## Context
As per PR title
<img width="500" alt="image"
src="https://github.com/user-attachments/assets/4cf07471-a0c1-449d-9759-a0ccb3456e09"
/>
Also resolves FE-3565
Closes mobile menu when a link is clicked
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Improvements**
* Mobile menu now closes reliably when selecting more navigation items
(Modules, various Developers/Solutions links and footer links).
* Enhanced link focus and interaction behavior in the mobile menu for
clearer keyboard/touch feedback.
* **New Features**
* Navigation links can now accept optional click handlers, enabling
custom onClick behavior.
* **Refactor**
* Internal reorganization of mobile menu styling and link composition to
simplify maintenance.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Subtle improvement to charts that cannot load data. Less floaty.
| Before | After |
|--------|--------|
| <img width="731" height="323" alt="Screenshot 2026-06-08 at 11 46 21"
src="https://github.com/user-attachments/assets/14c87766-dfe3-448d-8c9c-f3176b658d08"
/> | <img width="791" height="333" alt="Screenshot 2026-06-08 at 11 46
01"
src="https://github.com/user-attachments/assets/d0e33b91-2990-41d2-b14c-25065b1f0c12"
/> |
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
**Style**
- Improved visual styling for chart error and loading states. Chart
placeholders now feature increased height and enhanced border
presentation with dashed borders and rounded corners, providing clearer
visual distinction when data is unavailable or unable to load.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The org Audit Log Drains page fires the same
`log_drain_save_button_clicked` and `log_drain_removed` telemetry events
as the project Log Drains page, even though they are distinct features
(project product logs vs. the org audit log). Org-scoped events should
have their own names and drop the project group.
## Fix
Add dedicated org-scoped events and use them in the org container:
- `audit_log_drain_save_button_clicked`
- `audit_log_drain_removed`
Both declare `groups: Omit<TelemetryGroups, 'project'>` (no project
group), matching the convention used by other org-scoped events (e.g.
the documents page events). The project Log Drains page keeps the
original `log_drain_*` events unchanged.
## How to test
- Open `/org/{slug}/audit-log-drains` (with the `auditLogsLogDrain` flag
enabled).
- Create a drain and confirm `audit_log_drain_save_button_clicked` fires
(with the destination type, org group, no project group).
- Delete a drain and confirm `audit_log_drain_removed` fires.
- Confirm the project Log Drains page still fires `log_drain_*` events.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated internal telemetry tracking for audit log drain operations to
improve monitoring and analytics of system behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This PR syncs the latest troubleshooting guides from the
supabase/troubleshooting repository.
---------
Co-authored-by: github-docs-bot <github-docs-bot@supabase.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
The `Update JS Client Libraries Docs` workflow's "Refresh
reference-content snapshot" step fails because `npx vitest run --update
scripts/build-reference-content.test.ts` is treated as a filter, not a
restriction, under Vitest 4, so all docs tests
run. `CodeSample.test.ts` then fails with ENOENT on
`apps/docs/examples/_internal/fixtures/*` because the workflow bypasses
the `pretest` npm hook that runs `codegen:examples`.
This is a regression of #44943 (commit 28ef62cf31), reintroduced by
#46163 when the snapshot step was renamed and rewritten back to the
file-path form.
Fixes:
- Workflow: use `--dir scripts` so only the snapshot test runs.
- Tests: add a vitest globalSetup that mirrors `codegen:examples`, so
`npx vitest`, `pnpm test:local`, and IDE single-test runs no longer
depend on the `pretest` lifecycle hook being triggered first.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated test infrastructure configuration and initialization process
for improved test suite management.
* Refined test execution workflow to efficiently manage test discovery
and execution across project directories.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Reorganized REST API documentation navigation to consolidate debugging
resources under a dedicated subsection for improved discoverability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The PostgREST observability page crashes for some projects with
`URIError: URI malformed`. The route renderer calls `decodeURIComponent`
directly on the request query string, which is user-controlled. A
malformed percent-sequence (for example a literal `%` in
`?discount=100%`) makes `decodeURIComponent` throw during render, taking
down the whole page via the global error boundary.
