## Problem
When I bumped the pnpm-lock file in an unrelated KB fix (#51132), I
believe that refreshed the build cache (either that, or Vercel started
flagging this issue very recently).
At any rate, builds are now failing b/c of a [vulnerable
Tanstack/react-start
package](https://github.com/TanStack/router/security/advisories/GHSA-qx66-fv34-fjm8),
which this PR attempts to fix.
```
The build blocks vulnerable @tanstack/react-start@1.168.18 due to an XSS security check.
```
<img width="1355" height="397" alt="image"
src="https://github.com/user-attachments/assets/7d0d90fb-009c-4a0b-aadc-b526e0fcce0a"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated project maintenance settings and supporting TanStack package
versions.
* Improved error reporting so standard errors include their stack trace,
while other error values are logged directly.
* No app features were added or removed.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
## What
Adds a warning in Project Settings > API when the `authenticator` role's
`pgrst.db_schemas` setting overrides the Dashboard's "Exposed schemas"
configuration, plus an inline "Reset override" button to fix it in one
click.
## Why
`ALTER ROLE authenticator SET pgrst.db_schemas = ...` silently overrides
what PostgREST actually exposes, regardless of what's selected in the
Dashboard. Users hit a confusing PGRST106 error with no indication that
a role-level override is the cause.
## How
- New query (`authenticatorRoleConfigQueryOptions`) reads
`pg_roles.rolconfig`
for the `authenticator` role and parses out any `pgrst.db_schemas`
value.
Configured to always refetch on mount and window focus, since the fix is
often applied outside the Dashboard (SQL editor, another client) with no
cache-invalidation event for the app to react to.
- `PostgrestConfig.tsx` compares that value against the currently
selected
schemas and shows an `Admonition` warning naming the actual overriding
schemas, with a link to the PGRST106 troubleshooting guide, when they
differ.
- The warning includes a "Reset override" button that runs
`alter role authenticator reset pgrst.db_schemas` after a confirmation
step (showing the exact SQL that will run, with a copy button), then
refetches so the warning clears immediately without a page reload.
## Testing
1. In the SQL Editor of a test project, run:
```sql
alter role authenticator set pgrst.db_schemas = 'public';
```
2. Go to Project Settings > API, and select a schema other than (or in
addition to) `public` in "Exposed schemas" (e.g. add `api`).
3. The new warning should appear, naming `public` as the schema actually
in effect, with a link to the PGRST106 troubleshooting guide.
4. Click "Reset override" in the warning, confirm in the modal, and
check
that the warning clears immediately without a page reload.
5. Alternatively, clear the override manually from the SQL editor:
```sql
alter role authenticator reset pgrst.db_schemas;
```
then navigate away from the API settings page and back (or refocus the
browser tab) — the warning should clear without a hard refresh.
Fixes
[FE-4472](https://linear.app/supabase/issue/FE-4472/warn-when-authenticator-role-overrides-exposed-schemas)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* The API settings page now warns when the authenticator role’s exposed
schemas differ from the saved Dashboard configuration.
* You can reset the override to restore the saved schema configuration.
The reset requires permission and provides success or error feedback.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Document `supabase init --use-orioledb` in the CLI reference. Add
`db.orioledb_version` to the CLI config reference, and mark
`experimental.orioledb_version` as deprecated.
This complements the general OrioleDB beta guide update in #50813.
Companion CLI PR: https://github.com/supabase/cli/pull/6828, released in
[v2.119.0](https://github.com/supabase/cli/releases/tag/v2.119.0).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Documented the `supabase init --use-orioledb` option, which sets the
OrioleDB image version in `supabase/config.toml`.
* Added configuration guidance for `db.orioledb_version`, including its
PostgreSQL version requirements.
* Marked `experimental.orioledb_version` as deprecated and directed
users to `db.orioledb_version`. The CLI continues to read the
experimental setting and warns when it is set.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
## Problem
The Snowflake destination still uses a neutral text monogram even though
its Studio asset is available. Supporting that monogram also leaves a
separate rendering path used by no other destination.
## Solution
Restore Snowflake through the shared brand-icon registry introduced by
#51073. Simplify `DestinationLogo` back to a map of destination marks,
removing the monogram type, configuration, and rendering branch.
| After |
| --- |
| <img width="924" height="730" alt="CleanShot 2026-09-30 at 15 14
59@2x"
src="https://github.com/user-attachments/assets/7409d483-3371-45ec-bf54-0ddc6ad22857"
/> |
## Review instructions
1. Open `/project/<ref>/database/replication` with a Snowflake pipeline.
2. Confirm the Snowflake mark appears in the pipeline list and diagram.
3. Open the pipeline child route and confirm the same mark appears in
its header.
4. Confirm the other destination marks remain unchanged in light and
dark themes.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Visual Updates**
* Snowflake replication destinations now display a themed brand icon
instead of the “SF” monogram. Other destinations retain their existing
icons.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
As per PR title - this was the behaviour for the SQL Editor and figured
it makes sense to also have this behaviour in the Explorer QueryEditor +
Logs Explorer where the main UX is writing queries, and lets the user
bring the active section of the code closer to the middle of the
viewport (rather than right at the bottom)
<img width="790" height="305" alt="image"
src="https://github.com/user-attachments/assets/07eb63fa-1bb9-4abe-859e-2968a73e7ca5"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Editor Improvements**
* Query editors now allow scrolling beyond the final line, providing
more room to position the last lines on screen.
* The SQL editor no longer forces the decoration area to zero width; it
now uses Monaco’s default width behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
Some destination marks need different assets to maintain contrast across
light and dark surfaces. Their paths are also duplicated between
Pipelines and Wrappers.
