mirror of
https://github.com/supabase/supabase.git
synced 2026-10-10 03:45:06 +03:00
feat/github-copilot-plugin
36403
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Pedro RodriguesandClaude Sonnet 4.6
|
34560802ff |
feat: serve agent skills index.json from .well-known at build time
Fetches the latest index.json from supabase/agent-skills release assets and writes it to public/.well-known/agent-skills/index.json at build time. Skill URLs are absolute GitHub Release asset URLs embedded by the agent-skills repo at release time — no URL rewriting needed here. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
Prashant Sridharan
|
a96396d1e9 |
Added the datadog webinar recording (#46211)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Adds the YouTube recording of the datadog webinar to the landing page <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * A webinar previously scheduled as a live event is now available as an on-demand recording * Embedded video player has been added for immediate viewing of the recorded session * Event page content and key takeaways have been updated to reflect the recording format * Call-to-action button now directs users to access the recording directly instead of registering <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46211?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Etienne Stalmans
|
1097fcaa2f |
fix: vercelUrl must always be https (#46193)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Bug fix ## What is the current behavior? Only checks the for a valid URL that has hostname of vercel.com. ## What is the new behavior? Ensures the URL protocol is HTTPS ## Additional context Vercel will never load over any other protocol than HTTPS |
||
|
Taryn King
|
16f4dae3d2 |
docs: remove language on postgres version release cadence (#46182)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update ## What is the current behavior? Current docs mentions Postgres releases approximately every week. ## What is the new behavior? Removes language on Postgres version release cadence and direct users to migrate if the potential wait for next release is a concern when needing to right size disk. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated database size reduction guidance with a new alternative approach: migrating to a new project while awaiting PostgreSQL releases. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46182?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Taryn King
|
6ae7d9ebac |
docs: add note to direct to correct doc for self-hosted configuration (#46122)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update ## What is the current behavior? Received feedback that guide for customizing email templates for local development was not helpful. Referenced variable that caused friction is a variable related to self-hosted configuration. ## What is the new behavior? Admonition added to direct users to correct guide for self-hosted configuration. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added a note in the local development guide directing users to self-hosting documentation for information about custom email templates. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46122?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
supabase-supabase-autofixer[bot]andgithub-docs-bot
|
f13cc98b4f |
[bot] Sync from supabase/troubleshooting (#46125)
This PR syncs the latest troubleshooting guides from the supabase/troubleshooting repository. Co-authored-by: github-docs-bot <github-docs-bot@supabase.com> |
||
|
supabase-supabase-autofixer[bot]andsupabase-releaser[bot]
|
4972359033 |
docs: update js sdk docs (2.106.1) (#46155)
Updates JS sdk documentation following stable release.
Ran `make` in apps/docs/spec to regenerate tsdoc files.
**Details:**
- **Version:** `2.106.1`
- **Source:** `supabase-js-stable-release`
- **Changes:** Regenerated tsdoc files from latest spec files
🤖 Auto-generated from @supabase/supabase-js stable release.
Co-authored-by: supabase-releaser[bot] <223506987+supabase-releaser[bot]@users.noreply.github.com>
|
||
|
Joshen Lim
|
d11bd4997e |
Revert "Support form Assistant" (#46194)
Reverts supabase/supabase#45861 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **New Features** * Support form now returns to home view upon completion within the help panel. * Success screen conditionally displays community (Discord) section for specific issue categories. * **Bug Fixes** * Improved project selection logic in support form initialization. * **Style** * Updated support form label text for clarity. * Redesigned success screen layout with updated styling and separators. * **Removed Features** * Removed support assistant follow-up card from success screen. * Removed support request message parsing from AI responses. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46194?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Chase Cresgy
|
61ed5f9172 |
Update humans.txt (#46192)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Update to reflect offboardings ## What is the current behavior? NA ## What is the new behavior? NA ## Additional context NA <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated public team documentation. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46192?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Saxon FletcherandGildas Garcia
|
af7d953f52 |
Support form Assistant (#45861)
When a support from is submitted, we believe there is an opportunity to help people before a human receives and responds. Human support is still involved regardless of whether Assistant helps or not, so this is to positioned as a "while you wait" type experience. ## To test: - Enable to `supportAssistantFollowUp` feature flag - Open a project - Open the support form and submit a request - Note the success state and the additional Assistant card - Note text generation in card - Clicking card should open the Assistant conversation <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * AI assistant follow-up card appears after submitting a support ticket to continue the conversation * Support request preview rendered in the assistant panel showing subject/message when present * **Bug Fixes** * Improved project selection fallback during support form initialization * **Improvements** * Refined success layout and messaging; finish action behavior simplified [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45861) <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com> |
||
|
Saxon Fletcher
|
f0afc5948b |
page layout patterns (#46126)
