mirror of
https://github.com/supabase/supabase.git
synced 2026-10-10 11:55:05 +03:00
docs/debugging-guide
37273
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Jordi EnricandClaude Sonnet 4.6
|
df61856936 |
feat(feature-preview): remove hardcoded plan check for unified logs (#46114)
Removes `useIsEnterpriseOrSupabaseOrg` and replaces it with the `unifiedLogs` ConfigCat flag. ConfigCat now handles tier targeting directly, so the hardcoded enterprise/internal org check is redundant. Also eliminates three queries (project detail, org, subscription) that were firing on every page load just to gate the feature preview. --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
Andrew Valleteau
|
da3b0cb3ec |
fix(cli): login creating duplicate tokens on re-renders (#46120)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Bug fix ## What is the current behavior? The CLI login page was firing `POST /platform/cli/login` multiple times per page load due to an unstable `navigate` reference in the parent component re-triggering the effect. This caused several duplicate personal access tokens to be created for each browser sign-in attempt (regression CLI-1491). Additionally, error messages from non-Error rejection shapes (like those from openapi-fetch) were being replaced with a generic "Unknown error" message instead of surfacing the actual platform error. ## What is the new behavior? 1. **Prevents duplicate API calls**: Added a `useRef` guard (`startedForSessionIdRef`) to ensure `createCliLoginSession` is only called once per `sessionId`, even if the parent component re-renders with a new `navigate` reference. 2. **Improved error handling**: Created a `getErrorMessage()` utility that properly extracts error messages from both Error instances and plain objects (e.g., `{ message: string, statusCode: number }`), allowing platform error messages to surface instead of generic fallbacks. 3. **Added comprehensive test coverage**: - E2E test verifying the POST fires exactly once per page load with realistic network latency - E2E test confirming platform error messages are displayed correctly - Unit test for non-Error rejection shapes - Unit test verifying the effect doesn't re-trigger on parent re-renders ## Additional context The fix addresses the root cause by: - Using a ref to track which `sessionId` has already been processed, preventing re-execution when deps change - Extracting error message handling into a reusable utility that handles both Error instances and plain objects - Adding tests that specifically check for the regression (multiple POST calls and error message display) The E2E test includes a 400ms delay in the mock response to simulate real-world conditions where the original bug only surfaced after React committed multiple re-renders. Closes: CLI-1491 https://claude.ai/code/session_01GAujw33MTRBRYSnS8cxcEa <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved CLI login error handling to display platform-specific error messages instead of generic fallback text. * Fixed duplicate login session creation during component rerenders. * **Tests** * Added test coverage for error message display in CLI login. * Added regression tests for single session creation and platform error scenarios. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46120?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Julian Domke
|
c414146572 | fix(upcomingInvoice): do not manually subtract credits (#46116) | ||
|
Ali WaseemandJoshen Lim
|
a1c7e57df3 |
studio: clarify storage bucket upgrade message for Pro users on Nano compute (#46008)
## Summary Vector and analytics bucket access is gated by both the org's plan tier and the project's compute size, but the storage config API only returns a single `enabled: false` flag. The empty state always told users to "Upgrade to Pro" — including users who were already on Pro with Nano compute, leaving them no obvious path forward. `BucketsUpgradePlan` now reads the org plan and the project's `infra_compute_size`. When the user is on a paid plan but still on Nano compute, the message becomes "Upgrade your project's compute size to Micro or larger…" and the button is wired through `UpgradePlanButton`'s existing `addon='computeSize'` route to `/settings/compute-and-disk`. Free plan users keep the existing copy and upgrade flow. Closes FE-3383. ## Test plan - [ ] Free org, Nano compute, navigate to `/storage/vectors`: still shows "Upgrade to Pro" with the billing link - [ ] Pro org, Nano compute, navigate to `/storage/vectors`: shows the compute-size message and the button navigates to compute-and-disk settings - [ ] Pro org, Micro+ compute: page renders the actual Vector buckets UI (unchanged) - [ ] Same flows on `/storage/analytics` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a regional limitation notice for Vector Buckets with an informational "Coming soon" empty state and tooltip listing available regions. * **Bug Fixes** * Storage bucket upgrade prompts now show context-aware messaging based on organization plan and project settings, guiding users to the correct upgrade path. * **Refactor** * Region-gating UI logic consolidated into a shared component for clearer messaging and maintenance. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46008?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Alaister YoungandAlaister Young
|
b28323be98 |
fix(studio): prevent infinite render loop in new-project form (#46131)
Fixes a "Maximum update depth exceeded" infinite render loop on `/new/[slug]` introduced by #46085. The symptom showed up on the internal-only configuration dropdown, but the entire form was looping. ## Root cause The new `useEffect` that syncs `dataApiDefaultPrivileges` to the experiment-driven default had `form.formState` in its deps. `form.formState` is a react-hook-form Proxy that returns a new reference on every render, so the effect refired after every render → `setValue` → render → effect → loop. ## Fix Pull the dirty check out of the effect into a stable boolean computed during render, and drop `form.formState` from the deps. Semantics unchanged — still syncs on flag resolve, still skips when the user has touched the field. ## To test - Hard-reload `/new/[slug]` and confirm there's no "Maximum update depth exceeded" error in the console - Open the configuration dropdown (internal-only) and confirm it interacts normally - With the `data-api-revoke-on-create-default` flag off, confirm `dataApiDefaultPrivileges` defaults to `true`; with it on, defaults to `false` - Manually toggle the dataApiDefaultPrivileges field, then confirm the effect no longer overwrites your choice when the flag resolves <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed data API default privileges synchronization to prevent unnecessary updates and improve application stability during configuration changes. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46131?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Vaibhav
|
d0edaefc1a |
fix: edgefn shotcuts (#46057)
## TL;DR fixes few edge cases in edgefn shrortcuts ## ref: - closes https://github.com/supabase/supabase/issues/46056 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Edge function shortcuts now enforce permission requirements. Shortcuts for viewing function details are only available to users with read access, and shortcuts for creating new functions require create permissions. * Creating new edge functions is now restricted to active projects. Users must have the appropriate permissions and an active project to use the creation shortcut. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46057?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Saxon Fletcher
|
80da153450 |
Fix for AI Assistant query and deploy confirmation (#46052)