## Solution
Add a shared brand-icon registry that supports either one asset or light
and dark variants. Pipeline destination logos resolve against the active
theme, while Wrappers continue using the light variant for their white
logo tiles.
This keeps single-asset destinations unchanged and preserves the
existing monogram treatment where applicable.
| Light | Dark |
| --- | --- |
| <img width="926" height="742" alt="CleanShot 2026-09-30 at 15 03
31@2x"
src="https://github.com/user-attachments/assets/d76e5995-1bb8-4cb7-b991-c5dc1a5d8cb0"
/> | <img width="926" height="732" alt="CleanShot 2026-09-30 at 15 03
03@2x"
src="https://github.com/user-attachments/assets/83d45f30-3bf6-4ddc-8607-e27628cb4966"
/> |
## Review instructions
1. Open `/project/<ref>/database/replication` with pipelines using the
themed destination marks.
2. Switch between light and dark themes from the account menu.
3. Confirm each themed mark swaps assets and remains legible in the
pipeline list, diagram, and child-route header.
4. Open Database Integrations and confirm the corresponding Wrapper
tiles continue using their light-surface assets.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Updated the BigQuery, ClickHouse, DuckLake, and Snowflake icons in
integration and replication views to use branded marks. Icons now use
theme-appropriate variants where available, helping them display
consistently across light and dark themes. ClickHouse’s previous “CH”
monogram is replaced with its branded mark.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
The Docs sitemap lists a `/reference/<sdk>/undefined` URL for every
reference category header, on both latest and versioned paths (for
example `/reference/kotlin/v1/undefined`). `generateReferencePages`
turns every flattened section into a link, and category headers never
carry a slug. Search engines get a 404 for the `api/undefined` entries
and a soft 404 for the SDK ones.
I filtered the sections with the same predicate the reference static
params already use (`type !== 'category' && !!slug` in
`Reference.utils.ts`). I ran the generator locally before and after the
change: the only entries it removes are the `/undefined` ones (about 4%
of the sitemap), and it adds none.
**Note:** `getFlattenedSections` stays unchanged because the crawler
route and the reference pages share it.
## To test
Tested on Vercel preview:
- [x] Fetch `/docs/sitemap.xml` on the Docs preview and search for
`/undefined</loc>`: expect no matches
- [x] In the same file, search for `/docs/reference/javascript/select`
and `/docs/reference/kotlin/v1/select`: expect both still listed
## Linear
- fixes GROWTH-1310
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Reference pages no longer generate links for category sections or
sections without a slug. Existing link paths and priorities remain
unchanged.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
I made the crawler renderer resolve legacy JavaScript and Dart reference
slugs to their current sections, and updated authored guide and SDK spec
links to use them. Exact slugs still win, ambiguous bare slugs still
return 404, and `file-buckets-listv2` remains a section slug in
canonical links. I kept the www redirect work in a separate draft PR
because the apps deploy independently.
## To test
- [x] On the Docs preview, request `reference/javascript/order` and
`reference/dart/get-user` with a bot user agent. Expect the intended
heading and canonical URL.
- [x] Request `reference/javascript/file-buckets-listv2` with bot and
browser user agents. Expect it to open the list v2 section.
- [x] Request `reference/swift/get-user` and the Kotlin reference root
with a bot user agent. Expect the intended heading.
- [x] Open the Storage quickstart guide and follow its upload reference
link. Expect the current JavaScript upload section.
## Linear
refs GROWTH-1293
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Reference pages now resolve legacy aliases and ambiguous slugs more
accurately, with canonical links that preserve explicit SDK versions.
* SDK version paths are recognized only when the full path segment
matches the version format, improving reference-page routing.
* **Documentation**
* Updated API reference links across authentication, storage, security,
and SDK guides to point to current pages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
`pnpm dev:www` ran `content:build`, whose final `fetchAgentSkills` step
rewrote the committed skills index.
## Change
Local development now runs the existing `content:build:core` generators
and serves the committed index. Every WWW build still runs
`content:build`, which runs the core generators followed by
`fetchAgentSkills`.
```mermaid
flowchart LR
L[Local dev] --> C[content:build:core]
C --> N[Next dev]
I[Committed index] --> N
B[Preview / production build] --> F[content:build]
F --> C
F --> A[fetchAgentSkills]
R[Latest GitHub release] --> A
A --> D[Next build]
```
Preview builds fall back to the committed index if fetching fails.
Production builds fail rather than publish a stale index. The committed
fallback is updated to v0.1.9.
## Test plan
- `pnpm dev:www` leaves the index unchanged and serves it byte-for-byte
- stale v0.1.8 fixture refreshes to v0.1.9 through the real fetch script
- `pnpm --filter www test turbo-build.test.ts`
- `pnpm --filter www typecheck`
- `pnpm exec prettier --check apps/www/package.json
apps/www/public/.well-known/agent-skills/index.json`
- [x] I have read
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
Closes
[AI-1275](https://linear.app/supabase/issue/AI-1275/running-pnpm-devwww-modifies-the-generated-agent-skills-index)
Co-authored-by: OpenAI Codex <noreply@openai.com>
Production secrets sat after two non-procedure sections, so the reader
setting up a key crossed reference material to get from the local steps
to the production ones. Move it up to follow Local secrets, which runs
all four procedure sections unbroken before the reference sections.
Group "Where local values come from" and "Default secrets" under a
Reference heading. Both answer "what are its parts?", so both are
Structure under the style guide's information types, and Reference is
the group the worked outline ends with. They demote from H2 to H3,
which keeps them in the page TOC, since it is built from h2 and h3.
No heading is renamed, so the anchors Studio deep-links into
(#default-secrets, #using-the-cli) and the one the secrets-limit
troubleshooting page uses (#accessing-environment-variables) are
intact. Changing a heading's level preserves its slug.