Tracked in Sentry issue 7536581822.
## Fix
Add a `safeDecodeURIComponent` helper that wraps `decodeURIComponent` in
a try/catch and falls back to the raw string on failure. Use it in the
route renderer. The sibling `queryParamsToObject` call is unaffected
since `URLSearchParams` already tolerates malformed escapes.
## How to test
- Open a project's PostgREST observability report
(`/project/[ref]/observability/postgrest`).
- Ensure a request with a malformed query string (e.g. a path containing
a bare `%`) appears in the data.
- Expected result: the row renders with the raw search string instead of
crashing the page.
- Unit tests for `safeDecodeURIComponent` cover valid decode, malformed
input, and empty string.
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update
## What is the current behavior?
Auth hooks documentation doesn't explicitly state that the hook name
configured in `config.toml` must correspond to available hooks to
prevent errors, which has caused confusion for some users.
## What is the new behavior?
Doc includes mention that hook name must correspond to available hooks.
## Additional context
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added clarification note regarding authentication hook configuration
requirements, specifying that hook names in configuration files must
correspond to available hook types.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Refactored the Database Create Index side panel to align with the
recommended Studio form patterns.
## What is the current behavior?
The side panel was using a legacy layout that did not follow the common
Studio form patterns.
It's also not a real form.
## What is the new behavior?
The Create Index side panel in the Database section is now consistent
with the Studio form patterns.
It's now a real form using `react-hook-form`
## Additional context
Before:
<img width="668" height="855" alt="image"
src="https://github.com/user-attachments/assets/d15ee63c-8d03-4780-8945-1792f0493133"
/>
After:
<img width="606" height="856" alt="image"
src="https://github.com/user-attachments/assets/78e0269c-e79c-42d1-a2c2-9465c0b0c46a"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **UI Improvements**
* Reworked index-creation panel into a validated, form-driven workflow
with clearer field interactions, multi-column selector, live read-only
SQL preview, and updated submit/cancel behavior.
* Footer actions: Cancel resets the form and closes the panel; Create
triggers form submission and reflects loading state.
* **Tests**
* Updated end-to-end flow to click "Select a table" (replacing "Choose a
table") during index creation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com>
## Problem
Clicking a checkbox in the logs filter sidebar (Log Type, Status,
Method, etc.) doesn't do anything. The box ticks, but the log list and
counts don't change. Only the search bar at the top actually filters. On
top of that, opening a URL that already has filters renders the sidebar
checkboxes unticked, so the active filters are invisible.
## Solution
The top search bar and the sidebar each store a selected filter in a
different internal format. A recent change taught the query builder
(`columnFiltersToLogsFilters`) to understand only the search bar's
wrapped `{ operator, values }` format, so anything clicked in the
sidebar (a bare `string[]`) was thrown away before it reached the query,
and nothing refetched.
- Accept the sidebar's bare format, treating it as a plain "equals"
filter (which is exactly what a checkbox means). Sidebar clicks apply
immediately again.
- Seed the sidebar checkboxes from the URL: equality filter groups are
seeded as a bare `string[]` (the shape the checkbox reads), so they
render ticked on load. Non-eq groups (neq/ilike from the top bar) stay
wrapped so their operator survives a round-trip.
- Keep the time-range picker out of the `filter` URL param so it doesn't
get swept in by mistake.
- Extracted the URL-building (`buildFilterSearchUpdate`) and URL-seeding
(`logsFiltersToColumnFilters`) into pure helpers so the click-to-query
and URL-load wiring are unit tested, not just the transform.
## How to test
Open Unified Logs and click a Log Type / Status / Method checkbox in the
left sidebar. The list and counts should update right away, without
touching the top search bar. Reload the page (or open a shared URL with
filters): the matching sidebar checkboxes should be ticked.
`UnifiedLogs.filters.test.ts` covers both filter formats, the time-range
exclusion, cleared filters, the click-to-URL wiring, and the URL-load
round-trip (including that a neq filter is not downgraded to eq).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added coverage for filter ↔ URL conversions, checkbox grouping,
operator preservation, null/cleared handling, and timerange routing.
