## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Added contest deadlines to two conference landing pages.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated contest entry deadlines in the “How to enter” checklist: MCP
Dev NYC 2026 — Monday April 13, 2026 at 12:00 PM PDT; PgConf Dev 2026 —
Monday June 1, 2026 at 12:00 PM PDT.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Fixes https://linear.app/supabase/issue/FE-2941
- Replaced per-cell `ContextMenu_Shadcn_` in SQL result tables with a
single shared instance
- Each Radix ContextMenu registers a `keydown` listener on `document`
via `useEffect`. With 1000+ row result sets, this created thousands of
document-level listeners. Chrome trace showed listeners growing from 21k
to 347k, with every keystroke taking ~250ms (70k+ function calls per
long task)
- Fixed DataGrid not rendering in Firefox by using flex layout instead
of `height: 100%` for sizing
- Fixed double scrollbar in QueryBlock results by making the container a
flex column and removing `overflow-auto`
- Moved format utils into `Results.utils.ts`
## Test plan
The `Results` component and `QueryBlock` are used in several places.
Each should be verified:
- [x] **AI Assistant** — Have the assistant run a query returning 1000+
rows. Verify the page stays responsive while typing and there is only a
single scrollbar on the results table
- [x] **AI Assistant (Firefox)** — Same as above but in Firefox. Verify
the results table actually renders
- [x] **SQL Editor results panel** — Run a query in the SQL Editor.
Verify results render correctly with a single scrollbar in the utility
panel
- [x] **SQL Editor explain tab** — Run an EXPLAIN query. Verify explain
results render
- [x] **Editor Panel** (used in Table Editor SQL preview) — Verify
results display correctly
- [x] **Context menu** — Right-click a cell in any of the above and
verify "Copy cell content" and "View cell content" still work
## Traces
<img width="891" height="599" alt="image"
src="https://github.com/user-attachments/assets/6e1b710b-ca9e-4748-9369-d03457d80206"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed context menu behavior so it opens at the cursor and is
instantiated once.
* Improved clipboard copy formatting for cell values; NULLs copy as
empty and cells render as "NULL".
* **Style**
* Adjusted table layout and scrolling behavior to improve results
container sizing.
* **Tests**
* Added tests for results rendering, context-menu behavior, and
cell/clipboard formatting utilities.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Adding my name to the humans.txt list!
## What is the current behavior?
Currently, my name is not on the list of employees.
## What is the new behavior?
My name is now on the list of employees.
## Additional context
N/A
Bug fix / enhancement to an existing Studio import flow.
## What is the current behavior?
Studio currently supports converting empty CSV cells to `NULL`, but the
behavior applies across all imported columns. That makes it impossible
to preserve empty strings in some columns while still treating empty
cells as `NULL` in others.
This follows up on the earlier CSV import fix discussed in #43281, which
addressed the underlying issue reported in #43258.
## What is the new behavior?
This PR updates the CSV import flow so users can choose exactly which
imported columns should convert empty cells to `NULL`.
The import flow now:
- keeps all imported columns selected by default for
backwards-compatible behavior
- lets users narrow that selection down to specific columns
- keeps preview behavior aligned with the actual inserted data
## Additional context
I manually verified the full create-table-from-CSV flow locally in
Studio, including saving the imported data and confirming that only the
selected columns were persisted as `NULL` while other empty cells
remained empty values.
Formatting was checked with Prettier.
A direct production build run was started locally, but the Next.js build
process remained running without producing a final result during this
session, so I am not claiming a completed local build verification here.
## Related issues
- Fix follow-up for #43281
- Original issue: #43258
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added a "Set empty cells as NULL" selector during spreadsheet import,
allowing users to specify which columns should treat empty strings as
NULL values rather than converting all nullable columns automatically.
* Enhanced import preview to display NULL representation for selected
empty-string columns.
* **Tests**
* Added test coverage for selective empty-string-to-NULL conversion
behavior.
---------
Co-authored-by: Charis Lam <26616127+charislam@users.noreply.github.com>
This PR moves the client-side "Charge Today" calculation to the backend
- relying on the `preview` endpoint data to show the `Charge Today`,
`Prorated Credits` and `Customer Balance` in the Subscription Upgrade
Preview.
