mirror of
https://github.com/supabase/supabase.git
synced 2026-10-10 03:45:06 +03:00
feat/github-copilot-plugin
36403
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Gildas Garcia
|
8577b5fe77 |
chore: remove <Accordion> _Shadcn_ suffix (#46107)
## Problem The `_Shadcn_` suffix isn't needed anymore on Accordion components ## Solution - Remove the `_Shadcn_` suffix - Simplify UI package exports - Apply prettier <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Updated accordion component exports and imports to use unified naming conventions across the codebase, improving consistency for developers using the UI library. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46107?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Utkarash Kumar SinghandJoshen Lim
|
08c0fc247b |
feat(studio): warn about pg_graphql introspection change on upgrade (#46096)
<img width="1512" height="818" alt="introspection" src="https://github.com/user-attachments/assets/5c0e4c6a-c0e9-496d-8768-4a55a2433268" /> ## Summary Adds an in-product admonition on the Infrastructure Settings page when a project has pg_graphql < 1.6.0 installed, warning users that GraphQL introspection will be disabled by default after upgrading. Links to upgrade notes docs with the opt-in SQL. The admonition is purely informational — it renders alongside the upgrade button, does not block the upgrade. ## Context pg_graphql 1.6.0 disables GraphQL introspection by default. The change is upgrade-triggered (not backported), so users on 1.5.x will only encounter it when their AMI bundles 1.6.0+. To prevent surprise breakage of tools that rely on `__schema`/`__type` (GraphiQL, codegen, Relay compiler, etc.), Studio surfaces this admonition before they upgrade. Design discussion in [PSQL-1199](https://linear.app/supabase/issue/PSQL-1199/prepare-dashboard-notification-for-pg-graphql-breaking-change). ## Companion PR This depends on the schema change in [supabase/platform#32954](https://github.com/supabase/platform/pull/32954) which adds the new `warnings` field to `ProjectUpgradeEligibilityResponse`. ## Admonition copy - **Title:** \"GraphQL introspection will be disabled by default after upgrade\" - **Body:** \"After upgrading, queries to \`__schema\` and \`__type\` will return an error unless introspection is explicitly re-enabled on the schema. Regular data queries are not affected.\" - **CTA:** \"Read upgrade notes\" → links to the new docs section ## Related - Linear: [PSQL-1199](https://linear.app/supabase/issue/PSQL-1199/prepare-dashboard-notification-for-pg-graphql-breaking-change) - Parent rollout: [PSQL-1163](https://linear.app/supabase/issue/PSQL-1163/breaking-change-pg-graphql-introspection-rollout) - Companion platform PR: https://github.com/supabase/platform/pull/32954 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added “Upgrading to pg_graphql 1.6.0” and updated pg_graphql docs: introspection is disabled by default, how to re-enable per schema, verification steps, and affected tools. * **New Features** * Upgrade settings UI now shows validation warnings about introspection with links to upgrade notes. * **Chores** * Added "GraphiQL" to MDX spelling allow list and added upgrade-warning types to API surface. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46096?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Gildas Garcia
|
082c2546d2 |
chore: migrate from deprecated Accordion to new shadcn components (#46103)
## Problem We have multiple Accordion components ## Solution Migrate Accordion usages to Shadcn components ## Screenshots ### Documentation MDX pages Before: <img width="1156" height="1088" alt="image" src="https://github.com/user-attachments/assets/0f7b90ec-a613-45cf-8b04-39d2fd4b9644" /> After: <img width="1154" height="952" alt="image" src="https://github.com/user-attachments/assets/05c5051d-fa2a-497a-8f6f-96d555098e33" /> ### Documentation Mobile Menu Before: <img width="389" height="674" alt="image" src="https://github.com/user-attachments/assets/c9a0fa7a-3590-4f10-acfd-8add16c28b7b" /> After: <img width="376" height="665" alt="image" src="https://github.com/user-attachments/assets/d85fe05d-6d71-4e63-b0ea-cdc495d2fa94" /> ### www - Launch week pages Before: <img width="1434" height="718" alt="image" src="https://github.com/user-attachments/assets/d777f887-65d4-49f2-8b12-5b05010ba95d" /> After: <img width="1428" height="732" alt="image" src="https://github.com/user-attachments/assets/4fa7eb02-12c7-4b3b-b77f-09846518690c" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Replaced and standardized accordion UI across docs, navigation, mobile menu, pricing FAQs, Launch Week pages, and error/detail panels for a more consistent, reliable expand/collapse experience. * **Bug Fixes** * Fixed inconsistencies in accordion behavior and item rendering (e.g., multi-open support and disabled states) to improve navigation and content discovery. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46103?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Moaz Mirza
|
0e5d2dd433 |
Fix chat name truncation causing action icons to disappear (#46003)
Fixes issue #46002 ## Description If the chat name is too long, it wont get truncated properly, which caused the edit and delete icons to be pushed out of view. (see problem in #46002) ## Screenshots https://github.com/user-attachments/assets/7c664ff2-15da-47e0-88f0-39d8d3063686 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Updated text truncation and overflow styling for chat names in the AI Assistant Chat Selector. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46003) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen LimandGildas Garcia
|
7728bfae1d |
Joshen/debug 97 use the same filter bar in unified logs and table editor (#46071)
## Context Swaps out (and deprecates) the unified logs's own filter bar, for our existing design system's filter bar <img width="1450" height="355" alt="image" src="https://github.com/user-attachments/assets/c5e83bd1-4e67-4bb5-8f27-a3d9beacbbb5" /> Other changes involved for the FilterBar itself includes the following (more details in subsequent sections) - Add `onApply` param for `FilterBar` that will only trigger when an entered filter is "complete" (e.g on enter or blur) - Automatically select the operator if only one exists ## To test - Verify that the filter bar in general works BUT note there's some odd behaviour when searching on say the "status" column (more details under known issues) - likely something with the internal SQL i think, will need to investigate separately - afaict testing on the method seems to be working at least --- ### Add `onApply` parameter for `FilterBar` The search behaviour for the filter bar feels a bit awkward atm - referencing the table editor: - selecting the column triggers a search, which returns an error cause the search query is incorrect (operator and value not selected yet) - when typing the search value (after