## What
Escapes user-controlled string values before interpolating them into SQL
in `apps/studio/data/database-queues/`.
## Why
Several queue message queries were constructing SQL via direct string
interpolation without sanitization:
| File | Value | Risk |
|------|-------|------|
| `database-queue-messages-send-mutation.ts` | `payload` | **High** —
arbitrary user-provided JSON; a single quote breaks the query and a
crafted payload could execute arbitrary SQL |
| `database-queue-messages-infinite-query.ts` | `afterTimestamp` |
Medium — sourced from a previous DB result, but still unsafe to
interpolate |
| `database-queue-messages-delete-mutation.ts` | `messageId` | Low —
typed `number`, but truncated for safety |
| `database-queue-messages-archive-mutation.ts` | `messageId` | Low —
same as above |
## Fix
- Escape string literals with the standard PostgreSQL approach (doubling
single quotes `'` → `''`) before interpolation
- Wrap numeric `messageId` values with `Math.trunc()` to prevent
floating-point edge cases
- `queueName` was already validated via `isQueueNameValid` regex
(alphanumeric/underscore/hyphen only) — no change needed
Fixes#44375
## Test plan
- [x] Open Queue Messages panel in Studio
- [x] Send a message with a payload containing single quotes (e.g.
`{"key": "it's a value"}`) — verify it sends without error
- [x] Verify pagination still works correctly after fix
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved safety of queue operations by ensuring message IDs, payloads,
timestamps, and queue names are handled securely to prevent injection
and formatting issues.
* Normalized numeric message fields (IDs/delays) for consistent
processing.
* Increased stability and correctness of archive, delete, query, and
send operations; no public APIs were changed.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
We had some bugs where webhooks were not able to be turned on for
projects. This is to ensure that doesn't happen again
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added UI tests for integration overview and installation flows: verify
action enablement/disablement (aria-disabled and visual opacity)
depending on required extensions, ensure the "Install integration"
button is disabled when no installation command or required extensions
are missing, and confirm the installation command is invoked (without
executing SQL) when appropriate.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
Adds a link to the [OSS
repo](https://github.com/supabase-community/supabase-ssh) in the
supabase.sh blog post.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated blog post with refined introductory messaging
* Redirected community feedback links to the open-source repository for
issue reporting
* Added repository information to facilitate user access and
contributions
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
- The legacy jwt settings still uses `formik` and we want to remove it
in favour of `react-hook-form` to keep only one form library
- The legacy jwt settings does not follow the design system guidelines
## Solution
- Migrate to `react-hook-form`
- Apply the design system guidelines
## How to test
To test the custom JWT secret, I haven't found a better way than
inverting the condition at L337 (`!legacyKey` to `legacyKey`). This
allowed me to ensure the process worked at least up to the API call
which fails with my local instance as legacy tokens aren't supported
anymore.
## Screenshots
Before:
<img width="1199" height="599" alt="image"
src="https://github.com/user-attachments/assets/1c6e0bb1-0698-4238-847f-d2c72adf3462"
/>
After:
<img width="1228" height="646" alt="image"
src="https://github.com/user-attachments/assets/3b2a45a9-aa43-4c3e-9653-2b2610616889"
/>
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* **Chores**
* Updated internal module import paths across hook files to use
standardized path aliases for improved code consistency and
maintainability.
## Summary
- Adds 6 Playwright E2E tests for queue integration: view page, create
basic queue, create unlogged queue, delete queue, purge messages, and
send test message
- Adds `aria-label` to icon-only Purge and Delete buttons in
`QueueTab.tsx` for reliable test selectors
- Follows existing `cron-jobs.spec.ts` patterns for setup/teardown and
API helpers
## Test plan
- [x] All 6 queue integration tests pass locally against self-hosted
Supabase
- [x] Tests run stably in parallel (3 workers)
- [x] Cleanup via `withSetupCleanup` ensures no leftover test queues
## Problem
Project cards on the home page showed resource exhaustion warnings
twice: once as a badge in the card header, and again as an alert in the
card footer. This created a confusing, redundant UI as seen when a
project has disk IO, CPU, or other resource warnings active.
