Removes a dead `ExternalLinkIcon` constant and its now-orphaned
`ArrowUpRight` import that were breaking the build with a TS6133
(declared but never read) error.
**Removed:**
- `ExternalLinkIcon` constant and the `ArrowUpRight` lucide import
(unused)
## To test
- `pnpm typecheck --filter=studio` passes
- Database menu still renders normally
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed an unused icon import and a redundant internal constant.
* No user-facing behavior or menu options changed.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
## What
Removes this repo's `SECURITY.md` so it inherits the organization-wide
security policy maintained centrally in `supabase/.github`.
References supabase/.github#20
## Why
The security policy is being consolidated into a single org-wide default
(`supabase/.github`) instead of being duplicated across every
repository. GitHub serves that default as the "Security policy" for any
repo that doesn't define its own, so this file is now redundant.
## Note
Please do not merge until supabase/.github#20 is merged, otherwise this
repo would briefly show no security policy.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed the public security contact file previously available at the
`.well-known/security.txt` path.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What
Cleans up the service health chart labels so they are consistent across
the project homepage usage charts (behind the `newHomepageUsageDeltas`
flag) and the `/observability` service health table. Part of DEBUG-148.
## Changes
- Per-level charts now read `Errors / Warnings / Infos` (the success
series was `Ok` on `/observability` and `Requests` on the homepage).
- Homepage service cards use full-word `Warnings` / `Errors` headers
(was `Warn` / `Err`).
- The `Total Requests` headline keeps the `Requests` wording and its
existing value.
## Not in this PR
- Grouping the API Gateway chart by product. Summing every service's log
levels and labeling it "API Gateway" is not accurate data; real
per-product grouping needs the service-health matview to group API
Gateway requests by product first. Tracked as a follow-up.
- The 30-day interval option mentioned in the thread.
## Testing
- typecheck, prettier, ratchet, and unit tests green in CI.
- Pending manual confirmation in Studio that the tooltips read Errors /
Warnings / Infos on both surfaces.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **UI Improvements**
* Updated service health charts to show clearer segment labels for
errors, warnings, and healthy states.
* Refined project usage metrics text to use more user-friendly labels
like “Warnings” and “Errors.”
* Adjusted chart labeling for one usage view so the healthy/OK series is
presented more clearly.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
## Context
Just cleans up a couple of old redirect links from the Database section
<img width="267" height="654" alt="image"
src="https://github.com/user-attachments/assets/e3c7befe-e121-4588-8530-56d55907b058"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Simplified the database menu and removed two options that are no
longer shown: **Wrappers** and **Database Webhooks**.
* Updated the menu layout so the **Platform** section ends with the
currently available items.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
The email-change confirmation toast rendered a trailing `&sb=` ("...sent
to the other email&sb="). The dashboard parsed the auth-redirect URL
fragment with a naive `split('#message=')` that grabbed everything after
the key, including the empty `sb` origin marker the auth service appends
to every redirect fragment (an intentional, server-side Supabase-Auth
identifier so clients can tell a Supabase redirect from a third-party
OAuth one). The marker is working as designed; the bug is that the
dashboard wasn't parsing the fragment as URL params, so I fixed the
parse rather than the marker.
## Changes
- Parse the redirect fragment with `URLSearchParams` via a new
`parseRedirectMessage` helper, reading only the `message` key. Any other
trailing fragment param (the `sb` marker, or future ones) is now ignored
instead of being concatenated into the toast.
- Drop the manual `+`-to-space replacement. `URLSearchParams.get()`
already decodes form-encoded values, and the old `.replaceAll('+', ' ')`
would have clobbered a legitimately encoded `+`.
- Add unit tests for the helper: marker stripped, no hash, no `message`
key, `message` not first, and percent-encoded `+` preserved.
## Testing (Vercel preview)
The toast only reads the URL fragment, so the redirect can be simulated
directly. Do not use the real email round-trip on the preview: a real
confirm-link click is redirected to prod (the backend sets
`redirect_to`), not the preview build.
- [x] On the preview, log in and open the account preferences page with
this fragment appended:
`/account/me#message=Confirmation+link+accepted.+Please+proceed+to+confirm+link+sent+to+the+other+email&sb=`
— toast shows the clean sentence with no `&sb=`.
- [x] Open the same page with no fragment — no toast fires.
## Linear
- fixes GROWTH-938
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved how success messages are read after redirect in account
identity preferences, so notifications now display the correct text more
reliably.
* Supported messages with spaces and special characters, including cases
where the message appears later in the URL fragment.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This PR updates CODEOWNERS to prepare for renaming infrastructure teams:
- supabase/infra → supabase/platform
The new group names are added alongside the old ones. Once the GitHub
teams are renamed, a follow-up PR will remove the old group references
at the bottom of the file.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **Chores**
* Updated repository code ownership configuration to expand the set of
teams responsible for a shared disk-limits component.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Cleans up a number of stale feature flags that have been enabled for all
users for more than 3 months
- enableSmartRegion
- SentryLogDrain
- axiomLogDrain
- S3logdrain
- Last9LogDrain
- otlpLogDrain
- ShowPrettyExplain
- pgdeltaDiff
- CustomOauthProviders
- timezonePicker
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Timezone selector is now always available in the user menu.
* Log drain “Type” options are expanded in the creation flow.
* Custom auth providers now appear when the custom providers setting is
enabled.
* **Bug Fixes**
* Smart region selection and related queries now follow the selected
cloud provider.
* PG Delta Diff preview availability and SQL editor “EXPLAIN” routing
now follow the latest enabled settings (including platform-only preview
behavior).
* **Changes**
* Removed the Storage List-V2 migration callout from the Storage
settings page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Adds `method=post` to all auth related forms on the dashboard (sign in,
forget password, etc)
## To test
- [ ] Minimally ensure that logging in via email password still works as
expected
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Sign-in, sign-up, MFA, SSO, reset password, and forgot password forms
now explicitly submit using **POST** for more consistent authentication
behavior.