selecting the column + operator), the search triggers on debounce, which feels odd in this context as I'd expect the search to only trigger when i've hit enter (e.g to "finalize" my search parameters) - Am adding an `onApply` parameter gets called when a filter is "complete" -> column, operator, and value are finalized (e.g via Enter or onBlur) - Updated both Unified logs and table editor to use this behaviour ### Automatically select operator if only one exists in `FilterBar` This one's more specific to unified logs since there's only an `=` operator - but saves an unnecessary "enter" key event when filtering in unified logs ### Known issues - For some reason (even with the existing filter bar) - searching against status for e.g for postgres logs doesnt return the expected rows. e.g i've got rows with status as `00000`, but searching for `00000` doesnt return anything. Suspect its something to do with the SQL we're firing? <img width="1167" height="271" alt="image" src="https://github.com/user-attachments/assets/1dde74cf-8366-4cf1-8d8f-6907ba2473f6" /> <img width="1184" height="453" alt="image" src="https://github.com/user-attachments/assets/bf55f0fb-cb27-4e8f-b2d9-cd913d6ac6b9" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a dedicated Logs filter bar with an explicit "apply"/commit callback for filter UI. * **Bug Fixes** * Filter edits are buffered locally and only committed on apply to prevent aggressive data requests. * **Refactor** * Replaced legacy command-style table filter UI and removed related utilities. * Updated filter commit lifecycle and narrowed option value typing; adjusted top-level provider ordering. * **Style** * Small layout and trigger behavior tweaks for filter controls, timeline chart spacing, and download button. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46071?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com> |
||
|
Joshen Lim
|
dc211a972c |
Fix count query for unified logs (#46093)
## Context The query to retrieve counts in unified logs have been error-ing out with this `sql parser error: Expected: end of statement, found: UNION at Line: 71, Column: 2` This PR fixes that - can verify visually as the status filters are now populated correctly <img width="365" height="148" alt="image" src="https://github.com/user-attachments/assets/9397cca1-0519-4fe1-9397-c37d399c4b44" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Improved status-based log filtering so single-value and multi-value filters return more accurate results across all log sources. * Made facet count calculations (method, status, pathname) more robust for consistent counts. * **Bug Fixes** * Standardized log endpoint resolution so log retrieval behaves consistently when telemetry mode changes. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46093?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
supabase-supabase-autofixer[bot]andsupabase-workflow-trigger[bot]
|
ba34c1f6e9 |
feat: update @supabase/*-js libraries to v2.106.0 (#46068)
This PR updates @supabase/*-js libraries to version 2.106.0. **Source**: supabase-js-stable-release **Changes**: - Updated @supabase/supabase-js to 2.106.0 - Updated @supabase/auth-js to 2.106.0 - Updated @supabase/realtime-js to 2.106.0 - Updated @supabase/postgest-js to 2.106.0 - Refreshed pnpm-lock.yaml --- ## Release Notes ## v2.106.0 ## 2.106.0 (2026-05-18) ### 🚀 Features - **supabase:** W3C/OpenTelemetry trace context propagation ([#2163](https://github.com/supabase/supabase-js/pull/2163)) ### 🩹 Fixes - **auth:** return null user and session for email_change single-confirmation verifyOtp ([#2378](https://github.com/supabase/supabase-js/pull/2378)) - **release:** mark @supabase/tracing private and snapshot it for JSR ([#2370](https://github.com/supabase/supabase-js/pull/2370)) - **storage:** make StreamDownloadBuilder implement Promise and memoize executor ([#2367](https://github.com/supabase/supabase-js/pull/2367)) ### ❤️ Thank You - Claude Sonnet 4.5 - Guilherme Souza - Katerina Skroumpelou @mandarini - oniani1 This PR was created automatically. Co-authored-by: supabase-workflow-trigger[bot] <266661614+supabase-workflow-trigger[bot]@users.noreply.github.com> |
||
|
fadymak
|
ee64f0abc0 |
fix: update link for OAuth client registration documentation (#46098)
Updates broken link for OAuth client registration |
||
|
Joshen Lim
|
fac7bbbf21 |
Surface errors from logs.all.otel endpoint (#46094)
## Context If an error somehow occurs on the logs.all.otel endpoint for unified logs, the network request still returns a 200 but the error is then returned in the response as such: <img width="681" height="269" alt="image" src="https://github.com/user-attachments/assets/62bcf68f-8a8c-46a0-a91a-17f653004fa0" /> In which case, there's currently no UI error handling in unified logs, and it'll just show no results. Changes in this PR addresses that: <img width="1450" height="956" alt="image" src="https://github.com/user-attachments/assets/1b2c166b-d3d1-4923-9e35-51bad99b6e1c" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Enhanced error handling and messaging for log retrieval—displays explicit error notifications when queries fail instead of misleading empty state messages, improving user experience and clarity during troubleshooting. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46094?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
c88dba9628 |
docs: add Nuxt examples to SSR client guide (#43944)
## What kind of change does this PR introduce? Documentation update. ## What is the current behavior? The server-side auth client guide currently includes framework examples for Next.js, SvelteKit, Astro, Remix, React Router, Express, and Hono, but not Nuxt. ## What is the new behavior? - Adds a Nuxt env var tab in the setup section. - Adds a Nuxt framework section in the create-client guide with: - A server route example using `createServerClient` with cookie adapters. - A browser plugin example using `createBrowserClient`. ## Additional context Closes #34283 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **Documentation** * Added comprehensive Nuxt server-side rendering guide for creating Supabase clients with cookie support, including environment variable configuration setup and implementation examples for both server and browser environments. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/43944?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> |
||
|
Ziinc
|
9fcba73a7c |
docs: fix typo in share (#46040)
fixes minor typo in callout <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated link text formatting across storage analytics guides for improved consistency. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46040?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
supabase-supabase-autofixer[bot]andsupabase-releaser[bot]
|
0309fcccf0 |
docs: update js sdk docs (2.106.0) (#46069)
Updates JS sdk documentation following stable release.
