbit
leaves the reminder comment.
- `path_instructions` can be flaky — if CodeRabbit doesn't fire
reliably, the fallback is a GitHub Action + sticky PR comment scoped to
`paths: ['apps/studio/pages/**']`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added migration guidance for Studio page changes to help keep mirrored
routes in sync during the transition period.
* Clarified when page updates need to be reflected in the matching route
files, including new pages and changes to layout, access control,
titles, static data, or paths.
* Added a cleanup reminder for removing the temporary review guidance
once the migration is complete.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Updates the dashboard disk-management copy to match the new AWS EBS
modification limits (already reflected in the docs): from the old fixed
"4-hour cooldown / once every 4 hours" framing to "up to 4 modifications
within a rolling 24-hour window".
This is a copy-only change plus one small logic-constant alignment.
Timer/countdown behavior is unchanged — this only updates wording to
bring the dashboard in line with the docs.
**Changed:**
- `DiskSpaceBar` autoscaling tooltip, `DiskCountdownRadial` card,
`DiskSizeConfiguration` "Importing a lot of data?" alert,
`DiskSizeConfigurationModal` alert title + both countdown branches,
`DiskManagementReviewAndSubmitDialog` IOPS + disk-size row descriptions,
and two code comments — all reworded to the new "4 per rolling 24-hour
window" framing
- `DiskSizeConfigurationModal` countdown now derives from the shared
`COOLDOWN_DURATION` constant (4h) instead of a stale hardcoded `6 * 60`
(6h), so the legacy resize path matches the newer disk-attributes path
## To test
- Open a Pro AWS project → **Settings → Compute and Disk** → hover the
**Autoscaling** pill on the disk bar: tooltip should read "…limited to 4
within a rolling 24-hour window" (no "once every 4 hours")
- Change IOPS only → **Review changes** → IOPS row description shows the
new "rolling 24-hour window… as soon as the previous one completes" copy
- Change disk size → **Review changes** → Disk size row shows "You can
modify disk attributes up to 4 times within a rolling 24-hour window"
(not "For 4 hours after changes…")
- On a non-AWS Pro project → **Database → Settings → Increase disk
size**: modal title reads "Disk modifications are limited to 4 per
rolling 24-hour window"; any "resize again in ~X" countdown is bounded
by 4 hours, not 6
- Sanity: none of the old "4-hour cooldown" / "once every 4 hours"
strings appear anywhere in the disk UI
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated disk resizing messages across the app to reflect a rolling
24-hour limit instead of a fixed 4-hour cooldown.
* Clarified when disk size, IOPS, and throughput changes are available
again, including more accurate next-available timing.
* Improved warning copy in disk configuration and review dialogs so
limit messages are consistent and easier to understand.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix (regression).
## What is the current behavior?
#44172 replaced the old `isAwsK8s`-based check with an entitlement-based
check (`useCheckEntitlements('project_pausing', ...)`) for the pause
project button. In doing so, it also introduced an explicit `isBranch`
condition that unconditionally disables the pause button and shows
"Branch projects cannot be paused" for any branch project.
Prior to #44172, branches were exempt from the paid-plan pause
restriction entirely — the old `isPaidAndNotAwsK8s` computation
(`!isBranch && !isFreePlan && !isAwsK8s`) evaluated to `false` whenever
`isBranch` was `true`, so branch projects were never blocked by that
check. The new code changed this exemption into a hard block, which is
the regression: branches can no longer be paused at all.
## What is the new behavior?
Restore the original exemption: branch projects bypass the
`project_pausing` entitlement check (as they did the old AWS K8s check),
instead of being unconditionally blocked. The pause button and tooltip
for branches now only take into account permissions, project status, and
whether the project is active — matching pre-#44172 behavior.
```tsx
const buttonDisabled =
(!isBranch && !projectPausingAllowedInOrg) ||
project === undefined ||
isPaused ||
!canPauseProject ||
!isProjectActive
```
## Additional context
Regression introduced in
https://github.com/supabase/supabase/pull/44172.