* **Style**
* Reformatted authentication form markup (e.g., multiline JSX
attributes) to improve readability and maintainability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Bug fix, docs update
## What is the current behavior?
- The breadcrumb component docs at
`/design-system/docs/components/breadcrumb` reference six
`ComponentPreview` demos, but the example components were never
implemented and their registry entries were commented out. The page
rendered without working previews.
Unrelated but snuck in:
- The “responsive” Admonition example is a H2 instead of H3 like the
others.
- The design system ⌘K command switcher grows to the full height of its
nav items instead of scrolling within a bounded list.
Closes DEPR-607
Closes DEPR-608
## What is the new behavior?
- Adds six breadcrumb example components (`breadcrumb-demo`,
`breadcrumb-separator`, `breadcrumb-dropdown`, `breadcrumb-ellipsis`,
`breadcrumb-link`, `breadcrumb-responsive`) under
`apps/design-system/registry/default/example/`
- Re-enables the corresponding entries in `registry/examples.ts` and
rebuilds `__registry__/index.tsx`
- Fixes invalid nested `<li>` markup in the responsive breadcrumb demo
that caused a hydration error
Also includes two small unrelated fixes:
- Caps the ⌘K switcher `CommandList` at `max-h-[300px]` so it scrolls
instead of stretching
- Corrects the admonition fragment docs header type
## Additional context
Test plan:
- [ ] Run `pnpm dev:design-system` and open
`/docs/components/breadcrumb`
- [ ] Confirm all six breadcrumb previews render
- [ ] Confirm no hydration warnings in the browser console for the
responsive example
- [ ] Open the ⌘K switcher and confirm the list scrolls within a bounded
height
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added multiple Breadcrumb demos to the design system gallery,
including link, dropdown, ellipsis, separator, and responsive variants.
* Enabled these Breadcrumb demos in the examples registry.
* **Documentation**
* Updated the “Responsive” docs heading level.
* **Style**
* Constrained the command menu list height inside the dialog for
improved fit.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
- We have unused CSS from previous design system (`.sbui-*` classes)
- We use Tailwind `@apply` when we could set the tailwind classes on the
components directly
## Solution
- Delete all `.sbui-*` classes as we don't use them anymore
- Move classes directly on components when that make sense
## Notes
I did not migrate all `sbgrid` classes as they are applied in multiple
components
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated grid editors, placeholders, headers, and dropdowns for cleaner
spacing, truncation, and alignment.
* Improved layout consistency across text, number, time, JSON, and
foreign-key cells.
* Adjusted search and impersonation inputs for better fit and padding.
* **Chores**
* Simplified and removed outdated styling overrides across the Studio
and web app.
* Reduced unused UI package surface by removing an unused input icon
container export.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
UI polish.
## What is the current behavior?
Dropdown sub-menu triggers use symmetric padding and a heavier chevron.
## What is the new behavior?
Tighter right padding and a smaller, muted chevron.
| Before | After |
| --- | --- |
| <img width="1170" height="672" alt="CleanShot 2026-06-26 at 17 07
18@2x-4BDA3F92-78B4-45F4-B31E-897FF1FE537E"
src="https://github.com/user-attachments/assets/ade505c7-f4b0-4046-a728-c49ee93009d4"
/> | <img width="1168" height="672" alt="CleanShot 2026-06-26 at 17 06
33@2x-9A8992B6-C389-4698-BE19-7AEE3FB12A83"
src="https://github.com/user-attachments/assets/c1c9ba73-e059-45a1-82f3-5c268f060e2f"
/> |
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved dropdown submenu trigger spacing and alignment for a cleaner,
more consistent menu layout.
* Updated the trailing chevron icon’s positioning and sizing to keep it
consistently aligned at the far right across states.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
## What kind of change does this PR introduce?
Chore. UI polish for the auto-enable RLS notice.
## What is the current behavior?
Auto-enable RLS is shown in a card with a shield icon and a primary
"Learn more" button. The setup dialog uses longer copy and labels like
"Close" / "Create ensure_rls trigger".
## What is the new behavior?
- Banner uses a responsive note `Admonition` instead of a card.
- Clearer copy: title, description, and dialog body tightened around
protecting future tables.
- Actions: "Set up trigger" (default), "Cancel", "Create trigger";
dismiss tooltip updated.
- Code block border tweak in the dialog; SQL template gets a short
identifying comment.
| Before | After |
| --- | --- |
| <img width="1106" height="747" alt="Tables Database temp-stripe
wksp_6UXXrF9W8SK9CCKdlRh8Uts
Supabase-17201C2A-C57A-4AFE-BA79-591920BBEB8D"
src="https://github.com/user-attachments/assets/f7977ef1-b9c2-4064-b779-b32bdbcc4214"
/> | <img width="1106" height="747" alt="Tables Database temp-stripe
wksp_6UXXrF9W8SK9CCKdlRh8Uts
Supabase-48D740A2-0814-41FE-AE92-F86F1C6C4397"
src="https://github.com/user-attachments/assets/7168cd82-5563-4718-94e3-1ffb4fa690c1"
/> |
| <img width="1106" height="747" alt="Tables Database temp-stripe
wksp_6UXXrF9W8SK9CCKdlRh8Uts
Supabase-7FC76297-7640-440E-B4BF-34ECA51F652B"
src="https://github.com/user-attachments/assets/0b38711e-c6af-4d15-a4d5-d98db28bce20"
/> | <img width="1106" height="747" alt="Tables Database temp-stripe
wksp_6UXXrF9W8SK9CCKdlRh8Uts
Supabase-E98B2F86-E19C-4F5B-988F-DAC40E1B845D"
src="https://github.com/user-attachments/assets/01fa3b62-af2b-447d-bd17-b92e86064285"
/> |
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **UI Improvements**
* Refreshed the RLS notice banner with updated wording and a cleaner
alert-style presentation.
* Improved the trigger setup dialog copy, including title/description
text and updated button labels.