It also includes fields for displaying Tax information in the preview,
only for enabled orgs. Do note that at the moment the Tax Preview will
not change if the address in the Subscription Preview changes, that will
be tackled in a follow-up PR.
## Changes
- Replace client-side charge calculation with backend data: The upgrade
dialog previously computed the prorated credit and total charge locally
(using subscription period timestamps and plan prices). This PR uses the
`upfront_charge` object returned by the subscription preview API
instead.
- Display itemized tax breakdown: When the backend returns tax data, the
dialog now shows a line-by-line breakdown: plan cost → subtotal (if
different) → tax (with rate %) → total charged today.
- Use `tax_status` from the subscription preview to conditionally show
tax details, and display a warning when tax calculation fails.
## Testing
### No taxes - Upgrade from Free to Paid Plan
- With a Free Org with a billing address in Canada or any other
non-enabled jurisdiction, start the upgrade to the Pro Plan
- Assert that only the Charge Today field is shown in the summary
<img width="410" height="298" alt="image"
src="https://github.com/user-attachments/assets/e8c7e12e-833d-41d5-aec3-00092b12782f"
/>
### Taxes - Upgrade Plan
- Update an Org's Orb Customer on the Free or Pro Plan with the
`automatic_tax_enabled: true` flag.
```
curl --location --request PUT 'https://api.withorb.com/v1/customers/external_customer_id/{ORG_SLUG}' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'Authorization: ••••••' \
--data '{
"tax_configuration": {
"tax_exempt": false,
"tax_provider": "numeral",
"automatic_tax_enabled": true
}
}'
```
- Update the Org address to a valid taxable address, like:
```
"address": {
"country": "US",
"line1": "100 Congress Ave",
"city": "Austin",
"state": "TX",
"postal_code": "78701"
}
```
- Assert that the tax information is shown in the preview, including Tax
Rate, Prorated credits (if applicable), Customer balance (if applicable)
and the price of the intended plan.
<img width="465" height="470" alt="image"
src="https://github.com/user-attachments/assets/dd6a7e27-1708-48a8-bbf3-5435e6d582c2"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added itemized breakdown of subscription charges, including plan cost,
unused time credits, subtotal, and applicable taxes.
* Enhanced billing estimates with detailed tax information display.
* **Improvements**
* Updated "Charge today" calculations to reflect real-time preview data
for greater accuracy.
* Improved billing estimate UI layout and clarity with better
organization of charge details.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Adds `min-w-0` to the flex container holding the report block label in
`ReportBlockContainer`, so CSS truncation works correctly and the Remove
button stays visible even with long report names.
## Test plan
- [x] Create a report with a very long name on the Project Overview page
- [x] Verify the Remove (X) button remains visible without needing to
zoom out
- [x] Verify the report name truncates with an ellipsis
Fixes FE-2944
## Demo
<img width="938" height="390" alt="image"
src="https://github.com/user-attachments/assets/17419035-b03d-4f61-a324-8e446685a109"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved text truncation in report block titles to prevent layout
overflow in narrow containers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Missing mock made the pipeline fail 😢
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Extended test mock infrastructure to support additional component
composition patterns.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Refactor authorize page to move Next.js dependencies into the page shell
and have Next.js-agnostic code for the core logic. Add unit tests for
authorize screen.
## Summary by CodeRabbit
* **New Features**
* New end-to-end API authorization UI: loading, error, invalid,
approved, and main approval screens.
* Organization selector with preselection, create-organization link, MCP
warning, expiration handling, and approve/decline actions.
* Improved page title handling via layout/head provider.
* **Tests**
* Added comprehensive component tests covering loading, error, approval
flows, organization states, validation, and side effects.
Bug fix & feature
## What is the current behavior?
Customers with large schemas have trouble running:
pg-meta/{ref}/tables?include_columns=false
## What is the new behavior?
In the webhooks view some users with large schemas could not click a
table name as the underlying query times out. This just adds a light
weight query and fetches the table name
## Additional context
Add any other context or screenshots.
