The autogenerated Data API docs listed every table and database function
from the PostgREST OpenAPI spec, even ones that aren't actually
accessible via the Data API (i.e. with grants revoked). This filters the
docs down to only the entities that are exposed, and surfaces a count of
the excluded ones with a link to enable them.
This applies to **both** autogenerated docs surfaces:
- the **API Docs side panel** (the slide-over opened from the API docs
button), and
- the **full-page Data API docs** at `/integrations/data_api/docs`.
<img width="259" height="272" alt="Screenshot 2026-06-01 at 5 48 21 PM"
src="https://github.com/user-attachments/assets/d2af86f2-5436-4e94-8295-83ecc74a77d9"
/>
**Changed:**
- Both docs UIs now only list tables and functions that have Data API
access (any `anon`/`authenticated`/`service_role` grant). Fully-revoked
entities are hidden.
- Side panel: both the sidebar list and the drilled-in resource picker
are filtered.
- Full page: the menu's Tables/Functions groups are filtered, with a
footer note under each.
**Added:**
- A footer under each list — "N table(s)/function(s) not exposed via
**Data API**" — linking to Data API settings
(`/integrations/data_api/settings`) so the entity can be granted access.
- One-shot `useExposedTablesQuery` / `useExposedFunctionsQuery` hooks
reusing the same granted/custom/revoked SQL as the Data API settings
page (no new SQL).
- Pure, unit-tested `partitionExposedDocsEntities()` helper (fails open
if grant status hasn't loaded / errors, so docs are never blanked).
- Optional `footer` slot on `ProductMenuGroup` (rendered by `DocsMenu`)
so the full-page menu can show the not-exposed note under a group.
**Note on the "all" queries:** the new `useExposedTablesQuery` /
`useExposedFunctionsQuery` fetch the full grant-status list in a single
request (rather than paginating like the Data API settings page does).
This is deliberate — the docs sections aren't paginated and render every
entity from the OpenAPI spec at once, so we need the complete status set
to cross-reference against. Ideally we'd refactor the docs to be
paginated in future, at which point these queries should move to a
paginated approach too; until then, the one-shot "all" fetch is what
matches the current (unpaginated) docs behavior.
## To test
- On a project, revoke a `public` table's Data API access (Data API
settings → uncheck it)
- Open the **full-page** docs at `/integrations/data_api/docs`: the
table should no longer appear under Tables and Views, and you should see
"1 table not exposed via Data API" under that menu group
- Open the **API Docs side panel** and expand Tables and Views: same
behavior
- Click the "Data API" link → goes to Data API settings (closes the side
panel if open)
- Same for a database function under Functions
- Tables/functions that are still granted (or have custom/partial
grants) should remain visible
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Data API docs now reflect actual exposure: tables/functions not
exposed by permissions are hidden and counted.
* Sections display footer indicators with counts of hidden entities and
links to Data API settings.
* Navigation lists and docs menu updated to show only exposed entities
and the new "not exposed" cues.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
- Minor updates to date on pooler changes
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Extended the on-screen maintenance notice so the banner remains
visible until June 9, 2026.
* Updated the scheduled maintenance window details for the US East
region.
* Revised local maintenance tracking to use the new June 9, 2026 date.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
- Better role selector thats actually more helpful with descriptions
- More tests with MSW
- Refactored to a side panel due to more information being presented in
the modal
## How to test
- Try inviting members to an org
- Make sure members can still be revoked!
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Team member invitation interface redesigned from modal dialog to side
panel.
* Role selection now displays as an interactive radio list with
descriptions for each role.
* Improved form layout with horizontal organization for better
usability.
* **Tests**
* Added integration and unit tests for team member invitation
functionality.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
Because we have controller inputs and zod validation on numbers, many of
them cannot be cleared correctly as deleting their value resets it to
`0`.
## Solution
Update the `Input` component to allow those editions by always storing
and displaying the user entered value
## How to test
- Open the webhook page and add/edit one
- Clear its timeout value and observe that it is not reset to `0`
- Same for:
- Database network restrictions
- API settings max rows
- Disk size modal
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Standardized numeric form input handling across examples, settings,
and modals — inputs now rely on form bindings and schema coercion for
consistent parsing and simplified behavior.