---
_Generated by [Claude
Code](https://claude.ai/code/session_01VdtDMaXzz8zgqQHSMbtMAA)_
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated project pause availability so the button now reflects the
correct conditions for branch and non-branch projects.
* Improved pause-related tooltips to show more accurate messaging based
on plan type and project status, including when pausing may not be
available on free plans.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix (accessibility improvement)
## What is the current behavior?
Icon-only buttons do not have explicit accessible names for screen
readers or tooltips.
## What is the new behavior?
All icon-only buttons now have explicit accessible names using visually
hidden text (sr-only), ensuring proper screen reader support.
## Additional context
Tooltip text is preserved or added for visual users.
No visual changes were introduced.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Tightened end-to-end checks for policy creation so policy names must
match exactly in the list.
* Improved validation coverage for SELECT, INSERT, UPDATE, and DELETE
policy flows, reducing the chance of false-positive test matches.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The buttons on the organization home page that allow to switch between
list and grid views are not accessible.
## Solution
Add screen readers only text to these buttons.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary of changes
* **Bug Fixes / Improvements**
* Improved accessibility for project view toggle controls and the
clear-search action.
* Added an explicit accessible label to the clear button.
* Added screen-reader text and tooltips to better communicate grid vs.
list view.
* **Other**
* Improved error handling robustness when updating report snippet
visibility.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Adds `'wal2json'` to `HIDDEN_EXTENSIONS` so it's filtered out of the
extensions list in the Dashboard, matching how other non-user-facing
extensions (e.g. `pg_stat_monitor`, `supautils`) are already hidden.
## Summary by CodeRabbit
* **Bug Fixes**
* Updated the list of hidden database extensions so `wal2json` no longer
appears in places where hidden extensions are excluded.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Minor remove any to fix ratchet baseline rules
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved error handling when making a report snippet public, so error
messages are only shown when a valid error message is available.
* Reduced the chance of unexpected failures from non-standard error
values during this action.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix (Fixes#47562)
## What is the current behavior?
Header and data row overlaps:
<img width="1416" height="58" alt="Screenshot 2026-07-03 at 12 39 43 PM"
src="https://github.com/user-attachments/assets/fd5ab174-f18d-4f84-9158-5824f43d5ab5"
/>
## What is the new behavior?
Now it correctly displays entry data without overlapping text:
<img width="1289" height="115" alt="Screenshot 2026-07-03 at 12 38
38 PM"
src="https://github.com/user-attachments/assets/df0d96d6-1091-4be9-be44-cad317b87847"
/>
## Additional context
Colors are consistent with surrounding for all color theme.
This issue appeared after PR #47288, I am not exactly sure about the
whole situation as 47288 is a massive PR. I drilled in a bit into the
CSS with the help of my cursor agent, it mentioned css conflicts with
react-data-grid's background-color: inherit, take it with a grain of
salt though.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Updated the grid header appearance to better match the app canvas.
* Header rows now keep their existing behavior and borders, while header
cells use the canvas background for a cleaner look.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
Now that we migrated all usages of the deprecated `Tabs` component, we
don't need the `_Shadcn_` suffix anymore.
## Solution
Remove `_Shadcn_` suffix from `ui` tabs components. That's all this PR
does, no visual nor functional changes
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Standardized tab components across the app so pages and dialogs now
use the same consistent tab UI.
* Improved tab-based views in design, docs, studio, learn, and website
experiences for a more uniform interface.
* **Chores**
* Updated shared UI exports to expose tab components directly,
simplifying future usage across the product.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- closes https://github.com/supabase/supabase/issues/47606
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Copying cell values now preserves `false` and `0` instead of treating
them like empty values.
* Clipboard copy behavior now only returns blank for truly empty inputs,
helping keep table data accurate when copied.
* **Tests**
* Added end-to-end coverage for copying table cells with `false`, `0`,
and `true` values.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix.