When Assistant requests confirmation to run a query or deploy an edge function if the user doesn't skip or run and instead sends a follow-up message it errors out. This allows follow-up messages and treats them as "skips" which means adjusting confirmation message state as part of the follow-up. This also uses toModelOutput to cleanse data based on permissions. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **New Features** * Enhanced tool approval workflow: pending approvals are now automatically resolved as denied when submitting new messages * Improved chat input state management with better handling of approval states * Customizable loading messages for tool operations * **Bug Fixes** * Fixed chat input availability during pending tool approval states * Improved tool execution feedback during approval workflows <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46052?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
cc0b2d3d21 |
chore(studio): remove require-safe-sql-fragment ESLint rule (#46079)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Refactor / chore. ## What is the current behavior? A custom type-aware ESLint rule (`studio/require-safe-sql-fragment`) enforces that the `sql` argument to `executeSql` is a `SafeSqlFragment`. It runs in a separate `eslint.type-checks.config.cjs` and a dedicated CI ratchet step, and pulls in `@typescript-eslint/utils` as a direct dev dependency. ## What is the new behavior? `SafeSqlFragment` enforcement is now handled entirely by TypeScript compilation. The ESLint rule, its dedicated config, the ratchet baselines for it, the CI step, and the `@typescript-eslint/utils` direct dev dependency have all been removed. ## Additional context <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Simplified development linting workflow by removing type-aware ESLint checks and associated rule files. * Cleaned up ESLint configuration and dependencies in the studio application. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46079?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
1e113a8a01 |
fix(studio): preserve unsaved columns in table editor across refetches (#46073)
## Summary - Fixes FE-3386: columns added via the Table Editor side panel vanished when components auto-refreshed. - Root cause: a `useEffect` re-initialized `tableFields` from server data on every `table` / `foreignKeyMeta` refetch, clobbering unsaved local edits. - Fix (initial): `hasInitializedRef` gates the late-init path so it runs at most once per panel session (to incorporate late-arriving `foreignKeyMeta`) and resets on panel close. - Fix (follow-up): handle the race where the user starts editing *before* `foreignKeyMeta` resolves. Added `hasUserEditsRef` (flipped on user edits, reset on panel close) and a `mergeForeignKeyMeta` utility. Both late-init paths now merge FK metadata into existing `tableFields` instead of wholesale-replacing when the user has unsaved edits — `foreignKey` is only injected onto matching server-originated columns, so user-added columns and other in-progress edits survive. Linear: FE-3386 ## Test plan - [ ] Open the Table Editor on an existing table. - [ ] Add one or more new columns via the side panel. - [ ] Watch the foreign key section flash / resolve its loading state. - [ ] Confirm the newly-added columns are NOT removed when the FK section resolves. |
||
|
Charis
|
3aec96f9c6 |
fix(studio): use measured node heights for instance diagram layout (#46075)
## Summary The homepage instance diagram looks visually off when a project has read replicas — see [FE-3390](https://linear.app/supabase/issue/FE-3390/adjust-homepage-diagram-spacing-for-read-replicas). Root cause: the dagre layout in `InstanceConfiguration.utils.ts` was passing a fake `height: 25` (and a `-70` hack for the load balancer) for every node, regardless of how tall the rendered node actually is. When the Primary card grew taller after #45274 added the compute-metrics row, the gap between the Primary node and the Read Replica node became visually tight while the gap between the Load Balancer and Primary stayed loose — the diagram looked lopsided. ## Fix - Pass the **real measured height** of each node to dagre, sourced from React Flow's internal measurement (`node.measured.height`). - Run the layout in two passes: 1. First pass uses small per-type fallback heights so React Flow has something to render and measure against. 2. Once `useNodesInitialized()` flips true, re-run dagre with the measured heights and fitView. - Keep the diagram at `opacity-0` until the measured pass completes, so the fallback positions are never visible to the user. Subsequent data refetches don't re-hide the diagram — once measured, it stays visible. - Drop `NODE_ROW_HEIGHT` and the load-balancer `-70` hack. Replaced with a small `NODE_HEIGHT_FALLBACKS` table used only on first paint. - `ranksep` reduced from 160 → 60 since dagre now knows real heights. Closes FE-3390. ## Test plan - [x] Open the project homepage for a project with no read replicas — diagram renders centered, single Primary node. - [x] Open the project homepage for a project **with** a read replica — Load Balancer → Primary → Replica spacing is visually balanced; no flash of fallback positions on initial render; the diagram fades in once. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * More accurate infrastructure diagram layout with better node sizing and spacing for initial and measured renders. * Introduced fallback heights so diagrams render correctly on first paint before measurements are available. * Region containers now use a consistent fixed height for stable layout. * Smoother, visually consistent diagram initialization with improved opacity transition during layout setup. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46075?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
64143a5d90 |
fix(pg-meta): tighten pg-format keyword() against control-phrase injection (#46076)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Bug fix (sanitization hardening). ## What is the current behavior? `pg-format`'s `keyword()` helper validates with `/^[A-Za-z][A-Za-z0-9_ ]*$/`, which allows any space-separated word sequence. Phrases like `'DROP TABLE'` or `'DELETE FROM users'` pass validation and can be interpolated into queries. ## What is the new behavior? `keyword()` accepts either a single word matching `[A-Za-z][A-Za-z0-9_]*` (no spaces) or a phrase from a small case-insensitive allow-list (`'INSTEAD OF'`, `'BY DEFAULT'`) — which covers every multi-word value real callers actually produce (trigger activation, identity generation). Arbitrary multi-word phrases now throw. Tests updated accordingly. ## Additional context <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Reinforced SQL keyword validation with stricter security controls to prevent unsafe keyword usage. The system now only permits single-word identifiers or specific pre-approved multi-word keyword phrases. Previously accepted multi-word inputs that don't match the curated allowlist are now properly rejected with improved error messaging. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46076?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Sean Oliver
|
fdceb29260 |
fix(telemetry): exposure event captures dataApiDefaultPrivileges + drop race-fix hook (#46085)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Bug fix. ## What is the current behavior? This PR addresses three issues with the implementation of the `dataApiRevokeOnCreateDefault` experiment ([GROWTH-858](https://linear.app/supabase/issue/GROWTH-858)) on the frontend side: 1. The `project_creation_default_privileges_exposed` event payload captures `dataApiEnabled`, which is the parent "Enable Data API" toggle. That value defaults to `true` for everyone in both arms, which doesn't help understand how people are interacting with the form. 2. The hook itself was gating on PostHog JS SDK values rather than our backend server values being sent from `/telemetry/feature-flags`. 3. The form on `/new/[slug]` captures `dataApiDefaultPrivileges` defaults once at mount via react-hook-form's `defaultValues`. If the flag is still loading when the page mounts, `useDataApiRevokeOnCreateDefaultEnabled()` returns `false` (coerced from undefined), and the form locks the field to the legacy default of `true`. The flag later resolving has no effect, and treatment users get the legacy default visually and in the exposure event. ## What is the new behavior? 1. Main-surface payload now sends `dataApiDefaultPrivileges` — the form field the experiment actually controls (`true` = legacy grants kept, `false` = revoked on create). Post-fix data will let us read out whether treatment users actually got the new default. 