Replaces the in-dashboard logic to manually construct the redirect URL
with a backend API call, as these are now routed through server-side
processing to do Posthog events and status tracking in the marketplace
DB.
Fixes INT-109
## Problem
Some pages still uses the deprecated `Modal` for:
- Legacy JWT new secret
- PITR recovery confirmation
## Test
Hard to test the JWT. I had to force its display by settings its `open`
prop to `true` in
`apps/studio/components/interfaces/JwtSecrets/jwt-settings.tsx`
## Solution
- use `Dialog` instead
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Improved database restore (PITR) confirmation: replaced modal flow
with an alert dialog, reorganized review sections (timing, warnings),
and made the restore action await completion for clearer feedback.
* Redesigned JWT secrets dialog: replaced modal with dialog primitives,
centralized form and state reset on open/close, moved confirmation into
dialog footer, and disabled confirm during submission.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46366?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
The Compute card's "High Availability" badge was overflowing the cell
horizontally in 2-column layouts and bleeding vertically into adjacent
cards when the badges wrapped onto a second line in narrow/vertical
layouts.
Root cause was in `SingleStat`: the value row used `h-[34px]` +
`truncate` (overflow: hidden), so the inner `flex-wrap` couldn't grow
the row, and the flex column lacked `min-w-0` so it couldn't shrink to
its grid track.
**Changed:**
- `SingleStat` outer flex gets `min-w-0` so the grid item is constrained
by its track
- Right column swapped from `truncate` to `min-w-0 flex-1` (takes
remaining space, can shrink)
- Value row swapped from `h-[34px]` to `min-h-[34px]` with `py-0.5` —
keeps the 34px baseline for single-line text values, but lets the row
grow when badges wrap
Closes [FE-3408](https://linear.app/supabase/issue/FE-3408)
## To test
- Open the project overview on a project with `high_availability`
enabled
- At 2-column widths: the "HIGH AVAILABILITY" badge should sit fully
inside the Compute card alongside the compute size badge — no clipping
at the right edge
- At narrow / 1-column widths: when the two badges need to wrap, the
Compute card should grow vertically rather than letting the second-line
badge overlap the cards above/below
- Spot check the other stat cards (GitHub, Recent branch, Last
migration, Last backup) — long text values should still truncate with an
ellipsis as before
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Updated stat card layout and inner spacing to improve responsiveness
and prevent overflow.
* Improved text truncation and minimum-width behavior for stat values
and labels.
* Standardized spacing, truncation and color handling across activity
stats for more consistent display.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46370?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
## Context
Improved formatting for auth logs in unified logs - their metadata are
seemingly all hidden within "event_message" so the changes here bring
them up
- Fix detecting status, pathname, and method for auth logs from
`event_message`
- None were showing originally, status was mostly defaulting to `200`
- Improve formatting of `event_message` by prioritising errors +
floating up the auth action
- Currently only shows "request completed"
## Before
<img width="1449" height="955" alt="image"
src="https://github.com/user-attachments/assets/f0c7f166-06ab-4bfc-8653-6f5638bf1ae7"
/>
## After
<img width="1449" height="956" alt="image"
src="https://github.com/user-attachments/assets/cdf49bd8-c33a-4f40-a6b7-8783dc38d174"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* More robust parsing of auth log messages to extract
error/status/method/path values and fall back to the original text when
parsing fails.
* Fixed cases where displayed status/method/pathname could be incorrect
for auth logs.
* **Improvements**
* Normalized auth error text (underscores → spaces) and optional
auth-action prefixes for clearer messages.
* Conditional sentence-capitalization for auth event messages.
* **New Features**
* Centralized log metadata extraction for unified log display.