## Summary by CodeRabbit
* **Refactor**
* Optimized table name fetching in the database interface by introducing
an enhanced query mechanism that streams table metadata more efficiently
from the database.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
- Remove queue operations from feature preview into settings
- Refactor dashboard settings
- Resolves DEPR-434
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Dashboard settings panel in Account preferences with toggles for
Inline Editor and Queue Operations; “Dashboard” added to project
Configuration.
* **Removed**
* Old Inline Editor settings UI and the Queue Operations feature-preview
UI removed.
* **Refactor**
* Consolidated dashboard preferences into a single settings surface;
banners and actions now navigate to preferences; account/preferences
layouts and back-navigation behavior adjusted for platform vs
self-hosted.
* **Tests**
* Added tests for settings UI, menu generation, redirects, and
local-storage.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com>
Follow-up to #44451 which added `literal()` escaping to 4 queue message
files. The remaining 5 files in the same directory still use raw string
interpolation.
The create mutation was the biggest gap -- no `literal()` and no
`isQueueNameValid` at all. It could also interpolate `undefined` into
SQL when partition config is missing.
Applied the same pattern from #44451 to all 5 files: import `literal`,
wrap interpolated values. For the metrics query and create mutation,
also used `ident()` for table name references.
## Summary by CodeRabbit
* **Refactor**
* Improved internal SQL query construction for database queue operations
to enhance code reliability and maintainability.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Adds a tooltip for the account settings button
## What is the current behavior?
It has no tooltip
Closes#44524
## What is the new behavior?
Has Tooltip
## Additional context
<img width="552" height="167" alt="Screenshot 2026-04-03 at 22 21 35"
src="https://github.com/user-attachments/assets/e41caee7-e688-4bd9-8823-0c47133c5470"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Improved interface usability by adding descriptive tooltips to
dropdown menu triggers in the studio. The settings dropdown trigger now
displays a "Settings" tooltip, while the user account dropdown trigger
displays "Account settings" to provide clearer guidance, help users
navigate key interface controls, and enhance the overall user
experience.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Ali Waseem <waseema393@gmail.com>
* **Refactor**
* Updated internal module import paths to use standardized alias
conventions across the codebase.
* Reorganized import statement ordering for improved code consistency.
Follow-up to #44562 – the org prop wasn't actually being passed in, so
`NoProjectsOnPaidOrgInfo` was always returning null. Switched to
`useSelectedOrganizationQuery` hook instead.
## To test
- Go to an org on a paid plan with no projects
- Verify the admonition banner appears on the general settings page
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Simplified component architecture by replacing prop-based organization
retrieval with hook-based approach, reducing component coupling and
improving maintainability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When high availability is enabled during project creation, automatically
switch to AWS (Revamped) and disable other cloud providers –
multigres/HA is only supported on v3.
<img width="778" height="390" alt="Screenshot 2026-04-06 at 5 09 55 PM"
src="https://github.com/user-attachments/assets/c458f345-497e-4963-9c2f-b4b1eafd030b"
/>
**Changed:**
- Cloud provider selector now watches `highAvailability` form state
- Non-`AWS_K8S` providers (Fly.io, AWS, AWS Nimbus) are disabled when HA
is on
- Warning description shown in orange when HA restricts the provider
choice
**Added:**
- `useEffect` in project creation form to auto-switch cloud provider to
`AWS_K8S` when HA is toggled on
## To test
- Enable the HA toggle on the new project page (requires
`instances.high_availability` entitlement)
- Verify cloud provider auto-switches to AWS (Revamped)
- Verify other providers are greyed out in the dropdown
- Verify orange warning text appears below the cloud provider label
- Toggle HA off and confirm all providers become selectable again
- Ensure project creation still works for both HA and non-HA projects
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* When high availability is enabled, cloud provider selection is
restricted to AWS.
* A warning appears when high availability is enabled, noting AWS-only
support.
* The cloud provider selection automatically switches to AWS if high
availability is toggled on.
* **Bug Fixes**
* Improved form validation to prevent incompatible high-availability and
provider combinations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
Platform orgs can have very high project cardinality (>1M projects),
making the project count query expensive. This disables the query across
all count-only usages for platform plan orgs.