Ran `make` in apps/docs/spec to regenerate tsdoc files.
**Details:**
- **Version:** `2.106.0`
- **Source:** `supabase-js-stable-release`
- **Changes:** Regenerated tsdoc files from latest spec files
🤖 Auto-generated from @supabase/supabase-js stable release.
Co-authored-by: supabase-releaser[bot] <223506987+supabase-releaser[bot]@users.noreply.github.com>
|
||
|
Stephen Morgan
|
1e28e6ac01 |
fix: run format step in separate low-privilege job (#46090)
Out of an abundance of caution, running the format step in a strictly read-only context. Added explicit validations on pushes instead of relying on an implicit lack of pull_request_target Resolves PRODSEC-118 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Reworked automated autofix workflow into a two-step format-and-apply flow, reduced top-level permissions, and moved from an auto-commit action to a manual apply/commit/push process for more controlled automated fixes. * No user-facing features or functionality changed. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46090?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
fda41502d6 |
Adjust width of status and pathname columns in unified logs to be smaller (#46089)
## Context Pulling changes over from a [previous PR](https://github.com/supabase/supabase/pull/46059) cause i had unrelated changes there 🤦 Just tiny UI nits to adjust the column widths of "method" + "pathname" columns in unified logs to be smaller <img width="1174" height="242" alt="image" src="https://github.com/user-attachments/assets/87985bb1-b7f4-4476-a235-7283529d63d8" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Adjusted column widths in the unified logs interface: reduced spacing for the method column and increased width for the pathname column to improve log visibility and readability. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46089?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Danny White
|
09bbb7c323 |
fix(design-system): keep Alert variant text foreground explicit (#46050)
## What kind of change does this PR introduce? Bug fix. Follow-up to DEPR-551, #45302, #45535, #45618, and stacked on #46049. ## What is the current behaviour? Warning and destructive Alert variants do not explicitly own their foreground text colour. In muted parent contexts, nested Admonition content can inherit lighter text styling. ## What is the new behaviour? Warning and destructive Alert variants now include `text-foreground`, just like the default counterpart. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Updated styling for alert components with destructive and warning variants. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46050?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Danny White
|
4c148ea060 |
chore(studio): move short Admonitions to descriptions (#46049)
## What kind of change does this PR introduce? Chore. Follow-up to DEPR-551, #45302, #45535, and #45618. ## What is the current behaviour? Some short Studio Admonitions still put their entire message in `title` or legacy `label`, so body-copy callouts render as headings. ## What is the new behaviour? Moves selected single-message Studio Admonitions to `description`, keeping the follow-up deliberately limited to Studio callsites. This PR does not touch Docs content, shared Alert styling, ui-patterns, design-system registry/docs, or Tailwind config. | Before | After | | --- | --- | | <img width="1818" height="388" alt="Image" src="https://github.com/user-attachments/assets/283a1853-348a-4d74-a408-013957350e5e" /> | <img width="1380" height="462" alt="Image" src="https://github.com/user-attachments/assets/e5761e8e-3697-423b-805b-45110205099a" /> | | <img width="1640" height="716" alt="CleanShot 2026-04-28 at 15 17 25@2x" src="https://github.com/user-attachments/assets/a5be4d5f-2bf7-4dc2-b396-56129fe64ec9" /> | <img width="1630" height="716" alt="CleanShot 2026-04-28 at 15 16 00@2x" src="https://github.com/user-attachments/assets/0d589252-aaf8-4efc-9d81-15ec4f99ec61" /> | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Refined message displays and admonition styling across settings, database, dashboard, and admin interfaces for improved visual consistency and clarity. * **UI Updates** * Updated search input layouts and form element styling in publications tables and other admin pages. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46049?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Prashant Sridharan
|
3356525028 |
Fix event linking behavior (#46083)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? 1. Removed the upcoming Figma webinar and postponed it until later 2. Fixed the event linking behavior for MDX events on the page. MDX events should link to the MDX page, not the CTA. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Updates** * Event links now intelligently route based on event configuration: external event URLs open in new tabs when available, while default events navigate to internal event detail pages within the application * This provides event organizers with flexible options for directing attendees to external event platforms or internal event information pages * Event entries updated to support new link routing functionality <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46083?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
47dc3d8478 |