2. Hook is simplified: drop `orgCountReady`, drop the `onFeatureFlags` subscription, drop the `posthogClient` import. It now fires once when the flag resolves, period. Vercel surface is unchanged (still no `dataApiDefaultPrivileges` since there's no user-facing toggle there). Tests updated. 3. New useEffect in `/new/[slug]` watches the raw flag value and syncs `dataApiDefaultPrivileges` to the correct experiment-driven default when the flag resolves, gated on `getFieldState(...).isDirty` so we don't clobber intentional user input. ## Additional context Backend half of this fix is at supabase/platform#32933 (passes `org_count` and `signup_timestamp` in `personProperties` so the audience filter actually evaluates correctly). Both PRs are needed for the experiment to bucket at 5% and be measurable. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Changes** * Telemetry now records the selected default-privileges setting (dataApiDefaultPrivileges) in project-creation events; the previous dataApiEnabled field was removed. * Project-creation flows apply the experiment-driven default for that setting once the experiment resolves, but they do not overwrite user-edited choices. Vercel new-project flow syncs with the experiment until the user changes the checkbox. * **Tests** * Updated tests to validate tracking, deduplication, and sync/timing behaviors for dataApiDefaultPrivileges. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46085?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lakshan PereraandJeremias Menichelli
|
4363dbb975 |
Some trivial fixes to Edge Function guides (#46092)
Was going through user feedback and fixed some of the minor issues with the guides. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added guidance on handling CORS when invoking Edge Functions from the browser (quickstart and dashboard) * Updated Deno configuration guidance to reference a top-level deno.json and adjusted recommended project structure * Improved internal cross-references for templates and shared documentation links in functions guides <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46092?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Jeremias Menichelli <jmenichelli@gmail.com> |
||
|
Alex Hall
|
544f4e7195 |
chore(studio): pass integration listing by slug when installing (#46119)
Passes listings by slug instead of UUID when getting an installation URL. This is already supported in the Platform API in a backwards compatible way. Toward INT-109 |
||
|
Ali WaseemandDanny White
|
3d9fb2f98d |
feat(realtime): shortcuts for realtime (#46001)
## What kind of change does this PR introduce? Feature — adds keyboard shortcuts for the Realtime section in Studio. ## What is the current behavior? No keyboard shortcuts exist for Realtime navigation or inspector actions. ## What is the new behavior? ### Navigation chords (layout-scoped, active on any Realtime page) | Shortcut | Action | |---|---| | `R I` | Go to Inspector | | `R P` | Go to Policies | | `R S` | Go to Settings | ### Inspector actions (active on the Inspector page) | Shortcut | Action | Gating | |---|---|---| | `Shift+J` | Join a channel | Only when no channel is joined | | `Shift+L` | Start/Stop listening | Only when a channel is joined | | `Shift+F` | Open filter popover | Only when a channel is joined | | `Shift+B` | Broadcast a message | Only when listening | | `Mod+Shift+C` | Copy selected message | Only when a message is selected | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Realtime Inspector: new keyboard shortcuts (join channel, toggle listening, toggle filters, broadcast) and a copy-message shortcut with toast feedback. * Channel & Filter popovers support controlled/uncontrolled open state; header now wires popover state through props. * Shortcut tooltips added to copy and broadcast actions; realtime page navigation shortcuts and menu shortcuts added. * **Tests** * Shortcut reference sheet tests updated to include realtime navigation and inspector groups. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46001?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com> |
||
|
Ali Waseem
|
34303997c6 |
fix(table-editor): wait for filter value before applying (#46113)
## Summary - Closes [FE-3399](https://linear.app/supabase/issue/FE-3399/make-table-editor-filter-bar-wait-for-a-value) - Table editor's filter bar was firing a row request as soon as a property was selected, before any operator/value was set. This regressed after #46071 unified the table editor and unified logs onto the shared `FilterBar`. - `LogsFilterBar` already validates that each condition has a propertyName, operator, and non-empty value before applying. `FilterPopoverNew.handleApply` did not — it called `setFilters` unconditionally on every `onApply` from the shared bar (property change, operator change, blur, etc.). This PR mirrors the `LogsFilterBar` validation so the table editor stops requesting rows until the condition is complete. ## Test plan - [ ] Open the table editor on any table - [ ] Click the filter bar, pick a column → no network request fires, no toast, grid unchanged - [ ] Pick an operator → still no request - [ ] Type a value and hit Enter → row request fires, grid filters - [ ] Remove the filter → grid refetches with no filter - [ ] New e2e test: `pnpm --prefix e2e/studio run e2e -- features/filter-bar.spec.ts --grep "does not trigger a row request"` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Filter validation now prevents incomplete filter conditions from being applied, ensuring only fully-specified filters affect table data. * **Tests** * Added end-to-end test coverage for filter bar operations to verify expected behavior during filter setup. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46113?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ali Waseem
|
a0b4eeb770 |
chore: fix undefined check for type warnings (#46111)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Minor type check to resolve sentry issue <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed an issue where validation warnings could display even when no warnings were present, improving clarity in infrastructure settings display. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46111?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ali Waseem
|
83992c55f7 |
feat(log-explorer): arrow key and deeper shortcuts for log explorer (#45989)
Closes [FE-3378](https://linear.app/supabase/issue/FE-3378/featlogs-keyboard-shortcuts-for-function-logs-invocations-and-logs). ## Summary Adds a shared shortcut registry for every `LogsPreviewer` surface — Function Logs, Function Invocations, and the Logs Explorer — and brings the grid keyboard model in line with the Auth Users / Table Editor patterns. ## Shortcuts | Key | Action | | --- | --- | | `↑` / `↓` | Move single-row selection; opens side panel | | `Shift+Space` | Toggle current row in multi-select | | `Mod+A` | Toggle all visible rows in multi-select | | `Esc` | Staged: clear multi-select → close side panel | | `Shift+R` | Refresh logs | | `Shift+H` | Toggle histogram | | `Shift+L` | Load older logs | | `Shift+P` | Open time range picker | | `Mod+Shift+J / M / C` | Copy selected rows as JSON / Markdown / CSV (existing global handler) | ## Other changes - `ShortcutTooltip` on search, refresh, histogram, load older, and time-picker controls. - `onSearchInputEscape` wired on the logs search bar (clear → blur). - Visual row highlight (`rdg-row--focused`) when a row is keyboard-focused or multi-selected. - Multi-select copy dropdown gains a **Copy as CSV** entry and shows the keybind on each item via `ShortcutBadge`. - Manual arrow-nav (`navigate()`) updates `selectedRow` directly without going through `onRowClick`, so multi-select checkmarks survive keyboard navigation. ## Test plan - [x] Function Logs and Function Invocations: all shortcuts above fire while the page is mounted, no firing in other tabs. - [x] Logs Explorer: same shortcuts work; copy keybinds still copy *all* rows when nothing is multi-selected. - [x] Arrow keys on first load select the first row even when the focus sink is the active element. - [x] Selecting rows via checkbox or `Shift+Space`, then pressing arrow keys, preserves the checkmarks. - [x] Escape on a populated search input clears it; Escape on an empty input blurs it. - [x] Esc with multi-select active clears the selection before closing the side panel. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * CSV export for log selections (adds CSV alongside JSON and Markdown). * New logs-preview keyboard shortcuts: search focus, refresh, chart toggle, date picker, load older, navigation, and selection. * **Improvements** * Shortcut badges and tooltip integration across the logs UI. * Search input focus/ref support and controlled date-picker visibility. * Better no-results/error rendering and expanded copy dropdown sizing. * **Tests** * Added CSV formatting tests covering RFC 4180 edge cases. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45989) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordi EnricandClaude Sonnet 4.6