* **Tests**
* Added tests covering auth and non-auth log parsing and metadata
extraction.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46365?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Feature, docs update
## What is the new behavior?
This PR introduces a new `RealtimeFlow` component and hook to the UI
library for building collaborative React Flow with Supabase Realtime:
- keeps nodes and edges in sync across multiple connected clients in
real time
- uses Yjs with `@supabase-labs/y-supabase` to propagate flow updates
- supports optional persistence, so a flow can be restored from
previously saved shared state
## Additional context
https://github.com/user-attachments/assets/90d3a381-6f9c-427f-a493-5d91c2141462
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Collaborative "Realtime Flow" diagram editor with syncing overlays and
a dual-view demo component
* Interactive demo page and registry example for live editing
(add/remove/rename nodes)
* Framework-ready registry packages for Next.js, React, React Router,
and TanStack
* **Documentation**
* Comprehensive docs added for Next.js, React, React Router, and
TanStack (usage, persistence, hook API)
* **Chores**
* Added runtime dependency for the flow component package
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/44273)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Re-adds support form Assistant response using a lighter weight
Streamdown component vs the more heavy `Message` component.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* AI Assistant follow-up card after ticket submission for project-scoped
requests.
* In-chat support request preview panels showing submitted subject and
message.
* **Improvements**
* Smarter project selection when opening the support form via
route/context.
* Success screen: cleaner layout, project-name messaging, optional
finish action, and a "Join Discord" button.
* Category prompt text updated to "What issue are you having?"
* New success/feedback section for consistent layouts.
* **Tests**
* Added tests covering support prompt serialization/parsing and UI
previews.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46248?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
The Data API Access section on the new-table panel was showing
`https://<ref>.supabase.co/<table>` instead of the correct
`https://<ref>.supabase.co/rest/v1/<table>`.
The bug was duplicated endpoint-resolution logic in
`ApiAccessToggle.tsx` that omitted `/rest/v1`. Replaced it with the
existing `getApiEndpoint` utility from `DataApi.utils.ts`, which already
handles this correctly (and is unit-tested).
Addresses
[FE-3442](https://linear.app/supabase/issue/FE-3442/data-api-access-shows-incorrect-table-url).
**Changed:**
- `ApiAccessToggle.tsx` now uses `getApiEndpoint` for URL construction,
ensuring `/rest/v1/` is always included.
## To test
1. Open the dashboard, go to Table Editor, click "New table".
2. Scroll to the "Data API Access" section, enter a table name (e.g.
`test_table`).
3. Confirm the URL shown is
`https://<ref>.supabase.co/rest/v1/test_table` (not
`https://<ref>.supabase.co/test_table`).
4. Try the same with a non-public schema — URL should be
`.../rest/v1/<schema>.<table>`.
5. With read replicas / load balancer selected via the database
selector, confirm the URL still resolves to
`<replica-or-lb-host>/rest/v1/<table>`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Optimized Data API endpoint computation in the table editor interface
to improve performance and code maintainability.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46367?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
## Problem
On 4XL and larger compute sizes, Supabase disk IO is sustained rather
than burst-budget based. Baseline equals max, so there is no extra burst
balance to track (the instance can still be throttled if it hits its
configured IOPS or throughput limit, but that is unrelated to a burst
credit pool). The "Disk IO Burst Balance" / "Disk IO % Remaining" /
"Disk IO % Consumed" charts in custom reports are therefore meaningless
on 4XL+, yet they are currently still offered in the picker and rendered
as empty/misleading charts.
Custom reports persist their layout, so a report created when a project
was on a smaller compute and later upgraded to 4XL+ can still contain a
saved burst chart that we need to handle gracefully.
## Fix
- Add a shared \`hasBurstableIO(infra_compute_size)\` helper in
\`DiskManagement.utils.ts\` (replaces the local
\`BURSTABLE_IO_VARIANTS\` set previously defined inline in
\`database-charts.ts\`).
- Filter \`disk_io_budget\` and \`disk_io_consumption\` out of the
custom report chart picker (\`MetricOptions\`) when the project is on a
non-burstable compute size.
- In \`ReportBlock\`, detect saved burst charts on a 4XL+ project and
render a new \`UnavailableChartBlock\` that explains the chart no longer
applies and can be removed.