* **Bug Fixes**
* Consistently normalize and serialize varied filter input shapes.
* Omit non-allowlisted columns from URL filters.
* Ensure timerange uses its dedicated URL key and is removed when
cleared.
* **Refactor**
* Centralized filter serialization/deserialization and simplified URL
update wiring.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix
## What is the current behavior?
Scoped PAT access message checks `organization_slugs`/`project_refs` to
determine display text. This breaks when an org/project is deleted; its
tuple is removed and consequently from the token's slugs/refs, causing a
scoped token to incorrectly show "This token has access to all
resources."
## What is the new behavior?
Check the `token.scope` directly:
- `user` → "This token has access to all resources."
- `organization` → "This token has access to specific organizations."
(or "This token has no accessible organizations." if all scoped orgs
were removed)
- `project` → "This token has access to specific projects." (or "This
token has no accessible projects." if all scoped projects were removed)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved clarity of access token scope messaging. The resource access
information now displays more specific and accurate details based on
token type, distinguishing between organization-level, project-level,
and user-level access permissions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
When trying to create a new wrapper from the integrations page and no
wrappers exist yet, then the sheet is not closable unless you submit the
form or refresh the page.
https://github.com/user-attachments/assets/7d46cce3-0a0f-4efd-ba98-d141cfcfe31c
## After
- The sheet is closable with confirmation modal
- added nuqs to open "new" wrapper form via `new=true` params
https://github.com/user-attachments/assets/36c4ae9e-7aa8-430c-9741-6d84978997f1
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Improved state management for the wrapper creation dialog, enabling
state persistence through URL parameters for better shareability and
navigation consistency.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
In the new marketplace revamped view the link to filter wrappers should
be `/project/_/integrations?type=wrapper` instead of the old
`/project/_/integrations?category=wrapper`. This PR fixes the broken
link when the marketplace feature preview is enabled.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Wrappers menu item now routes correctly when different marketplace
page variants are enabled.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
removes three extensions from the list on the Postgres Extensions docs
page because we do not expose those extensions to users. extensions
removed are: amcheck, pg_surgery, pg_freespacemap
also adds a small cosmetic change to clarify that "public" refers to the
`public` schema on the same documentation page
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
docs update
## What is the current behavior?
extensions are listed at
https://supabase.com/docs/guides/database/extensions that will result in
permissions errors should users try to install them themselves, as they
require superuser access to install
## What is the new behavior?
removes those items from the list
## Additional context
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated extensions overview documentation with improved formatting for
better readability
* **Chores**
* Removed three extensions from the available extensions metadata
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Document Realtime broadcast of binary payloads
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Clarified binary payload behavior across SDKs and runtimes, including
version-gated support and which clients silently drop binaries.
* Added examples for sending binary messages via JavaScript, Swift, REST
(including file upload), and database broadcasts.
* Clarified REST payload handling (Content-Type selects JSON vs binary),
private messaging flag, and that batch endpoints accept JSON-only.
* Noted that channel.httpSend() uses REST starting in supabase-js
2.107.0.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
Fixes DOCS-651
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
This adds a non-null assertion to a Supabase method that expects
non-null.
Additionally, it updates a label from 'Remix' to 'React Router'.
## What is the current behavior?
Two issues:
- Following the Auth client steps with React Router creates a
`deprecation` error and downstream Typescript errors.
- 'Remix' is renamed to 'React Router'.
> Remix and React Router are the same thing, made by the same people.
Remix was simply renamed React Router Framework Mode starting in version
7 of React Router.
- [Blog
Source](https://reacttraining.com/blog/remix-vs-react-router-framework)
<img width="894" height="754" alt="Screenshot 2026-06-04 at 4 00 45 PM"
src="https://github.com/user-attachments/assets/33dc5d89-4a76-44b6-a5c3-39a30dca3b57"
/>
<img width="604" height="464" alt="Screenshot 2026-06-05 at 11 21 54 AM"
src="https://github.com/user-attachments/assets/10ea458f-22e5-498c-b43a-df13f7902a17"
/>
## What is the new behavior?
- Adding a non-null assertion clears up all error. Running the
application does not produce errors.