Glue the new shape needs: an outline of the three section groups at the
top, a transition out of the troubleshooting section, and an opening
line under Reference.
Inline rewording only. Nothing moves and no claim changes.
Addresses reader-facing "we", UI labels in quotes rather than bold, "allows
you to", "e.g.", future tense, and title-case common nouns in body prose.
Apply the docs style guide to Securing Edge Functions. Inline changes only.
- Open the page with a value statement
- Split the sentences that ran past the 26-word aim, and keep one
relationship per sentence
- Replace dash-bounded asides with separate sentences
- Lift `(the default)` out of parentheses so it reads as a claim
- Name the section instead of "above" and "the sections below"
- Introduce the mode table in the sentence before it
- Raise the `auth: 'none'` admonition to `danger`, and state it in the
positive form
- Stop restating that admonition in the Public functions section
- Spell out Row Level Security, and name `@supabase/server` rather than
"the SDK"
- Use Supabase Dashboard and Supabase Platform consistently
- Use "function" rather than "endpoint", and spell out "db"
- Link `@supabase/server` once, and name it as a GitHub destination
- Rewrite the Secret keys alt text to describe both rows, the column
headers, and the masked key format
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix (build resilience)
## What is the current behavior?
`apps/www/scripts/fetchAgentSkills.mjs` runs as part of `content:build`
and fails the whole `www` build (and `pnpm dev:www`) whenever the GitHub
API call fails. #50106 added `AGENT_SKILLS_GITHUB_TOKEN` to mitigate
rate limits on Vercel, but that does not cover local runs or builds
where the env var is not available (e.g. fork PRs).
Example from a local `pnpm dev:www` hitting the unauthenticated rate
limit:
```
www:dev: Error: GET https://api.github.com/repos/supabase/agent-skills/releases/latest → 403
www:dev: at fetchJson (file:///.../apps/www/scripts/fetchAgentSkills.mjs:38:22)
www:dev: at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
www:dev: at async main (file:///.../apps/www/scripts/fetchAgentSkills.mjs:53:19)
```
## What is the new behavior?
`public/.well-known/agent-skills/index.json` is already committed to the
repo, so when the fetch fails and `VERCEL_ENV` is not `production`, the
script logs the error, keeps the committed file, and exits 0:
```
www:dev: Error: GET https://api.github.com/repos/supabase/agent-skills/releases/latest → 403
www:dev: ...
www:dev: Fetch failed — keeping committed public/.well-known/agent-skills/index.json
```
Production builds still fail loudly so a stale skills list is never
silently shipped.
Verified locally by forcing a 401 with a bad token:
- `VERCEL_ENV=preview` exits 0 and keeps the committed `index.json`
- `VERCEL_ENV=production` exits 1
## Additional context
Follow-up to #50106.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved handling of skill data fetch failures outside production.
* Preserves previously available skill data when a fetch fails and a
committed fallback is available.
* Continues to report failures when no fallback data exists.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The documentation currently lists Docker Desktop as the preferred option
for all platforms, but OrbStack is a superior alternative on macOS that
offers better performance (faster startup, lower CPU/memory/disk usage).
Users on macOS should be guided toward OrbStack first.
## Solution
Reordered and updated the container runtime recommendations to:
1. Highlight OrbStack as the recommended option specifically for macOS
2. Position Docker Desktop as the recommended option for Windows and
Linux
3. Moved OrbStack higher in the list to reflect its priority on macOS
4. Added a dedicated paragraph in the CLI getting started guide
explaining OrbStack's benefits and why it's recommended over Docker
Desktop on macOS
The changes improve the developer experience by directing macOS users
toward the more performant option while maintaining clear guidance for
other platforms.
## Review instructions
1. Open the preview links for the modified documentation pages
2. Verify that OrbStack is now listed first and marked as "recommended
on macOS"
3. Verify that Docker Desktop is now marked as "recommended on Windows
and Linux"
4. Check the CLI getting started guide to confirm the new paragraph
about OrbStack's benefits is clear and helpful
5. Ensure the information is consistent across both modified files
## Checklist
- [x] I have read
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
- [x] Documentation changes follow the docs style guide
https://claude.ai/code/session_01Nbp9LwhMkqxEvQJzEVUbwt
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated local development guidance to recommend OrbStack for macOS and
Docker Desktop for Windows and Linux.
* Clarified that OrbStack supports extended file attributes on mounted
volumes and container networking, and added startup and resource-use
comparisons with Docker Desktop.
* Listed Rancher Desktop and Podman as alternatives; the CLI guide also
lists Colima.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude <noreply@anthropic.com>
This PR updates Management API docs automatically.
This regenerates:
- Management API specs and sections
- Personal Access Tokens permission-to-endpoint table
- Personal Access Tokens MCP tool permissions table
Sources include the live Management API specs, MCP permission map,
and Studio's shared permission catalog.
Co-authored-by: zamotany <17573635+zamotany@users.noreply.github.com>
## Problem
z-index issue for the KB `Topics` dropdown on the main page, where it
would get hidden behind other elements on the screen.
## Solution
Update z-index values
## Preview links
[Preview](https://kb-git-fix-kb-header-positioning-supabase.vercel.app/kb)
[Prod](https://supabase.com/kb/)
## Additional context
**Before**
https://github.com/user-attachments/assets/61216776-166a-41f9-b1b0-7b2e734ff229
**After**
https://github.com/user-attachments/assets/0c15855d-fac5-4d55-b403-b091fb48e178
## Review instructions
Provide a clear numbered procedure that the PR reviewer can walk
through.