- The database observability burst balance chart already gated on
\`hasBurstableIO\`; updated to use the shared helper.
- Infrastructure activity page already has equivalent handling via the
dedicated-IO admonition, so no change needed there.
Linear: FDBKPRI-1404
## Test plan
- [ ] On a project below 4XL, the custom report picker still lists "Disk
IO % Remaining" and "Disk IO % Consumed", and they render normally
- [ ] On a 4XL+ project, neither metric appears in the picker
- [ ] Open an existing custom report that contains a saved burst balance
chart on a 4XL+ project, and confirm the placeholder block renders with
a clear explanation and a remove action
- [ ] Database observability page on 4XL+: the burst balance chart
remains hidden, all other charts render
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Disk IO metrics are now filtered based on your project’s compute size
so only relevant charts appear.
* Metrics tied to burstable IO are hidden when the current instance does
not support burstable IO; deprecated metrics remain excluded.
* When a disk IO chart isn’t available for your instance, the UI shows
an explanatory unavailable-chart block with text about burst-balance
limits for very large instances and optional actions to remove the
unavailable chart.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46327?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
Database settings still uses the deprecated `Modal` for:
- readonly toggle
- password reset
- disk size configuration
- network restrictions
## Solution
- use `Dialog` instead
- use `AlertDialog` when it makes sense
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Replaced various Database settings modals with unified
Dialog/AlertDialog components for a consistent look and behavior.
* Confirmation flows now await async submit actions; confirm/cancel
controls are disabled and show loading while operations are pending.
* Validation, loading/disabled states, and user-facing success/error
messaging remain intact.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46270?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<img width="1285" height="654" alt="image"
src="https://github.com/user-attachments/assets/10074f07-3ac0-4f1f-b920-4255c67968d6"
/>
Updates file storage buckets to make use of new page components and
follow more standard full width pages as recommended in our design
system.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Search input now always visible with dynamic placeholder and cancel
control.
* “Go up one level” navigation button shown in list view when not at
bucket root.
* **Style**
* Thinner icon strokes and smaller button/icon sizing across the Storage
Explorer and preview.
* Header, breadcrumbs, and page container spacing/layout refined;
explorer outer container simplified.
* Selection count UI made compact/monospaced; new layout tokens for
header and bulk-action rows.
* **Tests**
* Unit and e2e tests updated; added e2e helper for rename/create inputs.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46184?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Bug fix.
## What is the current behavior?
On pages where the table has horizontal overflow (e.g. Database Tables
with its 7 columns), `ShadowScrollArea` unconditionally applies
`!bg-surface-200` to `td:last-child` on row hover. Since `TableCell` has
`transition-colors`, this gives the last cell an explicit animated
background change — making it visually distinct from every other cell,
which simply inherit the row's hover bg transparently.
This manifests as the last cell appearing to have its own independent
hover state, separate from the row hover.
## What is the new behavior?
The `!bg-surface-200` override on `td:last-child` is moved inside the
`stickyLastColumn` block, since that's the only case where an explicit
background is actually needed (sticky cells require a solid bg to avoid
showing scrolled content behind them). Non-sticky tables no longer get
the spurious cell-level hover.
Also reverts the MoreVertical dropdown trigger in `TableList` back to
`type="default"` (undoes the workaround from #46247).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed hover styling behavior in horizontally scrollable tables to
apply only when appropriate.
* **Style**
* Updated the visual appearance of the row action dropdown button.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46251?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Problem
Organization settings still uses the deprecated `Modal` for:
- downgrading subscription
- requesting feedback after downgrading
- showing an alert about members limit
- requesting feedback after upgrading
- deleting a published OAuth app
- showing preview of a new OAuth app
- Revoking an OAuth app
## Solution
- use `Dialog` instead
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Replaced legacy modal UI with the app's modern dialog/alert-dialog
components across billing and OAuth settings (upgrade/downgrade, exit
survey, members-limit, delete/revoke, preview), keeping existing content
and flows.