Adjusts layout / page patterns including design system documentation and page components. <img width="937" height="643" alt="image" src="https://github.com/user-attachments/assets/5f7864a3-04ae-4ccf-b2b8-d9fe5e29554e" /> **To test** - Ensure all existing page types in Studio are un-effected. They shouldn't be since existing components aren't touched. - Run design-system and have a read through layout and page header documentation. Make sure you understand when and where to use the various combinations of page components and their variants. **Next** Once we are happy with these patterns we can gradually start to update Studio pages that make use of breadcrumbs and/or sub navigation. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added PageBreadcrumbs and PageNav page chrome * Several new interactive layout examples (Auth Emails, Edge Functions, Full‑Width, Logs) and demo pages * **Documentation** * New docs for PageBreadcrumbs and PageNav * Reworked layout guidance and patterns; updated fragment/example docs and usage notes * **Improvements** * Component preview now supports explicit padding control * Simplified page header demo and updated previews <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46126?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
chappie
|
44462c49cf |
Update humans.txt to include Chris Chapman (#46102)
Updating and adding Chris Chapman to humans.txt ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? docs update: Adding to humans.txt ## What is the current behavior? n/a ## What is the new behavior? n/a ## Additional context n/a |
||
|
Charis
|
600a0ffcec |
docs(claude): add safe-sql-execution skill (#46171)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs (new Claude Code skill). ## What is the current behavior? There is no shared, written-down reference for the SQL safety model in Studio. The rules around `SafeSqlFragment`/`UntrustedSqlFragment`, sanitization utilities, and how to promote snippet content live only in code and contributor knowledge, which makes it easy for AI-assisted changes to bypass the type-based guarantees. ## What is the new behavior? Adds a `safe-sql-execution` skill under `.claude/skills/` that documents the proven-authorship security model: the three classes of SQL fragments, provenance tracking with branded types, sanitization utilities (`ident`/`literal`/`keyword`), the `acceptUntrustedSql` rule (event handlers only), and the special case that snippet content (`unchecked_sql`) must never be considered safe. Includes good/bad examples for the common patterns. ## Additional context <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added a comprehensive guide on secure SQL execution in Supabase Studio: explains provenance-based SQL safety, distinct categories of SQL fragments, how unsafe snippets must be explicitly promoted before execution, available sanitization helpers for user input, strict execution constraints to prevent accidental runs, and numerous examples demonstrating safe vs. unsafe usage and safe preview/runner patterns. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46171?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
0283d92505 |
fix: allow users to remove missing schemas from the data API (#46169)
## Problem Exposed schemas (from the Data API) that have been deleted manually (for instance, using the SQL editor) are still present in the Data API setting, crashing Postgrest clients. However, the Data API setting does not show them anymore preventing users from fixing the issue. ## Solution - Detect missing schemas and show users an error message - Make missing schema visually distinct - Allow users to unselect them and update the Data API settings ## How to test - Create a new schema - Verify that it is exposed (expose it if necessary) in the Data API settings - Delete the schema using the SQL editor - Verify that you can unselect it from the Data API settings ## Screenshots <img width="470" height="243" alt="image" src="https://github.com/user-attachments/assets/2a1f7dc5-c9a9-4779-9f26-1d3e0f66fb8f" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Dropdown for exposed API schemas now shows selected schemas that no longer exist and labels them "This schema does not exist", allowing users to toggle them. * "Exposed schemas" field now shows an inline validation/error message when selected schemas are unavailable to help resolve configuration issues. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46169?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
c8e1eb1836 |
Support click drag to highlight time range in timeline chart unified logs (#46149)
## Context As per PR title - supports click drag to highlight a specific time range in the TimelineChart of unified logs as such: Also adjusts the chart highlight behaviour which affects the database report charts to clear the highlighted area when clicking outside of it <img width="445" height="171" alt="image" src="https://github.com/user-attachments/assets/2a510fe1-2f86-4961-8f38-9dd5efcc80ec" /> ### Demo https://github.com/user-attachments/assets/5084fc04-49a7-4b41-94be-b4edb1bef3ce <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Escape key support to dismiss chart highlights * **Improvements** * Clear chart selections when clicking outside the menu while preserving chart interactions * Time-range filters now apply to the intended column for more accurate zooms * Tooltip and highlight rendering refined; reference highlight styling adapts to dark mode * Unified chart highlight interactions for more consistent selection and zoom behavior <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46149?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
69b22d37cd |
fix(studio): parse auth log event_message JSON for human-readable display DEBUG-111 (#46147)
## Problem
Auth log entries store metadata as a stringified JSON object in the
`event_message` field (e.g. `{"msg":"user signed
in","level":"info","status":200,"path":"/auth/v1/token"}`). The
dashboard was rendering this raw JSON string in the event message column
instead of a human-readable message.
## Fix
Added `parseAuthLogEventMessage` utility to `UnifiedLogs.utils.ts` that
JSON-parses the `event_message` value and extracts the `msg` field,
falling back to the `error` field, then the original raw string. The raw
string fallback ensures self-hosted versions with different log formats
continue to render without breaking between releases.
Applied in two places:
- `UnifiedLogs/components/Columns.tsx`: event_message column for
`log_type === 'auth'` rows
- `Settings/Logs/LogColumnRenderers/AuthColumnRenderer.tsx`:
event_message fallback when `metadata.msg` is absent
## How to test
1. Open the Supabase dashboard and navigate to Logs > Auth Logs
2. Verify that log entries show a plain message (e.g. "login attempt",
"invalid password") in the event message column instead of a raw JSON
string
3. Navigate to the unified logs view and filter to auth logs only
4. Verify the event message column shows the same human-readable
messages
5. Confirm that non-auth log types (edge, postgres, etc.) are unaffected
6. Expected result: auth log entries show readable messages; all other
log sources are unchanged
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Auth log messages now display in a more readable, human-friendly
format by intelligently parsing message data.