## Fix
Removed `resourceWarnings` from the footer `ProjectCardStatus` render in
`ProjectCard.tsx`. Resource exhaustion state now only appears as the
header badge (which already shows a tooltip with the description on
hover). Project status indicators such as paused or restarting still
appear in the footer since those do not depend on resource warnings.
Also removed the dead `showResourceExhaustionWarnings = false` flag from
`ProjectCardStatus.tsx`, which was hardcoded to false and only gated
description text that was no longer reachable.
## How to test
- Navigate to the org home page with a project that has an active
resource warning (disk IO, disk space, CPU, memory, or read-only mode).
- Confirm the warning badge appears in the card header with the correct
color (warning or critical).
- Confirm no duplicate alert appears in the card footer area.
- Confirm that paused or restarting projects still show the status alert
in the footer.
- Confirm the table view still shows the badge correctly in the status
column.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
**Style**
- Project status information now displays exclusively in the project
card footer, removing redundant header display for a cleaner interface.
- Simplified resource warning notification logic for more consistent and
straightforward warning presentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds blog post for supabase.sh.
## Preview
https://zone-www-dot-com-git-blog-supabase-ssh-supabase.vercel.app/blog/supabase-docs-over-ssh
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a new blog post, "Supabase docs over SSH," describing SSH-based
browsing of Supabase docs, agent setup commands, and navigation tips.
* Updated the site RSS feed to include the new post and refreshed the
feed build date.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Updates the tooltip copy for `public` pills in Storage. More accurate
description.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Unified the tooltip text for "Public" buckets across the storage
interface so the same explanatory message appears consistently on bucket
listings, badges, and bucket pages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Release Notes
* **New Features**
* Added project acknowledgement flow when deleting organizations. Users
with 10 or fewer projects must confirm each project individually; users
with more than 10 projects can confirm all at once.
* Organizations now display project counts and compute sizes during
deletion confirmation to help users understand what will be deleted.
## What kind of change does this PR introduce?
**Improvements to the delete organization workflow:**
* Added a checklist that requires users to acknowledge each project
before deleting organizations with up to 10 projects, and a single bulk
acknowledgement for organizations with more than 10 projects. This helps
prevent accidental deletion of projects.
* Extracted acknowledgement UI into dedicated sub-components
(`DeleteOrganizationButton.ListAck.tsx` and
`DeleteOrganizationButton.SingleAck.tsx`).
**Error handling and validation:**
* Acknowledgement state (`checkedProjects`/`acknowledgedAll`) is reset
synchronously in the button's click handler before the modal opens,
preventing any stale checked state from briefly appearing on re-open.
* Acknowledgement state is also reset when the organization changes
(`orgSlug` effect), ensuring a fresh confirmation when switching orgs.
* Deletion is blocked while projects are loading **or fetching**
(including background refetches triggered by `refetchOnMount:
'always'`), preventing deletion from proceeding on stale or incomplete
project data.
* Added error handling for project loading failures, and prevented
deletion if projects are not fully acknowledged or if there is a
loading/error/fetching state.
## What is the current behavior?
No explicit confirmation from the user to acknowledge all the projects:
<img
src="https://github.com/user-attachments/assets/68840781-467b-41ef-a821-50e471e93cc5"
width="500">
## What is the new behavior?
Small org (≤10): all projects load and checklist works
<img
src="https://github.com/user-attachments/assets/9869e94c-6a6f-4d65-8550-55da58a388f2"
width="500">
Large org (>10): show one checkbox
<img
src="https://github.com/user-attachments/assets/8420dfd1-814a-4656-acad-7fa00b088e83"
width="500">
## Additional context
* Projects are fetched lazily (`enabled: isOpen`) so no unnecessary
network requests occur until the delete modal is opened.
* The delete guard now checks both `isLoading`, `isProjectsDataPending`
and `isFetching` to cover background refetch scenarios where cached data
may be stale.
* Added explicit handling for the “pending but not loading” case to
avoid misleading users with acknowledgement errors before projects are
loaded.