## What is the current behavior?
On the `apps/www` homepage, the Realtime product card shows a
cursor-following hover animation (the "self" cursor) alongside two other
peer cursors (User 1 and User 2) that animate independently.
The mouse-follow animation is driven by an `onMouseMove` handler on the
`<figure>` in `RealtimeVisual.tsx`. The three animated cursor divs are
positioned absolutely on top of that figure but did **not** set
`pointer-events-none`. As the peer cursors move around (and the self
cursor tracks the pointer), they become the pointer target under the OS
cursor and intercept mouse events, so the main hover animation
stutters/breaks when the pointer passes over one of the other cursors.
## What is the new behavior?
Added `pointer-events-none` to all three animated cursor wrappers (User
1, User 2, and Self). The animated cursors are purely decorative, so
they should never intercept pointer events. The `<figure>` keeps
`pointer-events-auto` and now receives `onMouseMove` uninterrupted, so
the cursor-follow animation stays smooth while hovering over the card.
## Additional context
Three-line change in `apps/www/components/Products/RealtimeVisual.tsx`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_01YCXXskLSt6k4DjUxgS4vc5
---
_Generated by [Claude
Code](https://claude.ai/code/session_01YCXXskLSt6k4DjUxgS4vc5)_
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Improved interaction behavior for the on-screen user indicators so
they no longer capture pointer events, ensuring hover/drag behavior
elsewhere remains consistent.
- Refined the pointer-follow animation wiring to use DOM event listeners
for more reliable coordinate tracking.
- Updated motion behavior to respect “reduce motion” settings by
disabling the pointer-follow effect when enabled.
- Kept “Self” marker hover opacity transitions consistent with previous
visuals.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude <noreply@anthropic.com>
## What
Enforces a `LIMIT` clause on Logs Explorer queries, replacing the
previous soft warning.
- Queries without a `LIMIT <n>` can no longer be run.
- Instead of the warning badge, the results box shows a clear "Add a
LIMIT to your query" message.
- The error clears as soon as a valid `LIMIT` is added.
## Why
Unbounded queries can scan very large amounts of data. This adds a UI
guardrail so a bounded result set is always requested.
## Notes
- New `checkForLimitClause` util detects `LIMIT <n>` outside of string
literals and comments (mirrors the existing WITH/ILIKE checks), with
unit tests.
- The missing-limit message reuses the existing error-rendering path via
a `missingLimit` reason, alongside `resourcesExceeded`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Log queries now require a `LIMIT` clause before they can run.
* A new on-screen message guides users to add a `LIMIT` when it’s
missing.
* **Bug Fixes**
* Improved log query validation to better detect valid `LIMIT` usage,
including mixed case, multiline queries, and avoidance of false matches
in comments, strings, or column names.
* Existing error messages continue to appear for other query limits and
failures.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
## Problem
Adding a private SQL snippet ('user' visibility) as a Home / project
overview report created a broken experience for other project members,
who saw "SQL snippet not found" because they had no access to the
snippet.
## Fix
Selecting a private snippet from the report block picker now shows a
confirmation step that makes the snippet public to the project before it
is added. Already-shared snippets are added directly, and snippets
created via drag-and-drop onto the report are now shared on creation.
## How to test
- Open a project's homepage and go to the Reports section
- Create a private SQL snippet if you do not have one
- Click "Add block" and select the private snippet
- Confirm a dialog appears explaining the snippet will become visible to
the team
- Confirm, and verify the block is added to the report
- Log in as another project member and confirm the report block renders
instead of "SQL snippet not found"
- Selecting an already-shared snippet should add it without the
confirmation dialog
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a “make snippet public” confirmation flow for user-owned report
blocks.
* Updated snippet selection to support a private-snippet share prompt
when appropriate.
* **Bug Fixes**
* Improved duplicate-block handling to prevent adding the same snippet
multiple times.