1. Open the live and preview links side-by-side.
2. Expand the `Topics` dropdown and see whether or not it's covered.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated header and navigation menu layering to improve visibility when
elements overlap.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
> [!IMPORTANT]
> Don't merge until the OrioleDB public beta launches. Docs deploy on
merge.
## What
Updates the OrioleDB guide (`guides/database/orioledb`) for the public
beta:
- States that OrioleDB is in public beta and that OrioleDB projects have
access to the same paid features as other Supabase projects.
- Replaces the outdated "choose `OrioleDB Public Alpha` Postgres
version" instruction and its screenshot with text steps that match the
current project creation form (**Advanced Configuration** → **Postgres
Type** → **Postgres with OrioleDB**). It also notes that OrioleDB can't
be added to or removed from an existing project. A new screenshot will
follow once the dashboard shows the beta labels.
- Corrects the `orioledb.default_compress` range to `-1` to `22`. Values
outside that range are rejected.
- Updates the `EXPLAIN` output for the primary key lookup to match what
OrioleDB returns (`Custom Scan (o_scan)`).
- Replaces the benchmark chart's alt text with a description of the
chart.
Headings, frontmatter, and navigation are unchanged, so existing links
to this page and its sections still work.
## Checked against upstream OrioleDB
Checked the page's claims against the [OrioleDB
docs](https://github.com/orioledb/orioledb/tree/main/doc/usage) and
codebase on `main`:
- The concepts section, the `orioledb.serializable` values, and the
compression settings match.
- The limitations link still resolves (`#current-limitations`).
- Doc changes on `main` since beta17 (collations, sparse files,
concurrent unique bridged indexes) don't affect claims on this page.
## Verification (`/test-the-docs`)
| Snippet / step | Class | Sandbox | Result | Notes |
| --- | --- | --- | --- | --- |
| `create table blog_post …` | runnable-local | DinD + runner,
`supabase/postgres:17.9.0.028-orioledb` | pass | Table created with the
`orioledb` access method (default) |
| `create index …` (2 indexes) | runnable-with-setup | same | pass | |
| `insert …` + `select …` | runnable-with-setup | same | pass |
Timestamp differs, as expected |
| `explain` (3 statements) | runnable-with-setup | same | pass | Primary
key lookup output updated in this PR to match |
| `select … from pg_settings where name like 'orioledb.%'` |
runnable-local | same | pass | All 10 automatically tuned settings
present |
| `alter database … default_compress to 1` | runnable-local | same |
pass | |
| Compression range `-1`–`22` | claim check | same | pass | `23`
rejected: "outside the valid range (-1 .. 22)" |
| User-configurable settings have `user` context | claim check | same |
pass | `serializable` values match the page |
| Hidden `ctid` key when no primary key is defined | claim check | same
| pass | |
| HNSW index via index bridging | claim check | same | fail (product
bug) | Index misses rows inserted after it's created. Known upstream as
orioledb/orioledb#1118, fixed after beta17. The tested image bundles an
earlier OrioleDB release. Re-test on an image with beta18 before
merging. |
| Dashboard project creation steps | deferred | — | deferred | Needs a
hosted project; labels checked against Studio source |
**Tier A path:** every SQL block on the page, run in page order against
the Supabase OrioleDB image.
**Environment:** Docker 29.4.0 (linux/aarch64); compose sandbox from
`test-the-docs`; all SQL run inside the runner container.
**Build:** `pnpm build:guides-markdown` passes; the generated markdown
for this page includes all changes.
## Self-review
**Blockers:** none.
**Before merging:**
- [ ] Re-run the HNSW check on an image with OrioleDB beta18.
- [ ] Re-check the page against the `beta18` tag once it's published.
**Nits left for a follow-up (existing text, outside this PR's scope):**
- The page spells `pg_vector`; the extension is `pgvector`.
- Index support is described twice, in the top note and again under
"Creating indexes".
- The markdown export (`internals/markdown-schema/Admonition.ts`) drops
admonition titles on every page. This PR avoids relying on a title for
the beta status.
Linear: DOCS-1399
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the OrioleDB guide with benchmark results for an 8xlarge
instance, including a 1.8x speedup and throughput data across 32–256
connections.
* Clarified that OrioleDB projects have access to the same paid features
as other Supabase projects, and added guidance to review its
limitations.
* Updated project setup instructions, noting that OrioleDB must be
selected when creating a project and cannot be added later or removed.
* Revised the query plan example and documented compression levels from
`0` through `22`.
* **Product Updates**
* Updated OrioleDB’s availability stage to public beta.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Artur Zakirov <zaartur@gmail.com>
## Problem
We need to rename orioledb in Dashboard.
## Solution
- Update Studio copy/badges referencing OrioleDB from "Public Alpha" to
"Public Beta" (project creation advanced config, restore-to-new-project,
PITR empty state)
- Remove the scheduled-backups block that hid backups for OrioleDB
projects — OrioleDB now has WAL-G scheduled backups in beta, so that
page should behave normally. PITR keeps its existing guard since PITR is
not yet supported for OrioleDB.
- Update the `useOrioleDb` telemetry property doc-comment to reflect the
beta status
- Update project-creation wizard test expectations/fixtures accordingly
(`release_channel: 'beta'`)
Marketing (`apps/www`) and docs (`apps/docs`) references to OrioleDB
alpha status are being updated separately.
<!--
## Preview links
If relevant, include links to changed pages for easy review access.