* **Refactor**
* Removed tooltip functionality from the pathname column in logs view
for streamlined display.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46147?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
|
||
|
Pedro RodriguesandClaude Sonnet 4.6
|
3c5a5a45ca |
chore(docs): add GitHub Copilot CLI to MCP client list (#46150)
## Summary - Adds GitHub Copilot CLI as a new MCP client option in the AI Agent CLI group (positioned after Gemini CLI) - Includes light and dark mode SVG icons sourced from official GitHub Copilot brand assets - Setup instructions follow the `copilot mcp add --transport http supabase "<url>"` command, with authentication via `copilot -i /mcp` - Adds `CopilotMcpConfig` type and wires up the icon asset mapping Closes [AI-768](https://linear.app/supabase/issue/AI-768/add-github-copilot-mcp-setup-instructions-to-docs) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for GitHub Copilot CLI MCP configuration, including setup and authentication instructions. * Updated AI Agent CLI client group to include Copilot CLI. * Added theme-aware iconography for Copilot CLI integration. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46150?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
Gildas Garcia
|
243e079a2c |
chore: remove _Shadcn_ suffix from Command components (#46153)
## Problem The `_Shadcn_` suffix isn't needed anymore on `Command` components ## Solution - Remove the `_Shadcn_` suffix - Simplify UI package exports - Apply prettier <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Simplified command component imports and exports across the UI library by removing internal naming aliases and adopting direct component references. Updated the public UI package barrel export to use wildcard re-exports for cleaner API surface. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46153?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
e8af602d2d |
Joshen/debug 110 default unified logs search to event message (#46134)
## Context Adjusts the filter bar component to accept a `freeformDefaultProperty`, in which entering any text in the filter bar will opt to search against that property by default. (Property must be defined within the `filterProperties` prop too) Applies to unified logs, which for e.g "Event message" is a valid filter: <img width="428" height="250" alt="image" src="https://github.com/user-attachments/assets/a08c015c-c9aa-4985-9e15-6429f455ccf0" /> I've set `freeformDefaultProperty` to be `event_message`, and hence typing free text will opt the default action to just filtering against that property <img width="437" height="135" alt="image" src="https://github.com/user-attachments/assets/ccf6944a-1c5d-4944-acfa-ac82dc20bb10" /> ### Demo: https://github.com/user-attachments/assets/287ee22d-f957-48e5-89b0-1fed159cd86a ### Other changes - Opt to deprecate `truncateText` util from unified logs -> preference for tailwind instead - Event message is added as a filter field, but hidden in the side nav (wouldn't make sense since the content is very dynamic, unlike something similar like pathname) - Fixes some console errors in unified logs because we were using `.getColumn` in `DataTableSheetRowAction` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added an "Event message" filter (hidden by default) and set it as the default target for freeform searches. * **UI Improvements** * Filter sidebar resize constraints tightened. * Timeline chart spacing and x-axis tick behavior improved. * Action labels and command list items no longer truncate long input values. * **Bug Fixes** * More reliable resolution of target columns for row actions, improving available filter options. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46134?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kemal.earthandJoshen Lim
|
7e717fb7bc |
fix(studio): selected status bg colour unified logs (#46152)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Small visual gremlin where the status dot was blending in with the selected state background colour. See image below. Appreciate there's probably another PR to go in with the row select before this goes in. | Before | After | |--------|--------| | <img width="97" height="84" alt="Screenshot 2026-05-20 at 09 34 10" src="https://github.com/user-attachments/assets/7f21d415-e551-4686-a7e8-a6c7260ecab3" /> | <img width="173" height="67" alt="Screenshot 2026-05-20 at 12 51 14" src="https://github.com/user-attachments/assets/439b4c73-bd82-4bca-9d93-69c833da60bc" /> | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Updated visual styling for successful rows in data tables to use the selected-row variant, improving highlight consistency for selected/successful rows. * **Refactor** * Standardized row class composition so each table row reliably includes the base row grouping class alongside any custom row classes from table metadata, reducing UI regressions and improving consistency. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46152?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Joshen Lim
|
84484be46d |
Support multi select logs and add CTA (#45974)
## Context Supports selecting log rows and allow to copy / ask assistant for selected rows, similar to what we had for the old logs UI Selection will clear whenever the search parameters change <img width="1448" height="413" alt="image" src="https://github.com/user-attachments/assets/b81b359c-28c3-48a8-9895-e77327ebd33e" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Multi-row selection with an action header showing selected count * Copy selected logs as JSON or Markdown from a dropdown * "Explain with AI" action to open the assistant pre-filled with selected logs * Clear selection button * **Refactor** * Row/detail selection now syncs with the URL for shareable views and improves next/previous navigation and panel behavior * **Style** * Minor visual tweak to column level indicator dot size <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45974) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joey Freeland
|
394ccf4e27 |
fix(studio): correct gp3 IOPS validation for small disks (#45957)
- Fix gp3 max-IOPS calculation: was `3000 × size`, is slightly more complicated. The old multiplier let Studio accept IOPS values that the platform API would reject. - Block IOPS/throughput edits when the disk is smaller than the minimum required for custom IOPS (6 GB for gp3). Previously, a throughput-only change on a 2 GB disk would still ship `provisionedIOPS: 3000` in the payload and get rejected with: `Invalid IOPS value for gp3 volume 3000. Minimum is 3000. Max is 500 IOPS per GB or 16,000, whichever is lower.` - Show a NoticeBar prompting users to grow the disk first, with a one-click button to bump it to the minimum (mirrors the existing "Change to LARGE Compute" pattern). - Surface the helpful "Larger Disk size required" message for all disk sizes instead of a cryptic "Invalid IOPS value due to invalid disk size" fallback for disks < 8 GB. |