**Changed:**
- `OrgSelector` — disable query, show "Platform" label instead of count
- `OrganizationCard` — disable query, hide project count for platform
orgs
- `NoProjectsOnPaidOrgInfo` — disable query (component already returned
null for platform orgs)
**Not changed:**
- `TeamSettings` — also uses the count, but the warning it powers is
specifically relevant for orgs with a lot of projects, and it's tucked
away on the team settings page rather than on every page load.
## To test
- On a platform org, verify no `/organizations/{slug}/projects` requests
fire from the org selector, org cards, or billing info
- For regular orgs, verify the project count still displays normally
everywhere
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Improvements**
* Organization selector now shows a dedicated "Platform" label for
platform organizations instead of a project count.
* Reduced unnecessary network activity by skipping project fetching when
a platform organization is selected, improving load performance.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Don't fire the `available-versions` request when `dbRegion` is falsy
(undefined or empty string). Fixes race condition where the request
fires before a region is selected.
## To test
- Confirm no invalid `available-versions` request in the network tab
- Confirm create new project still works
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved database region validation during project creation to
consistently handle empty or undefined values.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
MobileNavigationBar was always mounted on desktop, triggering
unnecessary org/project queries even though it's visually hidden with
`md:hidden`. Now only rendered when the viewport is at or below the md
breakpoint.
**Changed:**
- Conditionally render `MobileNavigationBar` using `useBreakpoint('md')`
so it only mounts on mobile
## To test
- Open Studio on a desktop viewport – verify the mobile nav bar is not
in the DOM and no unnecessary requests fire
- Resize to a mobile viewport – verify the mobile nav bar appears and
works normally
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Bug Fixes
* Mobile navigation bar now correctly displays only on mobile devices
based on screen size, improving responsive design behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
## Summary
- Add an Admonition note to the Fair Use Policy section clarifying that
pausing or deleting a project does not remove accumulated usage from the
current billing cycle
- Addresses a common source of confusion identified in #team-support
thread (2026-04-02)
## Test plan
- [ ] Preview the MDX locally to confirm Admonition renders correctly
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated billing FAQ to clarify that pausing or deleting a project
stops new usage from accruing but does not remove usage already incurred
in the current billing cycle; quota-based usage remains counted until
the billing period resets.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
The `compute_badge_upgrade_clicked` event had zero fires since Apr 1
because the PostHog tracking call was never wired up on the "Upgrade
compute" button in the compute badge hover card. This adds the missing
`useTrack` call using the existing event definition in
`telemetry-constants.ts`.
## Changes
- Add `useTrack` hook and `onClick` handler to the upgrade button in
`ComputeBadgeWrapper.tsx`
- Fires `compute_badge_upgrade_clicked` with `computeSize`, `planId`,
and `upgradeType` properties
- Preserves existing `asChild` + `<Link>` navigation pattern
## Testing
Tested on Vercel preview:
- [x] Hover compute badge on a project with non-max compute, click
"Upgrade compute", verify `compute_badge_upgrade_clicked` event appears
in PostHog live events with correct properties
- [x] Verify navigation to compute settings page still works
(client-side, no full reload)
- [x] Test with paid-plan nano project: `upgradeType` should be
`free_micro_upgrade`
- [x] Test with paid-plan non-nano project: `upgradeType` should be
`compute_upgrade`
## Linear
- fixes GROWTH-751
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added analytics tracking for compute upgrade button clicks to record
upgrade type (free micro vs. paid), selected compute size (with
fallback), and plan identifier. This ensures upgrade interactions are
captured for product insights without changing visible UI behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
- Add an always-visible "Upgrade to Pro" button in the dashboard header
for free-plan users (GROWTH-615)
- Button is gated behind a PostHog experiment (`headerUpgradeCta`) with
`control` and `test` variants
- Experiment exposure is tracked for both variants; click events are
tracked when the button is clicked
- Button reuses existing `UpgradePlanButton` component for routing,
permissions, and billing logic
## What is the current behavior?
<img width="3840" height="2160" alt="Arc 2026-04-02 16 36 22"
src="https://github.com/user-attachments/assets/8a94db0c-06c8-4237-8ba5-6ac1fe111a56"
/>
## What is the new behavior?
<img width="3840" height="2160" alt="Arc 2026-04-02 16 36 12"
src="https://github.com/user-attachments/assets/0e60d834-028b-49fd-845e-ce1b4cbcc960"
/>
## Additional context
Add any other context or screenshots.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added an upgrade call-to-action in the header and mobile navigation
(visible on medium+ screens in platform builds) shown to free-plan users
as part of a controlled experiment.