- Changing the label from "Remix" to "React Router" updates the dropdown
name to match the rebrand. Now, it does not look outdated and matches
the docs.
<img width="609" height="519" alt="Screenshot 2026-06-05 at 11 22 48 AM"
src="https://github.com/user-attachments/assets/c18ee5b7-4693-40c9-9c20-8f95756c8298"
/>
## Additional context
The task was to clarify our documentation on this page: [Create a
Client](https://supabase.com/docs/guides/auth/server-side/creating-a-client?queryGroups=framework&framework=react-router&queryGroups=environment&environment=react-router-loader#create-a-client)
However, the code sample in the docs is correct; the documentation in
**Dashboard** produced the errors.
## Future improvements
- To make this more robust, the code could have a single source of
truth.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Clarified generated Supabase server client template text to improve
type/reference safety in the Remix integration guide.
* **UI**
* Renamed framework label from "Remix" to "React Router" across the
Connect interfaces for clearer framework identification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Miranda Limonczenko <mirandalimonczenko@Mirandas-MacBook-Pro.local>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES/NO
## What kind of change does this PR introduce?
Bug fix, feature, docs update, ...
## What is the current behavior?
Please link any relevant issues here.
## What is the new behavior?
Feel free to include screenshots if it includes visual changes.
## Additional context
Add any other context or screenshots.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Authentication configuration updates now trigger the app's default
refresh behavior, ensuring changes propagate automatically and remain
synchronized across the interface.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- Fetch additional project data needed to determine marketplace
integration installation status
- Consolidate logic to ensure consistency between left-hand nav and
overview tab
- Add special-case handling of new integrations to give us more granular
control of their behavior
Adds an info tooltip next to the "I'm purchasing as a business" checkbox
explaining that it's for tax-registered businesses and requires a tax
ID.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a help icon with tooltip next to the "I’m purchasing as a
business" checkbox. The tooltip clarifies when to select the business
option and notes that tax ID entry is required only for tax‑registered
businesses, reducing confusion and helping users provide correct billing
information.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
Webhook log drains (project and org/audit) deliver requests with a
malformed, duplicated `Content-Type: application/jsonapplication/json`
header. On at least some receivers this breaks body parsing, so the
delivered body appears empty even though it is present (confirmed with
gzip both on and off).
Root cause: the create form seeds a default `Content-Type:
application/json` header for webhook drains, and the logflare webhook
adaptor's `Tesla.Middleware.JSON` also sets `content-type:
application/json` when it encodes the body. Both are sent, and the
receiver concatenates the two same-named headers.
## Fix
Stop seeding `Content-Type` in the webhook default headers
(`getDefaultHeadersByType`). The delivery side already sets it, so a
single clean header is sent. OTLP keeps its `application/x-protobuf`
default because the OTLP delivery path uses `json: false` and does not
set a content type itself.
Updated the form tests that assumed the seeded header (the added-header
row is now index 0 instead of 1, and the duplicate-header test now adds
two explicit rows).
## How to test
- Create a webhook (Custom Endpoint) audit log drain pointing at a
request bin.
- Trigger an audit event and inspect the delivered request:
`Content-Type` should be a single `application/json`, and the JSON body
should be visible.
## Note
This fixes the common case (the seeded default). A user who manually
adds a `Content-Type` header to a webhook drain would still hit the
duplication; the robust cross-team fix would be for the logflare webhook
adaptor to drop an incoming `content-type` before its JSON middleware
sets one. Flagging for the logs team.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Log Drain header handling corrected: webhook drains no longer add a
default Content-Type; other drain types retain their appropriate
defaults. Empty header rows are no longer submitted.
* **Tests**
* Updated tests to match new header indexing, validation behavior, and
submission expectations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Adds the final set of keyboard shortcuts to the Unified Logs page and
converts the last hardcoded `keydown` listener (detail-panel prev/next)
to the shared shortcut registry. Each action also surfaces its keybind
in a registry-driven tooltip.
