fixes phone provider saves that showed success but did not persist the
enabled state
(smol regression from the refactor)
## ref:
- closes https://github.com/supabase/supabase/issues/44966
ig was introduced by 6b35cc8034
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Automatically clears certain conditional fields when their visibility
condition becomes false to avoid stale values.
* Preserves input values and registration state for fields removed from
the UI (they no longer unregister on hide), improving form continuity
during toggles.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This PR shows installed marketplace apps in the left pane on the
integrations page and shows the `Installed` badge on the card.
`Official` badge is not shown on marketplace listings.
<img width="1652" height="892" alt="image"
src="https://github.com/user-attachments/assets/16c0a218-1658-426e-9b5b-d28e44c5c3b6"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed excessive spacing on the integrations page
* Enhanced integration installation detection for improved accuracy
* **Style**
* Updated official badge display on integration cards
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
This change adds me (Dane Harrigan) to the humans.txt file.
## What is the current behavior?
I am not listed in the file.
## What is the new behavior?
I am in the file.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated public team listing: added team member Dane Harrigan.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Alaister Young <alaister@users.noreply.github.com>
## What kind of change does this PR introduce?
Docs update
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a "Manage image transformations" guide in Storage docs
describing where to find the setting and how to use the Enable Image
Transformations toggle in Storage > Settings. Clarifies that disabling
the toggle stops all image transformation requests from being processed
and includes step‑by‑step user guidance.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Adding my name `Sugat Mahanti` to humans.txt as part of onboarding
process as I have joined the compute team at Supabase
## What is the current behavior?
N/A
## What is the new behavior?
N/A
## Additional context
Add any other context or screenshots.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added an additional contributor to the project's public team credits
and acknowledgements. This is a minimal, single-line update to
contributor listings with no changes to content ordering or
functionality; low-risk, documentation-only change.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES/NO
## What kind of change does this PR introduce?
- Connected our notion db as source of truth for events.
- Refreshed layout a bit
- Fixed jumping gap when no upcoming events.
[DEBR-229](https://linear.app/supabase/issue/DEBR-229/fix-jumping-gap-on-website-events-page)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* "Speaking" badge highlights presenter events
* "Meet with us" secondary button for meetings
* Added "Conference" category filter; removed "On demand"
* Events now come from a single Notion-backed source
* **UI/Design Changes**
* Redesigned event banner and responsive layout (no cover image)
* Register button now shows a right-arrow icon; CTAs open in a new tab
* Event cards show up to 3 categories with "+N more" and support
multi-day ranges
* **Behavior**
* Events sort newest/upcoming first (descending date)
* Search/filters operate over a single unified events list
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
new troubleshooting doc to download complete storage
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a "Download Objects" guide detailing: downloading from the
Dashboard UI, using the CLI to list/copy objects, connecting with
S3-compatible clients (enable S3, generate keys, use endpoint),
migration scripts for bulk downloads, note on separate file metadata
storage, and links to backup/restore and authentication references.
* **New Features**
* Added a "Download Objects" entry to the docs navigation under Storage
→ Management.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Overhauled SQL generation across the Studio: queries and helpers now
use safer, parameterized SQL construction for more robust and consistent
behavior.
* **Bug Fixes**
* Improved trigger update flow so event values are normalized before
saving, reducing errors when modifying webhooks/triggers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated API key guidance to recommend publishable keys in getting
started materials.
* Added new "Get API details" section with credential retrieval
instructions.
* Updated code examples to use publishable keys.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: fadymak <dev@fadymak.com>
## Summary
- Makes the new table filter bar the permanent default by hardcoding
`useIsTableFilterBarEnabled` to return `true`
- Removes the feature preview toggle (opt-out) from the preview modal
- Cleans up E2E tests: removes old filter UI test, removes
`enableFilterBar` helper, fixes race condition in column-drop test
- Old filter code paths are left in place for a follow-up cleanup PR
Closes FE-2819
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed the table filter bar preview and its opt-in/local-storage
preview key.
* Cleared preview content from the feature preview modal.
* **Tests**
* Removed the UI filtering e2e test and associated preview opt-in
helper.