|
607cce2bc1 |
feat: pass subscription plan to ConfigCat for tier-based feature flags (#46063)
## Summary - Adds the organization's `plan` (e.g. `free`, `pro`, `team`, `enterprise`) as a custom attribute in the ConfigCat `User` object - Uses the existing `useSelectedOrganizationQuery` — already called inside `FeatureFlagProviderWithOrgContext`, so no extra network request (React Query deduplicates) - Refactors `customAttributes` construction from a conditional assignment to an incremental object build, making it easy to add more attributes in the future ## Why This unlocks tier-based percentage rollouts in the ConfigCat dashboard. For example, to roll out a feature to 25% of Pro accounts: 1. Add a Targeting Rule: `IF plan = "pro"` 2. Set the THEN clause to Percentage Options: `25% ON / 75% OFF` The split is deterministic per user email (or switch to `org_id` as the percentage evaluation attribute for per-org cohesion). ## Test plan - [ ] Log in as a user on a paid plan and verify `plan` appears as a custom attribute in ConfigCat's evaluation logs / targeting debugger - [ ] Log in as a free-tier user and confirm `plan = "free"` is sent - [ ] Confirm unauthenticated / org-less sessions don't break (attribute is omitted when `selectedOrganization?.plan?.id` is undefined) 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Enhanced feature flag configuration to account for organization and subscription plan information, ensuring more accurate feature availability based on user context. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46063?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
supabase-supabase-autofixer[bot]andgithub-actions[bot]
|
330dd79ff4 |
[bot] Decrease ESLint ratchet baselines (#46032)
Automated weekly decrease of ESLint ratchet baselines. Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> |
||
|
Gildas Garcia
|
8577b5fe77 |
chore: remove <Accordion> _Shadcn_ suffix (#46107)
## Problem The `_Shadcn_` suffix isn't needed anymore on Accordion components ## Solution - Remove the `_Shadcn_` suffix - Simplify UI package exports - Apply prettier <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Updated accordion component exports and imports to use unified naming conventions across the codebase, improving consistency for developers using the UI library. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46107?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Utkarash Kumar SinghandJoshen Lim
|
08c0fc247b |
feat(studio): warn about pg_graphql introspection change on upgrade (#46096)
<img width="1512" height="818" alt="introspection" src="https://github.com/user-attachments/assets/5c0e4c6a-c0e9-496d-8768-4a55a2433268" /> ## Summary Adds an in-product admonition on the Infrastructure Settings page when a project has pg_graphql < 1.6.0 installed, warning users that GraphQL introspection will be disabled by default after upgrading. Links to upgrade notes docs with the opt-in SQL. The admonition is purely informational — it renders alongside the upgrade button, does not block the upgrade. ## Context pg_graphql 1.6.0 disables GraphQL introspection by default. The change is upgrade-triggered (not backported), so users on 1.5.x will only encounter it when their AMI bundles 1.6.0+. To prevent surprise breakage of tools that rely on `__schema`/`__type` (GraphiQL, codegen, Relay compiler, etc.), Studio surfaces this admonition before they upgrade. Design discussion in [PSQL-1199](https://linear.app/supabase/issue/PSQL-1199/prepare-dashboard-notification-for-pg-graphql-breaking-change). ## Companion PR This depends on the schema change in [supabase/platform#32954](https://github.com/supabase/platform/pull/32954) which adds the new `warnings` field to `ProjectUpgradeEligibilityResponse`. ## Admonition copy - **Title:** \"GraphQL introspection will be disabled by default after upgrade\" - **Body:** \"After upgrading, queries to \`__schema\` and \`__type\` will return an error unless introspection is explicitly re-enabled on the schema. Regular data queries are not affected.\" - **CTA:** \"Read upgrade notes\" → links to the new docs section ## Related - Linear: [PSQL-1199](https://linear.app/supabase/issue/PSQL-1199/prepare-dashboard-notification-for-pg-graphql-breaking-change) - Parent rollout: [PSQL-1163](https://linear.app/supabase/issue/PSQL-1163/breaking-change-pg-graphql-introspection-rollout) - Companion platform PR: https://github.com/supabase/platform/pull/32954 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added “Upgrading to pg_graphql 1.6.0” and updated pg_graphql docs: introspection is disabled by default, how to re-enable per schema, verification steps, and affected tools. * **New Features** * Upgrade settings UI now shows validation warnings about introspection with links to upgrade notes. * **Chores** * Added "GraphiQL" to MDX spelling allow list and added upgrade-warning types to API surface. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46096?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Gildas Garcia
|
082c2546d2 |
chore: migrate from deprecated Accordion to new shadcn components (#46103)
## Problem We have multiple Accordion components ## Solution Migrate Accordion usages to Shadcn components ## Screenshots ### Documentation MDX pages Before: <img width="1156" height="1088" alt="image" src="https://github.com/user-attachments/assets/0f7b90ec-a613-45cf-8b04-39d2fd4b9644" /> After: <img width="1154" height="952" alt="image" src="https://github.com/user-attachments/assets/05c5051d-fa2a-497a-8f6f-96d555098e33" /> ### Documentation Mobile Menu Before: <img width="389" height="674" alt="image" src="https://github.com/user-attachments/assets/c9a0fa7a-3590-4f10-acfd-8add16c28b7b" /> After: <img width="376" height="665" alt="image" src="https://github.com/user-attachments/assets/d85fe05d-6d71-4e63-b0ea-cdc495d2fa94" /> ### www - Launch week pages Before: <img width="1434" height="718" alt="image" src="https://github.com/user-attachments/assets/d777f887-65d4-49f2-8b12-5b05010ba95d" /> After: <img width="1428" height="732" alt="image" src="https://github.com/user-attachments/assets/4fa7eb02-12c7-4b3b-b77f-09846518690c" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Replaced and standardized accordion UI across docs, navigation, mobile menu, pricing FAQs, Launch Week pages, and error/detail panels for a more consistent, reliable expand/collapse experience. * **Bug Fixes** * Fixed inconsistencies in accordion behavior and item rendering (e.g., multi-open support and disabled states) to improve navigation and content discovery. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46103?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Moaz Mirza
|
0e5d2dd433 |
Fix chat name truncation causing action icons to disappear (#46003)
Fixes issue #46002 ## Description If the chat name is too long, it wont get truncated properly, which caused the edit and delete icons to be pushed out of view. (see problem in #46002) ## Screenshots https://github.com/user-attachments/assets/7c664ff2-15da-47e0-88f0-39d8d3063686 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Updated text truncation and overflow styling for chat names in the AI Assistant Chat Selector. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46003) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen LimandGildas Garcia