* The CTA records experiment exposures and sends analytics for
impressions and clicks, including the user's current plan, to measure
engagement and upgrade interest.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Refactor
## What is the current behavior?
Storage explorer preferences (`view`, `sortBy`, `sortByOrder`,
`sortBucket`) are managed inline within the Valtio proxy state in
`storage-explorer.tsx`, which reads/writes localStorage directly.
## What is the new behavior?
Preferences are extracted into a dedicated `useStoragePreference` hook
backed by `useLocalStorage`. A companion `getStoragePreference` function
allows the Valtio state to read sort options imperatively for API calls
without holding preference data itself. Consumers import the hook
directly instead of reading preferences from the snapshot.
## Additional context
No behavioral or visual changes — localStorage key and data shape are
unchanged.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Storage view and sorting preferences now persist per project and drive
the explorer UI.
* Changing view or sort preferences refreshes folder contents and clears
the open file preview.
* **Chores**
* Centralized preference handling for consistent behavior across the
storage explorer.
* **Tests**
* Updated tests to exercise the new preference-backed behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
INDATA-193
BACKEND: <https://github.com/supabase/platform/pull/30575>
<img width="1199" height="1005" alt="Screenshot 2026-04-03 at 11 54 29"
src="https://github.com/user-attachments/assets/38e9d676-449f-45c0-9e07-f273312a812f"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Consolidated read replica limit configuration to provide more
consistent behavior across different compute tiers.
* **Tests**
* Added comprehensive test coverage for read replica eligibility checks
and replica limit calculations based on compute tier.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Show Vercel/AWS partner badge on organization selection cards, matching
the existing behaviour in the org dropdown switcher. Uses the existing
`PartnerIcon` component.
**Added:**
- `PartnerIcon` to `OrganizationCard` – renders alongside the MFA lock
icon on the right side of each card
<img width="626" height="275" alt="Screenshot 2026-04-03 at 5 36 54 PM"
src="https://github.com/user-attachments/assets/f3cd2eb4-bf9d-4b42-b94c-e4636ebf7303"
/>
## To test
- Verify Vercel-managed orgs show the Vercel triangle badge
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Partner icon now appears in the organization card header next to the
MFA/security indicator.
* **Style**
* Improved alignment and spacing of header elements; MFA tooltip now
appears alongside the icon with consistent sizing.
* Cleaner grouping of header metadata for easier scanning and visual
clarity.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Feature and docs.
## What is the new feature?
Adds a toggle to enforce current password checks for updating a user's
password (auth)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added configurable option to require the current password when
changing passwords.
* Added configurable option to require recent reauthentication before
allowing password changes.
* **Documentation**
* Added "Password security" guide sections documenting current-password
verification and reauthentication safeguards, with usage examples.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Added sponsor and participant logos to the party page.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added hosts section displaying event partners with logos and
descriptions.
* Updated event page branding and messaging throughout.
* Revised call-to-action button text and styling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Moves knowledge (RLS, Edge Functions, PostgreSQL best practices,
Realtime) out of the static system prompt and into a `load_knowledge`
tool the model calls on demand, reducing prompt bloat. This is a
temporary stopgap until the [standard Supabase
agent-skills](https://github.com/supabase/agent-skills) are ready for
integration in Assistant.