* Updated the trigger creation tooltip/action wording for clearer
guidance.
* **Documentation**
* Added a small inline label comment to the generated auto-enable RLS
event trigger SQL for easier readability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## What
PR 6 of the SQL editor state re-layering stack. Moves ephemeral,
never-persisted SQL editor state out of the snippet/folder "god store".
**Session store** — `state/sql-editor/sql-editor-session-state.ts` holds
per-snippet, read-by-many session state:
- query `results`
- `explainResults`
- the row `limit`
…with their mutators (`addResult`/`addResultError`/`resetResult`,
`addExplainResult`/`addExplainResultError`/`resetExplainResult`,
`resetResults`, `setLimit`). `removeSnippet` drops a snippet's session
entries via `clearForSnippet(id)`.
**Diff-request slice** — `state/sql-editor/sql-editor-diff-request.ts`.
The Assistant's "Insert code" / "Replace code" diff is *not* per-snippet
session state: it's a transient, fire-and-forget command produced
outside the editor (e.g. query blocks / assistant) and consumed exactly
once by whichever editor is active. It's modeled as a consume-once
request (`requestDiff` / `consumeDiffRequest`) rather than durable state
— the editor drains it on apply, so a stale diff can't leak into a later
editor or session. (Previously this was `diffContent` in the god store:
never cleared and triggered by object-reference identity.)
Consumers read session state from `useSqlEditorSessionSnapshot` and the
diff channel from `useSqlEditorDiffRequestSnapshot`, keeping
`useSqlEditorV2StateSnapshot` only for snippets/folders.
### Why not the TanStack Query cache for results/explain?
Editor execution is a **mutation**, not a keyed query — `mutation.data`
is per-hook-instance and not keyed by snippet id, and there's no caching
value to capture (re-running SQL must return *fresh* data, never a
cached result). `EXPLAIN ANALYZE` actually executes the statement, so a
declarative/auto-refetching `useQuery` is semantically wrong.
Results/explain are imperative mutation outputs, scoped to the session,
read by several decoupled consumers keyed by snippet id — exactly what a
small in-memory keyed store models honestly.
## Consumers migrated
- `SQLEditor.tsx` — results/explain/limit reads +
`addResult`/`addResultError`/`addExplainResult`/`addExplainResultError`/`setLimit`;
diff-apply effect now drains a consume-once request
- `UtilityPanel.tsx`, `UtilityTabResults.tsx`, `UtilityTabExplain.tsx`,
`UtilityActions.tsx`
- `QueryBlock/EditQueryButton.tsx` — produces via `requestDiff`
## Notes
- Result/explain types are kept verbatim from the god store
(pre-existing `any` row/error types come along unchanged; tightening
them is out of scope for this move).
- `ref()` on result rows is preserved to avoid Valtio proxying large row
sets.
## Tests
- `sql-editor-session-state.test.ts` — result/explain mutators,
`resetResults`, `clearForSnippet`, `limit`
- `sql-editor-diff-request.test.ts` — `requestDiff`,
`consumeDiffRequest` (drain + queue-of-one)
Validation:
- `pnpm --filter studio typecheck` ✅
- `pnpm exec vitest --run state/sql-editor/` ✅ (110 passed)
- lint ✅ (no new errors)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* SQL editor query results, EXPLAIN output, and the “Limit results to”
setting now persist more reliably across a session.
* AI-assisted SQL insert/replace actions now use a pending diff workflow
to apply updates more consistently.
* **Bug Fixes**
* Results/EXPLAIN rendering and downloads stay in sync with the latest
executed data.
* Switching databases/snippets now clears the correct temporary results.
* Diff application is more resilient when an editor is still loading,
including empty-vs-non-empty editor cases.
* **Tests**
* Added coverage for the session and diff-request state logic.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## Summary
The creation-funnel instrumentation that shipped Jun 25 (#47291, #47293)
had real gaps, surfaced by the weekly telemetry audit and confirmed
against production PostHog data before I touched code. The two automated
reports also contradicted each other on `errorReason`; I checked
production (every value is a controlled slug) and the emit path (only
`useTrackFunnelError` sets it, and it only accepts classified slugs), so
I left the type as-is rather than add a cross-package abstraction for a
risk that cannot occur today.
## Changes
- Classify HTTP 401/403/404 API errors as `unauthorized` / `forbidden` /
`not_found` instead of the catch-all `other`. In production the
`org_creation` `other` bucket was ~96% 401s (~1,300 real over 4 days),
invisible in reason breakdowns. The status-code fallback runs after the
message-pattern match, so specific reasons still win and it only rescues
errors that would otherwise be `other`.
- Add a single `tier` property (`tier_free` / `tier_pro` / `tier_payg` /
`tier_team`) to `organization_creation_completed`, which previously
carried no properties. One canonical billing slug (matching
`SubscriptionTier`) instead of two overlapping plan/tier fields, so the
org-creation funnel segments cleanly by tier and joins against
subscription data. `tier_payg` is uncapped PRO.
- Freeze the submitted tier at submit time (snapshot in `createOrg`)
rather than reading live form state in the success callback, so the
event records the tier that was actually created even if the user edits
the form during the async payment flow.
- Emit `project_creation_form_exposed` with `surface: 'vercel'` on the
integration deploy-button project-creation page (the enum value existed
but was never fired). Gated on the URL `slug` so the impression is
captured as soon as the form renders, matching the sibling exposure hook
on that page.
I also checked the confirm-modal error path flagged in the insights
post: it already classifies via the shared
`useProjectCreateMutation.onError`, so adding instrumentation there
would double-count. No change made.
## Testing
These are analytics events with no UI change, so correctness is in what
lands in PostHog. Post-deploy validation I will run against production
(project 34344):
- `dashboard_error_created` where `origin='org_creation'` and
`errorReason='other'` drops ~96%, with `unauthorized` / `not_found`
appearing.
- `organization_creation_completed.tier` populated on 100% of new events
with one of the four tier slugs.