|
7728bfae1d |
Joshen/debug 97 use the same filter bar in unified logs and table editor (#46071)
## Context Swaps out (and deprecates) the unified logs's own filter bar, for our existing design system's filter bar <img width="1450" height="355" alt="image" src="https://github.com/user-attachments/assets/c5e83bd1-4e67-4bb5-8f27-a3d9beacbbb5" /> Other changes involved for the FilterBar itself includes the following (more details in subsequent sections) - Add `onApply` param for `FilterBar` that will only trigger when an entered filter is "complete" (e.g on enter or blur) - Automatically select the operator if only one exists ## To test - Verify that the filter bar in general works BUT note there's some odd behaviour when searching on say the "status" column (more details under known issues) - likely something with the internal SQL i think, will need to investigate separately - afaict testing on the method seems to be working at least --- ### Add `onApply` parameter for `FilterBar` The search behaviour for the filter bar feels a bit awkward atm - referencing the table editor: - selecting the column triggers a search, which returns an error cause the search query is incorrect (operator and value not selected yet) - when typing the search value (after selecting the column + operator), the search triggers on debounce, which feels odd in this context as I'd expect the search to only trigger when i've hit enter (e.g to "finalize" my search parameters) - Am adding an `onApply` parameter gets called when a filter is "complete" -> column, operator, and value are finalized (e.g via Enter or onBlur) - Updated both Unified logs and table editor to use this behaviour ### Automatically select operator if only one exists in `FilterBar` This one's more specific to unified logs since there's only an `=` operator - but saves an unnecessary "enter" key event when filtering in unified logs ### Known issues - For some reason (even with the existing filter bar) - searching against status for e.g for postgres logs doesnt return the expected rows. e.g i've got rows with status as `00000`, but searching for `00000` doesnt return anything. Suspect its something to do with the SQL we're firing? <img width="1167" height="271" alt="image" src="https://github.com/user-attachments/assets/1dde74cf-8366-4cf1-8d8f-6907ba2473f6" /> <img width="1184" height="453" alt="image" src="https://github.com/user-attachments/assets/bf55f0fb-cb27-4e8f-b2d9-cd913d6ac6b9" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a dedicated Logs filter bar with an explicit "apply"/commit callback for filter UI. * **Bug Fixes** * Filter edits are buffered locally and only committed on apply to prevent aggressive data requests. * **Refactor** * Replaced legacy command-style table filter UI and removed related utilities. * Updated filter commit lifecycle and narrowed option value typing; adjusted top-level provider ordering. * **Style** * Small layout and trigger behavior tweaks for filter controls, timeline chart spacing, and download button. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46071?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com> |
||
|
Joshen Lim
|
dc211a972c |
Fix count query for unified logs (#46093)
## Context The query to retrieve counts in unified logs have been error-ing out with this `sql parser error: Expected: end of statement, found: UNION at Line: 71, Column: 2` This PR fixes that - can verify visually as the status filters are now populated correctly <img width="365" height="148" alt="image" src="https://github.com/user-attachments/assets/9397cca1-0519-4fe1-9397-c37d399c4b44" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Improved status-based log filtering so single-value and multi-value filters return more accurate results across all log sources. * Made facet count calculations (method, status, pathname) more robust for consistent counts. * **Bug Fixes** * Standardized log endpoint resolution so log retrieval behaves consistently when telemetry mode changes. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46093?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
supabase-supabase-autofixer[bot]andsupabase-workflow-trigger[bot]
|
ba34c1f6e9 |
feat: update @supabase/*-js libraries to v2.106.0 (#46068)
This PR updates @supabase/*-js libraries to version 2.106.0. **Source**: supabase-js-stable-release **Changes**: - Updated @supabase/supabase-js to 2.106.0 - Updated @supabase/auth-js to 2.106.0 - Updated @supabase/realtime-js to 2.106.0 - Updated @supabase/postgest-js to 2.106.0 - Refreshed pnpm-lock.yaml --- ## Release Notes ## v2.106.0 ## 2.106.0 (2026-05-18) ### 🚀 Features - **supabase:** W3C/OpenTelemetry trace context propagation ([#2163](https://github.com/supabase/supabase-js/pull/2163)) ### 🩹 Fixes - **auth:** return null user and session for email_change single-confirmation verifyOtp ([#2378](https://github.com/supabase/supabase-js/pull/2378)) - **release:** mark @supabase/tracing private and snapshot it for JSR ([#2370](https://github.com/supabase/supabase-js/pull/2370)) - **storage:** make StreamDownloadBuilder implement Promise and memoize executor ([#2367](https://github.com/supabase/supabase-js/pull/2367)) ### ❤️ Thank You - Claude Sonnet 4.5 - Guilherme Souza - Katerina Skroumpelou @mandarini - oniani1 This PR was created automatically. Co-authored-by: supabase-workflow-trigger[bot] <266661614+supabase-workflow-trigger[bot]@users.noreply.github.com> |
||
|
fadymak
|
ee64f0abc0 |
fix: update link for OAuth client registration documentation (#46098)
Updates broken link for OAuth client registration |
||
|
Joshen Lim
|
fac7bbbf21 |
Surface errors from logs.all.otel endpoint (#46094)
## Context If an error somehow occurs on the logs.all.otel endpoint for unified logs, the network request still returns a 200 but the error is then returned in the response as such: <img width="681" height="269" alt="image" src="https://github.com/user-attachments/assets/62bcf68f-8a8c-46a0-a91a-17f653004fa0" /> In which case, there's currently no UI error handling in unified logs, and it'll just show no results. Changes in this PR addresses that: <img width="1450" height="956" alt="image" src="https://github.com/user-attachments/assets/1b2c166b-d3d1-4923-9e35-51bad99b6e1c" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Enhanced error handling and messaging for log retrieval—displays explicit error notifications when queries fail instead of misleading empty state messages, improving user experience and clarity during troubleshooting. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46094?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
c88dba9628 |
docs: add Nuxt examples to SSR client guide (#43944)
## What kind of change does this PR introduce? Documentation update. ## What is the current behavior? The server-side auth client guide currently includes framework examples for Next.js, SvelteKit, Astro, Remix, React Router, Express, and Hono, but not Nuxt. ## What is the new behavior? - Adds a Nuxt env var tab in the setup section. - Adds a Nuxt framework section in the create-client guide with: - A server route example using `createServerClient` with cookie adapters. - A browser plugin example using `createBrowserClient`. ## Additional context Closes #34283 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **Documentation** * Added comprehensive Nuxt server-side rendering guide for creating Supabase clients with cookie support, including environment variable configuration setup and implementation examples for both server and browser environments. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/43944?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> |
||
|
Ziinc
|
9fcba73a7c |
docs: fix typo in share (#46040)
fixes minor typo in callout <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated link text formatting across storage analytics guides for improved consistency. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46040?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
supabase-supabase-autofixer[bot]andsupabase-releaser[bot]
|
0309fcccf0 |
docs: update js sdk docs (2.106.0) (#46069)
Updates JS sdk documentation following stable release.
