Introduce an API endpoint that serves preprocessed Markdown for guide pages (.mdx) and a client "Copy as Markdown" button. Adds mdxToMarkdown transformer to convert MDX/JSX (admonitions, Image, other components) into plain Markdown, a test script to scan guides for unhandled JSX, and a CopyMarkdownButton client component. Integrates the copy button into GuidesMdx template and GuidesTableOfContents (TOC now accepts children), updates next.config.mjs with rewrites and outputFileTracingIncludes for the new API, and adds a navigation types reference in next-env.d.ts. The API enforces existing access checks via getGuidesMarkdown and returns Markdown with caching headers.
## What kind of change does this PR introduce?
Grammar corrections in comments and user-facing text.
## What is the current behavior?
Several files have minor grammar issues:
- Missing contraction: "it an error" (should be "it's an error")
- Subject-verb disagreement: "a users loads" (should be "a user loads")
- Missing possessive apostrophe: "a users organization" and "a users
language" (should be "a user's")
## What is the new behavior?
All grammar issues are corrected:
- `apps/studio/instrumentation-client.ts` — "it's an error" + "a user
loads"
- `apps/docs/instrumentation-client.ts` — "a user loads"
- `apps/www/data/partners/index.tsx` — "a user's organization"
-
`apps/docs/content/troubleshooting/customizing-emails-by-language-KZ_38Q.mdx`
— "a user's language"
## What kind of change does this PR introduce?
Grammar corrections across documentation and test descriptions.
## What is the current behavior?
Multiple docs and test files use "a" before acronyms that start with a
vowel sound when pronounced:
- "a HTTP" (pronounced "aitch-tee-tee-pee") should be "an HTTP"
- "a API" (pronounced "ay-pee-eye") should be "an API"
- "a RLS" (pronounced "arr-ell-ess") should be "an RLS"
- "the all users" is redundant (should be "all users")
## What is the new behavior?
All instances corrected to use proper English indefinite articles:
### Docs files (11 files):
- `firebase-auth.mdx` — "the all users" -> "all users" (2 occurrences)
- `log-drains.mdx` — "a HTTP drain" -> "an HTTP drain"
- `securing-your-api.mdx` — "a HTTP 402" and "a HTTP 420" -> "an HTTP"
- `scan-error-*.mdx` — "a HTTP 500" -> "an HTTP 500"
- `roboflow.mdx` — "a HTTP interface" -> "an HTTP interface"
- `auth-hooks.mdx` — "A HTTP Hook" -> "An HTTP Hook", "a HTTP hook" ->
"an HTTP hook", "a HTTP error" -> "an HTTP error"
- `auth-mfa.mdx` — "a HTTP 401" -> "an HTTP 401"
- `password-verification-hook.mdx` — "a HTTP request" -> "an HTTP
request"
- `before-user-created-hook.mdx` — "a HTTP implementation" -> "an HTTP
implementation"
- `pgtap-extended.mdx` — "a API exposed schema" -> "an API exposed
schema"
- `error-codes.mdx` — "a RLS policy" -> "an RLS policy"
- `broadcast.mdx` — "a RLS" -> "an RLS"
### Studio files (1 file):
- `CronJobs.utils.test.ts` — "a HTTP request" -> "an HTTP request" (9
test descriptions) + "notationa" typo -> "notation"
## Additional context
The rule: use "an" before acronyms pronounced with a leading vowel
sound. "HTTP" starts with "aitch" (vowel sound), "API" starts with "ay"
(vowel sound), and "RLS" starts with "arr" (vowel sound).
## What kind of change does this PR introduce?
Documentation and copy corrections.