- New always-available `load_knowledge` tool added to
`rendering-tools.ts`
- Updated `Message.Parts.tsx` so the "Ran load_knowledge" chip renders
in chat
- System prompt replaces the four knowledge blobs with an `## Available
Knowledge` block and is hardened to load knowledge for given topics
- New "Knowledge Usage" scorer and `requiredKnowledge` assertions check
that knowledge loads as expected in test scenarios
- Filters GraphQL error responses out of `output.docs` before
faithfulness scoring to reduce noise
See "Knowledge Usage" scoring 100% in evals with no major regressions:
https://github.com/supabase/supabase/pull/44296#issuecomment-4145760236
Sample trace showing the tool in action
([Braintrust](https://www.braintrust.dev/app/supabase.io/p/Assistant/trace?object_type=project_logs&object_id=5a8d02e5-b3b6-40cc-ba76-ecee286478f4&r=351a11c8-9cb7-4945-93ad-d11e8cc2e3e1&s=351a11c8-9cb7-4945-93ad-d11e8cc2e3e1))
<img width="2192" height="1730" alt="CleanShot 2026-03-30 at 13 53
59@2x"
src="https://github.com/user-attachments/assets/f483767c-34e0-401c-8089-5b9834fe696a"
/>
**References**
- https://ai-sdk.dev/cookbook/guides/agent-skills
Closes AI-508
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added dynamic knowledge loading capability enabling the AI assistant
to retrieve on-demand information about PostgreSQL best practices, Row
Level Security, Edge Functions, and Realtime.
* **Bug Fixes**
* Improved search results filtering to exclude error responses in tool
outputs.
* **Tests**
* Enhanced evaluation metrics with knowledge usage scoring.
* Expanded test dataset cases to validate knowledge requirement
handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Modified event landing page to point to Pedro's slides.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the slides download link for the MCP Dev Summit NYC event.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Added a blog post and og/thumb images for the GitHub 100,000 stars
announcement.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Embedded an interactive Developer Growth chart into the new blog post
announcing the milestone.
* **Documentation**
* Published a blog celebrating 100,000 GitHub stars with historical
context, a product principles excerpt, links to related projects, and a
community thank-you.
* Updated the site RSS feed to include the new post and other recent
entries.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Ever since the update to TypeScript 6, IDE auto-imports are suggesting
"node_modules/package_name/...." rather than the correct "package_name".
This is due to our deprecated bare specifier wildcard in paths,
replacing this with a listing of all bare specifiers we currently
support (while migrating away) to restore auto-import suggestions.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated all quickstart guides and tutorials to reference publishable
keys instead of anon keys for Supabase client initialization.
* Simplified environment variable setup instructions across multiple
framework guides by removing anon key configuration requirements.
* Clarified usage of publishable keys in step-by-step setup
documentation for various frameworks and platforms.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: fadymak <dev@fadymak.com>
This pull request refactors the Turbo build configuration by moving each
app's build settings from the root `turbo.json` file into their own
dedicated `turbo.jsonc` files within each app's directory. The root
configuration is simplified to only include generic tasks, improving
maintainability and clarity.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Turbo to v2.9.3 to improve build performance and stability.
* Reorganized and added per-app build pipeline configurations to
streamline builds and caching across the workspace.
* Removed a Tailwind container-queries plugin from one app's styling
setup.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Coerces `before`/`after` cost values to `Number()` in
`QueryPanelScoreSection` and `calculateImprovement` before any
comparison or arithmetic
- Fixes contradictory index advisor display where correct cost numbers
showed 0% improvement and wrong arrow direction
## Root Cause
When `index_advisor_result` is prefetched from the Reports SQL query
(via `json_build_object`), cost values can arrive as strings instead of
numbers. JavaScript string comparison is lexicographic, producing wrong
results:
| Expression | Numbers | Strings |
|---|---|---|
| `after > before` (arrow) | `50 > 100` → `false` ✅ | `"50" > "100"` →
`true` ❌ |
| `costBefore <= costAfter` (improvement calc) | `100 <= 50` → `false` ✅
| `"100" <= "50"` → `true` ❌ |
The direct fetch path (`retrieve-index-advisor-result-query.ts`)
validates through Zod and is unaffected. Only the prefetched path lacks
validation.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved numeric value handling in query performance calculations to
ensure more accurate and reliable improvement metrics.
* **Refactor**
* Enhanced type safety and numeric coercion for query performance score
comparisons, resulting in more consistent and robust metric
calculations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix
## What is the current behavior?
When enabling Apple Sign-in in Studio, the form requires a valid JWT
secret key whenever a client ID is provided. This blocks users who only
use Apple native sign-in (iOS, macOS, watchOS, tvOS), where only the
client ID (bundle ID) is needed and no secret is required.
Resolves AUTH-1138
## What is the new behavior?
The secret key field is now optional, matching Google's provider
behavior. JWT format validation still applies when a secret is provided,
but leaving it empty is allowed. This supports native-only Apple sign-in
configurations.