- `project_creation_form_exposed` with `surface='vercel'` goes from 0 to
greater than 0.
## Linear
- fixes GROWTH-948
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added telemetry for organization creation completion that includes the
selected billing tier.
* Added one-time telemetry when the Vercel project creation form is
exposed.
* **Bug Fixes**
* Improved API error classification to more accurately distinguish
unauthorized, forbidden, and not found responses.
* **Documentation**
* Updated telemetry event definitions to require tier metadata for
organization creation events.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
`Tabs` is deprecated in favour of the Shadcn `Tabs` component currently
suffixed with `_Shadcn_
## Solution
Migrate the only studio usage
Before:
<img width="662" height="396" alt="image"
src="https://github.com/user-attachments/assets/62f36e98-6754-4362-9375-f2a45bd8028e"
/>
After:
<img width="666" height="434" alt="image"
src="https://github.com/user-attachments/assets/a96f9e61-7420-4e77-a60a-a5db54b0e3d6"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated the spreadsheet import panel to use a refreshed tab interface
with clearer “Upload CSV” and “Paste text” options.
* Improved the layout of the import flow so each tab’s content is
displayed more consistently.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
`ui-patterns` exports its components under a subpath (see its
`package.json`). This is easy to forget when adding a new component.
## Solution
Add a CI job that validate the exports are corrects
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added a new “Validate exports” step to the UI patterns pipeline to
ensure generated exports remain in sync.
* When discrepancies are detected, the workflow outputs the diff and
fails immediately to prevent stale artifacts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Supabase > Studio > Table Editor > Filters
## What is the current behavior?
When you add a filter and you are on a different page from the first or
total pages from the filter you have to manually go back to the first
page:
https://github.com/user-attachments/assets/d254c8d4-3a5a-4e90-b7be-25a3a16a5b6f
## What is the new behavior?
Table editor now automatically redirects to the first page or page in
which you will see data:
https://github.com/user-attachments/assets/e77aa27e-884f-45a2-a951-7fd1c675e62f
## Additional context
Add any other context or screenshots.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated pagination so the current page automatically returns to page 1
whenever filters are changed, keeping results consistent with the new
criteria.
* The reset is skipped on the initial load to avoid disrupting the
default starting state.
* Prevents pagination from becoming out of sync after applying or
modifying filters.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
Knip reported some unused dependencies. Some are actually used in
builds, etc but others are not.
## Solution
Remove the really unused dependencies
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Cleaned up unused dependencies and removed some obsolete test/support
files.
* Updated project ignore rules to better match current app structure and
generated files.
* **Bug Fixes**
* No user-facing behavior changed; this release is focused on
maintenance and cleanup.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Standardized Monaco Editor package versions across the workspace using
the shared dependency catalog.
* **Bug Fixes**
* Improved Monaco initialization by configuring asset loading only on
the client and serving Monaco assets from a single base-path URL
(removing platform-specific switching).
* Streamlined Monaco stylesheet injection in Studio’s document
rendering.
* **New Features**
* Added/updated Monaco language support in Studio, including GraphQL,
SQL, and PostgreSQL, with refreshed HTML, JSON, and CSS editor modes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Previous PR was [here](https://github.com/supabase/supabase/pull/45143)
but it got stale with lots of conflicts so figured it'll be easier redo
it off the latest master
Moves policies page from Auth to Database under an Access Control
section along with Roles. This moves all existing files, applies
redirects, and updates urls to point to the new route
<img width="274" height="412" alt="image"
src="https://github.com/user-attachments/assets/7952c185-64ae-4355-ba36-45397efe1787"
/>
<img width="453" height="471" alt="image"
src="https://github.com/user-attachments/assets/04b3dcb3-48a5-4049-9893-d01109fb46a9"
/>
## To test
- [ ] Verify that policies now live under Database correctly
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a quick navigation shortcut to open **Database > Policies
(RLS)**.
* **Bug Fixes**
* Updated Policies and RLS-related links across the product to open the
**Database policies** area (menus, command palette, context actions,
alerts, and link-outs).
* Added a permanent redirect from the old **auth policies** URL to the
new **database policies** URL.
* **Documentation**
* Updated RLS Dashboard and security checklist instructions to reference
**Database > Policies**.
* **Tests**
* Adjusted automated tests to validate the new Policies route.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update
## Additional context
Small errata fix and adds note about pgbouncer not being supported
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Clarified temporary access guidance: it works with direct connections
and IPv4 pooler connections, but not with the IPv6 transaction pooler.
* Updated the example connection options to use `jit=true` for temporary
access setup.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
Adds a new SQL example to the SQL editor to make following quickstarts
easier.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a new SQL quickstart template called **“Instruments”**.
* The template helps users create a sample `instruments` table, add
example rows, and set up read access with row-level security.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
Opening replication/ETL logs via the "View logs" button on a pipeline
details view fails with "Error executing ClickHouse query" on the OTEL
logs path.
The button links to `/logs/replication-logs?f={"pipeline_id": <id>}`,
and `pipelineId` is a number (`Number(_pipelineId)` in
ReplicationPipelineStatus, typed `number` in PipelineStatus). The OTEL
ETL filter emitted that value as an unquoted numeric literal:
```sql
WHERE source = 'etl_replication_logs' AND (log_attributes['pipeline_id'] = 123)
```
`log_attributes` is a `Map(String, String)`, so comparing its string
value to a number is a type error in ClickHouse, which surfaces as the
generic "Error executing ClickHouse query".
## Fix
Coerce the value to a string in the OTEL ETL `pipeline_id` filter so it
always compares string-to-string:
```sql
WHERE source = 'etl_replication_logs' AND (log_attributes['pipeline_id'] = '123')
```
- OTEL-only change. The legacy BigQuery path (a numeric `pipeline_id`
column) is left untouched and still compares as a number.
- The existing unit test only passed a string `'42'`, which hid the bug.