* **Chores**
* Added form resolver utilities and a user-event testing library to
development dependencies.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Adds AUP clause **1.6 — Privacy Violations, Doxxing, and Targeted
Harassment** to Section 1 (General Prohibitions), positioned between the
existing 1.5 (Obfuscation) and Section 2.
**The wording for clause 1.6 was supplied verbatim by Supabase Legal.**
This PR is the mechanical addition of that text in the right place with
the right formatting and numbering — the wording itself is not up for
review.
Driven by the "namehim" case — see the Slack `#team-security`
investigation thread for the specific events that drove this addition.
Codifies the AUP grounds for handling that abuse pattern so future
enforcement actions for the same shape don't have to lean on General
Prohibitions stretch interpretations.
Linear:
[ABU-44](https://linear.app/supabase/issue/ABU-44/chore-add-aup-clause-16-privacy-violations-doxxing-and-targeted)
## What changed
- New clause 1.6 inserted in Section 1
- `_Last Modified:_` date bumped to 1 June 2026
- Trailing-two-spaces added to the previous 1.5 line so 1.6 renders on a
new line (matches the existing within-section line-break convention)
## Wording rationale (per Legal)
The clause prohibits using the Services to publish, disclose, or
facilitate dissemination of another person's
personal/confidential/identifying information, plus using the Services
to doxx, harass, intimidate, threaten, stalk, extort, or otherwise
target individuals.
The legitimate-uses carve-out at the end was specifically requested by
Legal:
> This provision does not prohibit lawful processing, publication, or
distribution of information for legitimate purposes, including
journalism, research, public-interest reporting, legal compliance,
public records uses, or other activities protected by applicable law.
Keeps the clause from accidentally prohibiting customers doing
journalism, public-records work, breach research, or other lawful uses.
## Open question for review
The AUP doesn't currently follow the date-suffixed-archive pattern that
`privacy.mdx` does (e.g. `privacy-260316.mdx`). Should this substantive
change trigger archiving the prior version as `aup-260225.mdx`? Flagging
for the reviewers — happy to add the archive copy in a follow-up commit
on this branch if so.
## Test plan
- [ ] Reviewer renders the page locally (`pnpm --filter www dev`, then
`http://localhost:3000/aup`) and confirms clause 1.6 displays correctly
between 1.5 and Section 2
- [ ] Clause numbering convention matches existing pattern (bold title
with period and colon, two-trailing-space line breaks within sections)
- [x] Wording supplied by Supabase Legal (no wordsmith review required)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated Acceptable Use Policy with an effective date of 1 June 2026.
* Enhanced General Prohibitions section with revised Obfuscation
guidance and newly added provisions addressing Privacy Violations,
Doxxing, and Targeted Harassment.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
During the migration to make `PREVIEW` match `PRODUCTION` environment we
got a negation wrong.
With this fix, now wrappers pages are rendered statically on build, so
we can catch errors on MDX syntax on the fly.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix (documentation) — fixes three internal links that currently 404.
## What is the current behavior?
Three docs pages link to internal paths that do not resolve (no matching
page, and no redirect in `apps/www/lib/redirects.js`):
| File | Link | Problem |
| --- | --- | --- |
| `guides/telemetry/reports.mdx` (×3) |
`/docs/content/guides/database/query-optimization` | Stray `content/`
path segment (the content folder name leaked into the public URL) |
| `guides/database/prisma.mdx` |
`/docs/guides/database/prisma-troubleshooting` | Page lives under the
`prisma/` subfolder |
| `guides/database/postgres/data-deletion.mdx` |
`/docs/blog/postgres-bloat` | Blog posts are served from `/blog`, not
`/docs/blog` |
No related issue — these are self-evident broken links found by checking
every internal `/docs/...` link against the actual pages, the redirects
config, and the dynamic doc routes.