Copy the preview base URL from the Vercel bot comment on this PR. Use
the following table as an example template.
| Site | Live | Preview | Search for |
| -------------- |
-------------------------------------------------------------------------
|
------------------------------------------------------------------------------------------------------------
| ----------------------------- |
| WWW | [/blog/your-post](https://supabase.com/blog/your-post) |
[/blog/your-post](https://zone-www-dot-com-git-branch-name-supabase.vercel.app/blog/your-post)
| unique phrase from the change |
| Docs |
[/docs/guides/your-page](https://supabase.com/docs/guides/your-page) |
[/docs/guides/your-page](https://docs-git-branch-name-supabase.vercel.app/docs/guides/your-page)
| unique phrase from the change |
| Studio | [/dashboard](https://supabase.com/dashboard) |
[/dashboard](https://studio-git-branch-name-supabase.vercel.app/dashboard)
| unique phrase from the change |
| Design system | [/design-system](https://supabase.com/design-system) |
[/design-system](https://design-system-git-branch-name-supabase.vercel.app/design-system)
| unique phrase from the change |
| UI library | [/library](https://supabase.com/library) |
[/library](https://ui-library-git-branch-name-supabase.vercel.app/library)
| unique phrase from the change |
| Knowledge base |
[/kb/guides/your-page](https://supabase.com/kb/guides/your-page) |
[/kb/guides/your-page](https://kb-git-branch-name-supabase.vercel.app/kb/guides/your-page)
| unique phrase from the change |
-->
<!-- ## Additional context
Optionally add any other context or screenshots.
-->
## Review instructions
## Checklist
Check all before review:
- [x] I have read
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
- [x] If I wrote a new docs topic or edited an existing topic, I used
the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs
[style
guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* OrioleDB is now labeled as being in public beta rather than public
alpha, and project creation selects the beta release channel.
* Restore-to-new-project and Point-in-Time Recovery notices clarify that
these features are unavailable for OrioleDB projects.
* OrioleDB projects now follow the standard eligibility checks and page
flow for scheduled backups.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix
## What is the current behavior?
Operations names for webhooks in Organizations webhooks and Project
webhooks use titles derived from slug, which produces wrong/incoherent
titles, for example: `Organizations slug webhooks deliveries id get`.
## What is the new behavior?
For Organizations webhooks and Project webhooks use `summary` from the
OpenAPI spec as the title instead of deriving it from the operation id.
## Additional context
Once this PR is merged, an _Update Mgmt Api Docs_ workflow needs to be
run to regenerate the sections and the spec.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Management API documentation section titles for organization and
project operations now use the OpenAPI summary when one is available. If
no summary is provided, the title falls back to the existing name-based
format. Titles for other operations continue to use the existing format,
so their presentation is unchanged.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
## Problem
Kevin Webb joined team and needs to add name to humans.txt as part of
onboarding
## Solution
Edited humans.txt and added Kevin Webb
## Review instructions
Confirm name is correctly alphabetized.
## Checklist
Check all before review:
- [x] I have read
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the team listing to include Kevin Webb, keeping the published
team information current. This change is visible in the project’s public
documentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
`@supabase/middleware` ships as 1.0.0. The docs still label the
`pipeline` entry form of `withSupabase` alpha, and several snippets
import `npm:@supabase/server` and `npm:@supabase/middleware` with no
version or with a `^0.5.0` pin. A snippet without a version leaves
readers and tools to guess one, and a guessed version fails on deploy.
## Solution
- Removes the alpha wording from the middleware reference intro and
usage examples, the server frameworks partial, and the Bring your own
MCP guide. The `@supabase/server` 1.6.0 floor stays.
- Pins every `npm:@supabase/server` and `npm:@supabase/middleware`
import in the guides to a major range, `@1`, following the
`npm:@supabase/supabase-js@2` convention in Managing dependencies.
- Bumps the authenticated-mcp-server example to middleware `^1.0.0` and
server `^1.9.0`.
~~Blocked by supabase/middleware#49. The `@1` range resolves once 1.0.0
is on npm.~~
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated authentication, API key, and MCP examples to use versioned
Supabase server and middleware packages.
* Clarified that pipeline and nested composition behave the same, and
that both require `@supabase/server` 1.6.0 or later.
* Removed alpha-status labels from `withSupabase` guidance while
retaining the 1.6.0 minimum-version requirement.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Docs update
## What is the current behavior?
humans.txt doesn't list my name.
## What is the new behavior?
Add to humans.txt
## Additional context
Done as part of the onboarding tasks.
## Checklist
Check all before review:
- [x] I have read
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the public team information to include Mario Karuza. The
listed team members now reflect this addition.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: mkaruza <mkaruza@users.noreply.github.com>
## Problem
As part of having `None / No Access` available to customers, we need to
start providing this role entry in `/platform/organization/:ref/roles`
endpoint. However, when making it available, the role will show up
prematurely on all the components that relies on
`useOrganizationRolesV2Query` function.
## Solution
This change is to allow us to test the behavior of the new role without
having to turn the API on/off. The UI will show only the "predefined"
entries and ignore the "extras" sent by API.
After this is merged, we will do the following
1. Unhide the None role from the API
https://github.com/supabase/platform/pull/39137 -- this will not have
any effect on the frontend as we already ignore it in this PR
2. Work and continue testing on
https://github.com/supabase/supabase/pull/50922 -- which will be easier
to verify as we no longer need to change the API side
## Review instructions
1. Modify the items in the `FIXED_ROLE_ORDER` list, remove some roles
from there
2. You will see that the role will disappear from the components like
the invitation form or managed access form.
## Checklist
Check all before review:
- [x] I have read
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
- [x] If I wrote a new docs topic or edited an existing topic, I used
the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs
[style
guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **Bug Fixes**
* Organization role lists now show only supported roles, in the expected
order. Roles outside the supported set are no longer displayed. This
keeps the list consistent and focused on recognized roles, making
available organization roles easier to review.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This PR bumps the vulnerable dependencies `devalue`, `mermaid`,
`@faker-js/faker`, `brace-expansion`, `undici`, `fast-uri` and
`markdown-it`.