* **Refactor**
* Refactored SQL snippet upsert payload construction for more consistent
project visibility updates.
* **Tests**
* Added unit tests covering snippet selection decision logic.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
**Stack 5.2/6** of the TanStack Start migration (#46424) — second half
of the project routes (S5 was split for CodeRabbit's 150-file cap).
Stacked on **#47117** (5.1).
> [!NOTE]
> Same shape as 5.1 — thin route wrappers over the existing pages-router
components. With this PR every route is present, so `routeTree.gen.ts`
is now **byte-identical to the migration branch**.
## What's in this PR
- **Remaining project routes:** auth, logs, settings, observability,
functions, advisors, project-level integrations.
- **Supporting edits:** hoist `EdgeFunctionsIndexPageWrapper` out of
`getLayout`, `functions/secrets`, and move `DefaultLayout` to the root
for the logs page.
- `routeTree.gen.ts` regenerated for the full set.
## Verification
On top of S1–5.1: `studio` typecheck ✓, lint (0 errors) ✓, **Next build
✓ (181/181 pages)**.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Reorganized internal routing and page structure to improve navigation
and maintainability across project settings, logs, functions,
authentication, integrations, and observability sections.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
- closes https://github.com/supabase/supabase/issues/47555
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the password verification guide to use the `current_password`
parameter name consistently.
* Aligned the example code with the current parameter format for user
password updates.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Users who set a database password with special characters (\`@\`, \`#\`,
\`%\`, \`+\`, etc.) get no warning that it must be percent-encoded when
used in a connection URL, which leads to confusing connection failures
([FE-3379](https://linear.app/supabase/issue/FE-3379)).
<img width="700" height="200" alt="Screenshot 2026-07-03 at 6 26 43 PM"
src="https://github.com/user-attachments/assets/48608d65-8057-4abe-96fc-c0ede3550951"
/>
<img width="1002" height="395" alt="Screenshot 2026-07-03 at 6 27 14 PM"
src="https://github.com/user-attachments/assets/1366b985-7d80-4e7d-97f0-c79d5c84cefd"
/>
<img width="548" height="303" alt="Screenshot 2026-07-03 at 6 27 26 PM"
src="https://github.com/user-attachments/assets/b042101a-0e88-4730-adb8-1b490018f208"
/>
**Changed:**
- `PasswordStrengthBar` now shows a warning-colored callout (with a docs
link) whenever the entered password contains characters that need
percent-encoding — this covers project creation, reset database
password, restore-to-new-project, and the Vercel deploy-button flow
- Replaced `DATABASE_PASSWORD_REGEX` (only caught `@`, `:`, `/`) with a
`passwordNeedsPercentEncoding()` helper based on `encodeURIComponent`,
so `#`, `%`, `+`, `?`, `&`, spaces etc. are caught too
- Moved `SpecialSymbolsCallout` from `ProjectCreation/` to
`components/ui/` since it's now shared
**Added:**
- Info admonition in the Connect sheet next to connection strings that
still contain `[YOUR-PASSWORD]` (direct connection + `.env`-based file
setups; hidden for psql and .NET where percent-encoding doesn't apply,
and after a password reset since the substituted password is already
encoded)
## To test
- Project creation → type a password containing \`#\` or \`@\` → warning
callout appears above the strength bar; disappears for alphanumeric
passwords
- Database Settings → Reset database password → same behaviour
- Connect sheet → Direct connection → note shows under the connection
string for URI/JDBC types, not for psql; after resetting the password
from the sheet, the note disappears (password is substituted already
encoded)
- Connect sheet → Node.js/Python/Go/SQLAlchemy file setups show the
note; .NET does not
- \`pnpm vitest run lib/password-strength.test.ts\` passes
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* Added a dedicated password encoding note (with documentation link) on
direct connection screens when the password is embedded in a URL.
* Added an encoding hint to the password strength area when
percent-encoding is required.