Closes FE-3415.
## Shortcuts
| Action | Shortcut | Notes |
| --- | --- | --- |
| Refresh logs | `Shift+R` | new |
| Download logs | `Shift+E` | new — opens export dropdown |
| Focus filter bar | `Shift+F` | new |
| Clear filters | `F` then `C` | new |
| Copy selected as JSON | `Mod+Shift+J` | new — reuses
`results.copy-json` |
| Copy selected as Markdown | `Mod+Shift+M` | new — reuses
`results.copy-markdown` |
| Previous / next log (detail panel) | `↑` / `↓` | converted from
hardcoded listener |
| Close details panel | `Escape` | new |
Existing shared `data-table.*` shortcuts kept as-is: toggle sidebar
(`Mod+B`), live mode (`Mod+J`), reset filters (`Mod+Esc`), reset columns
(`Mod+U`), reset focus (`Mod+.`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added keyboard shortcuts for Unified Logs: copy selected rows as
JSON/Markdown, navigate rows, refresh, clear/reset filters, download,
and focus filter — shortcuts show in the command menu and display
badges/hints in menus and buttons.
* **Refactor**
* Shortcut handling unified across log controls; shortcuts
enable/disable based on context and a new "Logs" group appears in the
shortcut reference.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds a short intro line above the suggested support articles list in the
new support case form so it's clearer that the items are clickable
links. Resolves FE-3548.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Documentation suggestions now include a short introductory message
above results and place recommendations inside a clearer grouped
container with improved spacing, enhancing readability while preserving
subtle dimming for older suggestions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
The Supabase MCP repo transferred from `supabase-community/supabase-mcp`
-> `supabase/mcp`. This updates links on docs and www to point to the
new location: https://github.com/supabase/mcp
The main one needing this change is the MCP docs page at `mcp.mdx`:
https://supabase.com/mcp
I also updated links in the changelog / blog for good measure, though I
can remove those changes if desired since the old URL redirects to the
new location.
Related: https://github.com/supabase/mcp/pull/295
Ref: AI-792
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated Supabase MCP server repository references across all
documentation guides, blog articles, changelog entries, and supporting
materials to direct users to the current official location.
* Refreshed documentation links including feature groups, setup
instructions, abilities documentation, and GitHub issue tracking URLs
for consistency.
* Updated MCP server release links in changelog.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- closes https://github.com/supabase/supabase/issues/46548
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Main content now reliably scrolls to the top when navigating between
project sections.
* **Tests**
* Updated tests to cover the updated scroll behavior and context
handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
Sustained memory overcommitment is one of the failure patterns that most
often leads to databases being killed when the system runs out of
memory. Today the database report only shows used memory against total
RAM, which hides the kernel's commit accounting: a project can sit far
above its commit limit (RAM plus swap, adjusted by the overcommit ratio)
and the dashboard gives no signal until something breaks.
A combined chart with swap, overcommitment, and main memory was
considered too dense, and a standalone swap chart was not useful enough
on its own.
Linear: [DEBUG-119](https://linear.app/supabase/issue/DEBUG-119)
## Fix
Adds a separate "Memory commitment" chart between the existing memory
usage and swap charts. It plots `ram_commit_used` (Committed_AS) as the
main series with `ram_commit_limit` (CommitLimit) as the max-value
threshold line, so values approaching or crossing the limit are visually
obvious. Backend support for the two new metric attributes ships in
supabase/platform#33321.
## How to test
- Wait for the platform PR (supabase/platform#33321) to deploy so the
two new attributes are accepted by the infra monitoring endpoint.
- Open any project, navigate to Database -> Reports.
- Confirm the new "Memory commitment" chart appears between "Memory
usage" and "Swap usage".
- Confirm the chart shows two series: the committed memory bars/area and
a max line for the commit limit.
- Hover the legend and the chart to confirm the tooltips read clearly.
- Confirm the time range selector and chart sync (`syncId:
'database-reports'`) keep this chart aligned with the others.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added comprehensive guide for interpreting memory commitment patterns
in telemetry reports, including component breakdown, chart pattern
guidance, and actionable recommendations.