* Confirm/cancel flows updated for more reliable async handling and
clearer loading/disabled states during actions.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46332?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Remove useless expire snapshot configuration
> This is an alpha feature not already deployed to any of our customers
so breaking changes are not an issue.
Signed-off-by: Benjamin <5719034+bnjjj@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Refactor / security hardening (part 3 of stacked analytics safe-SQL
series; stacks on top of PR 2: "feat(logs): route unified-logs hooks
through executeAnalyticsSql")
## What is the current behavior?
`ServiceFlow.sql.ts` interpolates `logId` and `serviceType` as raw
template-literal strings directly into SQL (e.g. `` `WHERE el.id =
'${logId}'` ``). The legacy BigQuery branch of
`unified-log-inspection-query.ts` calls `post()` directly with a plain
`string`-typed SQL value, bypassing the `executeAnalyticsSql`
wire-boundary.
## What is the new behavior?
- Add `SAFE_SERVICE_LITERAL: Record<EdgeServiceType,
SafeLogSqlFragment>` — pre-branded SQL string literals for each service
type, built with `analyticsLiteral`.
- Rewrite `getBaseEdgeServiceFlowQuery`,
`getEdgeFunctionServiceFlowQuery`, and `getPostgresServiceFlowQuery` to
use `safeSql` template tag with `analyticsLiteral(logId)` and
`SAFE_SERVICE_LITERAL[serviceType]`. Return types changed to
`SafeLogSqlFragment`.
- Update the four thin wrappers (`getPostgrestServiceFlowQuery`,
`getAuthServiceFlowQuery`, `getStorageServiceFlowQuery`) to return
`SafeLogSqlFragment`.
- Replace `let sql = ''` + direct `post()` call in
`unified-log-inspection-query.ts`'s legacy BigQuery branch with `let
sql: SafeLogSqlFragment` + `executeAnalyticsSql`, eliminating the last
direct `post()` call to the analytics endpoint in this file.
`pnpm typecheck` passes cleanly.
## Additional context
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Secured analytics and log inspection queries through parameterized SQL
execution, preventing potential SQL injection vulnerabilities.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46336?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Security / refactor — routes all unified-logs analytics queries through
the `executeAnalyticsSql` wire-boundary wrapper (PR 2 of the
safe-analytics-sql series).
## What is the current behavior?
All five unified-logs query hooks call `post()` directly with a raw SQL
string, bypassing the `SafeLogSqlFragment` type enforcement. The
`getUnifiedLogs` infinite-query also drops the brand by composing with a
plain template literal before sending to the wire.
## What is the new behavior?
- `unified-logs-infinite-query`: brand-dropping plain template literal
replaced with `safeSql` + `analyticsLiteral`; `post()` replaced with
`executeAnalyticsSql`
- `unified-logs-count-query`, `unified-logs-chart-query`,
`unified-logs-facet-count-query`: `post()` replaced with
`executeAnalyticsSql`
- `unified-log-inspection-query` (OTEL branch only): both `post()` calls
replaced with `executeAnalyticsSql`; legacy BigQuery branch is unchanged
pending PR 3
The wire boundary now rejects plain strings at compile time for all OTEL
unified-logs paths.
## Additional context
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46333?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Why this happens
- `@tanstack/hotkeys` matches `Mod+/` against `event.key`, then falls
back to `event.code` via `PUNCTUATION_CODE_MAP` (the library's macOS
Option+punctuation workaround).
- On Spanish/Italian ISO keyboards, the physical key at the `Slash`
position produces `-`/`_`, so `Cmd+-` (browser zoom out) reports
`event.key='-'` and `event.code='Slash'`.
- The fallback maps `Slash → '/'`, the match succeeds, and the shortcuts
drawer opens. US/Canada layouts report `event.code='Minus'` and are
unaffected.
## Fix
- Change the hotkey to `Shift+?`. The shift-modifier check fails before
the punctuation `event.code` fallback runs, so no misfire.