## What is the new behavior?
The links now point to the correct, existing pages:
- `/docs/guides/database/query-optimization` (page:
`apps/docs/content/guides/database/query-optimization.mdx`)
- `/docs/guides/database/prisma/prisma-troubleshooting` (page:
`apps/docs/content/guides/database/prisma/prisma-troubleshooting.mdx`)
- `/blog/postgres-bloat` (post:
`apps/www/_blog/2024-04-26-postgres-bloat.mdx`; consistent with the ~30
other `/blog/...` links across the docs)
Docs-only change; no wording changes beyond the URLs. The `reports.mdx`
tables were re-aligned by Prettier as a result of the shortened links.
## Additional context
For each link I confirmed the target page/post file exists, that the
broken path has no rule in `apps/www/lib/redirects.js`, and that it is
not served by a dynamic Next.js route under `apps/docs/app/`.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Adds Lukas Klingsbo to the humans.txt
## What is the current behavior?
There is no Lukas Klingsbo in humans.txt
## What is the new behavior?
There is a Lukas Klingsbo in humans.txt
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated team information with a new team member addition.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Adds my name to the public-facing `humans.txt` endpoint on
`supabase.com`.
## What is the current behavior?
Existing humans listed without me.
## What is the new behavior?
I become listed as another human. 🎉
## Additional context
I think that's enough already. 😈
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated team information in public documentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
fixes `UseInfiniteQuery` so it recreates when query inputs change
the previous prop change check compared values to themselves so the hook
could keep stale paginated state
after table columns page size or trailing query changed
- closes https://github.com/supabase/supabase/issues/37750
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added an optional trailingQueryKey prop to the infinite-query hook to
better control when its internal store is refreshed.
* **Bug Fixes**
* Pagination now reliably uses the latest trailing query and avoids
inconsistent state during initial load and subsequent pages.
* **Refactor**
* Reworked store lifecycle and initialization for the infinite-query
hook to reduce unnecessary recreations, streamline startup, and improve
performance and stability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
After improving error handling on guides loader, of course, an error
emerged about a missing partial that doesn't exist anymore within the
project.
Removing the partial importing within MDX to fix search embedding
script.
## What kind of change does this PR introduce?
This PR enables io2 block express in additional regions: `eu-central-2`,
`eu-west-3`, and `sa-east-1` as it is [now
available](https://aws.amazon.com/about-aws/whats-new/2025/07/amazon-ebs-io2-block-express/)
in all the regions as of 22 July, 2025
Depends on platform PR: https://github.com/supabase/platform/pull/33440
## What is the current behavior?
Currently IO2 block express is not available for these regions:
`eu-central-2`, `eu-west-3`, and `sa-east-1`
## What is the new behavior?
You can use io2 block express in additional regions: `eu-central-2`,
`eu-west-3`, and `sa-east-1`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Improvements**
* Disk management features are now available in three additional AWS
regions: eu-central-2 (Central Europe), eu-west-3 (Western Europe), and
sa-east-1 (South America). Users in these regions can now access storage
management capabilities.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Add support to displaying binary payloads while displaying realtime
messages
<img width="2073" height="694"
alt="Realtime_Inspector___Realtime___29_APR___eduardo_gurgel_supabase_io_s_Org___Supabase"
src="https://github.com/user-attachments/assets/fcb5c3d2-f880-484b-97a9-b0ca3b939a3f"
/>
JSON payloads are untouched:
<img width="1744" height="625"
alt="Realtime_Inspector___Realtime___29_APR___eduardo_gurgel_supabase_io_s_Org___Supabase"
src="https://github.com/user-attachments/assets/8227d0af-21ee-4444-b8ca-4ebeeda11f75"
/>
How to test on staging:
```
select
realtime.send(
'\x48656C6C6F2066726F6D205265616C74696D65'::bytea, -- Binary Payload
'event', -- Event name
'main', -- Topic
false -- Public / Private flag
);
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Binary payloads in real-time message inspection show compact
placeholders with byte counts instead of raw binary.
* Added an inline hexdump viewer to inspect binary payload contents with
offsets, grouped hex bytes, and ASCII gutter.
* Message list and details view now use the placeholder/hexdump behavior
for payload rendering.