Added a numeric `42` case that would emit the unquoted literal without
the fix.
## How to test
- Open a project with an ETL/replication destination, go to the pipeline
details view, and click "View logs".
- Expected result: the logs load instead of showing "Error executing
ClickHouse query".
- Run the unit tests: `pnpm test:studio` (or target
`Logs.utils.otel.test.ts`).
- Expected result: the new test "quotes a numeric etl pipeline_id so it
compares as a string" passes, asserting `log_attributes['pipeline_id'] =
'42'`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed filtering for ETL logs so `pipeline_id` values are consistently
treated as text, including numeric inputs.
* Improved matching behavior when using the pipeline filter, helping
ensure results appear as expected.
* **Tests**
* Updated and expanded test coverage for pipeline ID filtering to verify
the corrected SQL output.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
**Stack 4/6** of the TanStack Start migration (#46424). Stacked on
**#47112** (S3).
> [!NOTE]
> Mechanical and homogeneous — every file is the same shape: a
`createFileRoute(...)` whose `server.handlers` delegate to the existing
`pages/api` handler via `toWebHandler` (the compat shim from S2). The
pages-router handlers are unchanged; Next still serves them directly and
ignores `routes/`.
## What's in this PR
- `routes/api/**` (~104 files): platform (`pg-meta`, auth, storage,
integrations, profile, telemetry, organizations, projects…), `ai/*`,
`v1/*`, `connect`, `content`/`mcp`, and standalone endpoints
(`deployment-mode`, `get-ip-address`, etc.).
- `routeTree.gen.ts` — **regenerated** for the routes present so far
(root + auth/app + api).
## Review tip
The route files are near-identical wrappers, so this is fast to skim.
The generated `routeTree.gen.ts` isn't meaningful review surface.
## Verification
On top of S1–S3: `studio` typecheck ✓, lint (0 errors) ✓.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Model Context Protocol (MCP) API endpoint with configurable
feature support and read-only mode
* Added function artifact streaming capability for self-hosted functions
* **Chores**
* Migrated API route infrastructure for improved system architecture
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
**Changes:**
- New blog post: `/blog/agentic-coding-on-supabase-with-opencode`
- New author entry: Eric Kharitonashvili (`ekhar`) in `authors.json`
- Blog images and author avatar
## Checklist
- [x] Blog post reviewed internally and approved
- [x] Reviewed and approved by OpenCode
([doc](https://docs.google.com/document/d/1Azyt7Ot0Q8bxBF3YOLdks8CPME-SKVUr-WXGl2HDJR8/edit?tab=t.0))
- [x] Images added
- [x] Video embed added
- [x] Author added to `authors.json`
- [ ] Marketing +1 in `#team-marketing`
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Problem
Individual edge function logs are broken on the OTEL logs path. The logs
chart for a single function filters by the `metadata.function_id`
override key passed from the function logs page. On the OTEL path this
key has no filter template, so it falls through to the unknown-clause
resolver and is emitted verbatim as
`log_attributes['metadata.function_id']`. OTEL drops the `metadata`
root, so the live attribute key is just `function_id`. The filter
matched nothing and the chart came back empty.
Generated before:
```sql
WHERE source = 'function_logs' AND (log_attributes['metadata.function_id'] = '...')
```
## Fix
Strip a leading `metadata.` prefix in the OTEL unknown-clause resolver
(`resolveUnknownOtelClause`). The same BigQuery-style override key now
resolves to `log_attributes['function_id']`, matching the working
invocations query. This is the documented OTEL convention (the
`metadata` root is always dropped), so it also covers any other
`metadata.*` override keys.
Generated after:
```sql
WHERE source = 'function_logs' AND (log_attributes['function_id'] = '...')
```
## How to test
- Enable the OTEL logs path and open an edge function's Logs tab for a
project with recent invocations.
- Confirm the logs chart renders ok/warning/error buckets instead of an
empty chart.
- Run the unit tests: `pnpm test:studio` (or target
`Logs.utils.otel.test.ts`).
- Expected result: the new test "drops the metadata root from an
override key for function logs" passes, asserting the generated SQL uses
`log_attributes['function_id']`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed OTEL filter handling so keys that include the `metadata.` prefix
are translated correctly for log searches.
* Filters like `metadata.function_id` now generate the expected
log-attribute predicates, improving Function logs matching.
* **Tests**
* Added/updated inline snapshot coverage to verify SQL generation for
metadata-based log filter overrides in both chart and preview queries.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
## Problem
We now export components under a subpath in ui-patterns to avoid barrel
files as they slow down every tools (from IDE to linters, etc.) and may
also affect bundles our users have to download.
## Solution
- Remove the UI patterns index file
- Fix invalid impors
## I have read the CONTRIBUTING.md file.
YES
## What kind of change does this PR introduce?
This PR helps standardise link sections which is useful for overview
pages that frequently use similar sections such as "Next steps", "Get
started", or "Examples".
Six high-traffic overview pages are migrated as a pilot, with a skill in
the new
[supabase/docs-agent-skills](https://github.com/supabase/docs-agent-skills)
repo to audit and convert the rest in a follow-on PR.
Refactored from an initial YAML front matter approach per review
feedback from @jeremenichelli. Now implemented as a React component and
using existing linting & Markdown export functionality.
A second round of review feedback further simplified the architecture:
the per-listing component registry was removed in favor of a single
`<ContentListings id="..." />` component backed by an ID-keyed data
lookup, the listing data moved out of `apps/docs/components/` into
`apps/docs/data/content-listings/`, the listing-specific link wrapper
was replaced with the existing `<Link>` + `<GlassPanel>` pattern from
the rest of the docs, and the headings now defer to the shared
`<Heading>` from `MdxBase.shared.tsx` (no parallel marker-to-tag
mapping, no typography overrides). Great feedback, thank you! 🙏
Relates to DOCS-1032.