* Updated filter-bar e2e flows to adjust navigation/wait behavior (added
explicit waits, removed redundant reloads).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## Summary
- Fixes the cursor jumping to end of input on every keystroke in the
database functions search
- Replaced manual `useParams` + `router.push` URL sync with
`useQueryState` from nuqs, which updates state synchronously — matching
the pattern already used for the other filters on this page
- Removed the `setTimeout` hack in the SchemaSelector onChange that was
only needed because of the async URL update
Fixes FE-3000
## Test plan
- [x] Navigate to Database > Functions
- [x] Type a search string, then click in the middle of the string and
type — cursor should stay in place
- [x] Verify search filtering still works correctly
- [x] Verify switching schemas still clears the search input
- [x] Verify the `?search=` query param is still reflected in the URL
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved responsiveness of schema selection in the Functions
list—search filters now clear immediately when switching schemas,
eliminating previous delays.
* **Improvements**
* Enhanced URL state synchronization for better consistency with browser
history and navigation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
While trying to update `react` to version `19`, I noticed type related
errors that can be fixed in version `18`, mostly usage of `JSX.Element`
instead of `ReactNode`.
## Solution
- Use `ReactNode` instead of `JSX.Element`
- Fix some invalid usage of `rechart`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Refactor**
* Standardized React component type annotations across the codebase for
improved type consistency and flexibility.
* Updated component prop types to accept a broader range of renderable
content.
* **Bug Fixes**
* Adjusted chart layout positioning to improve visual alignment.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
We currently have 2 libraries for schema validation: `yup` that was used
with `formik` and `zod` which is now the preferred one.
## Solution
- Migrate the auth providers form to `zod`
- Remove `yup`
No visual changes.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Preserve empty numeric inputs in auth provider forms to avoid
unintended conversion.
* **Refactor**
* Migrated auth provider form validation to a new validation system for
more consistent rules.
* Strengthened provider-specific validation (email, phone/SMS, OAuth,
SAML, Web3), added improved SMS test-OTP/date checks, and adjusted
initial handling for password-required-characters.
* **Chores**
* Removed an unused validation dependency from project packages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The CLI backup instructions added inline to `ProjectPausedState`
(#44621) make the paused project card too tall to fit on smaller
screens. Because the card itself doesn't scroll, users on smaller
viewports cannot reach the Resume button — blocking them from resuming
their project entirely.
## Fix
Remove the inline `LogicalBackupCliInstructions` section from
`ProjectPausedState`. CLI backup instructions are still available in:
- The delete project modal (inline)
- The "Download backup" button dialog in `PauseFailedState` /
`RestoreFailedState`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Removed CLI backup command instructions from the paused project state
view, streamlining the interface and eliminating redundant messaging
about project resumption requirements before running commands.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Summary
- Adds a new "Copy as CSV" action to the export dropdown in the SQL
editor results panel, alongside the existing Copy as Markdown, Copy as
JSON, and Download CSV options
- Registers a `Shift+Cmd+C` keyboard shortcut for the action, with a
toggle in Account > Preferences > Keyboard shortcuts
- Works everywhere `DownloadResultsButton` is used: SQL editor, logs,
query performance, and linter pages
Fixes FE-2991
## Test plan
- [x] Run a SELECT query in the SQL editor, open the Export dropdown,
and verify "Copy as CSV" appears between "Copy as JSON" and "Download
CSV"
- [x] Click "Copy as CSV" and verify CSV data is copied to clipboard
- [x] Use `Shift+Cmd+C` shortcut and verify it copies CSV to clipboard
- [x] Go to Account > Preferences > Keyboard shortcuts and verify the
"Copy results as CSV" toggle is present and functional
- [x] Disable the shortcut in preferences, verify `Shift+Cmd+C` no
longer triggers the copy
- [x] Verify the same option appears in the logs export dropdown
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added "Copy as CSV" action to the results download menu, allowing
users to quickly copy query results in CSV format to the clipboard.
* Introduced a new hotkey preference setting to enable/disable the
Shift+Meta+C keyboard shortcut for copying results as CSV.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
Since the drag & drop refactor, users cannot double click to select the
column name in the columns headers of the table editor. Besides, the
advisor button cannot be clicked either.