* **Tests**
* Added comprehensive tests for binary detection, hexdump formatting,
and placeholder substitution.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46408?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Ali Waseem <waseema393@gmail.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
UI update
## What is the current behavior?
The homepage hero displays an announcement badge promoting the State of
Startups 2026 survey.
## What is the new behavior?
The announcement badge has been removed from the hero section, allowing
the main heading to be more prominent.
## Additional context
Removed the AnnouncementBadge component and its import from the Hero
component in apps/www.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed announcement badge from the Hero section
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Call API manually due to minor bug in Supabase js right now.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Refactored OAuth custom provider management operations to use a new
admin request helper for update and delete operations, replacing direct
client calls.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
> [!IMPORTANT]
> Will open up for review once CLI PR is merged and deployed so that
it's easier to test
Related PR: https://github.com/supabase/cli/pull/5230
Adding support for vector buckets for local CLI - will need to be tested
locally via `pnpm run dev:studio-local`
## To test
There's a bit of testing instructions in the linear ticket
[here](https://linear.app/supabase/issue/FE-3474/show-vector-buckets-in-local-admin-studio)
as it involves using a branch of CLI - otherwise do reach out to
Fabrizio if any help might be needed, but generally:
### Local CLI
You might need to manually set `isCli` to `true` in `StorageMenuV2` if
the "Vectors" nav item isn't showing up on the storage UI given we're
testing via `pnpm run dev:studio-local`
- [x] Can create bucket
- [x] Can delete bucket
- [x] Can create indexes
- [x] Can insert data into indexes (via FDW)
- [x] Can delete indexes
Known issues (that aren't directly solvable from FE end)
Reach out to Fabrizio for context as we were both investigating this
- PG database needs to be on 17.6 (otherwise there's no S3 vectors FDW)
- Storage version needs to be on 1.59.0
### Self-hosted (This might be tricky to actually test, but just ensure
that the code satisfies this)
- [x] Cannot see vector buckets
### Hosted
- [x] Everything works status quo
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Vector bucket management UI and platform APIs (create/list/delete
buckets & indexes)
* Local S3 credentials endpoint and client-side hook for self‑hosted/CLI
use
* **Bug Fixes**
* Improved S3 vector setup notifications and clearer error guidance for
manual installation
* **Refactor**
* Deployment-mode gating: platform vs CLI/self‑hosted now controls
feature visibility and page behavior
* **Tests**
* Added suites covering deployment-mode gates and vector bucket
error/usage scenarios
* **Chores**
* Build env updated to expose local S3 credential vars
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46381?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Ali Waseem <waseema393@gmail.com>
**I have read the CONTRIBUTING.md file.**
YES
**What kind of change does this PR introduce?**
Docs update
**What is the current behavior?**
The Prisma quickstart and troubleshooting pages reference Prisma v6
patterns: `prisma-client-js` generator, `datasource db` with
`url`/`directUrl`, CommonJS imports, `ts-node`, and no driver adapter
setup.
**What is the new behavior?**
Updated for Prisma ORM v7:
- Install steps use `tsx`, `@prisma/adapter-pg`, `dotenv`, and `pg`
- New step for `prisma.config.ts` with `dotenv/config` and `DIRECT_URL`
- Schema uses `prisma-client` generator with explicit output,
provider-only `datasource db`
- Removed old `datasource db { url, directUrl }` block from serverless
tab
- Test file uses ESM imports from `./generated/prisma/client` and
`PrismaPg` driver adapter
- Troubleshooting cross-schema example updated to match v7 patterns
**Additional context**
Prisma v7 requires driver adapters, moves datasource config to
`prisma.config.ts`, and deprecates the `prisma-client-js` generator in
favor of `prisma-client`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated Prisma quickstart: refreshed install and setup steps, added a
new runtime configuration step, adjusted migration + generate workflow,
and replaced the test API example with an ESM-style, dotenv-powered
snippet.