Ran `make` in apps/docs/spec to regenerate tsdoc files.
**Details:**
- **Version:** `2.106.0`
- **Source:** `supabase-js-stable-release`
- **Changes:** Regenerated tsdoc files from latest spec files
🤖 Auto-generated from @supabase/supabase-js stable release.
Co-authored-by: supabase-releaser[bot] <223506987+supabase-releaser[bot]@users.noreply.github.com>
|
||
|
Stephen Morgan
|
1e28e6ac01 |
fix: run format step in separate low-privilege job (#46090)
Out of an abundance of caution, running the format step in a strictly read-only context. Added explicit validations on pushes instead of relying on an implicit lack of pull_request_target Resolves PRODSEC-118 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Reworked automated autofix workflow into a two-step format-and-apply flow, reduced top-level permissions, and moved from an auto-commit action to a manual apply/commit/push process for more controlled automated fixes. * No user-facing features or functionality changed. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46090?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
fda41502d6 |
Adjust width of status and pathname columns in unified logs to be smaller (#46089)
## Context Pulling changes over from a [previous PR](https://github.com/supabase/supabase/pull/46059) cause i had unrelated changes there 🤦 Just tiny UI nits to adjust the column widths of "method" + "pathname" columns in unified logs to be smaller <img width="1174" height="242" alt="image" src="https://github.com/user-attachments/assets/87985bb1-b7f4-4476-a235-7283529d63d8" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Adjusted column widths in the unified logs interface: reduced spacing for the method column and increased width for the pathname column to improve log visibility and readability. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46089?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Danny White
|
09bbb7c323 |
fix(design-system): keep Alert variant text foreground explicit (#46050)
## What kind of change does this PR introduce? Bug fix. Follow-up to DEPR-551, #45302, #45535, #45618, and stacked on #46049. ## What is the current behaviour? Warning and destructive Alert variants do not explicitly own their foreground text colour. In muted parent contexts, nested Admonition content can inherit lighter text styling. ## What is the new behaviour? Warning and destructive Alert variants now include `text-foreground`, just like the default counterpart. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Updated styling for alert components with destructive and warning variants. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46050?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Danny White
|
4c148ea060 |
chore(studio): move short Admonitions to descriptions (#46049)
## What kind of change does this PR introduce? Chore. Follow-up to DEPR-551, #45302, #45535, and #45618. ## What is the current behaviour? Some short Studio Admonitions still put their entire message in `title` or legacy `label`, so body-copy callouts render as headings. ## What is the new behaviour? Moves selected single-message Studio Admonitions to `description`, keeping the follow-up deliberately limited to Studio callsites. This PR does not touch Docs content, shared Alert styling, ui-patterns, design-system registry/docs, or Tailwind config. | Before | After | | --- | --- | | <img width="1818" height="388" alt="Image" src="https://github.com/user-attachments/assets/283a1853-348a-4d74-a408-013957350e5e" /> | <img width="1380" height="462" alt="Image" src="https://github.com/user-attachments/assets/e5761e8e-3697-423b-805b-45110205099a" /> | | <img width="1640" height="716" alt="CleanShot 2026-04-28 at 15 17 25@2x" src="https://github.com/user-attachments/assets/a5be4d5f-2bf7-4dc2-b396-56129fe64ec9" /> | <img width="1630" height="716" alt="CleanShot 2026-04-28 at 15 16 00@2x" src="https://github.com/user-attachments/assets/0d589252-aaf8-4efc-9d81-15ec4f99ec61" /> | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Refined message displays and admonition styling across settings, database, dashboard, and admin interfaces for improved visual consistency and clarity. * **UI Updates** * Updated search input layouts and form element styling in publications tables and other admin pages. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46049?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Prashant Sridharan
|
3356525028 |
Fix event linking behavior (#46083)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? 1. Removed the upcoming Figma webinar and postponed it until later 2. Fixed the event linking behavior for MDX events on the page. MDX events should link to the MDX page, not the CTA. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Updates** * Event links now intelligently route based on event configuration: external event URLs open in new tabs when available, while default events navigate to internal event detail pages within the application * This provides event organizers with flexible options for directing attendees to external event platforms or internal event information pages * Event entries updated to support new link routing functionality <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46083?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
47dc3d8478 |
chore: remove NoticeBanner2 (#46074)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Chore / cleanup. ## What is the current behavior? `NoticeBanner2` displayed a maintenance notice for `ap-southeast-1` and `sa-east-1` on May 13-14. The window has passed and the banner is no longer needed. ## What is the new behavior? `NoticeBanner2`, its `showNoticeBanner2` flag wiring in `AppBannerWrapper`, and its now-unused imports (`useQueries`, `useOrganizationsQuery`, `projectKeys`, `getOrganizationProjects`, `OrgProject`, `MAINTENANCE_REGIONS`) are removed. Shared utilities still used elsewhere (`projectKeys.bannerProjectsByOrg`, `getOrganizationProjects`/`OrgProject`, `LOCAL_STORAGE_KEYS.MAINTENANCE_BANNER_DISMISSED`) are kept. ## Additional context <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Terms of Service update notification banner that expires on July 4, 2026, with options to view details or dismiss. * **Chores** * Removed deprecated maintenance banner notification. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46074?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Matt Rossman
|
212ccf8135 |
fix(ai): contextualize cron schedule as SQL writes, score in "Tool Usage" (#45997)