- Matches the `?`-for-help convention used by GitHub, Linear, Notion.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated keyboard shortcut for opening the keyboard shortcuts reference
from Mod+/ to Shift+?, so the reference can be opened with Shift+? on
supported keyboards. This aligns the trigger with the expected key label
and improves discoverability. No other user-facing behavior changed.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46279?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Adds **Data API** (API Gateway / edge logs) as a new service row in
the observability overview, positioned before PostgREST
- Data API row is only shown when Data API is enabled for the project
(gated on `useIsDataApiEnabled`)
- Renames the existing PostgREST entry from "Data API" to "PostgREST" to
correctly reflect the service
- Adds the Data API description to `SERVICE_DESCRIPTIONS`
## Test plan
- [ ] Enable Data API for a project — Data API row appears before
PostgREST in the overview with chart data
- [ ] Disable Data API for a project — Data API row is hidden, PostgREST
row remains
- [ ] PostgREST row label now reads "PostgREST" instead of "Data API"
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Observability dashboard can optionally show an “API Gateway” service
when the Data API feature is enabled; it surfaces logs and health
metrics.
* The service health table now includes a description/tooltip for the
API Gateway and aggregates its metrics.
* **Bug Fixes**
* Restored and relabeled the PostgREST entry so its observability report
and reporting links appear correctly.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46266?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Feature - Security infrastructure
## What is the current behavior?
Analytics queries (BigQuery for legacy cloud, ClickHouse for self-hosted
OTEL) lack a compile-time safety model to prevent SQL injection from
untrusted input sources like URL parameters, UI inputs, or LLM output.
## What is the new behavior?
Implement a security model with a branded type `SafeLogSqlFragment` that
ensures all SQL fragments originate from either static code or
sanitization helpers. This includes:
- `analyticsLiteral()` for escaping string/number/boolean values
- `bqIdent()` and `clickhouseIdent()` for quoting identifiers with
engine-specific syntax
- `safeSql` template tag for composing fragments safely
- `executeAnalyticsSql()` wire boundary that rejects plain strings at
compile time
The pattern prevents cross-engine confusion by keeping
`SafeLogSqlFragment` (analytics) distinct from pg-meta's
`SafeSqlFragment` (Postgres).
## Additional context
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Introduced analytics SQL execution capabilities with built-in safety
validation for queries.
* Enhanced query robustness through keyword and identifier validation
mechanisms.
* Improved error handling and reporting for analytics operations.
* **Tests**
* Added comprehensive test suite for analytics SQL safety and validation
utilities.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46287?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Support policy update with current offerings for Uptime and Support SLA
for Teams and Enterprise customers.
Applies latest prettier config formatting.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Clarified Service Level Agreement details to distinguish between
"Uptime" SLAs (Enterprise-only) and "Support" SLAs (Teams and
Enterprise).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Restores proper content in new marketplace detail overview pages
compared to the legacy overview pages.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Data API URL settings and a visible "Required extensions"
section across integration overviews.
* Unified install/manage UIs for webhooks, Stripe Sync, wrappers,
queues, and others; marketplace mode now shows marketplace-specific
overview content.
* **Style**
* Improved marketplace detail rail and filter-bar button styling;
refined list/link row visuals.
* **Refactor**
* Overview pages reorganized to branch on marketplace mode and extract
shared overview content for consistency.
* **Tests**
* Stabilized integration overview test data for deterministic runs.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46179?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## Context
There's an issue with copying / exporting rows from the table editor
with the following conditions:
- Row has a column value that exceeds 10,240 and hence is truncated for
performance reasons
<img width="300" alt="image"
src="https://github.com/user-attachments/assets/4639edbb-ece6-4028-89b6-769ac314c3f3"
/>
- User is trying to copy/export selected rows (not all rows in the
table)
<img width="300" alt="image"
src="https://github.com/user-attachments/assets/e7c0da77-051c-4c46-af0d-f9510e0b37c4"
/>
The copy/export action will return the truncated data which is incorrect
(Should return the full data)
## Problem
This is happening as if we're only copying/exporting selected rows,
we're just using what's been loaded in the table editor to export (as
opposed to if the user is copying/exporting all rows in the table, we'd
be fetching the data from the database first before doing so)
Hence am opting to add a data hydration logic, such that if there's a
selected row that's been truncated, we'd fetch them on demand first
before copying/exporting.