* Refined troubleshooting examples: clarified schema configuration
syntax and improved multi-schema guidance.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46082?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
This PR is add missing docs for the newly added wrappers:
- Cal
- Calendly
- Cloudflare D1
- DynamoDB
- Gravatar
- Hubspot
- Infura
- MySQL
- OpenApi
- Orb
- Shopify
- Slack
## What is the current behavior?
Those wrappers was added to Wrappers extension but docs links are not
updated.
## What is the new behavior?
- The missing wrappers docs are added.
- Removed the repetitive `Connecting to` title prefix in the Navigation.
- Collapse the lengthy wrappers list into a `Sources` sub navigation
item to make the UI tidy.
## Additional context
N/A
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added guides for new federated data wrappers: Cal, Calendly,
Cloudflare D1, Gravatar, Infura, MySQL, OpenAPI, Shopify, and Slack.
* Reorganized Foreign Data Wrappers navigation menu with an improved
hierarchical structure for easier discovery of available vendor
integrations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES/NO
## What kind of change does this PR introduce?
Bug fix, feature, docs update, ...
## What is the current behavior?
Please link any relevant issues here.
## What is the new behavior?
Feel free to include screenshots if it includes visual changes.
## Additional context
Add any other context or screenshots.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Accessibility**
* Improved screen-reader label for table row action menus so table
controls are clearer for assistive‑technology users.
* **Tests**
* Enhanced end-to-end test reliability: tightened selectors, added
dialog/toast visibility and API-wait synchronization, scoped lookup
fixes, removed redundant cleanup helper, and updated test setup to mark
a terms-of-service dismissal to reduce flakiness.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This PR overrides title, description, content, logo, images, docs url,
and site url from marketplace db for wrappers. If marketplace doesn't
yet publish a wrapper listing, the page falls back to the hardcoded
content we show today.
It also improves the marketplace listings and categories queries by
returning typed results, making the code more type safe.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Studio integrations now surface updated marketplace metadata (name,
description, icon, docs, site, author, files) when available.
* Marketplace wrapper integrations are consolidated and shown alongside
studio integrations.
* **Refactor**
* Marketplace category and integration fetching rewritten for more
reliable loading, cancellation support, and improved menu/category
population.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46472?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Performance improvement / feature
## What is the current behavior?
The Schema Designer fetches all tables in a single request via
`useTablesQuery`. For schemas with 400+ tables this blocks first paint
on a large payload.
## What is the new behavior?
`SchemaGraph` uses `useInfiniteTablesQuery` (pageSize: 100) so the first
100 tables paint immediately. A "Load more tables" button appears above
the legend whenever more pages remain, letting users load the rest on
demand.
## Additional context
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a "Find table…" selector and keyboard shortcut to quickly locate
and focus tables; supports incremental loading and debounced name search
(with literal wildcard handling).
* Schema Graph shows a bottom "Load more tables" control with loading
state and preserves view after loading more.
* **Refactor**
* Table listing switched to infinite/paginated retrieval and improved
"no tables" logic; server-side name filtering supported.
* **Tests**
* E2E tests add a schema-visualizer wait helper and update flows to
support the paginated visualizer.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46402?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Update (third-party integration script).
## What is the current behavior?
The Default.com snippet on `/contact/sales` used the old `form_id`
(`299973`) and listened to the legacy HubSpot form element IDs
(`hsForm_de9a785a-…_5037`), which no longer match the form rendered on
the page.
## What is the new behavior?
The snippet now uses `form_id=879120` and listens to `["support-form"]`,
the actual `id` of the `RequestADemoForm` rendered on the page, so
submissions are enriched and routed correctly.
## Additional context
`team_id` and the loader logic are unchanged.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated form configuration on the sales contact page to enhance data
processing and routing.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46510?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update.
## What is the current behavior?
The troubleshooting entry
`edge-functions-worker-timeouts-and-websocket-drops.mdx` includes
frontmatter fields that are not part of the troubleshooting
template/schema, so it does not conform to the expected metadata shape.
## What is the new behavior?
The document now matches the supported troubleshooting template
metadata.
- **Frontmatter cleanup**
- Removed unsupported `teams` and `types` fields.