||
|
Gildas Garcia
|
224dbb09bb |
chore: rename CommandMenu internal components to avoid conflicts with base shadcn ones (#45996)
## Problem The `ui-patterns/CommandMenu` exposes internal components that have the same names as the base shadcn components they wrap. This create confusion about which one to use and forces us to expose the base ones with the `_Shadcn_` suffix. ## Solution Rename those internal components to have `CommandMenu` in their names to make it clearer they are meant to be used with `CommandMenu`. We will then rename the shadcn base ones to remove the suffix. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Refactor * Standardized Command Menu component naming across the design system for improved consistency and clarity. Updated component names: `CommandInput` → `CommandMenuInput`, `CommandList` → `CommandMenuList`, `CommandItem` → `CommandMenuItem`, `CommandEmpty` → `CommandMenuEmpty`, and `CommandGroup` → `CommandMenuGroup`. Updated public API exports, internal subpath references, all examples within the registry, and implementations across documentation, studio, and application interfaces. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45996) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
afade92b44 |
Set default size for filter side bar unified logs (#46132)
## Context Width of filter side bar of unified logs was getting defaulted to the max value because the default value isn't set <img width="1449" height="646" alt="image" src="https://github.com/user-attachments/assets/15e336b5-ca0b-43f9-93eb-4c5c52694f4e" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Improved the filter sidebar's default width initialization to ensure consistent visual appearance upon loading. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46132?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Mert YEREKAPAN
|
1ef80fec23 |
chore(studio): remove HeaderUpgradeButton experiment code (#46144)
## Summary - Removes the `HeaderUpgradeButton` component, all call sites, and the `HeaderUpgradeCtaClickedEvent` telemetry type. The GROWTH-615 header upgrade CTA experiment ended on Apr 29. - Fixes the `Flag key "headerUpgradeCta" does not exist in PostHog flag store` console errors that were logging on every render. PostHog drops disabled flags from `/feature-flags` responses, so the still-mounted consumer logged a missing-flag warning continuously. Removing the consumer lets the flag be safely disabled again. Context: [Slack thread](https://supabase.slack.com/archives/C07P3AU3J2D/p1779250648219089?thread_ts=1779166940.445709&cid=C07P3AU3J2D) ## Test plan - [x] `pnpm dev:studio`, open the dashboard, confirm no `headerUpgradeCta` warning in the browser console - [x] Desktop header still renders correctly (the button was hidden behind the `test` variant; visually nothing changes for users since rollout was 100/0 control) - [x] Mobile nav bar still renders with `UserDropdown` to the right of the org/project selector <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Removed the upgrade call-to-action button from the navigation header in both desktop and mobile layouts. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46144?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
df77fc9011 |
fix(cli): resolve infinite loader on device code screen (#46137)
## Summary Follow-up fix for [#46120](https://github.com/supabase/supabase/pull/46120). PR #46120 correctly guarded against duplicate `POST /platform/cli/login` calls using a `useRef`, but left `navigate` in the `useEffect` deps array. Because the parent passes an inline lambda, `navigate` gets a new reference on every render. This causes React to: 1. Run the effect cleanup mid-flight (setting `isActive = false`) 2. Re-run the effect, which hits the session-id ref guard and returns early When step 1 happens while the POST is in-flight, the response arrives with `isActive === false`, silently drops the `navigate(...)` call, and leaves status stuck at `{ _tag: 'loading' }` — the infinite spinner reported in Slack. ## Fix Store `navigate` in a ref (updated each render) and call `navigateRef.current(...)` inside `createSession`. Remove `navigate` from the deps array so parent re-renders never trigger a cleanup while the POST is in-flight. ```ts const navigateRef = useRef(navigate) navigateRef.current = navigate // always up to date, never a dep ``` All 7 existing CLI login unit tests pass, including the "POSTs exactly once even when parent re-renders" regression test. ## Test plan - [ ] Run `pnpm test:studio tests/pages/cli-login.test.tsx` — all 7 tests pass - [ ] Browser: `supabase login` flow completes and shows the verification code screen without hanging on the loader - [ ] DevTools Network: exactly one `POST /platform/cli/login` fires per login attempt 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved CLI login navigation reliability when parent components update during session creation. * **Style** * Adjusted loading indicator styling on the CLI login screen. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46137?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com> |
||
|
Gildas Garcia
|
0c46c33861 |
chore: improve field reference everywhere in logs explorer (#46143)
## Problem #45828 only fixed some screens. ## Solution Fix all of them by fixing the `LogsExplorerHeader` ## Screenshots Before: <img width="659" height="811" alt="image" src="https://github.com/user-attachments/assets/e1efffca-9fb2-4be6-af97-2da658dce2d5" /> After: <img width="655" height="806" alt="image" src="https://github.com/user-attachments/assets/173a4d15-0efb-407d-9abf-a1edefe03351" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Schema selection now features a searchable dropdown interface, replacing the previous tabbed layout for improved ease of navigation and discovery. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46143?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Francesco Sansalvadore
|
1e06fb80e4 |
chore: marketplace featured integrations layout (#46141)
Renders number of columns based on number of featured integrations. ## Before <img width="1008" height="379" alt="Screenshot 2026-05-20 at 11 40 02" src="https://github.com/user-attachments/assets/168bb0a3-2656-4cb1-8cbd-9970cd78426e" /> ## After <img width="1011" height="325" alt="Screenshot 2026-05-20 at 11 40 27" src="https://github.com/user-attachments/assets/e05002ca-2d5e-40fd-ada9-a9b04564d911" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Improved responsive layout for the marketplace featured section with optimized display of integration logos on mobile devices. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46141?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Andrey A.