* Limited project fetch size to MAX_PROJECT_ACKNOWLEDGEMENTS + 1 to
reduce payload and improve modal load performance.
* Acknowledgement state is reset both on modal open and when the
organization changes (orgSlug), ensuring consistent behavior across org
switches.
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix
## What is the current behavior?
search is passed in un-escaped
## What is the new behavior?
escapes to ensure correct query format
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Bug Fixes
- Enhanced query safety and reliability in performance monitoring with
improved parameter handling
- Fixed query condition handling for edge cases with non-finite values
## Refactor
- Simplified query generation logic and streamlined internal
implementation
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update: `supabaseR` is a structured, planned approach by
@deepanshkhurana and @maciekbanas to support all Supabase functionality
through a package in R.
We're moving with a fully open-source approach. A public Project board
can be found
[here](https://github.com/users/DeepanshKhurana/projects/6). The goal is
to support all Supabase functionality and get the package on the
official R CRAN soon.
## What is the current behavior?
There is no Supabase package for R.
## What is the new behavior?
We are introducing a new package for R.
## Additional context
Add any other context or screenshots.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added new R language library entry to the community libraries table
with documentation link
* Enhanced table formatting and standardized column widths across all
community library entries for improved readability
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
docs update
## What is the new behavior?
Adds 503 troubleshooting doc
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added comprehensive troubleshooting guide for Edge Function 503 error
responses, including diagnostic procedures to classify errors into three
categories (app-level, boot-level, and internal failures) with detailed
resolution instructions specific to each error type and links to
complementary resources.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
This PR introduces some visual indicators when a Nano project is
exhausting resources on Pro plus plans. The indicator tells the user a
free upgrade to Micro is available via a flashing Nano badge that guides
them to Upgrade and a global banner that notifies them resources are
near exhaustion, please upgrade for free.
| Project List | Project View |
|--------|--------|
| <img width="412" height="223" alt="Screenshot 2026-03-31 at 16 11 19"
src="https://github.com/user-attachments/assets/0d0e7727-e4eb-4ade-9024-528a2501596c"
/> | <img width="1256" height="618" alt="Screenshot 2026-03-31 at 16 11
10"
src="https://github.com/user-attachments/assets/b664e020-2b18-4842-8e64-4e49fac69eef"
/> |
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Free Micro Upgrade banner appears for nano-tier projects near compute
exhaustion with animated visuals and an “Upgrade for free” CTA.
* Compute badge highlights near-exhaustion with glow/shimmer and an
animated upgrade indicator; optional icon support added.
* Per-project banner dismissal is saved locally; dismissed banners
remain hidden.
* **Tests**
* Added tests covering banner display and dismissal scenarios.
* **Chores**
* Added local-storage keys and telemetry events for banner and upgrade
interactions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The Compute and Disk settings page shows all 12+ instance sizes (Nano
through >16XL) in a grid, which requires scrolling on smaller screens
like a 13" MacBook. This makes it impossible to see all three sections
(compute size, disk size, advanced settings) in a single view. Free tier
users have no need to see 8XL, 12XL, or 16XL options.
## Fix
Show only the first 6 compute sizes (Nano through XL) by default,
cutting the grid from 4 rows to 2 rows. Larger sizes (2XL and above,
plus the >16XL contact card) are revealed via a "Show all sizes" toggle
button below the grid. The grid auto-expands if the project is already
running on a large instance size so the selected option is always
visible.
## How to test
- Go to Settings > Compute and Disk on a project
- Verify only 6 cards are visible by default (Nano, Micro, Small,
Medium, Large, XL)
- Verify the Disk size and Advanced settings sections are visible
without scrolling on a 13" screen
- Click "Show all sizes" and verify the remaining sizes appear (2XL
through 16XL plus the >16XL contact card)
- Click "Show fewer sizes" and verify the grid collapses back to 6 cards
- On a project running 4XL or larger, verify the grid opens expanded by
default so the selected card is visible
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Compute size options now display in a compact view with a toggle to
expand and show all available sizes
* Auto-expands to reveal the currently selected compute size when it's
not visible in the initial view
* Enhanced loading state for improved visual clarity
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
docs update
## What is the new behavior?
Adds 500 code troubleshooting guide for Edge Functions
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* New troubleshooting guide for HTTP 500 errors in Edge Functions
covering diagnostic workflows, SQL-based log analysis techniques,
methods to distinguish between unhandled JavaScript errors and custom
error responses, and targeted solutions for common error scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
### Summary
This PR refactors the billing address form to use Stripe AddressElement
on both the org billing page and the missing-address modal, adding
Google Maps autocomplete and country-aware state/province inputs.