There's limitations to this though - e.g if the table doesn't have a
primary key we can't do this (since we need to run a query to fetch the
data). This is already an existing behaviour when trying to load the
column value in the table editor in the grid so no issues I believe.
We'll just show this toast:
<img width="300" alt="image"
src="https://github.com/user-attachments/assets/442637bb-4b9b-492d-b202-bbf6e5ae7512"
/>
## To test
You'll need a column with a really large value - the way I do it is to
load the data directly into the DB via TablePlus
- [ ] Verify that copying / exporting selected rows with really large
column values copies/exports all the data correctly (there shouldn't be
any truncated value)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Improved handling of truncated cell values during copy and export
operations
* **Bug Fixes**
* Copy and export operations now require an active project selection
* Fixed data export for tables without primary keys
* **Style**
* Updated grid header copy and export control layout
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46268?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
As per PR title - persists the opened state of the connect sheet into
local storage so re-opening it again will have the same parameters
chosen
## To test
- [ ] Verify that the persisting of the opened state of the connect
sheet works
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Connect Sheet now saves user preferences so selections persist across
sessions.
* **Improvements**
* Better synchronization between the UI and the URL for more consistent
state when opening or sharing links.
* Clearing selections reliably removes all relevant filters.
* **Refactor**
* Internal state handling simplified for more predictable mode and field
changes.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46213?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Light rewording of the "How does the GitHub integration work?" section
on Integrations > GitHub
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## What kind of change does this PR introduce?
Refactor
## What is the current behavior?
FE-3452: `Connect.Commands.tsx` has a local `ConnectShortcutBadge`
component that hand-rolls the same Fragment + `KeyboardShortcut` +
"then" separator loop that `ShortcutBadge` already provides.
FE-3453: The `'header_button' | 'connect_section' | 'keyboard_shortcut'`
union is written out twice: once in `app-state.ts` and once in the
`ConnectSheetOpenedEvent` telemetry type in `telemetry-constants.ts`.
## What is the new behavior?
FE-3452: `ConnectShortcutBadge` is removed; the badge uses
`<ShortcutBadge shortcutId={SHORTCUT_IDS.CONNECT_OPEN_SHEET} />` inline.
FE-3453: A `ConnectSheetSource` type is exported from
`telemetry-constants.ts` and imported into `app-state.ts`.
## Additional context
- Resolves FE-3452
- Resolves FE-3453.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Consolidated shortcut badge rendering to use a shared component across
the application, improving code maintainability and reducing
duplication.
* Introduced a centralized type definition for connect sheet source
tracking, enhancing type consistency throughout the codebase.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46245?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Context
Updating the shared pooler notice banner a little as we're shifting the
maintenance windows a bit
- eu-central-1: 2026-05-26, 13:00-15:00 UTC
- eu-west-1: 2026-06-01, 13:00-15:00 UTC
- us-west-1: 2026-06-02, 16:00-18:00 UTC
- us-east-1: 2026-06-03, 13:00-15:00 UTC
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Extended the notice banner expiry to remain visible for an additional
two days.
* Updated regional maintenance window schedules and related incident
info for system notices.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46280?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Adds discoverable keyboard shortcuts for the Advisors area, covering
both navigation between advisor sub-pages and in-page actions on the
Security/Performance Advisor pages. Built on the shared shortcut
registry (`apps/studio/state/shortcuts/`) so they show up in the command
menu and follow the existing chord conventions (`V` for adVisor,
mirroring auth-nav / database-nav).