## What is the current behavior?
Authors implement these sections however they wish. As a result,
overview and index pages use inconsistent patterns for orientation
links: some use hand-rolled Markdown lists, some use custom panel/grid
components, some use buttons, and some have no guidance about where to
go next at all. There is no shared component for these sections and no
analytics on those clicks.
## What is the new behavior?
Authors add orientation sections in two steps:
1. Define listing data in a `.data.ts` file under
`apps/docs/data/content-listings/` (for example, `storage.data.ts`).
Each `ContentListingGroup` has a globally-unique `id` like
`storage-get-started`.
2. Place a single `<ContentListings id="..." />` component inline in
guide MDX.
The ID is also the telemetry `listingId`, so the same value
disambiguates the section in PostHog dashboards.
Grid and list layouts, optional icons (such as
`/docs/img/icons/github-icon` with `-light.svg` variants for dark mode),
and external URLs are supported. Conditionals that use `$Show` around
inline components are also supported, for example for auth pricing.
### Usage example from "Storage" overview page
`apps/docs/data/content-listings/storage.data.ts`:
```ts
export const storageGetStarted: ContentListingGroup = {
id: 'storage-get-started',
heading: 'Get started',
description: 'Choose the bucket type that fits your use case:',
type: 'grid',
items: [
{
title: 'Files buckets',
href: '/guides/storage/quickstart',
description:
'Store and serve images, videos, documents, and general-purpose files with direct URL access and row-level security.',
},
{
title: 'Analytics buckets',
href: '/guides/storage/analytics/introduction',
description:
'Store data in Apache Iceberg tables for data lakes, logs, and ETL. Query from Postgres via foreign tables with partitioning.',
},
{
title: 'Vector buckets',
href: '/guides/storage/vector/introduction',
description:
'Store embeddings and run similarity search for semantic matching, AI, and RAG. Use HNSW indexing, distance metrics, and metadata filtering.',
},
],
}
```
`apps/docs/content/guides/storage.mdx`:
```mdx
<ContentListings id="storage-get-started" />
```
Renders as:
<img width="689" alt="Storage Get started listing — Files, Analytics,
and Vector buckets"
src="https://github.com/user-attachments/assets/0d1b9531-962f-40ae-891e-b1e93ff1c939"
/>
<br>Exported in Markdown as:
```md
## Get started
Choose the bucket type that fits your use case:
- **[Files buckets](/docs/guides/storage/quickstart):** Store and serve images, videos, documents, and general-purpose files with direct URL access and row-level security.
- **[Analytics buckets](/docs/guides/storage/analytics/introduction):** Store data in Apache Iceberg tables for data lakes, logs, and ETL. Query from Postgres via foreign tables with partitioning.
- **[Vector buckets](/docs/guides/storage/vector/introduction):** Store embeddings and run similarity search for semantic matching, AI, and RAG. Use HNSW indexing, distance metrics, and metadata filtering.
```
Click tracking fires via PostHog (`docs_content_listing_clicked`):
```json
{
"action": "docs_content_listing_clicked",
"custom_properties": {
"targetPath": "/guides/storage/quickstart",
"linkTitle": "Files buckets",
"groupTitle": "Get started",
"listingId": "storage-get-started"
}
}
```
Still finding my way around PostHog, but I verified on preview deploy
that clicking a content listing on `/docs/guides/auth` sends
`docs_content_listing_clicked` to
`https://api.supabase.green/platform/telemetry/event` and receives HTTP
201.
### Authoring experience
Three ways to add or convert content listings: copy the agent prompt
first, use snippets for manual edits, or invoke the audit skill for
batch follow-on work. Refer to `CONTRIBUTING.md` for the full authoring
guide.
#### 1. Agent prompt
Copy into Cursor or another AI assistant:
```text
Add a content listing block for [TOPIC] / [SECTION] (for example, Storage / Examples).
Follow CONTRIBUTING § Content listings in apps/docs.
- Add data to apps/docs/data/content-listings/[topic].data.ts
- Use a globally-unique kebab-case id like `[topic]-[section]`
- Place inline in the guide MDX with <ContentListings id="..." />
- Copy structure from storageGetStarted in apps/docs/data/content-listings/storage.data.ts
- Run pnpm test:local lib/content-listings.test.ts from apps/docs
```
#### 2. VS Code / Cursor snippets
Type these prefixes in the docs workspace
(`.vscode/content-listing.code-snippets`):
| Prefix | Inserts |
| ----------- | --------------------------------------------------------
|
| `cl-data` | `ContentListingGroup` export skeleton with namespaced id |
| `cl-inline` | `<ContentListings id="…" />` in guide MDX |
<img width="658" height="274" alt="image"
src="https://github.com/user-attachments/assets/5ef20954-7aee-4925-887d-79a5ae766b37"
/>
#### 3. Batch audit skill
For follow-on overview page conversion or maintenance, use the
[`audit-content-listings`](https://github.com/supabase/docs-agent-skills/blob/main/.claude/skills/audit-content-listings/SKILL.md)
skill in `docs-agent-skills` (skill, `conversion-manifest.json`, and
validation script).
Example:
```text
Use audit-content-listings. Audit getting-started.mdx, update conversion-manifest.json, then convert the next unconverted section only.
```
## Additional context
The implementation includes a presentational `<ContentListings />`
component (grid/list layouts, GlassPanel, telemetry) backed by ID-keyed
data modules, and a single markdown export handler that reads the same
`id` prop from the JSX and looks up data via the shared registry.