|
82a3f2cb24 | chore(self-hosted): add a reference docs for configurable env vars (#46124) | ||
|
|
dc986674d9 |
chore(studio): integrations Marketplace layout (#45856)
Introducing a new Integrations Marketplace layout - behind feature flag - behind opt-out feature preview (default to true) to easily toggle before and after Doesn't introduce new functionality, only layout change behind ff. ## What changed Nothing if `marketplaceIntegrations` flag is off. ### With flag - New Marketplace index layout - filter via text or by `category`, `integration type` and `source` - Featured Partners Integrations hero (hidden when any filter is active) - toggle between `grid` and `list` view - new integration detail page layout - with top action bar - more consistent fullWidth or narrow content layouts - can access Feature Preview toggle under Account Dropdown > Feature Previews > Marketplace ## How to review and what to test I recommend reviewing file changes from bottom to top in https://github.com/supabase/supabase/pull/45856/changes because it makes more sense from a pr-logic perspective. - [ ] Visit https://studio-staging-git-chore-integrations-ui-refine-fs-supabase.vercel.app/dashboard/project/_/integrations - [ ] Check if new layout doesn't have big layout issues like weird paddings or margins mostly. (We can iterate in upcoming PRs for additional features/fixes) - [ ] Toggle "Marketplace" feature preview to `FALSE` and check that the Integrations layout looks like in prod https://supabase.com/dashboard/project/_/integrations - [ ] Also check individual integration pages and toggle the feature preview on and off to see before and after and check if everything looks good <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Full Marketplace experience: explorer with featured hero, filters/search, list & grid views, cards, sidebar, detailed integration pages, install flows, badges, and a preview toggle. * **Bug Fixes** * Prevented stale markdown from showing when switching integrations. * **Style** * Improved responsive layouts, loading placeholders, and header/nav full-width behavior. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45856) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Saxon Fletcher <saxonafletcher@gmail.com> Co-authored-by: Raminder Singh <romi_ssk@yahoo.co.in> |
||
|
Jordi EnricandClaude Sonnet 4.6
|
df61856936 |
feat(feature-preview): remove hardcoded plan check for unified logs (#46114)
Removes `useIsEnterpriseOrSupabaseOrg` and replaces it with the `unifiedLogs` ConfigCat flag. ConfigCat now handles tier targeting directly, so the hardcoded enterprise/internal org check is redundant. Also eliminates three queries (project detail, org, subscription) that were firing on every page load just to gate the feature preview. --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
Andrew Valleteau
|
da3b0cb3ec |
fix(cli): login creating duplicate tokens on re-renders (#46120)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Bug fix ## What is the current behavior? The CLI login page was firing `POST /platform/cli/login` multiple times per page load due to an unstable `navigate` reference in the parent component re-triggering the effect. This caused several duplicate personal access tokens to be created for each browser sign-in attempt (regression CLI-1491). Additionally, error messages from non-Error rejection shapes (like those from openapi-fetch) were being replaced with a generic "Unknown error" message instead of surfacing the actual platform error. ## What is the new behavior? 1. **Prevents duplicate API calls**: Added a `useRef` guard (`startedForSessionIdRef`) to ensure `createCliLoginSession` is only called once per `sessionId`, even if the parent component re-renders with a new `navigate` reference. 2. **Improved error handling**: Created a `getErrorMessage()` utility that properly extracts error messages from both Error instances and plain objects (e.g., `{ message: string, statusCode: number }`), allowing platform error messages to surface instead of generic fallbacks. 3. **Added comprehensive test coverage**: - E2E test verifying the POST fires exactly once per page load with realistic network latency - E2E test confirming platform error messages are displayed correctly - Unit test for non-Error rejection shapes - Unit test verifying the effect doesn't re-trigger on parent re-renders ## Additional context The fix addresses the root cause by: - Using a ref to track which `sessionId` has already been processed, preventing re-execution when deps change - Extracting error message handling into a reusable utility that handles both Error instances and plain objects - Adding tests that specifically check for the regression (multiple POST calls and error message display) The E2E test includes a 400ms delay in the mock response to simulate real-world conditions where the original bug only surfaced after React committed multiple re-renders. Closes: CLI-1491 https://claude.ai/code/session_01GAujw33MTRBRYSnS8cxcEa <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved CLI login error handling to display platform-specific error messages instead of generic fallback text. * Fixed duplicate login session creation during component rerenders. * **Tests** * Added test coverage for error message display in CLI login. * Added regression tests for single session creation and platform error scenarios. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46120?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Julian Domke
|
c414146572 | fix(upcomingInvoice): do not manually subtract credits (#46116) | ||
|
Ali WaseemandJoshen Lim
|
a1c7e57df3 |
studio: clarify storage bucket upgrade message for Pro users on Nano compute (#46008)
## Summary Vector and analytics bucket access is gated by both the org's plan tier and the project's compute size, but the storage config API only returns a single `enabled: false` flag. The empty state always told users to "Upgrade to Pro" — including users who were already on Pro with Nano compute, leaving them no obvious path forward. `BucketsUpgradePlan` now reads the org plan and the project's `infra_compute_size`. When the user is on a paid plan but still on Nano compute, the message becomes "Upgrade your project's compute size to Micro or larger…" and the button is wired through `UpgradePlanButton`'s existing `addon='computeSize'` route to `/settings/compute-and-disk`. Free plan users keep the existing copy and upgrade flow. Closes FE-3383. ## Test plan - [ ] Free org, Nano compute, navigate to `/storage/vectors`: still shows "Upgrade to Pro" with the billing link - [ ] Pro org, Nano compute, navigate to `/storage/vectors`: shows the compute-size message and the button navigates to compute-and-disk settings - [ ] Pro org, Micro+ compute: page renders the actual Vector buckets UI (unchanged) - [ ] Same flows on `/storage/analytics` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a regional limitation notice for Vector Buckets with an informational "Coming soon" empty state and tooltip listing available regions. * **Bug Fixes** * Storage bucket upgrade prompts now show context-aware messaging based on organization plan and project settings, guiding users to the correct upgrade path. * **Refactor** * Region-gating UI logic consolidated into a shared component for clearer messaging and maintenance. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46008?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Alaister YoungandAlaister Young
|