Linear: [FE-3413](https://linear.app/supabase/issue/FE-3413)
### Shortcuts
| Shortcut | Action | Scope |
| --- | --- | --- |
| `V` then `S` | Go to Security Advisor | Anywhere under
`/project/<ref>/advisors/*` |
| `V` then `P` | Go to Performance Advisor | Anywhere under
`/project/<ref>/advisors/*` |
| `V` then `R` | Go to Advisor Settings (Rules) | Anywhere under
`/project/<ref>/advisors/*` |
| `1` | Switch to Errors tab | Security / Performance Advisor page |
| `2` | Switch to Warnings tab | Security / Performance Advisor page |
| `3` | Switch to Info tab | Security / Performance Advisor page |
| `Shift+R` | Refresh / rerun the advisor | Security / Performance
Advisor page |
| `Escape` | Close lint details panel | When a lint row is selected |
## Test plan
- [x] From anywhere in Advisors, `V S` / `V P` / `V R` route to Security
/ Performance / Rules
- [x] On Security and Performance Advisor pages, `1` / `2` / `3` switch
tabs and update the `preset` query param
- [x] `Shift+R` reruns the linter (disabled while a refresh is
in-flight)
- [x] `Escape` closes the lint details side panel when a lint is
selected
- [x] Digit shortcuts do not fire while typing in inputs (`ignoreInputs:
true`)
- [x] Shortcuts appear in the command menu under the Advisors group
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added keyboard shortcuts for Advisors (tab navigation, refresh/rerun,
close detail) with visible shortcut hints on tabs, refresh/rerun
buttons, close controls, and the Advisors menu; pages wire shortcuts to
tab switching, refresh, and close actions.
* **Chores**
* Registered Advisors shortcuts globally and added an Advisors
navigation group for discovery in the shortcuts reference.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46238?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com>
## Problem
Project settings still uses the deprecated `Modal` for:
- transferring a project
- upgrading Postgres in _Infrastructure_
## Solution
- use `Dialog` instead
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Migrated project upgrade confirmation and project transfer flows to a
unified dialog-based UI for improved consistency and accessibility.
Visual structure (headers, sections, footers) and action placement were
standardized; existing functionality, validation, and user workflows
remain unchanged.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46265?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update.
## What is the current behavior?
No docs for client-side trace propagation with the JS SDK. Users with
OpenTelemetry-instrumented apps had no way to find out that supabase-js
can attach W3C Trace Context headers and that `trace_id` shows up in API
Gateway and Edge Function logs.
## What is the new behavior?
New guide at `/guides/telemetry/client-side-tracing` covering
requirements, opt-in setup (`tracePropagation: true`), advanced options,
domain scoping, where `trace_id` appears in Supabase logs, and
troubleshooting. Linked from the Logging & observability nav.
Preview:
https://docs-git-docs-otel-sdk-supabase.vercel.app/docs/guides/telemetry/client-side-tracing
## Additional context
First of several planned SDK tracing guides. When the next SDK gets one
we'll restructure into a shared `tracing/` folder.
## Summary by CodeRabbit
* **Documentation**
* New comprehensive guide for client-side trace propagation with the JS
SDK: explains W3C Trace Context header behavior, requirements, setup
steps, opt-in examples, advanced configuration, domain/security notes,
and troubleshooting when trace IDs are missing.
* Added a new "Tracing with the JS SDK" entry in the Logging &
observability navigation for easy access to the guide.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* New comprehensive guide for client-side trace propagation with the JS
SDK: explains W3C Trace Context header behavior, requirements, setup
steps, opt-in examples, advanced configuration, domain/security notes,
and troubleshooting when trace IDs are missing.
* Added a "Tracing with the JS SDK" entry under Logging & observability
for quick access.
* Documentation metadata updated to reference the latest source
snapshots.
* Lint rules updated to allow "OpenTelemetry", "Zipkin", and "noop".
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46218?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Alex Hall