Key files:
- **Data:** `apps/docs/data/content-listings/` (one `.data.ts` file per
guide topic, plus `index.ts` exporting `CONTENT_LISTINGS` and
`getContentListingById`)
- **Renderer:** `apps/docs/components/ContentListings/` (single
`<ContentListings id="…" />` component); registered in
`apps/docs/features/docs/MdxBase.shared.tsx`
- **Types/helpers:** `apps/docs/lib/content-listings.schema.ts` (zod
schemas, type aliases, grid/heading/href helpers)
- **Markdown export:** `apps/docs/internals/markdown-schema/Listings.ts`
(single ID-driven handler) wired into
`apps/docs/internals/generate-guides-markdown.ts`
- **Telemetry:** `docs_content_listing_clicked` defined in
`packages/common/telemetry-constants.ts`, fired from
`ContentListings.client.tsx`
- **Authoring guide:** `apps/docs/CONTRIBUTING.md` (Components and
elements → Content listings)
- **VS Code snippets:** `.vscode/content-listing.code-snippets`
(`cl-data`, `cl-inline`)
### Before & After
#### Auth
| [Before (production)](https://supabase.com/docs/guides/auth) | [After
(preview)](https://docs-git-fork-nrichers-nikrichers-docs-1032-sta-e2a8cb-supabase.vercel.app/docs/guides/auth)
|
|
---------------------------------------------------------------------------------------------------------------------------
|
---------------------------------------------------------------------------------------------------------------------------
|
| 
| 
|
#### Database overview
| [Before
(production)](https://supabase.com/docs/guides/database/overview) |
[After
(preview)](https://docs-git-fork-nrichers-nikrichers-docs-1032-sta-e2a8cb-supabase.vercel.app/docs/guides/database/overview)
|
|
--------------------------------------------------------------------------------------------------------------------------------------------------
|
--------------------------------------------------------------------------------------------------------------------------------------------------
|
| 
| 
|
#### Edge Functions
| [Before (production)](https://supabase.com/docs/guides/functions) |
[After
(preview)](https://docs-git-fork-nrichers-nikrichers-docs-1032-sta-e2a8cb-supabase.vercel.app/docs/guides/functions)
|
|
--------------------------------------------------------------------------------------------------------------------------------------------
|
--------------------------------------------------------------------------------------------------------------------------------------------
|
| 
| 
|
#### Storage
| [Before (production)](https://supabase.com/docs/guides/storage) |
[After
(preview)](https://docs-git-fork-nrichers-nikrichers-docs-1032-sta-e2a8cb-supabase.vercel.app/docs/guides/storage)
|
|
----------------------------------------------------------------------------------------------------------------------------------------
|
----------------------------------------------------------------------------------------------------------------------------------------
|
| 
| 
|
#### Realtime
| [Before (production)](https://supabase.com/docs/guides/realtime) |
[After
(preview)](https://docs-git-fork-nrichers-nikrichers-docs-1032-sta-e2a8cb-supabase.vercel.app/docs/guides/realtime)
|
|
-------------------------------------------------------------------------------------------------------------------------------------------
|
-------------------------------------------------------------------------------------------------------------------------------------------
|
| 
| 
|
#### Getting Started (partial migration for demoing)
| [Before
(production)](https://supabase.com/docs/guides/getting-started) | [After
(preview)](https://docs-git-fork-nrichers-nikrichers-docs-1032-sta-e2a8cb-supabase.vercel.app/docs/guides/getting-started)
|
|
------------------------------------------------------------------------------------------------------------------------------------------------------
|
------------------------------------------------------------------------------------------------------------------------------------------------------
|
| 
| 
|
### Test plan
- [ ] Visually verify migrated pages render correctly:
- [ ] `/guides/auth` — grid "Get started", conditional pricing list,
grid "Next steps"
- [ ] `/guides/database/overview` — get started + next steps listings
- [ ] `/guides/getting-started` — top 3-column grid
- [ ] `/guides/functions` — get started + example listings
- [ ] `/guides/storage` — get started, examples, resources listings
- [ ] `/guides/realtime` — get started, examples, resources listings
- [ ] Confirm listings render at explicit page positions
- [ ] Click a content listing link and verify
`docs_content_listing_clicked` fires in PostHog with expected properties
(the new `listingId` is the namespaced kebab-case id, e.g.
`storage-get-started`)
- [ ] Build docs and confirm `.md` alternate output includes listing
sections at component placement (e.g.
`public/markdown/guides/storage.md`)
- [ ] Run unit tests: `pnpm test:local lib/content-listings.test.ts` in
`apps/docs`
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Introduced a standardized content listings system for organizing
related guides and resources.
* Content listings now support both grid and list layouts for consistent
presentation.
* Added click telemetry for content listing interactions.
* **Documentation**
* Updated authentication, database, functions, getting started,
realtime, and storage guide pages to use the new content listing
components.
* Improved MDX structure examples and listing markup formatting in
contributor documentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Introduced a new content listings component for displaying guide
content in list and grid layouts across documentation pages.
* Added telemetry tracking for content listing interactions to measure
user engagement.
* **Documentation**
* Updated guide pages (Authentication, Database, Functions, Storage,
Realtime, Getting Started) to use the new listings layout.
* Added contribution guidelines for creating and managing content
listings in documentation.
* **Tests**
* Added comprehensive test coverage for content listings validation,
serialization, and rendering.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Nik Richers <nik@validmind.ai>
Co-authored-by: Jeremias Menichelli <jmenichelli@gmail.com>
## Problem
There's still more unused code in the repository which slows down
everything:
- checkouts
- tooling
- probably builds (not sure how good turbopack is at handling this)
## Solution
- remove old unused code
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Cleaned up several UI building blocks and related styling, including
typography, menus, buttons, loading states, side panels, form layout,
input adornments, spinner, theme context, and mobile detection.
* Removed some previously available UI helpers and variants from the
public component set.
* **Style**
* Simplified or removed multiple CSS modules and visual rules across the
design system.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
- Adds event landing page for the Supabase x TRAE webinar (July 22, 2026
at 7pm PT)
- Adds Gary Qi (TRAE) to authors.json
- Adds TRAE logos and Gary Qi avatar
## Test plan
- [ ] Preview the page at `/events/supabase-trae-high-quality-apps`
- [ ] Confirm speaker cards render correctly
- [ ] Confirm TRAE logo appears in the event header
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a new MDX event page for an upcoming webinar about building
high-quality Supabase apps with TRAE.
* Included event details such as schedule, duration, timezone, speaker
information, and a registration/CTA link.