It also dedupes `rolldown`, `vite` and various `react-router` deps.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated development and build tooling for Lite Studio, Studio, and the
Vue block, along with tooling used in automated Studio checks. These
changes do not alter app features or workflows, and no new user-facing
capabilities or behavior changes are included. They are limited to the
project’s underlying development setup.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The Files tab on block previews showed a "Supabase files." caption row
between the tabs and the file viewer. It doesn't add anything useful and
takes space from the code.
## Solution
Remove the caption row and render the file viewer directly in the tab
panel. The registry lookup that fed the caption is dropped from
`BlockOverview`; the markdown and agent-prompt export still lists
dependencies as before.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Interface Changes**
* Block overviews now show the generated file tree directly when file
display is enabled.
* The “Supabase files” banner and dependency details are no longer
shown, and the surrounding file layout has been removed.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
## Problem
Studio lets people create an item while selecting one, but the design
system does not document this pattern.
## Solution
Document the create action in the Combobox guide with a focused example.
The action sits below the options and leaves the current selection
unchanged. Products can connect it to their own creation flow.
| After |
| --- |
| <img width="552" height="352" alt="CleanShot 2026-09-30 at 10 57
46@2x"
src="https://github.com/user-attachments/assets/69c8069c-d4f9-45e2-b3a1-6e5431e2aff9"
/> |
## Review instructions
1. Open the design system Combobox page and find “[Create from
list](https://design-system-git-dnywh-document-select-create-action-supabase.vercel.app/design-system/docs/components/combobox#create-from-list)”.
2. Select a bucket, then choose “New bucket”. Because it’s just an
example, the selector closes without replacing the selected bucket.
## Checklist
- [x] I have read
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a combobox example with a separate “New bucket” action. Choosing
it closes the menu without changing the current selection; choosing an
existing bucket updates the selection.
* Added documentation showing how to use this create-action pattern,
including guidance on labeling and positioning the action.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The S3 access key creation dialogs are wider than their contents, use
plural titles for one key pair, and call the name field “Description”
even though the table calls it “Name”. The save state also implies both
values disappear, although only the secret does.
## Solution
Use the small dialog size for both states. Use singular titles, label
the field “Name”, shorten the create button to “Create”, and clarify
when the secret must be copied. The API field remains `description`.
## Review instructions
1. Open a project’s **Storage > S3** page and select **New access key**.
Check the dialog width, title, Name field, and Create button.
2. Create a key and check the save dialog width, singular title, and
secret visibility guidance.
| Before | After |
| --- | --- |
| <img width="1084" height="572" alt="CleanShot 2026-09-30 at 14 37
20@2x"
src="https://github.com/user-attachments/assets/781706ee-0ecc-4535-abb5-f6ac65f02c71"
/> | <img width="844" height="584" alt="CleanShot 2026-09-30 at 14 36
56@2x"
src="https://github.com/user-attachments/assets/119df19f-2f39-4e23-94b4-26665583765c"
/> |
| <img width="1096" height="730" alt="CleanShot 2026-09-30 at 14 37
57@2x"
src="https://github.com/user-attachments/assets/00481ed7-dc05-48b9-8cbc-e76d608aa4b1"
/> | <img width="842" height="780" alt="CleanShot 2026-09-30 at 14 37
39@2x"
src="https://github.com/user-attachments/assets/8c837101-250a-474f-a0fc-cf46ce491f83"
/> |
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* The credential form now labels the field “Name” and uses “Create” for
the submit button.
* Confirmation text now clarifies that the access key is bucket-wide,
bypasses RLS, and its secret is shown only once. It also refers to a
single access key instead of using S3-specific wording.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
I made the connected-project framework icons fall back when no shipped
SVG exists for a framework. The three icon sites built
`/img/icons/frameworks/<framework>.svg` straight from the integration's
framework preset, which is an open-ended string. They only fell back
when the value was empty, so any preset without an asset (`express`,
`hono`, `fastapi`, `tanstack-start` and others) showed a broken image
and logged a 404.
**Changed:**
- **Broken framework icons**: `getFrameworkIconUrl` returns the asset
URL only for slugs in a set that mirrors `public/img/icons/frameworks/`.
The integration connection row, the org project linker and the
marketplace project picker now show their existing fallback icon for any
other slug. A test keeps the set equal to the directory listing.
- **Framework type**: I deleted the hand-kept `VercelFramework` union.
It listed exactly the shipped icon slugs, while the API types the field
as `string | null`, and that mismatch is what made the old empty-only
check look safe.
**Note:** I rejected an `onError` fallback because the browser still
sends the 404 request. Adding logos for common presets is left for
design.
## To test
Tested on Vercel preview (staging): no real connection there uses these
presets, so I rewrote the org integrations response in the browser to
give one integration four connections.
- [x] Open an org's Integrations page with connections whose framework
has no shipped icon (`express`, `eve`, `tanstack-start-lovable`). Expect
the fallback badge and no request under
`/dashboard/img/icons/frameworks/` for those slugs. Observed: all three
rows showed the badge and the network log had no request for their SVGs.
- [x] Same page with a `nextjs` connection. Expect its framework logo.
Observed: `nextjs.svg` loaded with a 200.
- [x] Same page with the real, unmodified response (one connection with
`framework: null`). Expect the badge, no frameworks requests, and no new
console errors. Observed: as expected.
## Linear
- fixes GROWTH-1309
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Vercel integration and project views now display framework icons when
available and fall back to the Vercel icon when no matching icon exists.
* Framework metadata now supports values beyond a fixed list, while
unsupported frameworks continue to use the fallback icon.