* **New Features**
* Added memory commitment chart to database observability dashboard,
displaying RAM commitment usage and limits.
* Extended monitoring API to support new RAM commitment metrics.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
## Problem
On the org Audit Log Drains page, the description "Export your
organization audit logs to third party destinations" sits flush against
the destination cards below it, with no separation.
## Fix
Add `pt-8` to the page's `PageContainer` so the content has a clear gap
below the header. `PageHeader` only applies top padding and relies on
the following content for the gap (other org settings pages get this
from `PageSection`); this page renders the cards directly in
`PageContainer`, so it needed the explicit top padding.
## How to test
- Open `/org/{slug}/audit-log-drains` (with the `auditLogsLogDrain` flag
enabled).
- Confirm there is clear vertical spacing between the page description
and the destination cards.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Adjusted the top spacing of the audit log drains page for improved
visual alignment.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
## Problem
In the Logs Explorer, clicking the Run button after editing the SQL did
not execute the latest query. It ran a stale version. Pressing Cmd+Enter
ran the correct, latest query.
The Run button's handler read the query from the `editorValue` React
state, which can lag behind the most recent keystroke. Cmd+Enter works
because Monaco's keybinding reads the live value directly off the editor
instance.
## Fix
`handleRun` now reads the live value from the editor instance
(`editorRef.current.getValue()`), falling back to `editorValue`. This
makes the Run button consistent with the Cmd+Enter keybinding.
## How to test
- Open the Logs Explorer (Project > Logs > query/explorer).
- Type or edit a SQL query in the editor.
- Without clicking elsewhere, click the Run button.
- Expected result: the query that runs reflects your latest edit,
matching the behavior of Cmd+Enter.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed an issue in the logs explorer where SQL queries would not
execute with the most recent code changes you've typed. The query runner
now uses the latest content from the editor to ensure your most recent
edits are run.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
New landing page for an upcoming webinar with Perplexity.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* New webinar event now available: "Workflows That Scale: Supabase +
Perplexity Computer for Small Businesses" with event details, agenda,
speaker information, and registration link.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update
## What is the current behavior?
Currently, this doc outlines how to restore a dashboard backup which
only applies to projects that still use logical backups. Newer projects
cannot follow this process.
## What is the new behavior?
Adds an admonition to direct users with projects that use physical
backups to the correct guide.
Keeping the legacy guide content for now for older projects that may
still be using logical backups.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added clarification that dashboard backups are only available for
Supabase projects using logical backups. Projects using physical backups
are directed to refer to the CLI backup and restore guide instead.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Extracts the Cancellation Flow from the subscriptions side panel and
adds a new button that initiates the flow (old journey is still
possible):
(screenshots see below)
Verified manually:
- ✅ confirmed the old downgrade flow works, Team -> Pro; Pro -> Free
- ✅ confirmed the new downgrade flow works
- ✅ button does not show up when on free plan; no flicker
- ✅ button does not show up on enterprise/platform plan
- ✅ verified button is disabled when managed by AWS marketplace
(hardcoded in `useSelectedOrganizationQuery`)
- ✅ verified button is disabled if `canUpdateSubscriton` is false,
hardcoded in `useAsyncCheckPermissions`
- ✅ modal for exceeding-free-projects shows up
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a guided subscription cancellation flow with confirmation steps,
member/usage checks, and an exit survey.
* Exposed a visible "Cancel Subscription" control in billing settings,
enabled/disabled with contextual tooltip messaging.
* **Improvements**
* Downgrade/exit survey confirm action can be disabled when appropriate;
exit survey confirm label updated to "Downgrade Now".
* **Chores**
* Added frontend telemetry for cancellation button interactions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
adding georgian
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES/NO
## What kind of change does this PR introduce?
Bug fix, feature, docs update, ...
## What is the current behavior?
Please link any relevant issues here.
## What is the new behavior?
Feel free to include screenshots if it includes visual changes.
## Additional context
Add any other context or screenshots.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated blog post with corrected wording regarding investor
participation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
Log drains were only available per project. Organizations had no way to
export their platform audit logs to a third party destination, which had
to be set up manually through the API.