## What is the current behavior?
Several docs and one Studio file contain grammar, spelling, and
capitalization issues:
- JS v1 upgrade guide: "we'll continuing" (should be "we'll continue"),
"Some the [PR]" (should be "See the [PR]"), extra space before comma
- Realtime docs: "PostgresSQL" (should be "PostgreSQL") in 2 files
- Kotlin SDK installing docs: "Websockets" (should be "WebSockets"),
"Checkout the" (should be "Check out the")
- Broadcast guide: "Websockets" (should be "WebSockets") in code
comments (5 occurrences)
- Prisma troubleshooting: "Checkout this" (should be "Check out this")
- Edge function template: "Websocket Server Example" (should be
"WebSocket Server Example")
## What is the new behavior?
All grammar, spelling, and capitalization issues are corrected:
- **Grammar**: "we'll continue" (verb tense), "See the [PR]" (correct
word), removed extra space
- **Spelling**: "PostgreSQL" (correct product name)
- **Capitalization**: "WebSocket" / "WebSockets" follows the official
W3C/IETF naming convention
- **Word splitting**: "Check out" as a phrasal verb (two words), vs
"checkout" the noun
## Files changed (8)
- `apps/docs/docs/ref/javascript/v1/upgrade-guide.mdx` — grammar fixes
(3 issues)
- `apps/docs/docs/ref/self-hosting-realtime/introduction.mdx` —
PostgresSQL -> PostgreSQL
- `apps/docs/docs/ref/realtime/realtime.mdx` — PostgresSQL -> PostgreSQL
- `apps/docs/docs/ref/kotlin/v2/installing.mdx` — WebSockets + Check out
- `apps/docs/docs/ref/kotlin/installing.mdx` — WebSockets + Check out (2
occurrences)
- `apps/docs/content/guides/realtime/broadcast.mdx` — Websockets ->
WebSockets (5 occurrences)
- `apps/docs/content/troubleshooting/prisma-error-management-Cm5P_o.mdx`
— Check out
- `apps/studio/components/interfaces/Functions/Functions.templates.ts` —
WebSocket template name
## What kind of change does this PR introduce?
Documentation improvement for Realtime Presence.
## What is the current behavior?
The Presence documentation doesn't explain that during a `sync` event,
clients may receive `join` and `leave` events simultaneously even when
no users are actually joining or leaving. This can be confusing for
developers new to Presence.
## What is the new behavior?
Added an explanatory note clarifying that:
- During `sync`, you may receive `join` and `leave` events at the same
time
- This is normal and expected
- It reflects state reconciliation with the server, not real user
movement
This helps developers understand this behavior upfront rather than
having to discover it through debugging.
## Additional context
As mentioned in the issue, this behavior is discussed in [this community
discussion](https://github.com/orgs/supabase/discussions/26748) where
the solution had to be discovered by users.
Fixes#41175
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Clarified behavior during sync events in the Realtime Presence guide.
Added explanation that simultaneous join and leave events may occur due
to state reconciliation rather than actual user movement changes.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Documentation fix
## What is the current behavior?
In `apps/docs/content/guides/platform/billing-on-supabase.mdx`, the
"Control your costs" link has an empty URL (`[Control your costs]()`),
making it non-functional. Users clicking this link are not taken to the
cost control documentation.
## What is the new behavior?
The link now correctly points to `/docs/guides/platform/cost-control`,
which is the existing page that covers Spend Cap, Billing Alerts, and
other cost control features.
## Additional context
The other two links in the same list (`Your monthly invoice` and `Manage
your usage`) already have correct URLs. This appears to be an oversight
where the cost-control page was created but the link in the billing
overview was not updated.
This PR:
- Adds a new Join types and join modifiers section to the
joins-and-nesting guide.
- Documents default left join semantics for embedded relations.
- Explains !inner for inner-join behavior.
- Explains : aliasing and ! join modifiers (!inner, !foreign_key).
- Adds join/filter examples with expected JSON results.
- Includes query examples across JavaScript, Dart, Swift, Kotlin,
Python, and URL.
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## Problem
The [spec generation Makefile started
failing](https://github.com/supabase/supabase/actions/runs/22142393017)
with:
```text
ReferenceError: React is not defined
at Object. (/Users/.../_npx/.../node_modules/styled-components/dist/styled-components.cjs.js:1:860)
```
This occurred when `@redocly/cli@2.18.2` was released on Feb 16, 2026.
The error happens because `npx @redocly/cli` installs the package in an
isolated temporary cache without properly resolving peer dependencies
(React is a peer dependency of styled-components).
## Solution
Replace `npx @redocly/cli` with `pnpm exec redocly` to use the installed
version from `packages/generator/package.json`.