When Assistant tries to schedule crons in read-only mode, it succeeds but creates the jobs under the `supabase_read_only_user`. This causes permission errors when user try to delete or unschedule them from the Cron dashboard. The root fix will be to enforce read-only transactions for that user. In the meantime, this PR steers Assistant to avoid the mistake. **Changes** - Prompts `execute_sql` to treat side-effecting function calls such as `cron.schedule()` as write queries. - Adds tool input assertions for "Tool Usage" scorer and a focused cron regression eval. - Updates eval mocks to show pg_cron extension as installed so it can call `cron.schedule()` **Verification** See [this trace](https://www.braintrust.dev/app/supabase.io/p/Assistant/trace?object_type=experiment&object_id=4a9e8c0e-83b7-4555-8502-365662c3ec8e&r=e041e69b-b70f-41d1-b88c-e8f7888c3de5&s=e041e69b-b70f-41d1-b88c-e8f7888c3de5) from Braintrust where the new eval passes "Tool Usage", correctly using `isWriteQuery` for the `cron.schedule()` Closes AI-737 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Tool evaluation now validates tool inputs (including exact and substring matches) in addition to tool presence. * **Tests** * Added a test confirming cron-scheduling behavior and that SQL scheduling/enqueue calls are treated as write operations. * **Chores** * Added pg_cron to mock extension data. * Clarified description that SQL calls with side effects should be treated as writes. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45997?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
50e158bddb |
fix: improve loading state when changing log filters in unified logs (#46070)
## Problem When changing filters, while the query is running the loading state is not clear, its only shown in the "Load more" button at the bottom which can be missed if you got a lot of logs, we should improve the filters loading state. That's actually due to two things: - we rely on the `isLoading` state instead of `isFetching` - we debounce filters changes by a second ## Solution - use `isFetching` to determine whether to display the loading spinner in the top filter bar - reduce the debounce delay to `250ms` as users can't filter by typing anyway (what they type must be validated with Enter to select a filter, no fuzzy filtering) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Performance** * Optimized unified logs filter response time, applying filter changes more quickly. * **Bug Fixes** * Enhanced loading indicator behavior in data tables to accurately reflect active data fetching operations, providing clearer visual feedback during interactions. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46070?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Andrey A.
|
31ca536bcb | fix(self-hosted): add jwt issuer env var to auth config (#46020) | ||
|
Andrey A.
|
af031e2abf | fix(self-hosted): add depends_on analytics for vector (#46038) | ||
|
Vaibhav
|
f8f948a2a4 |
fix: policy urls (#46064)
## TL;DR fixes `Table Editor -> View policies` for schema names with special characters tested with schema `sales&ops` : ## ex: | b4 url: `schema=sales&ops` | after url: `schema=sales%26ops` | | --- | --- | | <img width="394" height="63" alt="image" src="https://github.com/user-attachments/assets/fe5bea94-e364-493e-a2de-e9493bf17ef2" /> | <img width="544" height="67" alt="image" src="https://github.com/user-attachments/assets/23f5d648-d7f0-49b9-95de-ef0207d5839c" /> | ## ref - closes #46061 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved URL handling for the "View policies" link to ensure proper encoding and reliability. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46064?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Tomás PozoandChris Chinchilla
|
9d46004210 |
docs: rewrite Securing Edge Functions guide around @supabase/server (#45959)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update. ## What is the current behavior? The "Securing Edge Functions" guide (`/docs/guides/functions/auth`) opens with two conceptual sections — "Understanding authorization headers" and "The `verify_jwt` platform check" — followed by a "Common auth patterns" section that re-implements the same four use cases twice: once without an SDK using `Deno.serve` + manual `createClient` + manual `Authorization` header forwarding, and again using `@supabase/server`. The recommended path is buried below background reading and a legacy-style implementation. Linear: COM-235. ## What is the new behavior? The guide now leads with practical how-tos built on `@supabase/server`: - Authenticated user calls (`auth: 'user'`) - Service-to-service calls (`auth: 'secret'`) - Public functions (`auth: 'none'`) - External webhooks (`auth: 'none'` + signature verification) - Combining modes - Custom error responses - Environment variables The two conceptual sections are extracted into a new sibling page at `/docs/guides/functions/auth-headers` ("Authorization headers"), linked from the top of the how-to page and added to the side nav between "Securing your functions" and "Legacy JWT secret". The legacy SDK-less examples are removed. The mode table uses the unnamed forms (`'secret'`, `'publishable'`), and a note in the service-to-service section introduces the `'secret:<name>'` / `'publishable:<name>'` syntax for callers that want to scope to a specific named key. ## Additional context Each section preserves the "who calls this and why" framing from the original (cron jobs, workers, and `pg_net` for service-to-service; `supabase.functions.invoke` for authenticated user calls; signed webhook providers for external webhooks). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added a new guide explaining Edge Functions authentication headers, JWT validation, and API key handling * Redesigned core authentication guide to focus on the primary wrapper approach with clearer examples and common scenarios * Improved navigation and added redirects to make authentication docs easier to find and access <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45959?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Chris Chinchilla <chris.ward@supabase.io> |
||
|
Gildas Garcia
|
573b165cd2 |
fix: unified logs time range active filter has invalid applid filter count (#46060)
## Problem After selecting a time range filter value, users see that `2` filters are applied which is technically correct (begin/end of the time range) but weird as you have only one filter made of two values. ## Solution ~~Not great, but check the filter column id and display `1` if it is the _Date_ column~~ Better: rely on column definition metadata <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed data table filter reset button display for date columns: date-based filters now show a consistent single indicator, while other columns continue to display their actual filter counts. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46060?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordi EnricandClaude Sonnet 4.6
|
5d9cf3971f |
fix(studio): improve memory and swap units in DB reports (#45889)