* Added supporting content covering what attendees will learn, plus live
Q&A and recording availability.
* Updated the authors list by adding Gary Qi to support refreshed
speaker/content attribution.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Snippet content was wiped blank after a move or rename (until dashboard
refreshed) because it depended on the API returning the new content, but
the API returns under the `content` field, not the `unchecked_sql` field
that is expected. Added a `remapSqlContentField` remap to fix.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved the saved content response so snippet fields are mapped
consistently before being returned.
* Kept the saved status unchanged while updating the returned data shape
for better accuracy.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Chore
## What is the current behavior?
- Add-column uses implicit button styling
- Replication row tooltip says "Open in Table Editor"
## What is the new behavior?
- Add-column explicitly uses `variant="default"`
- Auth Users explicitly uses `variant="default"`
- Replication row tooltip says "Table Editor"
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix.
## What is the current behavior?
`withAuth` calls `signOut()` and redirects to `/sign-in` whenever the
current AAL is below the required level. For IdP-initiated SSO logins —
where the user lands directly on `/dashboard` rather than passing
through `/sign-in-mfa` — this destroys the valid AAL1 session that was
just established. Subsequent mgmt-api requests then return 401
Unauthorized, and the user is dumped on `/sign-in` with no way to
recover except restarting the SSO flow (which loops them back to the
same state).
The platform already returns an actionable `403 Insufficient AAL: MFA
required` on the first mgmt-api request, but the dashboard does not
capture it.
## What is the new behavior?
`withAuth` now distinguishes between "not logged in" and "needs AAL
elevation":
- **Logged in but AAL1** → `router.push('/sign-in-mfa?returnTo=…')`,
session preserved. The existing `/sign-in-mfa` page picks up the
session, renders the MFA form, and bounces the user to `returnTo` after
a successful challenge.
- **Not logged in** → unchanged: `signOut()` then redirect to
`/sign-in?returnTo=…`.
- `/sign-in-mfa` is also added to the "already there, do nothing" guard
so the user isn't re-redirected mid-challenge.
This relies on the gotrue client's local AAL state via
`useAuthenticatorAssuranceLevelQuery`, which fires before any mgmt-api
request, so no fetcher-level error parsing is needed.
## Additional context
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved multi-factor authentication (MFA) elevation flow to preserve
user sessions instead of forcing sign-out and requiring users to restart
sign-in.
* Fixed unnecessary redirects when users are already on sign-in pages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes DOCS-1057
Contributes to DOCS-1052
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## Problem
We have hundreds of MDX lint warnings in our docs going against style
best practices.
## Solution
Remove and replace in context the following:
- PostgreSQL. There was only one. There was concern about exceptions,
but I found none.
- Just
- Quickly
- Actually
### What changed
Edits follow the [Google developer documentation style
guide](https://developers.google.com/style): concise, direct, active
voice. The flagged words were removed when the sentence still read well,
or replaced when meaning needed to be preserved.
### Common patterns
| Flagged word | Approach | Example |
|---|---|---|
| **just** (filler) | Removed | "you just installed" → "you installed" |
| **just** (limiting) | **only** | "just one row" → "only one row" |
| **just like** | **like** / **the same as** | "function just like
regular users" → "function like regular users" |
| **not just** | **not only** | "not just errors" → "not only errors" |
| **quickly** (performance) | **efficiently** or removed | "find rows
quickly" → "find rows efficiently" |
| **quickly** (time) | **soon** / **rapidly** / removed | "expires too
quickly" → "expires too soon" |
| **actually** (filler) | Removed | "actually execute" → "execute"; "is
actually the most common" → "is the most common" |
## Tophatting
1. See the diff.
2. See that content continues to make sense in context.
3. Locally, `cd apps/docs` and run `pnpm run lint:mdx`.
4. Search for "just," "actually," "quickly", and "PostgreSQL" and see
there are 0 warnings.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated wording across quickstarts, guides, and troubleshooting
articles for grammar, clarity, and consistent step-by-step phrasing.
* Clarified key concepts including Row Level Security policy evaluation
across Supabase products, deferred foreign key constraint behavior, and
when `EXPLAIN ANALYZE` executes queries (and related side effects).
* Refined several troubleshooting instructions and added guidance to cap
log payload size to reduce billed Logs Ingest volume.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Nik Richers <nrichers@gmail.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Add recording / change CTA
## What is the current behavior?
It links to the GoToWebinar page.
## What is the new behavior?
It will now link to the on-demand recording :)
## Additional context
Add any other context or screenshots.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated the event page to feature a watchable recording instead of a
registration link.
* Added an embedded video section and a new “Key takeaways” area for
easier recap.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Increased the allowed maximum values for rate-limit settings, enabling
much larger numeric inputs.
* Updated validation messages so error text matches the new limits and
time-window wording.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
Refreshing the browser while viewing a saved log query loads stale query
content. The sidebar navigation link embeds the SQL in the `q` URL param
at the time it is rendered. When the query is updated and saved, the URL
still holds the old SQL. On refresh, the editor initialises from that
stale `q` param instead of fetching the latest content from the API.
## Fix
When a `queryId` is present in the URL, the `q` param is now ignored for
initialising the editor. Instead, a new effect populates the editor from
the API response once `useContentQuery` resolves. If the user previously
ran a modified query (stored in the `search`/`s` param), that takes
precedence over the saved content, preserving existing behaviour.
## How to test
- Open Logs Explorer and create a new query, save it as "test".
- Change the query content, click "Save query" to update it.
- Refresh the browser.
- Expected: the editor shows the updated query content, not the old
content.
- Navigate away and back, then refresh again.
- Expected: the updated content still loads correctly.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved the logs explorer so that selecting a saved query reliably
loads its SQL into the editor.
* Updated behavior so URL query text no longer overwrites the editor
contents when a saved query is selected.
* Ensured editor content is preserved when searching, preventing
unexpected replacements.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Chris Gwilliams