This ensures:
1. **Proper dependency resolution** - pnpm installs the full dependency
tree including peer dependencies
2. **Version control** - locked to the version in package.json instead
of always fetching latest
3. **Reproducible builds** - won't break when new versions are released
## Changes
- Replace `npx @redocly/cli` → `cd $(GENERATOR_DIR) && pnpm exec
redocly` (5 places)
- Replace `npm run` → `pnpm run` for consistency with project's package
manager (6 places)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated build configuration to execute documentation generation tasks
from a centralized generator directory with unified package management,
ensuring consistent handling of OpenAPI bundling, TypeScript
documentation, and validation workflows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add myself into `humans.txt`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated team information in public metadata.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Documentation / text fix (grammar)
## What is the current behavior?
Several places in the codebase use "a" before acronyms that start with
vowel sounds, which is grammatically incorrect:
- "enter a MFA code" (MFA is pronounced "em-eff-ay", starting with a
vowel sound)
- "a SMS with a OTP" (SMS = "ess-em-ess", OTP = "oh-tee-pee")
## What is the new behavior?
Corrected to use "an" before acronyms with vowel sounds:
- "enter an MFA code"
- "an SMS with an OTP"
## Files changed
- `apps/studio/data/profile/mfa-challenge-and-verify-mutation.ts` -
comment fix
- `apps/docs/content/guides/platform/multi-factor-authentication.mdx` -
user-facing docs
- `apps/docs/docs/ref/javascript/v1/upgrade-guide.mdx` - code comment in
example
- `apps/docs/docs/ref/dart/v0/upgrade-guide.mdx` - code comment in
example
## Additional context
The rule: use "an" before acronyms pronounced with an initial vowel
sound, regardless of the first letter. "MFA" starts with "em" (vowel
sound), "SMS" starts with "ess" (vowel sound), "OTP" starts with "oh"
(vowel sound).
## What kind of change does this PR introduce?
Documentation fix
## What is the current behavior?
1. In `apps/docs/content/troubleshooting/enabling-ipv4-addon.mdx`, the
heading reads "Will the project instance **will** be restarted?" with a
doubled "will"
2. In `apps/docs/content/guides/auth/auth-email-templates.mdx`, the `{{
.Email }}` description reads "Empty **when when** trying to link an
email address..." with a doubled "when"
## What is the new behavior?
1. Heading now reads "Will the project instance be restarted?"
2. Description now reads "Empty when trying to link an email address..."
## Additional context
Minor grammar fixes for documentation clarity.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added OpenTelemetry Protocol (OTLP) as a log drain destination with
configurable endpoint, protocol (HTTP/Protobuf), gzip compression, and
custom headers.
* OTLP appears as a selectable destination in the Log Drains UI with its
own icon and form fields.
* **Documentation**
* Added a full OTLP guide including HTTP/Protobuf details, Collector
example, and authentication examples.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
## Description
Adds a troubleshooting article for the `UNUSED_EXTERNAL_IMPORT` build
warnings
that Vite/Rollup/Nuxt users see when bundling apps that use
`@supabase/supabase-js`.
**File:**
`apps/docs/content/troubleshooting/unused-external-import-warning-vite-rollup.mdx`
## What the article covers
- What the warning looks like
- Why it's a false positive (re-exported external imports not recognised
as "used"
by Rollup's code-body check)
- `onwarn` suppression snippet for Vite/Rollup
- `onwarn` suppression snippet for Nuxt
## Related
- https://github.com/supabase/supabase-js/issues/2010
- https://github.com/supabase/supabase-js/pull/2122
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Adding me to humans.txt
## What is the current behavior?
Please link any relevant issues here.
## What is the new behavior?
Feel free to include screenshots if it includes visual changes.
## Additional context
Add any other context or screenshots.
fixing doc inconsistencies: privatelink is in beta not alpha, and read
replicas can be requested by contacting account rep.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs Update.
## What is the current behavior?
Inconsistent docs.