### Testing
- Address element renders on org billing page, autocomplete works, and
state/province options update per country.
- Existing billing address data loads correctly into the form.
- Need to verify this with invalid country/state as well.
- Save enables only when the form is dirty after editing address or tax
ID fields.
- Cancel restores both address and tax ID to the original values.
- Submitting with missing required address fields shows a validation
toast.
- Tax ID options are filtered by the selected billing country.
- Tax-ID-only edits submit successfully without interacting with the
address form.
- Without billing write permission, address fields are read-only.
- Update billing address modal behaves the same as the org billing page.
- Address element appearance looks correct in both light and dark mode.
- Payment method form remains unchanged and still uses floating labels.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Billing form now uses Stripe Address Element via Stripe Elements with
an embedded custom font and theme-aware appearance; tax-ID entry remains
separate.
* **Bug Fixes**
* Stronger address validation and submit gating, improved dirty-state
tracking, explicit save confirmation and reset behavior, and clearer
error toasts on update failures.
* **Tests**
* Expanded tests covering hook behavior, address element validation,
submit gating, payloads, reset, and permission scenarios.
* **Style**
* Adjusted billing email form spacing/layout.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
For database extensions, previously dashboard would fire a separate call
just to retrieve the "default schema" for an extension via
`useDatabaseExtensionDefaultSchemaQuery` from the
`pg_available_extension_versions` table (the `schema` from this table
implies where the extension will be installed in)
## Changes involved
Am updating the `useDatabaseExtensionsQuery` to use a custom studio SQL
that will fetch this data in one request via a `LEFT JOIN`, so dashboard
no longer needs to fire a request to `pg_available_extension_versions`
each time we open the `EnableExtensionModal` since all the info we need
is loaded up front.
Have also validated that the cost of the custom studio SQL is low (6.8,
via explain analyze) so performance wise on the project's DB should be
okay.
This will then also allow us to correctly render the "default schema" of
the extensions in the new Install Integration Sheet now that we have
that information up front.
## Misc fix
Also fixed a small issue on the database extensions page whereby if you
searched for an extension that's hidden (e.g pg_tle), there's no "No
results" UI state showing up
<img width="1112" height="319" alt="image"
src="https://github.com/user-attachments/assets/eb488117-2a24-4317-ad73-1d636f9b1bc8"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Per-extension default schema detection surfaced across install flows;
default schema options added to selectors when applicable.
* **Bug Fixes**
* Hidden extensions filtered out earlier so they no longer appear in
lists.
* Install button now correctly disables when required extensions are
missing.
* **Refactor**
* Consolidated extensions metadata retrieval and simplified schema
selection/validation logic; UI text formatting standardized.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update
## What is the current behavior?
N/A
## What is the new behavior?
Add my name to humans.txt
## Additional context
First contribution
Resolves FE-2931
Just removes this callout here as the issue is resolved
<img width="2574" height="298" alt="image"
src="https://github.com/user-attachments/assets/e5e45640-9b16-43c1-9a14-b8ad4594540e"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Removed EU projects metrics limitation warning from observability
views.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds the following badge for Multigres projects:
<img width="716" height="377" alt="Screenshot 2026-03-27 at 4 54 40 PM"
src="https://github.com/user-attachments/assets/b8d7b3a5-4d6d-4b17-b18d-7f58c2e2b81c"
/>
<img width="688" height="392" alt="Screenshot 2026-03-27 at 4 54 48 PM"
src="https://github.com/user-attachments/assets/853a0ba7-de69-4476-b2ba-d596740e28ab"
/>
To test:
- ensure the badge doesn't show on non-multigres projects
- create a project with HA enabled and check the badge is visible
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a High Availability badge indicator to the project home view
that displays when a project has high availability enabled
* Hovering over the badge reveals detailed information about the high
availability configuration, including an animated server grid
visualization and a link to the high availability documentation
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Ali Waseem <waseema393@gmail.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Adding myself to [humans.txt](https://supabase.com/humans.txt)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated team contributors list in public documentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Reapply the changes from #42184 which were reverted in #42271.