chore: remove NoticeBanner2 (#46074)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Chore / cleanup. ## What is the current behavior? `NoticeBanner2` displayed a maintenance notice for `ap-southeast-1` and `sa-east-1` on May 13-14. The window has passed and the banner is no longer needed. ## What is the new behavior? `NoticeBanner2`, its `showNoticeBanner2` flag wiring in `AppBannerWrapper`, and its now-unused imports (`useQueries`, `useOrganizationsQuery`, `projectKeys`, `getOrganizationProjects`, `OrgProject`, `MAINTENANCE_REGIONS`) are removed. Shared utilities still used elsewhere (`projectKeys.bannerProjectsByOrg`, `getOrganizationProjects`/`OrgProject`, `LOCAL_STORAGE_KEYS.MAINTENANCE_BANNER_DISMISSED`) are kept. ## Additional context <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Terms of Service update notification banner that expires on July 4, 2026, with options to view details or dismiss. * **Chores** * Removed deprecated maintenance banner notification. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46074?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Matt Rossman
|
212ccf8135 |
fix(ai): contextualize cron schedule as SQL writes, score in "Tool Usage" (#45997)
When Assistant tries to schedule crons in read-only mode, it succeeds but creates the jobs under the `supabase_read_only_user`. This causes permission errors when user try to delete or unschedule them from the Cron dashboard. The root fix will be to enforce read-only transactions for that user. In the meantime, this PR steers Assistant to avoid the mistake. **Changes** - Prompts `execute_sql` to treat side-effecting function calls such as `cron.schedule()` as write queries. - Adds tool input assertions for "Tool Usage" scorer and a focused cron regression eval. - Updates eval mocks to show pg_cron extension as installed so it can call `cron.schedule()` **Verification** See [this trace](https://www.braintrust.dev/app/supabase.io/p/Assistant/trace?object_type=experiment&object_id=4a9e8c0e-83b7-4555-8502-365662c3ec8e&r=e041e69b-b70f-41d1-b88c-e8f7888c3de5&s=e041e69b-b70f-41d1-b88c-e8f7888c3de5) from Braintrust where the new eval passes "Tool Usage", correctly using `isWriteQuery` for the `cron.schedule()` Closes AI-737 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Tool evaluation now validates tool inputs (including exact and substring matches) in addition to tool presence. * **Tests** * Added a test confirming cron-scheduling behavior and that SQL scheduling/enqueue calls are treated as write operations. * **Chores** * Added pg_cron to mock extension data. * Clarified description that SQL calls with side effects should be treated as writes. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45997?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
50e158bddb |
fix: improve loading state when changing log filters in unified logs (#46070)
## Problem When changing filters, while the query is running the loading state is not clear, its only shown in the "Load more" button at the bottom which can be missed if you got a lot of logs, we should improve the filters loading state. That's actually due to two things: - we rely on the `isLoading` state instead of `isFetching` - we debounce filters changes by a second ## Solution - use `isFetching` to determine whether to display the loading spinner in the top filter bar - reduce the debounce delay to `250ms` as users can't filter by typing anyway (what they type must be validated with Enter to select a filter, no fuzzy filtering) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Performance** * Optimized unified logs filter response time, applying filter changes more quickly. * **Bug Fixes** * Enhanced loading indicator behavior in data tables to accurately reflect active data fetching operations, providing clearer visual feedback during interactions. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46070?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Andrey A.
|
31ca536bcb | fix(self-hosted): add jwt issuer env var to auth config (#46020) | ||
|
Andrey A.
|
af031e2abf | fix(self-hosted): add depends_on analytics for vector (#46038) | ||
|
Vaibhav
|
f8f948a2a4 |
fix: policy urls (#46064)
## TL;DR fixes `Table Editor -> View policies` for schema names with special characters tested with schema `sales&ops` : ## ex: | b4 url: `schema=sales&ops` | after url: `schema=sales%26ops` | | --- | --- | | <img width="394" height="63" alt="image" src="https://github.com/user-attachments/assets/fe5bea94-e364-493e-a2de-e9493bf17ef2" /> | <img width="544" height="67" alt="image" src="https://github.com/user-attachments/assets/23f5d648-d7f0-49b9-95de-ef0207d5839c" /> | ## ref - closes #46061 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved URL handling for the "View policies" link to ensure proper encoding and reliability. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46064?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Tomás PozoandChris Chinchilla
|
9d46004210 |
docs: rewrite Securing Edge Functions guide around @supabase/server (#45959)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update. ## What is the current behavior? The "Securing Edge Functions" guide (`/docs/guides/functions/auth`) opens with two conceptual sections — "Understanding authorization headers" and "The `verify_jwt` platform check" — followed by a "Common auth patterns" section that re-implements the same four use cases twice: once without an SDK using `Deno.serve` + manual `createClient` + manual `Authorization` header forwarding, and again using `@supabase/server`. The recommended path is buried below background reading and a legacy-style implementation. Linear: COM-235. ## What is the new behavior? The guide now leads with practical how-tos built on `@supabase/server`: - Authenticated user calls (`auth: 'user'`) - Service-to-service calls (`auth: 'secret'`) - Public functions (`auth: 'none'`) - External webhooks (`auth: 'none'` + signature verification) - Combining modes - Custom error responses - Environment variables The two conceptual sections are extracted into a new sibling page at `/docs/guides/functions/auth-headers` ("Authorization headers"), linked from the top of the how-to page and added to the side nav between "Securing your functions" and "Legacy JWT secret". The legacy SDK-less examples are removed. The mode table uses the unnamed forms (`'secret'`, `'publishable'`), and a note in the service-to-service section introduces the `'secret:<name>'` / `'publishable:<name>'` syntax for callers that want to scope to a specific named key. ## Additional context Each section preserves the "who calls this and why" framing from the original (cron jobs, workers, and `pg_net` for service-to-service; `supabase.functions.invoke` for authenticated user calls; signed webhook providers for external webhooks). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added a new guide explaining Edge Functions authentication headers, JWT validation, and API key handling * Redesigned core authentication guide to focus on the primary wrapper approach with clearer examples and common scenarios * Improved navigation and added redirects to make authentication docs easier to find and access <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45959?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Chris Chinchilla <chris.ward@supabase.io> |
||
|
Gildas Garcia
|
573b165cd2 |
fix: unified logs time range active filter has invalid applid filter count (#46060)
## Problem After selecting a time range filter value, users see that `2` filters are applied which is technically correct (begin/end of the time range) but weird as you have only one filter made of two values. ## Solution ~~Not great, but check the filter column id and display `1` if it is the _Date_ column~~ Better: rely on column definition metadata <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed data table filter reset button display for date columns: date-based filters now show a consistent single indicator, while other columns continue to display their actual filter counts. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46060?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordi EnricandClaude Sonnet 4.6
|
5d9cf3971f |
fix(studio): improve memory and swap units in DB reports (#45889)
Fixes [DEBUG-94](https://linear.app/supabase/issue/DEBUG-94) ## Summary - **Min MB units**: Added \`formatBytesMinMB\` helper that always formats byte values in at least MB. Applied to RAM and swap y-axis tick formatters, tooltips, and chart headers. - **Swap chart scale**: Every Supabase compute instance is provisioned with **1 GB of swap regardless of size** (per [docs](https://supabase.com/docs/guides/troubleshooting/memory-and-swap-usage-explained-aPNgm0)), so the swap y-axis always shows at least 0 to 1 GB. Low swap usage no longer fills the full chart height. Removed the show/hide limit toggle since the limit is implicit in the y-axis scale. - **Swap units in header/tooltip**: Fixed all three formatters (initial header, hover-sync header, tooltip) to use \`formatBytesMinMB\` for swap so the value always shows a unit like "2.00 MB". - **Reference-line defensive fix**: Added a \`customValue\` fallback in \`useAttributeQueries\` so future reference-line attributes that use \`customValue\` instead of \`value\` are not silently overwritten to 0. ## Test plan - [ ] Open DB Reports and verify RAM/Swap y-axis labels show MB (or GB for large values), never KB or bytes - [ ] Hover a bar in the swap chart and verify tooltip and header show the same value with a unit (e.g. "2.00 MB") - [ ] With low or zero swap usage, the chart bars are flat and the y-axis goes 0 to 1 GB - [ ] CPU chart limit toggle still renders at 100% (regression check on the \`useAttributeQueries\` fallback change) 🤖 Generated with [Claude Code](https://claude.ai/claude-code) --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
Timothy Lim
|
360140b3de |
fix(docs): Update Edge Function error code from WORKER_LIMIT to WORKER_RESOURCE_LIMIT (#46051)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Updating to the current status code <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Documentation * Updated docs for HTTP status code 546 to reference the correct resource limit identifier: WORKER_RESOURCE_LIMIT. * Added a note that the limit was previously named WORKER_LIMIT for clarity. * Revised troubleshooting guidance and examples to reflect the new identifier and to include both WORKER_RESOURCE_LIMIT and the prior WORKER_LIMIT naming where relevant. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46051?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Timothy Lim
|
0884060914 |
fix(docs): Fix Oauth docs and code to use redirect_url (#45966)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Fix incorrect reference to `redirect_to` when it should be `redirect_url` - https://github.com/supabase/supabase-js/blob/1c48755657c5f7aac5e4a7abf3f68f27efc0c746/packages/core/auth-js/src/lib/types.ts#L2561-L2569 - https://github.com/supabase/supabase-js/blob/1c48755657c5f7aac5e4a7abf3f68f27efc0c746/packages/core/auth-js/src/lib/types.ts#L2534-L2537 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Enhanced OAuth Server "Getting Started" guide with updated code examples and clearer explanatory steps for implementing authorization flows with accurate field references. * Refined OAuth authorization code flow documentation, including updated diagrams and instructions to ensure consistent field references across all redirect and consent handling steps. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45966) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kemal.earth
|
d051fa5188 |