* **Tests**
* Added coverage for supported and unsupported framework icons,
including base-path handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
I updated first-party Vault links to open the current secrets route
directly. Wrapper credentials, extension metadata, and blog posts still
linked to the retired path and relied on a redirect.
## To test
On the preview:
- [x] Inspect a Wrapper credential's Vault link. Expect
`/integrations/vault/secrets` with a `search` query for that credential.
- [x] Open the inspected target URL. Expect Vault to show the matching
secret.
- [ ] Click a Wrapper credential's Vault link. Expect the filtered Vault
view.
- [ ] Open the pgsodium extension's Vault link and a Vault blog link.
Expect `/integrations/vault/secrets` without the retired route in the
address bar.
## Linear
- fixes GROWTH-1312
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Vault secrets links now direct you to the project’s Integrations page,
including links from wrapper metadata, blog articles, and the `pgsodium`
extension listing.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
I repointed legacy reference redirects and first-party links to the
sections the Docs app currently serves. Old client and common-filter
URLs still targeted bare slugs, while SDK landing URLs targeted
`/start`. I preserved v1 auth destinations and linked the retired Dart
v0 migration guide to its original source.
## To test
On the www preview:
- [x] Request `/docs/client/order` with a crawler user agent. Expect a
redirect to `/docs/reference/javascript/using-modifiers-order`.
- [x] Request `/docs/common/filters/_sl` with a crawler user agent.
Expect a redirect to `/docs/reference/javascript/using-filters-rangelt`.
- [x] Request `/docs/reference/kotlin` with a crawler user agent. Expect
a redirect to `/docs/reference/kotlin/introduction`.
- [x] Open the Storage permissions section. Expect its bucket reference
link to target `/docs/reference/javascript/file-buckets-createbucket`.
## Linear
- fixes GROWTH-1293
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated links across blog posts, product pages, and feature listings
to point to current JavaScript, Flutter, and Dart documentation.
* Updated legacy documentation redirects to current reference pages,
including filter, modifier, client, and authentication guides.
* Changed reference-root redirects to lead to each language’s
introduction page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Renames the `mcp-server` Library block to `mcp`. Installing it now
creates `supabase/functions/mcp`, so the server is served at
`/functions/v1/mcp`.
- Block, Edge Function folder, and docs page renamed
(`/docs/headless/mcp`)
- Headless App block now installs its tools into
`supabase/functions/mcp` and configures `[functions.mcp]`
- Links in the BYO MCP and MCP authentication guides updated
- Permanent redirects keep `/r/mcp-server.json` and
`/docs/headless/mcp-server` working
- `public/r` rebuilt
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* The MCP Server block is now named `mcp` across its documentation,
installation links, and setup instructions.
* Updated function endpoints and deployment commands to use `/mcp`.
* Added permanent redirects from the previous `mcp-server` documentation
and install URLs to their new locations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
I added permanent redirects for the moved Dashboard routes that still
send visitors to 404s. Project and organization identifiers carry
through, while the old project billing path opens the organization
picker for billing.
**Note:** The bare `/dashboard/project` path redirects straight to
Organizations instead of the `/dashboard/projects` hop named in
GROWTH-1295, since `/projects` already redirects there.
## To test
Tested on the Studio preview:
- [x] Requested the eight old Dashboard paths in GROWTH-1295 while
signed out. Each returned 308 with the specified destination.
- [ ] Request bare `/dashboard/project` while signed out on the latest
preview. Expect a single 308 to `/dashboard/organizations`.
- [x] Requested a project backup path with a query string. The
destination kept the project ref and query string.
- [x] Requested `/dashboard/project/_`. The project picker remained
reachable.
## Linear
- fixes GROWTH-1295
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Added permanent redirects for legacy Studio routes covering account
and project pages, backups, email templates, edge-function logs,
secrets, and billing settings.
* Redirects preserve incoming query parameters and URL fragments; the
project selector remains unaffected.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
Pipeline edit forms hide stored credentials but still show visibility
controls beside their placeholders. The controls suggest that the stored
secret can be revealed.
## Solution
- Hide visibility controls in edit mode for ClickHouse, Snowflake,
DuckLake, and Analytics Bucket secret fields.
- Keep the controls available when creating a destination, with
accessible labels for the DuckLake and Analytics Bucket controls.
| Before | After |
| --- | --- |
| <img width="1024" height="196" alt="CleanShot 2026-09-29 at 16 48
56@2x"
src="https://github.com/user-attachments/assets/a9da9a32-ab17-4c07-abf3-dfa88b8c6475"
/> | <img width="1024" height="168" alt="CleanShot 2026-09-29 at 16 47
23@2x"
src="https://github.com/user-attachments/assets/fddeb880-cd23-4752-ae73-8f27348c647f"
/> |
## To test
1. Open **Database → Pipelines** and edit a destination of each type:
ClickHouse, Snowflake, DuckLake with custom parameters, and Analytics
Bucket. Check that the hidden secret fields have no eye button.
2. Start creating each destination and check that its secret fields
still offer a working visibility control.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary
* **Improvements**
* Secret fields in replication destination forms remain masked when
editing an existing destination, and their visibility controls are
hidden. When creating a destination, supported secret fields can be
revealed.
* **Accessibility**
* Catalog-token visibility controls now use dynamic, descriptive labels.
DuckLake catalog URL and S3 secret-key reveal controls also have
descriptive labels.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The ClickHouse destination guide leaves parts of resource setup unclear.
The pipeline form suggests the `default` ClickHouse user and database
even when a dedicated user and database are prepared.
## Solution
- Clarify the ClickHouse setup path, connection details, engine choice,
and query example in the guide.
- Align the pipeline form's labels, examples, and help text with that
setup path.