b28323be98 |
fix(studio): prevent infinite render loop in new-project form (#46131)
Fixes a "Maximum update depth exceeded" infinite render loop on `/new/[slug]` introduced by #46085. The symptom showed up on the internal-only configuration dropdown, but the entire form was looping. ## Root cause The new `useEffect` that syncs `dataApiDefaultPrivileges` to the experiment-driven default had `form.formState` in its deps. `form.formState` is a react-hook-form Proxy that returns a new reference on every render, so the effect refired after every render → `setValue` → render → effect → loop. ## Fix Pull the dirty check out of the effect into a stable boolean computed during render, and drop `form.formState` from the deps. Semantics unchanged — still syncs on flag resolve, still skips when the user has touched the field. ## To test - Hard-reload `/new/[slug]` and confirm there's no "Maximum update depth exceeded" error in the console - Open the configuration dropdown (internal-only) and confirm it interacts normally - With the `data-api-revoke-on-create-default` flag off, confirm `dataApiDefaultPrivileges` defaults to `true`; with it on, defaults to `false` - Manually toggle the dataApiDefaultPrivileges field, then confirm the effect no longer overwrites your choice when the flag resolves <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed data API default privileges synchronization to prevent unnecessary updates and improve application stability during configuration changes. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46131?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Vaibhav
|
d0edaefc1a |
fix: edgefn shotcuts (#46057)
## TL;DR fixes few edge cases in edgefn shrortcuts ## ref: - closes https://github.com/supabase/supabase/issues/46056 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Edge function shortcuts now enforce permission requirements. Shortcuts for viewing function details are only available to users with read access, and shortcuts for creating new functions require create permissions. * Creating new edge functions is now restricted to active projects. Users must have the appropriate permissions and an active project to use the creation shortcut. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46057?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Saxon Fletcher
|
80da153450 |
Fix for AI Assistant query and deploy confirmation (#46052)
When Assistant requests confirmation to run a query or deploy an edge function if the user doesn't skip or run and instead sends a follow-up message it errors out. This allows follow-up messages and treats them as "skips" which means adjusting confirmation message state as part of the follow-up. This also uses toModelOutput to cleanse data based on permissions. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **New Features** * Enhanced tool approval workflow: pending approvals are now automatically resolved as denied when submitting new messages * Improved chat input state management with better handling of approval states * Customizable loading messages for tool operations * **Bug Fixes** * Fixed chat input availability during pending tool approval states * Improved tool execution feedback during approval workflows <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46052?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
cc0b2d3d21 |
chore(studio): remove require-safe-sql-fragment ESLint rule (#46079)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Refactor / chore. ## What is the current behavior? A custom type-aware ESLint rule (`studio/require-safe-sql-fragment`) enforces that the `sql` argument to `executeSql` is a `SafeSqlFragment`. It runs in a separate `eslint.type-checks.config.cjs` and a dedicated CI ratchet step, and pulls in `@typescript-eslint/utils` as a direct dev dependency. ## What is the new behavior? `SafeSqlFragment` enforcement is now handled entirely by TypeScript compilation. The ESLint rule, its dedicated config, the ratchet baselines for it, the CI step, and the `@typescript-eslint/utils` direct dev dependency have all been removed. ## Additional context <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Simplified development linting workflow by removing type-aware ESLint checks and associated rule files. * Cleaned up ESLint configuration and dependencies in the studio application. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46079?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
1e113a8a01 |
fix(studio): preserve unsaved columns in table editor across refetches (#46073)
## Summary - Fixes FE-3386: columns added via the Table Editor side panel vanished when components auto-refreshed. - Root cause: a `useEffect` re-initialized `tableFields` from server data on every `table` / `foreignKeyMeta` refetch, clobbering unsaved local edits. - Fix (initial): `hasInitializedRef` gates the late-init path so it runs at most once per panel session (to incorporate late-arriving `foreignKeyMeta`) and resets on panel close. - Fix (follow-up): handle the race where the user starts editing *before* `foreignKeyMeta` resolves. Added `hasUserEditsRef` (flipped on user edits, reset on panel close) and a `mergeForeignKeyMeta` utility. Both late-init paths now merge FK metadata into existing `tableFields` instead of wholesale-replacing when the user has unsaved edits — `foreignKey` is only injected onto matching server-originated columns, so user-added columns and other in-progress edits survive. Linear: FE-3386 ## Test plan - [ ] Open the Table Editor on an existing table. - [ ] Add one or more new columns via the side panel. - [ ] Watch the foreign key section flash / resolve its loading state. - [ ] Confirm the newly-added columns are NOT removed when the FK section resolves. |
||
|
Charis
|
3aec96f9c6 |
fix(studio): use measured node heights for instance diagram layout (#46075)
## Summary The homepage instance diagram looks visually off when a project has read replicas — see [FE-3390](https://linear.app/supabase/issue/FE-3390/adjust-homepage-diagram-spacing-for-read-replicas). Root cause: the dagre layout in `InstanceConfiguration.utils.ts` was passing a fake `height: 25` (and a `-70` hack for the load balancer) for every node, regardless of how tall the rendered node actually is. When the Primary card grew taller after #45274 added the compute-metrics row, the gap between the Primary node and the Read Replica node became visually tight while the gap between the Load Balancer and Primary stayed loose — the diagram looked lopsided. ## Fix - Pass the **real measured height** of each node to dagre, sourced from React Flow's internal measurement (`node.measured.height`). - Run the layout in two passes: 1. First pass uses small per-type fallback heights so React Flow has something to render and measure against. 2. Once `useNodesInitialized()` flips true, re-run dagre with the measured heights and fitView. - Keep the diagram at `opacity-0` until the measured pass completes, so the fallback positions are never visible to the user. Subsequent data refetches don't re-hide the diagram — once measured, it stays visible. - Drop `NODE_ROW_HEIGHT` and the load-balancer `-70` hack. Replaced with a small `NODE_HEIGHT_FALLBACKS` table used only on first paint. - `ranksep` reduced from 160 → 60 since dagre now knows real heights. Closes FE-3390. ## Test plan - [x] Open the project homepage for a project with no read replicas — diagram renders centered, single Primary node. - [x] Open the project homepage for a project **with** a read replica — Load Balancer → Primary → Replica spacing is visually balanced; no flash of fallback positions on initial render; the diagram fades in once. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * More accurate infrastructure diagram layout with better node sizing and spacing for initial and measured renders. * Introduced fallback heights so diagrams render correctly on first paint before measurements are available. * Region containers now use a consistent fixed height for stable layout. * Smoother, visually consistent diagram initialization with improved opacity transition during layout setup. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46075?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
64143a5d90 |