feat(studio): add new badge to feature preview for logs (#45171)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? We were missing the "New" badge as pointed out by @peekknuf. Though we already mention "New" in the feature name here. Thoughts @supabase/dashboard ? | Before | After | |--------|--------| | <img width="287" height="98" alt="Screenshot 2026-04-23 at 17 33 56" src="https://github.com/user-attachments/assets/06e32cd6-55da-4bd1-a79b-9305ff1aa938" /> | <img width="284" height="148" alt="Screenshot 2026-05-18 at 12 01 33" src="https://github.com/user-attachments/assets/e7721e80-6aa9-4c58-ab64-fc13bc346bf8" /> | |
||
|
Pamela Chia
|
0bed80b340 |
chore(telemetry): clean up frontend event catalog (#45964)
## Summary Resolves 13 findings (2 HIGH, 5 MEDIUM, 6 LOW) from the frontend telemetry audit: 1 action-string collision, 1 camelCase experiment name, 9 dead events removed, 4 missing org groups attached, 1 ambiguous property renamed, 1 raw-string property narrowed, plus consolidations and a structural tightening on TABLE_EVENT_ACTIONS. ## Changes ### HIGH - Rename `EventPageCtaClickedEvent.action` to `www_event_page_cta_clicked` so it no longer collides with the pricing CTA event (which had a different schema sharing the same action string) - Snake_case the header-upgrade experiment exposure name (`headerUpgradeCta_experiment_exposed` → `header_upgrade_cta_experiment_exposed`); PostHog flag key and `?source=` URL param unchanged ### MEDIUM - Remove 4 dead `ProjectCreation*Step*` events (referenced a v2 route that doesn't exist; 0 emissions) - Remove 4 dead experiment exposure events: `ProjectCreationRlsOptionExperimentExposed`, `HomeNewExperimentExposed`, `TableCreateGeneratePoliciesExperimentExposed`, `TableCreateGeneratePoliciesExperimentConverted` (0 emissions) - Attach org group to `dpa_request_button_clicked` (0% had `$group_0` per Hex) - Delete `RegisterStateOfStartups2025NewsletterClicked` (interface naming outlier, 0 emissions, page renamed to 2026) - Rename `AssistantSuggestionRunQueryClickedEvent.category` to `mutationType` with tightened literal union (`'functions' | 'rls-policies' | 'unknown'`) - Attach org group to `project_creation_default_privileges_exposed` on Vercel surface via explicit `groupOverrides` (auto-injection misses because `useSelectedOrganizationQuery` is undefined on that page) ### LOW - Consolidate `IndexAdvisorBannerEnableButtonClickedEvent` + `IndexAdvisorDialogEnableButtonClickedEvent` into one event with `origin: 'banner' | 'dialog'` - Rename `ImportDataFileDroppedEvent` → `ImportDataFileAddedEvent` so the interface name matches the action and the verb is on the approved list - Rename `LogDrainConfirmButtonSubmittedEvent` → `LogDrainRemovedEvent` and action to `log_drain_removed` (fires on delete-confirm modal, matches `CronJobRemovedEvent` pattern) - Add `type` property to `CronJobRemovedEvent` (parsed from the job's command), matching the create/update event shape - Tighten `TABLE_EVENT_ACTIONS` values with `satisfies` against the event union so renames in the union fail typecheck here too - Attach org group to `www_pricing_plan_cta_clicked` at 5 emission sites when an org is available in the page context - Narrow `unified_logs_row_clicked.logType` from raw `string` to the 5-literal `LOG_TYPES` union (zod already validates server values) ### Bundled refactor Migrated 5 emission sites from deprecated `useSendEventMutation` to `useTrack` while their containing files were being edited: `DPA.tsx`, `DisplayBlockRenderer.tsx`, `Grid.tsx` (2 events), `DeleteCronJob.tsx`. Full sweep of the remaining ~79 files is a separate follow-up. ## Testing Mostly just renaming of events ## Linear - fixes GROWTH-798 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Standardized telemetry to a unified tracking system for more consistent analytics. * Simplified experiment exposure reporting for upgrade prompts. * **New Features** * More granular tracking for CSV import, cron job deletions, log drain removals, DPA downloads/requests, and pricing CTAs. * Assistant now classifies mutation queries more precisely. * **Bug Fixes** * Improved default-privileges exposure logic on Vercel deployments (skips when org missing). <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45964) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Alaister YoungandAlaister Young
|
5950b6ca04 |
test(e2e/studio): stabilize flaky and TZ/OS-sensitive specs (#46039)
Backports a batch of e2e test stabilization fixes — each commit is
scoped to a single failure class and only touches `e2e/studio/` files.
**Changed:**
- **`_global.setup` — playwright-locks cleanup was dead code**: the
lock-cleanup block was at the bottom of `Global Setup`, but every branch
above it returns early — so it never ran. Tests that use
`withFileOnceSetup` (cron-jobs) would see a stale `setup.done.json`
marker from the previous run and silently skip their setup, leaving e.g.
`pg_cron` uninstalled and all 11 cron-jobs specs failing. Moved the
cleanup to before any early return.
- **filter-bar — Home key**: macOS Chromium doesn't honor a standalone
`Home` keypress inside text inputs (macOS routes "go to line start" via
`Cmd+ArrowLeft` / `Fn+ArrowLeft`). Tests that expected the cursor to
jump to position 0 silently kept the previous selection. Replaced with
`el.setSelectionRange(0, 0)` so the assertion runs against a known
cursor position on every OS.
- **filter-bar — date filters**: tests inserted rows with `CURRENT_DATE`
/ `NOW()` (postgres session TZ = UTC) and asserted with JS-local dates
from `getDateValue()`. Near midnight the two diverged and the filter
returned 0 rows. Switched the inserts to explicit `getDateValue()`
strings so insert and assert use the same calendar day.
- **queue-table-operations — `networkidle`**: Studio holds long-poll /
SSE connections (PostHog, realtime), so `page.reload({ waitUntil:
'networkidle' })` never resolves and timed out. Replaced with a targeted
`waitForTableToLoad` API waiter.