- Include **Start pipeline** in the BigQuery guide before the cost
confirmation and **Create and start pipeline**.
## Review instructions
1. Open **Database → Pipelines**, add a pipeline, and choose
**ClickHouse**. Check the endpoint label, user and database examples,
and table engine help.
2. Read the [ClickHouse destination
guide](https://supabase.com/docs/guides/database/replication/pipelines/clickhouse),
especially **Prepare ClickHouse resources** and **Configure ClickHouse
as a destination**.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the BigQuery guide to explain the pipeline validation, cost
review, and start steps.
* Expanded the ClickHouse guide with destination setup requirements,
engine behavior, and querying guidance for current-state views and
append-only history.
* **User Experience**
* Clarified ClickHouse connection field labels and descriptions,
password visibility controls, and table-engine options in the setup
form.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
Some Pipelines destinations should not display third-party brand marks
until their use is confirmed.
## Solution
Render neutral text monograms for destinations with pending brand marks.
Keep approved destination marks unchanged and preserve the existing
assets so they can be restored with a small configuration change.
| After |
| --- |
| <img width="1022" height="936" alt="CleanShot 2026-09-29 at 11 44
37@2x"
src="https://github.com/user-attachments/assets/d94fca61-aa02-4efb-aa78-47ada5d149d3"
/> |
## Review instructions
1. Open `/project/<ref>/database/replication`.
2. Open the destination picker and confirm destinations with pending
marks use neutral two-letter monograms.
3. Confirm the other destination marks are unchanged.
## Checklist
- [x] I have read
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* ClickHouse and Snowflake destinations now display “CH” and “SF”
monograms instead of image marks. BigQuery and DuckLake continue to
display their image marks, while destinations without configured
branding continue to show their destination icons. These logo treatments
make the configured destination branding visible in the replication
destination interface.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The pipeline detail header shifts slightly as its loading placeholders
become text.
- Resolves
[DEPR-683](https://linear.app/supabase/issue/DEPR-683/reduce-layout-shift-in-pipeline-header-loading-states)
## Solution
Match the breadcrumb, title, status, and destination placeholders to
their loaded line heights.
## Review instructions
1. Open a pipeline detail page and reload it. Check that the header
height stays steady as its data arrives.
## Checklist
- [x] I have read
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Increased the height of loading placeholders for replication pipeline
status, breadcrumbs, page titles, and destination names.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The Select banners on www and Studio still promote attendance. They need
to keep serving the waitlist until the event, promote the livestream
during the requested window, and disappear after the event.
## Solution
Use a shared three-phase clock: existing promotion before 8:00am PT on 2
October, livestream promotion from 8:00am to 5:30pm PT, and no banner
afterwards. Both livestream CTAs lead to `select.supabase.com`, where
viewers can choose a stage. Separate dismissal keys let someone who
dismissed the earlier promotion see the livestream. Open pages set a
timer for the next boundary and recheck on visibility, focus, or page
restore.
| `www` |
| --- |
| <img width="736" height="136" alt="CleanShot 2026-09-29 at 16 27
38@2x"
src="https://github.com/user-attachments/assets/1281bcf0-ece4-41fc-99d2-1f9ab6e1b3f5"
/> |
| _Until Friday 8am PT_ |
| <img width="734" height="138" alt="CleanShot 2026-09-29 at 16 28
06@2x"
src="https://github.com/user-attachments/assets/05b8779a-9961-4886-ad7d-96ba31c8b4f7"
/> |
| _Friday 8am to 5:30pm PT_ |
| `studio` |
| --- |
| <img width="612" height="454" alt="CleanShot 2026-09-29 at 16 26
51@2x"
src="https://github.com/user-attachments/assets/0d9a8bbb-c636-41dc-aa76-381196c149c2"
/> |
| _Until Friday 8am PT_ |
| <img width="616" height="440" alt="CleanShot 2026-09-29 at 16 27
09@2x"
src="https://github.com/user-attachments/assets/458afdb9-6576-4699-9419-947ca5312bcd"
/> |
| _Friday 8am to 5:30pm PT_ |
## Review instructions
1. Open the [www
homepage](https://zone-www-dot-com-git-dnywh-select-2026-livestre-93dab1-supabase.vercel.app/)
and a [hosted Studio
dashboard](https://studio-staging-git-dnywh-select-2026-livestream-05b822-supabase.vercel.app/)
in separate tabs. If the Privacy Policy update card is in front in
Studio, close it (only) to reveal the Select banner.
2. In each tab's DevTools console, paste this helper:
```js
window.selectRealNow = Date.now
window.showSelectAt = (iso) => {
Date.now = () => new Date(iso).getTime()
window.dispatchEvent(new Event('focus'))
}
```
3. Run `showSelectAt('2026-10-02T07:59:00-07:00')`: both banners keep
the existing “Apply to attend” CTA.
4. Run `showSelectAt('2026-10-02T08:00:00-07:00')`: www shows “Supabase
Select 2026” and “Watch the livestream”; Studio shows the same title,
the description “Keynote, main stage, and build stage, streamed all
day.” and “Watch livestream”. Both CTAs link to
`https://select.supabase.com/`.
5. Run `showSelectAt('2026-10-02T17:30:00-07:00')`: neither banner is
visible. Restore the clock with `Date.now = window.selectRealNow;
window.dispatchEvent(new Event('focus'))`.
The console clock override affects only the current tab and is lost on
reload.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- The Select 2026 banner switches from waitlist messaging to livestream
details and a “Watch livestream” link during the livestream period.
- Livestream banner dismissals are tracked separately from waitlist
banner dismissals.
- Promotion banners end at 5:30 p.m. Pacific on October 2, 2026, and
update when the promotion changes phase, including after returning to an
open tab.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Alaister Young