## Solution
- Add a delay constraint on the drag & drop operation, allowing click
events to trigger
- Add e2e tests to prevent future reggressions
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Double-click column headers to copy column names to clipboard
* Index Advisor warnings now accessible in the Table Editor
* **Improvements**
* Improved drag start timing and tolerance for smoother column dragging
* Better screen reader announcement for index suggestion actions
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## TL;DR
the table editor definition panel was showing incomplete SQL for views
with `WITH (security_invoker = true)`
ignoring the reloption and making it easy to accidentally strip it when
recreating the view
## prob
When viewing a security invoker view in the Table Editor, the Definition
panel only showed `CREATE VIEW ... AS ...`
without the `WITH (security_invoker = true)` clause
which caused two issues:
1. the displayed SQL was incomplete and didn't match the actual view
definition
2. users copying the SQL to recreate the view would unintentionally lose
the security_invoker setting
## ex:
| Before | After |
|--------|-------|
| `create view public.exposed_api as`<br>`select id, secret from
public.rls_protected_table;` | `create view public.exposed_api with
(security_invoker = true) as`<br>`select id, secret from
public.rls_protected_table;` |
## ref:
- closes https://github.com/supabase/supabase/issues/44934
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* View definitions now show the full CREATE statement (including
materialized views and WITH (...) options) and preserve security options
like security_invoker when viewed or opened in the SQL editor.
* **Tests**
* Added end-to-end test verifying security option preservation in view
definitions and when opening them in the SQL editor.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
If users accidentally click the _Auto layout_ button in the schema
visualiser, they immediately lose all their changes.
## Solution
- Ask for confirmation before applying auto layout
- Fix auto layout changes aren't persisted
<img width="457" height="232" alt="image"
src="https://github.com/user-attachments/assets/d58e2995-6537-43b4-9b99-b1447fb03e1f"
/>
## How to test
- Go to database/schema
- Make changes to the layout
- Refresh the page and check changes are still applied
- Click the _Auto layout_ button and click _Cancel_
- Check auto layout wasn't applied
- Refresh the page and check users changes are still applied
- Click the _Auto layout_ button and click _Apply_
- Check auto layout was applied
- Refresh the page and check auto layout changes are still applied
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a confirmation dialog for the "Auto layout" action so users can
review and confirm before changes are applied.
* **Bug Fixes**
* Ensured layout fitting completes before node positions are saved,
preventing incorrect or premature persistence.
* **Style**
* Simplified schema error rendering to present error messages more
directly and clearly.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
This PR integrates with the new marketplace db to allow Grafana (and
other partners) OAuth apps to install from the integrations page. A demo
of this working locally is available here:
https://supabase.slack.com/archives/C01GN60J0BS/p1775551752479709. End
to end flow is documented here:
https://www.notion.so/supabase/Grafana-Integration-Flow-33a5004b775f80eeaf91c098beb8071f.
TODO:
- [ ] Make sure `NEXT_PUBLIC_MARKETPLACE_API_URL` variable is set to the
new marketplace db.
- [x] Test with the `marketplaceIntegrations` enabled and disabled in
staging once https://github.com/supabase/platform/pull/31298 is merged
and available in staging.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Add OAuth "Install integration" button that detects installed
integrations and supports GET/POST install flows
* Marketplace listings now include install links, installation method,
partner info, and listing assets/logos
* **Infrastructure**
* Allow marketplace API origin for images and content in security and
image config
* Centralize marketplace types and switch marketplace data source for
more reliable listings
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Adds an Astro auth guide
## What is the current behavior?
No such guide
## What is the new behavior?
Adds the guide
<img width="1491" height="485" alt="Screenshot 2026-04-02 at 18 30 07"
src="https://github.com/user-attachments/assets/c76f926d-02b1-4a89-9595-700cf4fcb4e7"
/>
## Additional context
N/A
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added an Astro authentication quickstart covering Supabase setup, SSR
configuration, required env vars, server-side auth flows, email
confirmation handling, and testing the dev flow; includes end-to-end
examples for sign-up, sign-in, sign-out, protected pages, and a
dashboard walkthrough
* **Navigation**
* Added Astro to the Auth "Getting Started" navigation section
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update to include an Astro Quickstart Guide
## What is the current behavior?
No Astro quickstart guide
## What is the new behavior?
Added the Astro guide
<img width="1385" height="561" alt="Screenshot 2026-04-02 at 15 14 39"
src="https://github.com/user-attachments/assets/e86f64d3-a918-4bd4-8124-b3cb441e1217"
/>
<img width="1" height="1" alt="Screenshot 2026-04-02 at 10 44 32"
src="https://github.com/user-attachments/assets/5f1fbe87-4f4b-4e3d-a292-eca914735c38"
/>
## Additional context
N/A
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Astro.js to the Getting Started framework list, home page
framework grid, and main navigation under Framework Quickstarts.