---------
Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
docs update
## What is the current behavior?
Superuser settings list is out of date
## What is the new behavior?
Update superuser settings with [new
configs](https://github.com/supabase/postgres/blob/21338c84583acc6f0d65fc99f014c83206aaa32d/ansible/files/postgresql_config/supautils.conf.j2#L13)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated PostgreSQL custom configuration guide with new superuser-level
settings options including deadlock timeout, parameter logging, network
connectivity, safe update enforcement, and function tracking
capabilities.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
This PR updates documentation based on recent changes across multiple
SDK repositories since the last run on 2026-01-22.
## Changes Analyzed
| SDK | Repository | Commits | Latest Tag |
|-----|-----------|---------|------------|
| **js** | supabase/supabase-js | 40 | v2.95.4-canary.2 |
| **dart** | supabase/supabase-flutter | 4 | - |
| **py** | supabase/supabase-py | 12 | v2.28.0 |
| **swift** | supabase/supabase-swift | 14 | v2.41.1 |
| **kt** | supabase-community/supabase-kt | 36 | 3.3.0 |
| **csharp** | supabase-community/supabase-csharp | 1 | v1.1.2 |
## Documentation Updates
### JavaScript SDK (`supabase_js_v2.yml`)
- Added optional `jwt` parameter documentation to
`mfa.getAuthenticatorAssuranceLevel()`
- Added `timeout` and `urlLengthLimit` options to `PostgrestClient`
constructor with example
### Kotlin SDK (`supabase_kt_v3.yml`)
- Added new `getClaims()` API section with description, parameters, and
3 examples
- Added `channel` parameter to OTP `signInWith` config for WhatsApp
support
- Added WhatsApp OTP sign-in example
### Python SDK (`supabase_py_v2.yml`)
- Added `from_.list_v2()` method documentation with cursor-based
pagination support
- Includes `SearchV2Options` parameter documentation and pagination
example
- Added note about new User model fields (`is_sso_user`, `deleted_at`,
`banned_until`) on `get_user`
### Swift SDK (`supabase_swift_v2.yml`)
- Added breaking change note for `mfa.unenroll()`: response now uses
`id` instead of `factorId` (since v2.41.1)
### Phone Login Guide (`phone-login.mdx`)
- Added Kotlin WhatsApp OTP example to the sign-in section
### SDKs with no documentation updates needed
- **Dart**: Only CI and realtime type-cast fix (no user-facing API
changes)
- **C#**: Only README badge fix
## Test plan
- [ ] Verify YAML spec files parse correctly
- [ ] Review rendered documentation for new sections
- [ ] Confirm code examples match actual SDK APIs
---
Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Add clarify around enabling SSO for an organization
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a new "Enabling SSO for an organization" subsection with
step-by-step setup, user invitation, and re-invitation instructions to
support SSO adoption.
* Added an admonition clarifying that SSO identities are not
automatically linked to existing non-SSO accounts, showing a concrete
example of potential duplicate accounts and advising which account to
use when accepting invites or logging in.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated troubleshooting resources with significantly expanded guides
covering authentication, database management, edge functions, storage
operations, deployment scenarios, and system configuration. Enhanced
documentation includes detailed remediation procedures, alternative
solutions for common issues, and comprehensive step-by-step instructions
to help users resolve configuration and operational challenges.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Replace the decorative gradient TanStack icon with official logos from
the [TanStack brand guide](https://tanstack.com/brand-guide)
- Add light/dark theme support (`tanstack-icon.svg` white for dark mode,
`tanstack-icon-light.svg` black for light mode)
- Add TanStack Start to the getting-started framework quickstarts grid
## Test plan
- [ ] Verify TanStack icon displays correctly on the [docs
homepage](https://docs-git-ivasilov-tanstack-svg-icons-supabase.vercel.app/docs)
in dark mode
- [ ] Verify TanStack icon displays correctly on the [docs
homepage](https://docs-git-ivasilov-tanstack-svg-icons-supabase.vercel.app/docs)
in light mode
- [ ] Verify TanStack Start appears in the Framework quickstarts grid at
`/guides/getting-started`
- [ ] Verify the quickstart link navigates to
`/guides/getting-started/quickstarts/tanstack`
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed TanStack Start framework icon appearance in light mode
* **Documentation**
* Added TanStack Start quickstart guide to the Getting Started page with
Supabase project setup and data querying instructions
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
### Summary
- The `move` operation requires `select` + `update` permissions (not
`select` + `insert` as previously documented). The implementation was
changed in
[supabase/storage#400](https://github.com/supabase/storage/pull/400) to
update the row in-place instead of deleting and reinserting, but the
docs were never updated to reflect this.