* **Bug Fixes**
* Removed regex-based “invalid password” callout and replaced it with
safer percent-encoding detection logic.
* **Tests**
* Added test coverage for `passwordNeedsPercentEncoding`.
* Removed obsolete Project Creation password regex tests.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
update pg changes documentation
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the Realtime Postgres Changes guide with a new, generalized
“Listening to specific events” section (including INSERT/UPDATE/DELETE/*
examples) and standardized `event` usage.
* Refreshed “Available filters” with a unified filter builder approach,
expanded operator reference, consistent Filter-string/tab patterns,
`not.` and `AND` guidance, and clearer limitations (including
delete-event filtering).
* Updated “Selecting specific columns” examples to match the latest
payload/subscription guidance.
* **Refactor**
* Simplified the Realtime limits estimator by removing filter-based
throughput inputs and related UI/table columns; throughput is now based
on compute add-on, RLS, and concurrency.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This PR syncs the latest troubleshooting guides from the
supabase/troubleshooting repository.
---------
Co-authored-by: github-docs-bot <github-docs-bot@supabase.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Creating publishable and secret keys adds them alongside the existing
anon and service_role keys without affecting them. Make this explicit in
two places so users don't assume their legacy keys are revoked:
- Add an Admonition note to the API keys guide explaining both key types
work simultaneously and legacy keys must be disabled in a separate step.
- Update the "Create new API keys" dialog in Studio to reassure users
that their existing anon and service_role keys remain valid.
## Summary
- Follow-up to the axe-core accessibility audit (FE-3781), which found
1,733 failing elements across 126 Studio surfaces deduplicating to 12
root-cause families. A subset of those (missing accessible names/labels,
invalid/redundant ARIA, empty headings/anchors) is statically detectable
— this adds ESLint coverage for it instead of relying solely on the
runtime axe-core CI gate.
- Adds 13 `jsx-a11y` rules to `apps/studio/eslint.config.cjs` at
`'warn'`: `aria-props`, `aria-proptypes`, `role-supports-aria-props`,
`anchor-has-content`, `control-has-associated-label`
(`controlComponents: ['Button', 'Switch']`),
`label-has-associated-control` (`labelComponents: ['Label']`,
`controlComponents: ['Input', 'Switch']`), `aria-role`,
`no-redundant-roles`, `no-aria-hidden-on-focusable`,
`tabindex-no-positive`, `anchor-is-valid`, `heading-has-content`,
`no-distracting-elements`.
- Wires all 13 into the existing `lint:ratchet` script and initializes
their baselines in `apps/studio/.github/eslint-rule-baselines.json`, so
any *new* violation fails `studio-lint-ratchet.yml` while the
pre-existing ones (mostly `control-has-associated-label`: 274,
`label-has-associated-control`: 37) are tracked and shrink over time via
the weekly baseline-decrease cron.
Resolves
[FE-3795](https://linear.app/supabase/issue/FE-3795/add-jsx-a11y-eslint-ratchet-rules-for-statically-detectable-a11y).
## Test plan
- [x] `pnpm --filter studio run lint:ratchet` passes (exit 0, no
regressions)
- [x] Spot-checked several flagged instances against source to confirm
true positives (e.g. an unlabeled save/cancel icon-button pair in
`AIAssistantChatSelector.tsx`, an empty `<h3>` in `PITRForm.tsx`)
- [x] CI (`studio-lint-ratchet.yml`, typecheck.yml lint step) green on
this PR
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Expanded Studio’s accessibility linting to cover additional ARIA prop
validation, label/control relationships, anchor/heading validity,
role/ARIA correctness, and focus/tab behavior (including distracting
markup).
* Updated accessibility lint baselines so tracked violations remain
accurate as rules expand.
* **New Features**
* Enhanced the Studio lint “ratchet” workflow to load ratchet rule IDs
from an external `rules-file` instead of a long inline command.
* **Tests**
* Added an integration test to verify rule IDs are read from the
`rules-file`.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Andrey A.