fix(pg-meta): tighten pg-format keyword() against control-phrase injection (#46076)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Bug fix (sanitization hardening). ## What is the current behavior? `pg-format`'s `keyword()` helper validates with `/^[A-Za-z][A-Za-z0-9_ ]*$/`, which allows any space-separated word sequence. Phrases like `'DROP TABLE'` or `'DELETE FROM users'` pass validation and can be interpolated into queries. ## What is the new behavior? `keyword()` accepts either a single word matching `[A-Za-z][A-Za-z0-9_]*` (no spaces) or a phrase from a small case-insensitive allow-list (`'INSTEAD OF'`, `'BY DEFAULT'`) — which covers every multi-word value real callers actually produce (trigger activation, identity generation). Arbitrary multi-word phrases now throw. Tests updated accordingly. ## Additional context <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Reinforced SQL keyword validation with stricter security controls to prevent unsafe keyword usage. The system now only permits single-word identifiers or specific pre-approved multi-word keyword phrases. Previously accepted multi-word inputs that don't match the curated allowlist are now properly rejected with improved error messaging. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46076?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Sean Oliver
|
fdceb29260 |
fix(telemetry): exposure event captures dataApiDefaultPrivileges + drop race-fix hook (#46085)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Bug fix. ## What is the current behavior? This PR addresses three issues with the implementation of the `dataApiRevokeOnCreateDefault` experiment ([GROWTH-858](https://linear.app/supabase/issue/GROWTH-858)) on the frontend side: 1. The `project_creation_default_privileges_exposed` event payload captures `dataApiEnabled`, which is the parent "Enable Data API" toggle. That value defaults to `true` for everyone in both arms, which doesn't help understand how people are interacting with the form. 2. The hook itself was gating on PostHog JS SDK values rather than our backend server values being sent from `/telemetry/feature-flags`. 3. The form on `/new/[slug]` captures `dataApiDefaultPrivileges` defaults once at mount via react-hook-form's `defaultValues`. If the flag is still loading when the page mounts, `useDataApiRevokeOnCreateDefaultEnabled()` returns `false` (coerced from undefined), and the form locks the field to the legacy default of `true`. The flag later resolving has no effect, and treatment users get the legacy default visually and in the exposure event. ## What is the new behavior? 1. Main-surface payload now sends `dataApiDefaultPrivileges` — the form field the experiment actually controls (`true` = legacy grants kept, `false` = revoked on create). Post-fix data will let us read out whether treatment users actually got the new default. 2. Hook is simplified: drop `orgCountReady`, drop the `onFeatureFlags` subscription, drop the `posthogClient` import. It now fires once when the flag resolves, period. Vercel surface is unchanged (still no `dataApiDefaultPrivileges` since there's no user-facing toggle there). Tests updated. 3. New useEffect in `/new/[slug]` watches the raw flag value and syncs `dataApiDefaultPrivileges` to the correct experiment-driven default when the flag resolves, gated on `getFieldState(...).isDirty` so we don't clobber intentional user input. ## Additional context Backend half of this fix is at supabase/platform#32933 (passes `org_count` and `signup_timestamp` in `personProperties` so the audience filter actually evaluates correctly). Both PRs are needed for the experiment to bucket at 5% and be measurable. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Changes** * Telemetry now records the selected default-privileges setting (dataApiDefaultPrivileges) in project-creation events; the previous dataApiEnabled field was removed. * Project-creation flows apply the experiment-driven default for that setting once the experiment resolves, but they do not overwrite user-edited choices. Vercel new-project flow syncs with the experiment until the user changes the checkbox. * **Tests** * Updated tests to validate tracking, deduplication, and sync/timing behaviors for dataApiDefaultPrivileges. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46085?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lakshan PereraandJeremias Menichelli
|
4363dbb975 |
Some trivial fixes to Edge Function guides (#46092)
Was going through user feedback and fixed some of the minor issues with the guides. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added guidance on handling CORS when invoking Edge Functions from the browser (quickstart and dashboard) * Updated Deno configuration guidance to reference a top-level deno.json and adjusted recommended project structure * Improved internal cross-references for templates and shared documentation links in functions guides <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46092?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Jeremias Menichelli <jmenichelli@gmail.com> |
||
|
Alex Hall
|
544f4e7195 |
chore(studio): pass integration listing by slug when installing (#46119)
Passes listings by slug instead of UUID when getting an installation URL. This is already supported in the Platform API in a backwards compatible way. Toward INT-109 |
||
|
Ali WaseemandDanny White
|
3d9fb2f98d |
feat(realtime): shortcuts for realtime (#46001)
## What kind of change does this PR introduce? Feature — adds keyboard shortcuts for the Realtime section in Studio. ## What is the current behavior? No keyboard shortcuts exist for Realtime navigation or inspector actions. ## What is the new behavior? ### Navigation chords (layout-scoped, active on any Realtime page) | Shortcut | Action | |---|---| | `R I` | Go to Inspector | | `R P` | Go to Policies | | `R S` | Go to Settings | ### Inspector actions (active on the Inspector page) | Shortcut | Action | Gating | |---|---|---| | `Shift+J` | Join a channel | Only when no channel is joined | | `Shift+L` | Start/Stop listening | Only when a channel is joined | | `Shift+F` | Open filter popover | Only when a channel is joined | | `Shift+B` | Broadcast a message | Only when listening | | `Mod+Shift+C` | Copy selected message | Only when a message is selected | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Realtime Inspector: new keyboard shortcuts (join channel, toggle listening, toggle filters, broadcast) and a copy-message shortcut with toast feedback. * Channel & Filter popovers support controlled/uncontrolled open state; header now wires popover state through props. * Shortcut tooltips added to copy and broadcast actions; realtime page navigation shortcuts and menu shortcuts added. * **Tests** * Shortcut reference sheet tests updated to include realtime navigation and inspector groups. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46001?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com> |
||