Re-applies the AWS EBS update (January 15, 2026): up to 4 modifications
in a rolling 24-hour window, with no mandatory wait between
modifications as long as the previous one has finished.
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
The Fly login/auth endpoints were removed from the management API
(supabase/platform#30987). This cleans up the associated studio code and
regenerates the API types.
Note: existing Fly projects are still running, so all `cloud_provider`
guards and Fly-specific UI (disk management, billing, pg_cron warnings,
etc.) are intentionally kept in place.
**Removed:**
- `sign-in-fly-tos.tsx` page
- `organization-by-fly-organization-id-mutation.ts`
- `project-by-fly-extension-id-mutation.ts`
**Other:**
- Regenerated API types to reflect removed endpoints
- Removed stale Fly-related comments in `InstanceConfiguration`,
`ObservabilityMenu`, `ReportsMenu`
- Fixed unrelated optional chaining bug in `SSOConfig.tsx`
## To test
- Check project creation flow still works
- Verify `/sign-in-fly-tos` no longer resolves
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
<img width="1575" height="1134" alt="image"
src="https://github.com/user-attachments/assets/994b1113-717f-44a2-89a4-13bc0182db20"
/>
Attempts to improve our edge function overview pages to provide stronger
insights into the health of a function, including reliability (error
rates), performance (execution times) and usage (cpu and memory).
As part of this work it refactors existing charts to use our new chart
components.
main consideration is the collective performance of error queries
https://github.com/supabase/supabase/pull/44009/changes#diff-2a79cf61c5397a8ef363c333229fa7729a2efc90a4d8e0806e49c212d5aa97e7
## To test:
1. Create an edge function that errors out randomly across requests. You
can use cron to poll this function every second.
2. View the edge function and on the overview page confirm that errors
are showing and grouped correctly in recent failed invocations sections.
---------
Co-authored-by: Ali Waseem <waseema393@gmail.com>
## What kind of change does this PR introduce?
Chore that resolves DEPR-394.
## What is the current behavior?
This stack is consolidating RHF field-array patterns in smaller
reviewable steps.
After the key/value work lands, repeated single-value inputs are still
implemented separately across auth and SSO forms, and the design-system
docs only document the key/value pattern.
## What is the new behavior?
- adds a shared `SingleValueFieldArray` component in `ui-patterns`
- migrates repeated single-value inputs in:
- Redirect URL allow-list modal
- OAuth app redirect URIs
- SSO domains
- SSO attribute mapping
- documents the single-value pattern in the design system with:
- a dedicated fragment page
- updated forms guidance
- updated form pattern demos
- adds focused redirect URL modal coverage
## Additional context
This is PR 3 of a 3-PR stack for DEPR-394.
Base PR: #44058
- Add "[Feature Catalog](https://supabase.com/features)" to Product
above Pricing
- Add a section called "Community" underneath the "Developers" section
and move/add the following into it:
- [Events & Webinars](https://supabase.com/events)
- SupaSquad
- Contributing
- Open Source
- DevTo
- Move "Careers" to Company, above "General Availability"
- Add a sign-up for newsletter field. This will enable people to sign up
for our newsletter without having to sign up for the product. (good for
self-hosted and open-source users)
| Before | After |
|--------|--------|
| <img width="1468" height="525" alt="Screenshot 2026-03-13 at 16 40 47"
src="https://github.com/user-attachments/assets/be17cfdb-2523-4602-a3ba-a3b3041c62a4"
/> | <img width="1523" height="605" alt="Screenshot 2026-03-13 at 16 40
33"
src="https://github.com/user-attachments/assets/dd3707fd-cf2c-40d4-ad77-60d6a1f0aaf5"
/> |
Bug fix
## What is the current behavior?
Cron jobs using pg_cron's `$` syntax (representing 'last day of month')
show 'Unable to parse next run for job' in the dashboard's Next run
column, even though these are valid pg_cron schedules.