* **Documentation**
* Added an Astro quickstart guide: 8-step setup covering project
creation, package installation, server-side configuration, env vars,
example server-side Supabase usage, running the dev server, and links to
next steps.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Jeremias Menichelli <jmenichelli@gmail.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
## What does this PR do?
Adds a pgvector index tuning guide covering:
- IVFFlat vs HNSW index selection
- Parameter tuning (`lists`, `probes`, `m`, `ef_construction`)
- Performance trade-offs
- Recommendations for production workloads (100k+ embeddings)
## Why?
There is currently limited guidance on index tuning for semantic search
workloads. This helps developers optimize query latency and accuracy
when using Supabase for AI applications.
## Type of change
- [x] Documentation update
Closes#44598
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a semantic search guide section with practical index-tuning
recommendations for large datasets, including IVFFlat and HNSW index
explanations, best-use scenarios, and sample index creation guidance to
balance performance and accuracy.
* **Style**
* Minor import formatting cleanup in a UI utility module (no behavior
changes).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
Removed several names from the humans.txt file.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Update humans.txt at PeopleOps request
## What is the current behavior?
NA
## What is the new behavior?
NA
## Additional context
NA
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated documentation credits file.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
We'd like to update react to `19` but many of our dependencies don't
support it.
## Solution
Update those dependencies. This PR focuses on `react-markdown`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Upgraded react-markdown to 10.1.0 (and remark-gfm to 4.0.0) across
projects for improved Markdown support.
* **Style**
* Adjusted Markdown rendering so typography and spacing are applied via
surrounding containers, improving consistent styling across docs and UI.
* **New Content**
* Added a new RSS feed item for a recent blog post.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Preferred fix to this PR
[here](https://github.com/supabase/supabase/pull/44886)
On a security email template page (e.g. Reauthentication), if you edit
the Subject or Body without saving, then toggle **Enable notification**
in the Configuration card and click **Save changes**, the Content edits
are reverted to the last saved values.
## Changes involved
Opting to not invalidate the `authConfig` RQ cache on a successful
mutation when toggling the security email notification while on the
template editor page
## To test
- [ ] Open a security email template
- [ ] Make some changes to the template without saving
- [ ] Toggle the notification and save
- [ ] Ensure that the template changes are still present and not
reverted
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Optimized query cache handling for authentication configuration
updates to reduce unnecessary refresh operations.
* Enhanced type safety for form submissions in authentication settings
to prevent data validation errors.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Adds support for new OAuth scopes for reading and writing analytics
config to the app creation dialog and consent screen.
Depends on https://github.com/supabase/platform/pull/31539
Add
[Content-Signal](https://www.ietf.org/archive/id/draft-romm-aipref-contentsignals-00.txt)
directive to robots.txt opting into AI training, search, and inference
use.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated website and documentation robots.txt to enable AI training,
search indexing, and AI input processing for site content.
* Minor formatting fix: ensured trailing newline at end of both
robots.txt files.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds a `/.well-known/api-catalog` to advertise our management API.
Motivation is for agents, but this is generally part of [RFC
9727](https://www.rfc-editor.org/rfc/rfc9727).
## Testing
Make an HTTP request to `/.well-known/api-catalog` and confirm it
returns the JSON content with content type `application/linkset+json`:
```shell
curl -i https://zone-www-dot-com-git-feat-agent-catalog-supabase.vercel.app/.well-known/api-catalog
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a public API catalog (linkset) exposing API metadata, OpenAPI
endpoint, documentation and status links.
* Added HTTP headers to advertise the API catalog from the site root and
to serve the catalog with the correct content type.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Display tax information in the upcoming invoice breakdown.
- Show a "Tax" line item with amount and rate tooltip when tax is
successfully calculated
- Show a warning row when tax estimation fails, prompting users to
verify their billing address
- Update Current Costs and Projected Costs tooltips to indicate whether
tax is included or could not be estimated
## Test plan
- [ ] Verify tax row appears with correct amount
when `tax_status` is `calculated`
- [ ] Verify tax rate percentage shows in the tooltip (e.g., "Estimated
tax at 10%...")
- [ ] Verify warning row appears when `tax_status` is `failed`
- [ ] Verify no tax row appears when `tax_status` is `not_applicable`
- [ ] Verify "Applicable tax included." appears in Current/Projected
Costs tooltips when tax is calculated
- [ ] Verify "Tax could not be estimated and is not included." appears
in tooltips when tax fails
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Upcoming invoices now include tax details and a tax status.