- **sql-editor — RLS smoke test**: a hard-coded table name
(`pw_rls_smoke_test`) collided across 3 parallel workers running against
the same db. Suffixed with `test.info().parallelIndex`.
- **table-editor — FK spec timeout**: `waitForApiResponseWithTimeout`
for `query?key=table-update` returns `null` on timeout (silent), then
the panel-close assertion fails. Bumped 15s → 30s to absorb
parallel-load latency.
- **table-editor / storage-helpers — URL encoding & redirect race**:
post-action URL assertions were over-specific (`%20` vs `+` encoding)
and the bucket-delete redirect could race other history updates. Relaxed
the regex to accept both encodings; asserting the row removal directly
is a more stable signal than the redirect URL.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Improved end-to-end determinism with explicit dates/timestamps and
stable cursor positioning
* Prevented parallel-test collisions by using unique identifiers for
resources
* Made page reloads and API waits more robust for long-lived connections
and increased timeouts
* Strengthened assertions to rely on stable UI signals instead of
transient navigation/network state
* Ensured test setup reliably cleans up temporary locks before any setup
steps run
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46039?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
|
||
|
Joshen Lim
|
9dc3998fa0 |
RLS Tester sandbox environment (#45839)
## Context Resolves FE-3221 Heavily inspired by what @filipecabaco has done previously here: https://github.com/supabase/supabase/pull/45360 This PR explores the use of pglite to set up a sandbox for RLS testing, which will pave the way for testing mutation based queries so to ensure no disruption to the actual database. Sandbox can be set up within the RLS tester panel as such: <img width="500" alt="image" src="https://github.com/user-attachments/assets/0cfdf8e4-dd99-4dee-ac00-39a32b375c07" /> Which the sandbox will mimic the project's database to the bare minimum required - entities from the `public` schema are copied over (types, tables, functions, policies) - `auth` schema is pseudo setup with `SANDBOX_SETUP_STATEMENTS` - Enough to support role impersonation + querying tables with references to the auth schema (e.g users table) - data is seeded up to 100 rows for each table - More info RE limitations in the last section below Once sandbox is ready, you'll see this UI where you can either leave the sandbox, or re-sync the sandbox from the actual database <img width="500" alt="image" src="https://github.com/user-attachments/assets/d07ce55f-5bc8-4722-8ce9-898b9b458f9b" /> Changes are currently feature flagged, so won't be available publicly just yet until things are ironed out and ready ## To test - [ ] Verify that setting up sandbox works - [ ] Verify that you can query your sandbox, and queries do not touch the actual database (can verify that we're not sending HTTP requests to the /query endpoint) - [ ] Verify correctness of RLS tester as well, should match correctness with testing against actual DB - [ ] Verify that re-syncing sandbox picks up changes - Can test by updating your policies that will affect the output of your select query - e.g SELECT for `authenticated`, change from just `true` to `false` - [ ] RLS tester should work as per normal (against actual DB) with the feature flag off with no additional overhead Let me know of any edge cases you might run into while testing ## Known quirks that will be addressed subsequently Leaving these for now just to not bloat this PR further - Pglite schema needs to be re-synced if updating RLS policies while testing, to ensure that pglite gets the updated policies. Will think about how to make this more seamless - Sandbox has its own limitations, will need to add a dialog to inform users how the sandbox works and what limitations to note of - e.g only the auth schema is mimicked - so policies that reference storage helpers won't work (although i think auth is probably the main use case and the rest might be niche) - We can slowly expand tho where required - Eventually we'll also move forward with figuring out testing mutation queries with this sandbox <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * RLS tester gains an isolated Postgres sandbox with schema/seed import, start/refresh/exit controls, and pre-populated auth data. * Sandbox management UI with setup, loading, active, and error states; refresh and destroy actions. * **Bug Fixes** * Role impersonation now keeps the PostgREST role set to anon while the tester sheet is open. * **Chores** * Content Security Policy updated to allow sandbox/connectivity endpoints. * **Style** * Minor sheet styling adjustment (top border). <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45839) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Danny WhiteandJoshen Lim
|
e65da2c3e7 |
feat(studio): move redeem credits to connect interstitial (#45909)