|
Ali Waseem
|
34303997c6 |
fix(table-editor): wait for filter value before applying (#46113)
## Summary - Closes [FE-3399](https://linear.app/supabase/issue/FE-3399/make-table-editor-filter-bar-wait-for-a-value) - Table editor's filter bar was firing a row request as soon as a property was selected, before any operator/value was set. This regressed after #46071 unified the table editor and unified logs onto the shared `FilterBar`. - `LogsFilterBar` already validates that each condition has a propertyName, operator, and non-empty value before applying. `FilterPopoverNew.handleApply` did not — it called `setFilters` unconditionally on every `onApply` from the shared bar (property change, operator change, blur, etc.). This PR mirrors the `LogsFilterBar` validation so the table editor stops requesting rows until the condition is complete. ## Test plan - [ ] Open the table editor on any table - [ ] Click the filter bar, pick a column → no network request fires, no toast, grid unchanged - [ ] Pick an operator → still no request - [ ] Type a value and hit Enter → row request fires, grid filters - [ ] Remove the filter → grid refetches with no filter - [ ] New e2e test: `pnpm --prefix e2e/studio run e2e -- features/filter-bar.spec.ts --grep "does not trigger a row request"` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Filter validation now prevents incomplete filter conditions from being applied, ensuring only fully-specified filters affect table data. * **Tests** * Added end-to-end test coverage for filter bar operations to verify expected behavior during filter setup. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46113?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ali Waseem
|
a0b4eeb770 |
chore: fix undefined check for type warnings (#46111)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Minor type check to resolve sentry issue <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed an issue where validation warnings could display even when no warnings were present, improving clarity in infrastructure settings display. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46111?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ali Waseem
|
83992c55f7 |
feat(log-explorer): arrow key and deeper shortcuts for log explorer (#45989)
Closes [FE-3378](https://linear.app/supabase/issue/FE-3378/featlogs-keyboard-shortcuts-for-function-logs-invocations-and-logs). ## Summary Adds a shared shortcut registry for every `LogsPreviewer` surface — Function Logs, Function Invocations, and the Logs Explorer — and brings the grid keyboard model in line with the Auth Users / Table Editor patterns. ## Shortcuts | Key | Action | | --- | --- | | `↑` / `↓` | Move single-row selection; opens side panel | | `Shift+Space` | Toggle current row in multi-select | | `Mod+A` | Toggle all visible rows in multi-select | | `Esc` | Staged: clear multi-select → close side panel | | `Shift+R` | Refresh logs | | `Shift+H` | Toggle histogram | | `Shift+L` | Load older logs | | `Shift+P` | Open time range picker | | `Mod+Shift+J / M / C` | Copy selected rows as JSON / Markdown / CSV (existing global handler) | ## Other changes - `ShortcutTooltip` on search, refresh, histogram, load older, and time-picker controls. - `onSearchInputEscape` wired on the logs search bar (clear → blur). - Visual row highlight (`rdg-row--focused`) when a row is keyboard-focused or multi-selected. - Multi-select copy dropdown gains a **Copy as CSV** entry and shows the keybind on each item via `ShortcutBadge`. - Manual arrow-nav (`navigate()`) updates `selectedRow` directly without going through `onRowClick`, so multi-select checkmarks survive keyboard navigation. ## Test plan - [x] Function Logs and Function Invocations: all shortcuts above fire while the page is mounted, no firing in other tabs. - [x] Logs Explorer: same shortcuts work; copy keybinds still copy *all* rows when nothing is multi-selected. - [x] Arrow keys on first load select the first row even when the focus sink is the active element. - [x] Selecting rows via checkbox or `Shift+Space`, then pressing arrow keys, preserves the checkmarks. - [x] Escape on a populated search input clears it; Escape on an empty input blurs it. - [x] Esc with multi-select active clears the selection before closing the side panel. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * CSV export for log selections (adds CSV alongside JSON and Markdown). * New logs-preview keyboard shortcuts: search focus, refresh, chart toggle, date picker, load older, navigation, and selection. * **Improvements** * Shortcut badges and tooltip integration across the logs UI. * Search input focus/ref support and controlled date-picker visibility. * Better no-results/error rendering and expanded copy dropdown sizing. * **Tests** * Added CSV formatting tests covering RFC 4180 edge cases. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45989) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordi EnricandClaude Sonnet 4.6
|
607cce2bc1 |
feat: pass subscription plan to ConfigCat for tier-based feature flags (#46063)
## Summary - Adds the organization's `plan` (e.g. `free`, `pro`, `team`, `enterprise`) as a custom attribute in the ConfigCat `User` object - Uses the existing `useSelectedOrganizationQuery` — already called inside `FeatureFlagProviderWithOrgContext`, so no extra network request (React Query deduplicates) - Refactors `customAttributes` construction from a conditional assignment to an incremental object build, making it easy to add more attributes in the future ## Why This unlocks tier-based percentage rollouts in the ConfigCat dashboard. For example, to roll out a feature to 25% of Pro accounts: 1. Add a Targeting Rule: `IF plan = "pro"` 2. Set the THEN clause to Percentage Options: `25% ON / 75% OFF` The split is deterministic per user email (or switch to `org_id` as the percentage evaluation attribute for per-org cohesion). ## Test plan - [ ] Log in as a user on a paid plan and verify `plan` appears as a custom attribute in ConfigCat's evaluation logs / targeting debugger - [ ] Log in as a free-tier user and confirm `plan = "free"` is sent - [ ] Confirm unauthenticated / org-less sessions don't break (attribute is omitted when `selectedOrganization?.plan?.id` is undefined) 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Enhanced feature flag configuration to account for organization and subscription plan information, ensuring more accurate feature availability based on user context. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46063?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
supabase-supabase-autofixer[bot]andgithub-actions[bot]
|
330dd79ff4 |
[bot] Decrease ESLint ratchet baselines (#46032)
Automated weekly decrease of ESLint ratchet baselines. Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> |