- Kept the existing supported metadata (`title`, `topics`, `keywords`)
unchanged.
- **Template alignment**
- Brings the page in line with
`/apps/docs/content/troubleshooting/_template.mdx`.
- Avoids schema drift for troubleshooting content.
```mdx
---
title = "Edge Functions worker timeouts and WebSocket drops"
topics = [ "functions" ]
keywords = [ "websocket", "timeout", "earlydrop", "wall clock", "cpu limit", "streaming", "cold start" ]
---
```
## Additional context
This is a surgical docs-only change to make the page consistent with the
troubleshooting content schema used by the docs app.
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Rodrigo Mansueli <rodrigo@mansueli.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
Adding broad RLS policies to public buckets can cause users to expose
more than they expected, like the ability to list all profile pictures
on an app. This patches Assistant with knowledge to follow our latest
guidance on restrictive RLS policies for storage buckets
https://github.com/supabase/supabase/pull/46172
**Changes**
- Adds Storage bucket evals for public website assets and avatar access
patterns to distinguish public vs private bucket use cases
- Adds eval for overly permissive table policies
- Adds `storage` knowledge so Assistant distinguishes public buckets,
private buckets, object reads, and object listing.
- Adds `includeToolCallInputs` option for scorer transcripts so LLM
judges can evaluate proposed SQL/tool actions.
- Bumps max step count to 10 since storage knowledge may incur another
tool call (also 10 is recommended
[here](https://vercel.com/academy/ai-sdk/multi-step-and-generative-ui#why-multi-step-is-required)
for complex multi-tool scenarios)
**References**
-
https://supabase.com/docs/guides/storage/buckets/fundamentals#public-buckets
- https://supabase.com/docs/guides/storage/security/access-control
- https://github.com/supabase/supabase/pull/46172
**Notes:**
- These prompt tweaks are not meant to be exhaustive fixes, they are
mainly hotfixes intended to hold us out until these cases can be
addressed more deeply in skills/docs and tracked in a central evals
Closes AI-676
Closes AI-756
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Storage knowledge resource for the assistant covering Supabase
Storage access patterns and RLS guidance.
* Added three evaluation cases: two for Storage (marketing assets,
avatars) and one for RLS policy generation for user profiles.
* **Improvements**
* Evaluators now include tool call inputs when judging conversations.
* Assistant prompts and generation enhanced with richer Storage/RLS
guidance and extended streaming limits.
* **Tests**
* Added test ensuring tool call inputs are included in serialized thread
context.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46168?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Simplified the local setup instructions for running the docs site
during development.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The global `TooltipProvider` in `apps/studio/pages/_app.tsx` sets
`delayDuration={0}`, so every tooltip in Studio appears instantly on
hover. This makes tooltips easy to trigger accidentally while moving the
cursor, and contributed to issues like FE-3499 (status code tooltip in
Unified Logs).
The zero delay was introduced in #32679 when tooltips were migrated to
shadcn, without a stated reason.
## Fix
Remove the `delayDuration={0}` prop so tooltips use the Radix default
(700ms).
## How to test
- Open Studio
- Hover briefly over icons, buttons, and other elements with tooltips
- Expected: tooltips no longer appear instantly; they show after a short
hover delay
- Hovering long enough (around 700ms) still shows the tooltip as before
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated tooltip behavior to use default delay duration instead of
immediate display.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46456?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Refactor / chore — lints the analytics SQL wire boundary and tightens
internal API surface. Final PR in the safe-analytics-sql series (stacked
on #46476).
## What is the current behavior?
After PRs 1–10, every analytics SQL call site routes through
`executeAnalyticsSql`, but nothing prevents a future caller from
regressing by calling
`post('/platform/projects/{ref}/analytics/endpoints/logs.all', …)`
directly. `safe-analytics-sql.ts` also exports `rawSql` and
`LogSqlFragmentSeparator`, neither of which has external consumers —
`rawSql` in particular is a cast-to-brand escape hatch that should not
be reachable from outside the file. The safe-sql-execution skill
documents only the pg-meta (Postgres) side of the model.