Fixes [DEBUG-94](https://linear.app/supabase/issue/DEBUG-94) ## Summary - **Min MB units**: Added \`formatBytesMinMB\` helper that always formats byte values in at least MB. Applied to RAM and swap y-axis tick formatters, tooltips, and chart headers. - **Swap chart scale**: Every Supabase compute instance is provisioned with **1 GB of swap regardless of size** (per [docs](https://supabase.com/docs/guides/troubleshooting/memory-and-swap-usage-explained-aPNgm0)), so the swap y-axis always shows at least 0 to 1 GB. Low swap usage no longer fills the full chart height. Removed the show/hide limit toggle since the limit is implicit in the y-axis scale. - **Swap units in header/tooltip**: Fixed all three formatters (initial header, hover-sync header, tooltip) to use \`formatBytesMinMB\` for swap so the value always shows a unit like "2.00 MB". - **Reference-line defensive fix**: Added a \`customValue\` fallback in \`useAttributeQueries\` so future reference-line attributes that use \`customValue\` instead of \`value\` are not silently overwritten to 0. ## Test plan - [ ] Open DB Reports and verify RAM/Swap y-axis labels show MB (or GB for large values), never KB or bytes - [ ] Hover a bar in the swap chart and verify tooltip and header show the same value with a unit (e.g. "2.00 MB") - [ ] With low or zero swap usage, the chart bars are flat and the y-axis goes 0 to 1 GB - [ ] CPU chart limit toggle still renders at 100% (regression check on the \`useAttributeQueries\` fallback change) 🤖 Generated with [Claude Code](https://claude.ai/claude-code) --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
Timothy Lim
|
360140b3de |
fix(docs): Update Edge Function error code from WORKER_LIMIT to WORKER_RESOURCE_LIMIT (#46051)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Updating to the current status code <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Documentation * Updated docs for HTTP status code 546 to reference the correct resource limit identifier: WORKER_RESOURCE_LIMIT. * Added a note that the limit was previously named WORKER_LIMIT for clarity. * Revised troubleshooting guidance and examples to reflect the new identifier and to include both WORKER_RESOURCE_LIMIT and the prior WORKER_LIMIT naming where relevant. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46051?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Timothy Lim
|
0884060914 |
fix(docs): Fix Oauth docs and code to use redirect_url (#45966)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Fix incorrect reference to `redirect_to` when it should be `redirect_url` - https://github.com/supabase/supabase-js/blob/1c48755657c5f7aac5e4a7abf3f68f27efc0c746/packages/core/auth-js/src/lib/types.ts#L2561-L2569 - https://github.com/supabase/supabase-js/blob/1c48755657c5f7aac5e4a7abf3f68f27efc0c746/packages/core/auth-js/src/lib/types.ts#L2534-L2537 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Enhanced OAuth Server "Getting Started" guide with updated code examples and clearer explanatory steps for implementing authorization flows with accurate field references. * Refined OAuth authorization code flow documentation, including updated diagrams and instructions to ensure consistent field references across all redirect and consent handling steps. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45966) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kemal.earth
|
d051fa5188 |
feat(studio): add new badge to feature preview for logs (#45171)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? We were missing the "New" badge as pointed out by @peekknuf. Though we already mention "New" in the feature name here. Thoughts @supabase/dashboard ? | Before | After | |--------|--------| | <img width="287" height="98" alt="Screenshot 2026-04-23 at 17 33 56" src="https://github.com/user-attachments/assets/06e32cd6-55da-4bd1-a79b-9305ff1aa938" /> | <img width="284" height="148" alt="Screenshot 2026-05-18 at 12 01 33" src="https://github.com/user-attachments/assets/e7721e80-6aa9-4c58-ab64-fc13bc346bf8" /> | |
||
|
Pamela Chia
|
0bed80b340 |
chore(telemetry): clean up frontend event catalog (#45964)
## Summary Resolves 13 findings (2 HIGH, 5 MEDIUM, 6 LOW) from the frontend telemetry audit: 1 action-string collision, 1 camelCase experiment name, 9 dead events removed, 4 missing org groups attached, 1 ambiguous property renamed, 1 raw-string property narrowed, plus consolidations and a structural tightening on TABLE_EVENT_ACTIONS. ## Changes ### HIGH - Rename `EventPageCtaClickedEvent.action` to `www_event_page_cta_clicked` so it no longer collides with the pricing CTA event (which had a different schema sharing the same action string) - Snake_case the header-upgrade experiment exposure name (`headerUpgradeCta_experiment_exposed` → `header_upgrade_cta_experiment_exposed`); PostHog flag key and `?source=` URL param unchanged ### MEDIUM - Remove 4 dead `ProjectCreation*Step*` events (referenced a v2 route that doesn't exist; 0 emissions) - Remove 4 dead experiment exposure events: `ProjectCreationRlsOptionExperimentExposed`, `HomeNewExperimentExposed`, `TableCreateGeneratePoliciesExperimentExposed`, `TableCreateGeneratePoliciesExperimentConverted` (0 emissions) - Attach org group to `dpa_request_button_clicked` (0% had `$group_0` per Hex) - Delete `RegisterStateOfStartups2025NewsletterClicked` (interface naming outlier, 0 emissions, page renamed to 2026) - Rename `AssistantSuggestionRunQueryClickedEvent.category` to `mutationType` with tightened literal union (`'functions' | 'rls-policies' | 'unknown'`) - Attach org group to `project_creation_default_privileges_exposed` on Vercel surface via explicit `groupOverrides` (auto-injection misses because `useSelectedOrganizationQuery` is undefined on that page) ### LOW - Consolidate `IndexAdvisorBannerEnableButtonClickedEvent` + `IndexAdvisorDialogEnableButtonClickedEvent` into one event with `origin: 'banner' | 'dialog'` - Rename `ImportDataFileDroppedEvent` → `ImportDataFileAddedEvent` so the interface name matches the action and the verb is on the approved list - Rename `LogDrainConfirmButtonSubmittedEvent` → `LogDrainRemovedEvent` and action to `log_drain_removed` (fires on delete-confirm modal, matches `CronJobRemovedEvent` pattern) - Add `type` property to `CronJobRemovedEvent` (parsed from the job's command), matching the create/update event shape - Tighten `TABLE_EVENT_ACTIONS` values with `satisfies` against the event union so renames in the union fail typecheck here too - Attach org group to `www_pricing_plan_cta_clicked` at 5 emission sites when an org is available in the page context - Narrow `unified_logs_row_clicked.logType` from raw `string` to the 5-literal `LOG_TYPES` union (zod already validates server values) ### Bundled refactor Migrated 5 emission sites from deprecated `useSendEventMutation` to `useTrack` while their containing files were being edited: `DPA.tsx`, `DisplayBlockRenderer.tsx`, `Grid.tsx` (2 events), `DeleteCronJob.tsx`. Full sweep of the remaining ~79 files is a separate follow-up. ## Testing Mostly just renaming of events ## Linear - fixes GROWTH-798 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Standardized telemetry to a unified tracking system for more consistent analytics. * Simplified experiment exposure reporting for upgrade prompts. * **New Features** * More granular tracking for CSV import, cron job deletions, log drain removals, DPA downloads/requests, and pricing CTAs. * Assistant now classifies mutation queries more precisely. * **Bug Fixes** * Improved default-privileges exposure logic on Vercel deployments (skips when org missing). <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45964) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