* Billing breakdown shows projected tax and conditionally displays
projected totals excluding tax when applicable.
* If tax estimation fails, a “Tax — Could not be estimated” row appears
and totals reflect the failure.
* Added "Stripe Projects" as a billing partner option and clarified that
projected amounts may be explicitly null.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## Problem
We'd like to update react to `19` but many of our dependencies don't
support it.
## Solution
Update those dependencies. This PR focuses on `react-hook-form`
## How to test
Play with some forms, especially those that use arrays of values
(database/enumerated types for instance) and the highly dynamic ones
(auth providers for instance)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **Chores**
* Bumped the form-handling library version across apps and packages for
improved compatibility and stability.
* **Refactor**
* Improved component form typings and generics in the studio to increase
type safety and reduce potential runtime issues.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Upgrade vite and vitest to their latest major versions across the
monorepo, along with related packages.
**Changed:**
- `vite` catalog: `^7.3.2` → `^8.0.8` (Rolldown replaces esbuild/Rollup)
- `vitest` catalog: `^3.2.0` → `^4.1.4`
- `@vitejs/plugin-react`: `^4.3.4` → `^6.0.1`
- `@vitest/coverage-v8`: `^3.2.0` → `^4.1.4`
- `@vitest/ui`: `^3.2.0` → `^4.1.4`
- `vite-tsconfig-paths`: `^4.3.2` / `^5.1.4` → `^6.1.1`
**Pinned to vite 7:**
- `apps/lite-studio` — `@react-router/dev` hasn't declared vite 8
support yet
- `blocks/vue` — Nuxt plugins (`vite-plugin-inspect`, `vite-dev-rpc`,
`vite-hot-client`, `vite-plugin-vue-tracer`) haven't declared vite 8
support yet
**Test fixes for vitest 4 breaking changes:**
- **`apps/studio/lib/api/snippets.utils.test.ts`** — Replaced
`vi.mock('fs/promises')` automock with an explicit factory. Vitest 4's
automocking doesn't create mock functions for getter-based exports on
Node built-ins, so `mockedFS.access.mockResolvedValue` etc. were
`undefined`.
- **`apps/studio/lib/api/self-hosted/functions/index.test.ts`** —
Changed `mockReturnValue` to `mockImplementation(function() { ... })`
for a constructor mock. Vitest 4 no longer allows `mockReturnValue` when
the mock is called with `new`.
- **`apps/studio/tests/pages/api/mcp/index.test.ts`** — Changed arrow
function to regular `function` in `mockImplementation` for
`StreamableHTTPServerTransport`. Arrow functions can't be constructors,
and vitest 4 now enforces this.
- **`packages/ui-patterns/vitest.setup.ts`** — Changed `ResizeObserver`
mock from arrow function to regular `function` for the same constructor
enforcement reason. This was crashing Radix popover rendering in jsdom.
## To test
- `pnpm test:studio` — all 226 test files should pass
- `pnpm --filter ui-patterns vitest run` — all 183 tests should pass
- `pnpm --filter www test -- --run` — all 19 tests should pass
- `pnpm --filter ui vitest run` — all tests should pass
- `pnpm --filter dev-tools vitest run` — all tests should pass
- `pnpm --filter ai-commands vitest run` — all tests should pass
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Standardized and updated development tooling versions and version
sources for consistent installs across the repo (Vite, Vitest,
vite-tsconfig-paths and related plugins/catalog entries).
* **Tests**
* Improved test mocks and typings (updated mock
factories/implementations and tightened spy/type assertions) to increase
test reliability and compatibility with updated tooling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
## Problem
We'd like to update react to `19` but many of our dependencies don't
support it.
## Solution
Update those dependencies. This PR focuses on `framer-motion`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated animation library dependencies to the latest compatible
versions across applications and packages to ensure consistent
performance and stability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
When a project is paused, in a failed state, or about to be deleted,
users have no obvious way to take a logical backup of their data before
proceeding. This is particularly risky at deletion time — once deleted,
data is gone.
## Solution
Introduce a new `LogicalBackupCliInstructions` component that surfaces
ready-to-run `supabase db dump` commands pre-filled with the project's
direct connection details.
### Where it appears
| State | How |
|---|---|
| Project paused (restorable) | Inline in `ProjectPausedState` with a
note to resume first |
| Pause failed | Dialog via "Download backup" button when no backup is
available |
| Restore failed | Dialog via "Download backup" button when no backup is
available |
| Delete project modal | Inline in `DeleteProjectModal` for all plans |
Not shown in `PauseDisabledState` (project paused 90+ days, compute
stopped — `pg_dump` would fail anyway).