## Fix
Add a self-serve "Audit Log Drains" page under Organization Settings
(Compliance section) that reuses the existing log drains destination UI
at the org scope.
- Extract a presentational `LogDrainsList` shared by the project and org
containers, with no behavior change to the project page.
- Make `LogDrainDestinationSheetForm` presentational via
`existingDrainNames` and `onSaveClick` props, removing its project-only
data and telemetry coupling.
- Add org-scoped data hooks (list, create, update, delete, test
connection) calling
`/platform/organizations/{slug}/analytics/audit-log-drains`, gated by
the `audit_log_drains` entitlement.
- Add the page, nav entry and a keyboard shortcut, all gated behind the
`auditLogsLogDrain` feature flag and `IS_PLATFORM`.
The org audit log drain endpoints are not yet present in the generated
API types, so the new hooks use a localized `// @ts-ignore` (matching
the existing project log drain hooks) until the types are regenerated.
## How to test
- Open `/org/{slug}/audit-log-drains` on an org with the
`audit_log_drains` entitlement.
- Create an S3 and a webhook destination, confirm the cost dialog, then
delete one and test a connection.
- Confirm the list refreshes and that the existing project Log Drains
page is unchanged.
- Confirm the page and nav entry are hidden when the flag is off.
## Notes
- Verified locally: org data hook tests and the org settings nav
shortcut tests pass. Full typecheck, lint and the component test suite
should be run in CI, since this sandbox has an incomplete dependency
install.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Audit Log Drains management in organization settings: add, update,
test, and delete destinations; new Audit Log Drains page and navigation
shortcut.
* **Improvements**
* New consolidated list view with clearer loading, error, empty and
populated states.
* Feature-flag driven display of available drain types.
* Form validation prevents duplicate names and supports save callbacks
with telemetry on save.
* **Tests**
* Added tests covering listing, create/update/delete, testing, and form
validation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
New blog post for the Series F announcement.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Published a new blog post announcing the Series F funding, covering
investors, round priorities (open-source/Postgres tooling, platform
growth, employee liquidity), product updates (including Multigres
alpha), growth metrics, employee liquidity framework, and a community
message with an embedded image and careers link.
* **New Features**
* Added a public agent-skill discovery document listing two
archive-based skills with versioned download links and checksums.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copple <10214025+kiwicopple@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Adds a new blog post by Sugu.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added agent skills discovery index with downloadable Supabase and
Postgres best practices skills.
* **Documentation**
* Added blog post covering Multigres v0.1 Alpha, including deployment,
high availability, connection pooling, and backup features.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Jonathan Summers-Muir <MildTomato@users.noreply.github.com>
Mirrors the recent invite drawer change (#46515) on the edit access
drawer. Each role option now describes its permissions via the shared
\`ROLE_DESCRIPTIONS\` map instead of showing just the role name.
Closes FE-3524.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Role selection in Team Settings now shows full, role-specific
permission descriptions and appends any disabled-reason details for
clarity.
* **Tests**
* Added integration tests covering the role panel UI: role listing,
selected role label, documentation link, role-specific descriptions, and
an admin-safety notice; includes test environment compatibility stubs
for animations and routing.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
- Noticing our code we have many patterns of calling localstorage and
handling those errors
- We should add those in a single well tested file
- Handle those errors in the singleton which makes it easier for us to
debug customer issues. Logger is outputing local storage warnings for
feature we expose
- Side effect of this is random crashes on studio when local storage
isn't available or handled correctly
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Improved browser storage handling across the app for more reliable
persistence and graceful behavior in restricted or non-browser
environments (settings, previews, charts, tabs, sign-in/session flows,
integrations, and UI state).
* **New Features**
* Introduced a safe storage layer to standardize and harden
local/session persistence.