## What is the new behavior?
The dashboard now correctly parses schedules using `$` and displays the
proper next run time.
## Root Cause
pg_cron uses `$` for 'last day of month', but the `cron-parser` library
used by Studio uses `L` for the same purpose. The `$` character was
causing the parsing to fail.
## Fix
Normalize pg_cron's `$` syntax to cron-parser's `L` syntax before
parsing. Both represent 'last day of month' - it's just a syntax
difference between the two systems.
Fixes#42176
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved cron job scheduling to correctly calculate next-run times for
pg_cron-compatible schedule expressions.
---------
Co-authored-by: Charis <26616127+charislam@users.noreply.github.com>
## Summary
- Fixes the "Enable webhooks" button being greyed out in the
non-marketplace UI
- PR #44277 added `requiredExtensions: ['pg_net']` for the new UI, which
inadvertently caused the old UI's actions area to get disabled via
`hasToInstallExtensions`
- Skips the disabled styling when `hideRequiredExtensionsSection` is
set, since webhooks handles `pg_net` installation server-side
Companion to #44402 which fixed the same issue in the new (V2) UI.
## Summary
- The "Install integration" button in `InstallIntegrationSheet` was
unconditionally disabled when required extensions were missing from the
DB image (`hasMissingExtensions`)
- For webhooks, the installation goes through `installationCommand`
(platform API `/database/{ref}/hook-enable`) which handles `pg_net`
setup server-side — the client-side extension check is unnecessary
- Now only disables the button for missing extensions when there is no
custom `installationCommand`
## How this happened
PR #44277 migrated Database Webhooks to the new marketplace integrations
UI. The `InstallIntegrationSheet` already had a
`disabled={hasMissingExtensions}` guard from its original implementation
(for extension-only integrations like queues). When webhooks was added
with its `installationCommand` + `requiredExtensions: ['pg_net']`, the
guard wasn't updated to account for the command-based install path.
## Test plan
- [ ] With marketplace flag enabled, verify the "Install integration"
button is clickable for webhooks even if `pg_net` is not pre-installed
- [ ] Verify clicking it successfully enables webhooks via the platform
API
- [ ] Verify that extension-only integrations (e.g. queues) still
correctly disable the button when extensions are unavailable
Fixes FE-2928
`useOrgSSOConfigQuery` had an internal plan-based gate
(`canSetupSSOConfig`) that permanently disabled the query for
non-team/enterprise orgs.
The fix removes the redundant plan gate from the query hook, plan-based
access is already controlled upstream via the entitlement check in the
component.
## Problem
On self-hosted Supabase instances where the `pg_stat_statements`
extension is not installed, the Observability Overview page
automatically queries the extension on every page load. This produces
"relation pg_stat_statements does not exist" errors in Postgres logs for
all projects without the extension. Additionally, if a user navigated to
the Query Performance page, they received a generic error with no
actionable guidance. A secondary issue allowed malformed sort URL params
(e.g. `?sort=created_at:asc&order=asc`) to be interpolated directly into
SQL ORDER BY clauses.
## Fix
- Wrapped the `useSlowQueriesCount` SQL in a `CASE WHEN EXISTS (SELECT 1
FROM pg_extension WHERE extname = 'pg_stat_statements')` guard. The
query now returns 0 silently instead of erroring when the extension is
absent.
- Added a `VALID_SORT_COLUMNS` whitelist in
`generateQueryPerformanceSql`. Invalid column names from URL params are
rejected and the query falls back to the preset default ORDER BY.
- When the Query Performance page fails because `pg_stat_statements`
does not exist, a `warning` admonition now appears with "Enable it in
Database -> Extensions" guidance instead of a generic destructive error.