### What the component does
- Fetches the project's direct connection settings via
`useProjectSettingsV2Query`
- Builds a connection URI with a `[YOUR-PASSWORD]` placeholder (password
is never stored or displayed)
- Shows three shell commands to dump roles, schema, and data separately
— mirroring the [logical backup
docs](https://supabase.com/docs/guides/platform/backups)
- Optionally shows a **Reset database password** button (gated on
`UPDATE projects` permission); shown in the paused state, hidden
elsewhere via `showResetPassword={false}`
- Includes inline guidance to percent-encode special characters in the
password
### Shell safety
The generated `--db-url` values are wrapped in single quotes to prevent
shell metacharacter expansion when users paste and run the commands.
`npx supabase login` is intentionally omitted — the `--db-url` flag
authenticates directly against Postgres and does not require a Supabase
account.
### Backup button behaviour in failed states
The "Download backup" button in `PauseFailedState` and
`RestoreFailedState` now always stays enabled:
- **Backup available** — downloads immediately (unchanged)
- **No backup / physical backups** — opens a dialog with CLI
instructions instead of silently failing
## How to test
**Delete project flow**
1. Open any project → Settings → General → Delete project
2. Verify the CLI backup section appears with the project's host, port,
user, and db name pre-filled
3. Verify no Reset database password button is shown
**Paused project**
1. Open a paused project (`ProjectPausedState`) — verify CLI
instructions appear with the "Your project must be resumed before
running these commands." note
2. Open a project paused for 90+ days (`PauseDisabledState`) — verify
CLI instructions do not appear
**Failed states**
1. Simulate a pause-failed or restore-failed state
2. If a downloadable backup exists — "Download backup" downloads it
directly
3. Block the backup API or use a project with physical backups —
"Download backup" should open the CLI instructions dialog
**Error state**
1. Block the project settings API call (DevTools → Network → block
request)
2. Verify an error message appears with a link to Database settings
3. Verify a loading skeleton shows while the request is in flight
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Chore
## What is the current behavior?
100% of traces are being sent to Sentry, which alone would blew through
all of our quota leaving no spans available for other projects. For
April we are already rate limited.
## What is the new behavior?
Change `tracesSampleRate` to more reasonable value (0.02).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Optimized performance monitoring sampling configuration to reduce
application overhead while maintaining essential error tracking and
diagnostics.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The "Healthy / Unhealthy" badge on the Observability overview was
alarming — showing **UNHEALTHY** even when every bar in the chart looked
fine. Two root causes:
1. **The threshold is aggressive.** Any period where the aggregate error
rate is ≥ 1% flips the badge to "Unhealthy", even if that 1% came from a
short burst that is visually indistinguishable in the chart.
2. **Period-wide aggregation hides spikes.** The badge status is
computed over the entire selected time window (e.g. 24 h). A 5-minute
spike at 20% errors diluted across 24 h of mostly-clean traffic can push
the aggregate just over 1%, triggering "Unhealthy" while all chart bars
look green.
The badge wording ("Unhealthy") also implies a current service problem,
whereas the underlying metric is a historical aggregate — making it easy
to misread.
## Change
Remove the badge entirely. The per-row error/warning rate indicator
(e.g. `● 1.34% errors`) already surfaces the key signal without the
alarming label, and the bar chart lets users see the actual shape of
traffic over time.
## On spike visibility in charts
The charts already use **COUNT per time bucket** (not averages), so
individual bars faithfully represent event volume. The bucket
granularity does compress spikes for longer windows (hourly buckets for
1–3 day views, daily for 7-day), but that's a separate concern from the
badge. If we want to surface burst detection in the future, a better
approach would be per-bucket threshold highlighting rather than a single
period-wide badge.
https://claude.ai/code/session_01E1ejWyuR9BV4qcTyiGGVVY
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Removed the service health status indicator from the Service Health
Table.
* **New Features**
* Replaced per-row bar charts with a line chart showing error/warning
rates alongside OK series.
* Added a centered "No data" placeholder when chart data is empty and
preserved click interactions on chart points.
* Y-axis values now display as percentages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude <noreply@anthropic.com>
The docs build had a fragile implicit dependency on www's filesystem
(`../../../apps/www/public/llms`), flagged by the docs team in #44670.