* **Tests**
* Added comprehensive tests covering the new safe storage behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- Marketplace index page
- update order of feature partner integrations in hero
- fix z-index on MarketplaceFilterBar in "list" view
<img width="275" height="104" alt="Screenshot 2026-06-02 at 17 07 29"
src="https://github.com/user-attachments/assets/5cef64f9-895e-4f8d-8f30-153ddd5c89dd"
/>
- Marketplace detail page
- use "prose" css styling on overview content for better text styling
(heading with top padding, etc)
- refine FilesView in overview tab to only show swipeable and zoomable
previews (so the big image doesn't occupy too much space) + lazy load
FilesView component
- improve page loading state
- improve overview side rail sticky-top and remove redundant "About"
label
<img width="1333" height="732" alt="Screenshot 2026-06-02 at 17 20 29"
src="https://github.com/user-attachments/assets/8f3dd4a0-c241-4b7f-b8c8-192e1d7a616d"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Interactive carousel with image zoom capability for viewing
integration preview images
* **Bug Fixes**
* Fixed z-index layering issue with marketplace filter bar
* **Refactor**
* Redesigned marketplace detail page header with breadcrumb navigation
* Updated integration image handling structure with enhanced metadata
* Optimized dynamic loading for integration file viewers
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
## Problem
When workflow runs for branches fail due to stuck tasks, they can sit
idle indefinitely. Users are unaware that they need to make a new commit
to retrigger the workflow — leading to confusion, wasted time, and
silent failures going unnoticed.
## Solution
Provide a button that allows users to retrigger a workflow when it is
not being removed.
## How to test
- Create a branch
- Wait for its row to appear on the branch management page
- Click the _View logs_ button
- You should see a _Retrigger_ button
- Clicking it should make a new row appear in those logs
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Retrigger previously executed workflows directly from branch preview
actions.
* Confirmation dialog added for retrigger actions.
* **Improvements**
* Toast-style error notifications when retriggering fails.
* Workflow run list layout updated for a more flexible horizontal
display.
* After retriggering, workflow and action lists refresh so updates
appear promptly.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated build tools and development dependencies across the project
* Upgraded Vue framework and related tooling to latest versions
* Updated TanStack React Start dependency
* Refined dependency resolution settings to improve build stability and
performance
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Consolidated API key deprecation guidance into a reusable notice for
consistent messaging across docs. Announces deprecation of legacy
anon/service_role JWT-secret keys by end of 2026, instructs switching to
sb_publishable_xxx / sb_secret_xxx, and provides steps to locate and
copy both new and legacy keys. Applied across auth, getting-started,
API, and realtime guides.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: fadymak <dev@fadymak.com>
## What
Adds a getting-started guide for migrating an existing project from the
legacy JWT-based `anon` and `service_role` keys to the new publishable
(`sb_publishable_...`) and secret (`sb_secret_...`) keys.
The guide walks through the migration step by step:
- **Before you start** — maps legacy keys to their replacements.
- **Step 1** — create the new `default` keys.
- **Step 2 / 3** — swap the publishable key in client code and the
secret key in backend code.
- **Database Webhooks and `pg_net`** — move the key from the
`Authorization: Bearer` header to the `apikey` header (the new keys
aren't JWTs and are rejected on `Authorization`), with a Vault note for
not inlining secrets.
- **Step 4** — update Edge Functions, with two options: read the new env
vars (`SUPABASE_PUBLISHABLE_KEYS` / `SUPABASE_SECRET_KEYS`) and set
`verify_jwt = false`, or adopt the `@supabase/server` SDK.
- **Step 5 / 6** — verify nothing uses the legacy keys, then deactivate
them (reversible).
- **Next steps** — clarifies that JWT signing keys are a separate,
independent migration.
## Notes
While writing this we found Studio issues to fix separately (the Invoke
Function cURL snippet and the Database Webhooks editor both put the new
keys on the `Authorization` header).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a comprehensive migration guide for moving from legacy JWT-based
API keys to the new publishable and secret keys with zero‑downtime
steps, verification, limitations, and next steps.
* Clarified API key behavior and recommended migration actions in the
getting‑started docs.
* Added a navigation entry linking to the new migration guide.
* **Style**
* Relaxed documentation lint rules to allow expected wording/phrases
(e.g., "backends", "Database Webhooks").
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
Joshen Lim