- The `copy` operation requires `select` + `insert` by default. When the
user also has `update` permission, the copy can be performed as an
upsert, overwriting the destination if it already exists.
- Added an `update` policy example alongside the existing `select` and
`insert` examples.
### Related
Fixes https://github.com/supabase/storage/issues/807
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Enhanced guidance for storage copy operations with clarified
permissions requirements on source and destination.
* Added upsert option details for users with update permissions.
* Clarified move operation requirements for select and update
permissions.
* Updated policy examples with explicit operation names and owner
authentication checks.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update to resolve ambiguity. Clarifies assigning pool size
percentage in proportion to Database Max Connections, as it could be
mistaken for a percentage of max client connections.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Documentation**
* Improved clarity in the database connection management guide regarding
pool size configuration thresholds.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Added my name (Jamie Boyd) to humans.txt
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated team or contributor listing.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the CONTRIBUTING.md file.
YES
## What kind of change does this PR introduce?
Dependency upgrade (next-mdx-remote v4 → v6)
## What is the current behavior?
The docs app uses next-mdx-remote v4.4.1 with MDX v2.
## What is the new behavior?
- Upgraded to next-mdx-remote v6.0.0 (uses MDX v3)
- Updated @mdx-js/loader and @mdx-js/react to v3
- Upgraded remark-gfm to v4 for MDX v3 compatibility
- Removed deprecated `useDynamicImport` option (now default)
- Added `blockJS: false` to preserve JS expressions in MDX content
Build compiles successfully. Testing shows the same pre-existing
prerender error on /guides/troubleshooting as on master (supabaseUrl is
required).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Upgraded MDX and markdown tooling to major releases (MDX v3,
next-mdx-remote v6, remark-gfm v4).
* Adjusted MDX serialization to disable embedded JS handling and remove
legacy dynamic-import behavior for more consistent rendering of docs,
guides, and code examples.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix
## What is the current behavior?
Missing database ID on troubleshooting guide causes its last-updated to
always show up as the present time
## What is the new behavior?
Connected to database entry so correct last-updated date
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated internal metadata for troubleshooting documentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Documentation update
## What is the current behavior?
`https://supabase.com/humans.txt` does not have Tanun's name
## What is the new behavior?
`https://supabase.com/humans.txt` will have Tanun's name
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated team member information in public team listing.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated Edge Functions CORS header guides with version-specific
approaches for SDK v2.95.0+ and earlier versions.
* Revised code examples across multiple Edge Functions to reflect
current CORS header implementation patterns.
* Enhanced troubleshooting documentation with updated preflight handling
guidance.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This PR updates the TanStack blocks to the latest versions of their
libs. There were some minor renames in the functions. Everything should
work the same.
How to test:
1. Install the block for password-based auth and social auth
2. Follow the instructions from
https://supabase.com/ui/docs/tanstack/password-based-auth
Also fixes
https://github.com/supabase/supabase/security/dependabot/2674.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated @tanstack/react-router and @tanstack/react-start to v1.150.0,
bringing latest improvements and stability enhancements.
* Refactored internal server-side utilities to align with updated
library APIs, improving code maintainability without affecting user
experience.
* Added development dependency for build tooling support.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This PR
- reverts changes made in
https://github.com/supabase/supabase/pull/42568 and
https://github.com/supabase/supabase/pull/42570 because they had some
unneeded changes (`@types/node` bumped to v25+, for example)
- bumps only the vulnerable dependency (which is in `cms` app and it's
not currently used).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Adjusted CMS dependencies to earlier versions
* Optimized documentation API code organization and type handling
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Update lock file changes
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Reorganized internal imports and improved type compatibility handling
for the AI documentation API to ensure robust operation across different
OpenAI client versions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Jonathan Summers-Muir