Rather than formalising that dependency with a shared package, this PR
eliminates it entirely by making www the sole owner of llms content
assembly.
**How it works now:**
`/llms/[slug]` handles all `/llms/*.txt` requests via a 3-step cascade:
1. Dynamic content — `pricing.txt` generated at request time from
`shared-data` imports
2. Local file — product overviews read from `data/llms/`
3. Docs proxy — reference docs (guides, js, dart, etc.) fetched from the
docs app
No hardcoded slug lists, so adding new content just works.
**What changed:**
- `apps/docs/scripts/llms.ts` trimmed to only generate per-source
reference files — www now owns `llms.txt`, `llms-full.txt`, and product
overviews
- Removed `generateLlmsPricing.mjs` build script — pricing generated
dynamically from `shared-data`
- Removed llms rewrites from `rewrites.js` — routes handle everything
with consistent `Cache-Control: public, s-maxage=3600,
stale-while-revalidate=86400`
- Product overview `.txt` files moved from `public/llms/` → `data/llms/`
so all requests go through routes for consistent caching
**Docs team concerns from GROWTH-773:**
| Concern | Resolution |
|---------|-----------|
| Docs build depends on www files at a fragile relative path | Path
removed — docs no longer reads from www |
| www restructuring breaks docs with no obvious connection | Eliminated
— no cross-app filesystem dependency |
| No build order enforcement between www and docs | Not needed — docs
doesn't depend on www's build output |
## To test
- `curl <preview>/llms.txt` — markdown index with doc + product overview
links
- `curl <preview>/llms-full.txt` — combined product overviews + docs
content
- `curl <preview>/llms/pricing.txt` — dynamically generated pricing
tables
- `curl <preview>/llms/auth.txt` — product overview from local file
- `curl <preview>/llms/guides.txt` — proxied from docs app
- `curl <preview>/llms/nonexistent.txt` — 404
- Verify `Cache-Control` header on all responses
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
With the upcoming deprecation of anon and service role keys, this PR
updates the OAuth server examples to use the secret and publishable keys
instead.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated OAuth server authentication guides with revised client
initialization examples
* Improved environment variable references in code samples for server
client setup
* Enhanced troubleshooting sections with corrected terminology for
debugging Row-Level Security policy issues
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Amogh Rao (new hire) added to humans.txt
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES/NO
## What kind of change does this PR introduce?
Bug fix, feature, docs update, ...
## What is the current behavior?
Please link any relevant issues here.
## What is the new behavior?
Feel free to include screenshots if it includes visual changes.
## Additional context
Add any other context or screenshots.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated team attribution and credits information
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Next.js dependency versions across applications
* Updated TanStack React Router and React Start packages to newer
versions
* Updated workspace package configuration overrides
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The `ResourceExhaustionWarningBanner` routed disk IO, CPU, and
memory/swap exhaustion warnings to `/settings/infrastructure#<metric>` —
an infra chart page with no direct fix available. The action button
label "Learn more" didn't reflect a clear next step, and there was no
way to get AI-assisted query optimization from the banner.
## Changes
**Routing & CTAs**
- Compute warnings (`disk_io`, `cpu`, `ram`) now route to
`/settings/compute-and-disk` instead of the infra chart page
- Free plan users are routed to
`/org/[slug]/billing?panel=subscriptionPlan&source=resource_exhaustion_banner`
- Primary CTA text changed to "Upgrade compute" for all compute warnings
(paid and free plan)
- Read-only mode CTA changed from "Learn more" to "Manage disk"
**Troubleshoot dropdown**
- For compute warnings (which have both a docs URL and an AI prompt), a
"Troubleshoot" dropdown replaces the standalone "Learn more" button,
offering:
- Documentation — links to the relevant troubleshooting guide
- Ask AI Assistant — opens the AI assistant with a pre-filled query to
identify expensive queries via `pg_stat_statements`
- For warnings with only a docs URL (read-only mode, disk space, auth),
a direct "Learn more" button is shown as before
**Telemetry**
Two new events track user interactions with the banner:
| Event | Fires when | Properties |
|---|---|---|
| `resource_exhaustion_banner_upgrade_clicked` | User clicks the primary
CTA | `warningTypes: string[]`, `isFreePlan: boolean`, `destination:
string` |
| `resource_exhaustion_banner_ai_assistant_clicked` | User clicks "Ask
AI Assistant" | `warningTypes: string[]`, `isFreePlan: boolean` |
Both events include the standard `groups` payload (project + org).