## Additional context
The validation was simplified from two `.when` clauses (dependent on
both `ENABLED` and `CLIENT_ID`) to a single `.when` (dependent only on
`ENABLED`), matching the pattern used by the Google provider.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## Summary
- Fix `ToggleLegacyApiKeysPanel` being permanently hidden for users with
project-level admin access but no org-level access
- The `useAuthorizedAppsQuery` calls an org-level endpoint
(`/platform/organizations/{slug}/oauth/apps`) which returns 403 for
project-only admins, causing `isAuthorizedAppsSuccess` to never become
`true` and
the entire panel to never render
- When the authorized apps query fails, show a fallback warning
directing users to verify their org's OAuth apps before disabling legacy
keys
## What changed
- Removed `isAuthorizedAppsSuccess` from the rendering guard, the panel
now renders once legacy keys status and permissions resolve
- When the authorized apps query errors (e.g. 403), the button still
opens a warning dialog with appropriate copy before proceeding to the
confirmation modal
## Behavior
| User type | Authorized apps query | Button click |
|---|---|---|
| Org-level access, has apps | Success, apps > 0 | Warning → confirm
modal |
| Org-level access, no apps | Success, apps = 0 | Confirm modal directly
|
| Project-only admin | 403 error | Fallback warning → confirm modal |
## Current behavior
<img width="1461" height="707" alt="image-IcxHfCX0"
src="https://github.com/user-attachments/assets/2fd124cd-02eb-46c0-816e-178fe3ce99b0"
/>
Project admins can't view the button
## Changed behaaviour
<img width="1455" height="704" alt="image-YW1k6GQe"
src="https://github.com/user-attachments/assets/8c428c63-f1de-4b84-a1f2-6af7ff064e50"
/>
Projects admins can view the disable button and when clicked views a
warning about oauth apps:
<img width="451" height="250" alt="image-yu4bux3l"
src="https://github.com/user-attachments/assets/5a314329-350b-4207-b8e4-311d0c827e6f"
/>
and when they visit oauth apps, there is warning to contact with project
owner
<img width="1453" height="578" alt="image-pppzfksn"
src="https://github.com/user-attachments/assets/489ba3ba-c94e-4efb-923b-a989eebb2fc4"
/>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update to `humans.txt` to add `Dimitrios Liappis`
## What is the current behavior?
`Dimitrios Liappis` does not exist in `humans.txt`
## What is the new behavior?
`Dimitrios Liappis` exists in `humans.txt`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated contributor information.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Introduced new Lite Studio application with project management
dashboard
* Added project overview page with status monitoring and quick actions
* Added database browser and project settings management interfaces
* **Chores**
* Added Docker support for containerized deployment
* Added comprehensive project documentation
* Updated workspace configuration
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Design system and validation consistency update.
## What is the current behaviour?
`KeyValueFieldArray` already renders per-cell form messages, but each
consumer still decides its own validation rules. At the moment, some
consumers allow partially filled rows to submit silently, while Log
Drains now treats them as inline validation errors.
## What is the new behaviour?
This PR standardises the recommended partial-row behaviour for the
current `KeyValueFieldArray` consumers by introducing a shared
validation helper and using it from each form schema.
- adds `getKeyValueFieldArrayValidationIssues` alongside
`KeyValueFieldArray`
- keeps `KeyValueFieldArray` presentation-only and leaves validation in
consumer schemas
- shows inline errors when one side of a key/value row is filled and the
other is empty
- keeps fully empty rows as draft rows
- keeps duplicate-key validation in Log Drains, where it already applies
- updates the design-system docs and examples to describe the validation
pattern explicitly
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added reusable key/value validation utilities and public export; forms
now trim header/key/value inputs, show inline errors for partially
filled rows, and remove fully empty draft rows on submit.
* **Documentation**
* Clarified the field-array is rendering-only and added guidance for
placing validation in form schemas and handling draft rows.
* **Tests**
* Added unit and integration tests covering validation rules, duplicate
keys, trimming, draft-row stripping, and payload behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Chore that resolves FE-2785.
## What is the current behavior?
The Log Drains headers section still uses a bespoke add-header mini form
and stores headers directly as a record in form state.