The Sentry capture is skipped for this expected configuration state.
- Extracted `buildSlowQueriesCountSql` as a testable function and added
unit tests for both fixes.
## How to test
**Extension not installed (self-hosted):**
1. Run a self-hosted Supabase instance without the `pg_stat_statements`
extension enabled.
2. Navigate to the Observability Overview page.
3. Check Postgres logs -- no "relation pg_stat_statements does not
exist" errors should appear.
4. Navigate to the Query Performance page.
5. Expected: a yellow warning admonition appears saying the extension is
not enabled, with a link to Database -> Extensions. No red error.
**Extension installed (normal flow):**
1. With `pg_stat_statements` installed, navigate to Observability
Overview.
2. Expected: slow queries count loads as normal.
3. Navigate to Query Performance -- data loads as normal.
**Invalid sort URL param:**
1. Navigate to
`/project/<ref>/observability/query-performance?sort=created_at:asc&order=asc`.
2. Expected: the page loads and falls back to the default sort order
(total time descending). No SQL error in logs.
**Unit tests:**
```
node apps/studio/node_modules/vitest/dist/cli.js run --no-coverage \
apps/studio/components/interfaces/Observability/useSlowQueriesCount.test.ts \
apps/studio/components/interfaces/QueryPerformance/useQueryPerformanceQuery.test.ts
```
All 28 tests should pass.
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
When importing a CSV file, empty cells were always imported as empty
strings with no way to import NULL values instead. This adds a "Treat
empty cells as NULL" checkbox to the import configuration panel.
When enabled, PapaParse's transform option converts empty strings to
null before the data is parsed and previewed, so the imported rows
correctly contain NULL rather than empty strings.
Fixes#43258.
## What kind of change does this PR introduce?
Bug fix
## What is the current behavior?
Empty cells in a CSV file are always imported as empty strings with no
way to import NULL values instead. Fixes#43258.
## What is the new behavior?
"Treat empty cells as NULL" checkbox is added to the import
configuration panel. When enabled, empty cells are imported as NULL
instead of empty strings. Toggling the checkbox instantly re-parses the
preview.
## Additional context
The fix uses PapaParse's transform option to convert empty strings to
null before parsing. Applies to both file uploads and pasted text.
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Charis Lam <26616127+charislam@users.noreply.github.com>
## Summary
Remove the privacy policy update notification banner that was added for
the March 2026 policy update. The effective date has passed and users
have had sufficient notice.
## Changes
- Remove `PrivacyUpdateBanner` component from `AnalyticsSettings.tsx`
and its unused imports
- Remove banner usage from the organizations list page and org projects
page
- Remove `PRIVACY_NOTICE_ACKNOWLEDGED` localStorage key
## Testing
No setup needed - this is a removal of UI elements.
Tested on Vercel preview:
- [x] Organizations page loads without the banner
- [x] Org projects page loads without the banner
- [ ] No console errors on either page
- [x] Analytics settings page still renders correctly
## Linear
- fixes GROWTH-692
## Context
Resolves FE-2923
There's an issue with creating s3 keys in the storage settings at the
moment, where naming your key throws a form field validation error. This
PR fixes that - not sure when this was introduced though, but the main
fix was just using `field` from `render` instead of calling `register`
## To test
- [ ] Verify that you can create an s3 access key via the storage
settings
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix
## What is the current behavior?
The `getNextPageParam` function in
`database-queue-messages-infinite-query.ts` uses `<=` instead of `>=`,
which means pagination never stops. Since the result length is always
less than or equal to the page size, `hasNextPage` is always `true`,
causing infinite API requests when viewing queue messages in Studio.
Resolves#44291
## What is the new behavior?
Uses `>=` to correctly detect when there are more pages, consistent with
every other infinite query in the codebase:
- `database-cron-jobs-infinite-query.ts` uses `>=`
- `users-infinite-query.ts` uses `>=`
- `database-cron-jobs-runs-infinite-query.ts` uses `< PAGE_SIZE` to
return `undefined` (equivalent logic)
## Additional context
One character change: `<=` to `>=` on line 112.