**Suppression fixes**
- Banner is now hidden on `/settings/compute-and-disk` for paid-plan
compute warnings (CTA would be a no-op)
- Banner stays visible on `/settings/infrastructure` for compute
warnings (CTA now links to a different page)
**Description text**
- Removed stale "Check the usage page for more recent and detailed
statistics" from compute warning descriptions — no button in the banner
leads there
- Updated `multiple_resource_warnings` descriptions to reflect the
upgrade-focused CTAs
**Bug fixes**
- Fixed: auth rate limit critical banner was showing when warning
content had no title/description
- Fixed: CTA disabled state now only applies to compute warnings while
org data is loading (not all warning types)
## How to test
- Trigger or mock a `disk_io_exhaustion`, `cpu_exhaustion`, or
`memory_and_swap_exhaustion` warning
- Paid plan: CTA reads "Upgrade compute" →
`/project/<ref>/settings/compute-and-disk`
- Free plan: CTA reads "Upgrade compute" →
`/org/<slug>/billing?panel=subscriptionPlan&source=resource_exhaustion_banner`
- Troubleshoot dropdown appears with Documentation and Ask AI Assistant
options
- Verify `is_readonly_mode_enabled` shows "Manage disk" CTA and a direct
"Learn more" button (no dropdown)
- Verify `disk_space_exhaustion` and auth warnings show a direct "Learn
more" button (no dropdown)
- Verify the banner is hidden on `/settings/compute-and-disk` for
paid-plan compute warnings
- Verify the banner is still visible on `/settings/infrastructure` for
compute warnings
- Verify `resource_exhaustion_banner_upgrade_clicked` and
`resource_exhaustion_banner_ai_assistant_clicked` events fire with the
correct properties
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
This enables the user to restart an unhealthy project as opposed to
pausing and reactivating.
cc @GaryAustin1
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added detection and dedicated UI for unhealthy projects with restart
capability.
* Enabled automatic recovery monitoring that dismisses unhealthy state
once the project recovers.
* **Bug Fixes**
* Updated pause button to display appropriate message when project is
unhealthy.
* Extended restart functionality to support unhealthy project states.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
With the upcoming deprecation of the anonymous and service role keys,
this PR updates the Auth guides to use the publishable key instead of
the soon-to-be-deprecated anonymous key.
It also standardizes the example strings to be:
`'https://your-project-id.supabase.co'` and `'sb_publishable_...'` for
consistency.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Standardized client initialization examples to use a consistent
publishable-key placeholder (`sb_publishable_...`) and full project URL
format.
* Replaced "anon key" wording with "publishable key" across auth and API
guides and examples.
* Minor formatting and import-order/whitespace improvements in code
samples for clarity and consistency.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
This is a follow up for both our classic and scoped PAT's to add events
for tracking created and deleted.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Enhanced telemetry for access token creation and removal.
* Creation events now include token type (classic or scoped), expiry
setting, scope/resource access and permission counts when applicable.
* Removal events now include token type (classic or scoped).
* Instrumentation added across token creation and deletion flows to
improve analytics and auditing.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
* Add `@supabase/ssr` to catalog
* Use `catalog:` version of `@supabase/ssr` across repo
* Add workflow to update `@supabase/ssr`
* Switch runners for package and docs updates to `ubuntu-latest` (free,
lighter)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Centralized `@supabase/ssr` versioning across the workspace via the
package catalog.
* Updated CI workflow runners to a more consistent execution
environment.
* Added an automated workflow to streamline updating the `@supabase/ssr`
package and refreshing dependency lockfiles.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
When users have enabled a SMS hook, they can't update the TOPT test
values anymore.
This is because `formik` sent disabled inputs values in the form payload
while `react-hook-form` correctly does not.
## Solution
Make the inputs read only instead of disabled
## How to test
- Enable SMS auth
- Add a SMS hook
- Update the SMS auth settings
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Improvements**
* Authentication provider form fields now use read-only mode instead of
being disabled, preserving focus and interaction while preventing edits
across text, secret, multiline, numeric, select, boolean, and datetime
inputs.
* A new optional read-only prop was added to form fields for consistent
behavior.
* **Fixes**
* Initial form values recalculation was corrected so they update
reliably when the selected provider changes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## Additional context
Onboarding
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated team credits and contributors information.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Vaibhav