## What is the new behavior?
- Adds an ESLint `no-restricted-syntax` rule in
`apps/studio/eslint.config.cjs` that fails on direct `post()` / `get()`
calls against
`/platform/projects/{ref}/analytics/endpoints/logs.all{,.otel}` outside
the `executeAnalyticsSql` wrapper.
- Un-exports `rawSql` and `LogSqlFragmentSeparator` from
`safe-analytics-sql.ts`; updates the `SafeLogSqlFragment` docstring
accordingly.
- Adds an "Analytics SQL" section to
`.claude/skills/safe-sql-execution/SKILL.md` covering the disjoint
`SafeLogSqlFragment` brand, the helpers, the wire boundary, and the new
lint.
## Additional context
Resolves FE-2949
## Summary
PR 10 of the analytics SQL safety series. Migrates the last surface of
analytics queries that flowed through plain
`get(.../analytics/endpoints/logs.all, { query: { sql } })` or the
`fetchLogs(projectRef, sql: string, ...)` helper over to
`executeAnalyticsSql` with branded `SafeLogSqlFragment` inputs.
After this PR, every analytics SQL call site builds its query through
the safe-analytics-sql helpers and hits the wire through the single
`executeAnalyticsSql` boundary. User-controlled values (filter
operators, numeric thresholds, function IDs, regions, provider names)
all flow through `analyticsLiteral` / branded operator maps; static
fragments are wrapped in `safeSql`. PR 11 (ESLint / vitest rule
forbidding direct analytics-endpoint POST/GET outside
`executeAnalyticsSql`) is the next and final step.
## Changes
- **`hooks/analytics/useProjectUsageStats.tsx`** — route the
already-branded `genChartQuery` output through `executeAnalyticsSql`
(parallels `useLogsPreview`).
- **`data/reports/report.utils.ts`** — tighten `fetchLogs(sql)` from
`string` to `SafeLogSqlFragment`; the wire boundary is now the same
single `executeAnalyticsSql` wrapper used by the rest of the analytics
path. Adds two pre-branded fragment maps reused by the report configs:
- `SAFE_GRANULARITY_SQL` — closed set returned by
`analyticsIntervalToGranularity`.
- `SAFE_COMPARISON_OPERATOR_SQL` — closed set on
`NumericFilter.operator`.
- **`components/interfaces/Auth/Overview/OverviewErrors.constants.ts`**
— wrap the two static `AUTH_TOP_*_SQL` fragments in `safeSql` (no
interpolation, but the type now flows).
- **`data/reports/v2/edge-functions.config.ts`** — `filterToWhereClause`
and every entry in `METRIC_SQL` now return `SafeLogSqlFragment`.
User-controlled values (`status_code.value`, `execution_time.value`,
function IDs, regions) pass through `analyticsLiteral`; operators look
up the branded map; the granularity uses the branded map. The
wire-format strings are unchanged, so the existing
`edge-functions.test.tsx` exact-string expectations still hold.
- **`data/reports/v2/auth.config.ts`** — same shape applied to all ten
`AUTH_REPORT_SQL` entries. The legacy `whereClause.replace(/^WHERE\s+/,
'')` pattern is replaced by two helpers that emit `AND`-prefixed
predicate fragments directly (`authFiltersToAndPredicates`,
`edgeLogsFiltersToAndPredicates`). Static provider SELECT / GROUP BY
fragments are pre-branded.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Enhanced security for analytics and reporting queries by updating
query construction methods across auth, edge functions, and project
usage reports.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46476?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
- Minor issues here, the validation for creating names is there but
users can create crons with empty names through SQL
- When they edit the name in the Cron editor, since we use names as the
where clause it treats it as a new create
- So a duplicate cron is created
- Since creating requires a name, the validation is moved to the
component rather than zod and disabled when editing mode is on!
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Cron jobs can now be created without requiring a name field.
* Improved handling to properly distinguish between creating new cron
jobs and editing existing ones.
* **Bug Fixes**
* Fixed issue where editing unnamed cron jobs would create duplicate
entries instead of updating the existing job in place.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46486?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Andrey A.