That makes it inconsistent with the shared `KeyValueFieldArray` pattern
already adopted elsewhere in Studio.
## What is the new behavior?
- reuses the shared `KeyValueFieldArray` in the Log Drains destination
sheet
- keeps the external submit contract unchanged by converting between:
- form-only `headerEntries: { key, value }[]`
- submitted `headers: Record<string, string>`
- preserves type-specific defaults:
- webhook starts with `Content-Type: application/json`
- OTLP starts with `Content-Type: application/x-protobuf`
- moves header validation into standard form errors for:
- max 20 headers
- duplicate header names
- partially filled rows, while still allowing fully empty draft rows
- adds focused utility and sheet tests for the new adapter and
validation behaviour
| Before | After |
| --- | --- |
| <img width="1728" height="997" alt="Log Drains Settings Mallet
Toolshed Supabase-027E4669-8B02-4C43-8771-794E13799FA3"
src="https://github.com/user-attachments/assets/43ed6334-28ef-4d47-9747-dfb3221462ec"
/> | <img width="1728" height="997" alt="Log Drains Settings Mallet
Toolshed Supabase-68477EA1-6F56-4BE2-9355-C121896F11E4"
src="https://github.com/user-attachments/assets/9391bccd-3a50-4468-91e7-05059d41543c"
/> |
## Additional context
This is PR 4 of the DEPR-394 field-array stack.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Enhanced header validation with specific error messages for duplicate
headers and missing values.
* Improved form behavior for edge cases in header entry management.
* **New Features**
* Added destination-specific default headers for clearer initial
configuration.
* **Tests**
* Added comprehensive test suite validating header management and form
submission behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Bug fix / UX improvement for long-running project transitions. Resolves
DEPR-362.
## What is the current behaviour?
- `PausingState` does not preserve elapsed time across refreshes, so the
stuck escalation can disappear for the same user.
- `RestoringState` relies on weaker frontend heuristics and always
showed a support CTA in the footer even before the restore was clearly
long-running.
## What is the new behaviour?
- `PausingState`
- Persists a per-project pause start time in local storage so the stuck
CTA survives refreshes in the same browser.
- Escalates after 10 minutes.
- Clears the stored timer when pausing succeeds or fails.
- `RestoringState`
- Persists a per-project restore start time in local storage so the
stuck CTA survives refreshes in the same browser.
- Removes the always-visible footer CTA and only escalates once
restoration is genuinely long-running.
- Computes the long-running threshold from volume size using a shared
restore estimate: `max(10, ceil(estimateRestoreTime(sizeGb) * 1.5))`.
- Clears the stored timer when restoration succeeds or fails.
- Shared changes
- Extracts reusable transition timing helpers and restore estimate
helpers with unit tests.
- Reuses the same restore estimate formula for branch restore timing and
restore escalation, so the two do not drift.
| `PausingState` | `RestoringState` |
| --- | --- |
| <img width="1570" height="906" alt="Krosno Toolshed
Supabase-C6D7E29F-C38D-43E1-8AF9-C612B6A2FD8D"
src="https://github.com/user-attachments/assets/e0bd9434-09b6-4cf6-bffa-07a0ddcdf5db"
/> | <img width="1570" height="906" alt="Krosno Toolshed
Supabase-51F4763D-B798-4B41-A92D-43B3CF8ECDAF"
src="https://github.com/user-attachments/assets/d0e47356-dcc3-42aa-b602-802a35249a16"
/> |
## Additional context
- This PR intentionally stays frontend-only.
- We are not exposing backend lifecycle timestamps here; local storage
is the stopgap to improve the same-browser experience now.
- If you need to test the frontend blocker states locally, use
[`dnywh/chore/depr-362-blocker-preview-mocks`](https://github.com/supabase/supabase/tree/dnywh/chore/depr-362-blocker-preview-mocks)
and append one of the following query params to a project URL:
- `?mockProjectBlockingState=pausing`
- `?mockProjectBlockingState=pausing-long-running`
- `?mockProjectBlockingState=restoring`
- `?mockProjectBlockingState=restoring-long-running`
- I know these two views are quite differently stylistically, and will
consolidate later
- References DEPR-434
Prashant Sridharan