## What kind of change does this PR introduce? Feature. Part of DEPR-556. ## What is the current behavior? The `/redeem` credit redemption page uses the legacy redeem credits layout and scaffolded two-column UI. It is visually separate from the newer connect interstitial surfaces. ## What is the new behavior? `/redeem` now uses the shared connect interstitial layout with a Supabase logo, signed-in account row, organisation selector, and full-width redeem action. The existing `CreditCodeRedemption` modal still owns the actual code entry, hCaptcha, permission checks, mutation, and success/error handling. Creating a new organisation links to `/new` with a return URL, and the returned organisation is preselected when present. Temporary mock states are available on non-production and Vercel preview environments: - `/redeem?mock=loading` - `/redeem?mock=ready` - `/redeem?mock=redeeming` - `/redeem?mock=redeemed` - `/redeem?mock=already-redeemed` - `/redeem?mock=invalid` - `/redeem?mock=wrong-account` - `/redeem?mock=error` | Before | After | | --- | --- | | <img width="1024" height="759" alt="Redeem Credits Supabase-66AF2C81-89A0-4F95-A591-3550AAD7112A" src="https://github.com/user-attachments/assets/1e0dd7af-3168-4566-a7d9-0b889fe69d4e" /> | <img width="1024" height="759" alt="Redeem Credits Supabase-7F9C59DD-73EC-4717-B2B7-3E6BB325273C" src="https://github.com/user-attachments/assets/60e44213-d2ab-4b5c-b03e-38a3425dbd27" /> | | <img width="1024" height="759" alt="Redeem Credits Supabase-A77F2F93-98C3-42E9-B028-049E1AAC0CA3" src="https://github.com/user-attachments/assets/25087b51-94cb-40c7-9dde-1fc957b7dd8e" /> | <img width="1024" height="759" alt="Redeem Credits Supabase-4C4B7818-16A5-430E-B54F-E7FF34229CA0" src="https://github.com/user-attachments/assets/4da11122-b547-4e1e-a953-8d2e4c478431" /> | | <img width="1024" height="759" alt="Redeem Credits Supabase-A77F2F93-98C3-42E9-B028-049E1AAC0CA3" src="https://github.com/user-attachments/assets/25087b51-94cb-40c7-9dde-1fc957b7dd8e" /> | <img width="1024" height="759" alt="Redeem Credits Supabase-4C4B7818-16A5-430E-B54F-E7FF34229CA0" src="https://github.com/user-attachments/assets/4da11122-b547-4e1e-a953-8d2e4c478431" /> | <img width="1024" height="759" alt="Redeem Credits Supabase-49FC982C-2605-41B3-8216-B8F270825247" src="https://github.com/user-attachments/assets/8e5fc351-6e11-4fef-9d55-1a60fa34a89a" /> | | <img width="1024" height="759" alt="Redeem Credits Supabase-6AF18EF8-1699-4341-A900-34E3AEB59703" src="https://github.com/user-attachments/assets/7adf3d15-73a7-4ef1-9d25-bfcb07b1b15c" /> | <img width="1024" height="759" alt="Redeem Credits Supabase-4F8BBF66-6AF6-403F-B949-079F8E47200B" src="https://github.com/user-attachments/assets/b05461de-1fd3-4251-9a22-9d1a4dea2b20" /> | | <img width="1024" height="759" alt="Redeem Credits Supabase-320E56E7-A291-426B-92B4-5CD4518C85B6" src="https://github.com/user-attachments/assets/aa172303-0219-425d-9c8b-07044a9f5cac" /> | <img width="1024" height="759" alt="Redeem Credits Supabase-7E55274C-E39E-443B-B636-63B597E11494" src="https://github.com/user-attachments/assets/4a09d19e-a61c-4c1d-a0a2-e535e53aeee7" /> | | <img width="1024" height="759" alt="Redeem Credits Supabase-4D5A1985-D36B-48E1-8108-E95C10C52A12" src="https://github.com/user-attachments/assets/e3baffe9-e0ac-4dff-8f4c-1b01d34fbfe4" /> | <img width="1024" height="759" alt="Redeem Credits Supabase-B1296556-9DDF-48ED-A0DA-4BEFF5D20FBA" src="https://github.com/user-attachments/assets/27ed8201-960b-45e3-a32f-115045d0443e" /> | | <img width="1024" height="759" alt="Redeem Credits Supabase-193C4266-29BC-4B03-A746-4C2CE3BD29EB" src="https://github.com/user-attachments/assets/230fb7a0-4049-46b7-84d4-eb549099863b" /> | <img width="1024" height="759" alt="Redeem Credits Supabase-751A900D-A8CF-425C-A745-1511B6DC81E3" src="https://github.com/user-attachments/assets/55ab5719-a77c-486b-b2d0-5926a524a7b4" /> | | <img width="1024" height="759" alt="Redeem Credits Supabase-29305C15-19B7-4015-9041-62B79E0C95A8" src="https://github.com/user-attachments/assets/a1b2ba08-2d1a-4a95-a6ac-4d9e3faf9327" /> | <img width="1024" height="759" alt="Redeem Credits Supabase-A1628FDB-CFBE-47E7-83D7-3D3D426C3C1E" src="https://github.com/user-attachments/assets/7fbbf75e-1f8e-478f-83ec-2ab06dff0545" /> | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **New Features** * Added organization selector to the credits redemption workflow. * New "Create Organization" card for quick access to organization creation. * **Refactor** * Streamlined the credits redemption page for improved user experience. * Enhanced organization card display with customizable descriptions. * **Style** * Removed "Coming soon" beta indicators from action cards. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45909?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Danny WhiteandChris Chinchilla
|
9c03ad6b02 |
chore(docs): migrate Admonition labels to titles (#46053)
## What kind of change does this PR introduce? Docs update. Related to DEPR-551. ## What is the current behavior? Docs MDX still uses the legacy `label` prop for Admonitions, even though #45618 added `title` and kept `label` only as a backwards-compatible alias after #45302 was reverted in #45535. ## What is the new behavior? Migrates Docs-owned Admonitions from `label=` to `title=` without changing rendered copy, component APIs, Studio callsites, design-system examples, or the legacy `label` alias. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Standardized admonition headings across the docs by switching how admonition headings are provided (preserving all visible guidance and examples). Content and instructions remain unchanged; this ensures consistent rendering of callouts and improves uniformity across guides and reference pages. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46053?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Chris Chinchilla <chris.ward@supabase.io> |
||
|
supabase-supabase-autofixer[bot]andphamhieu
|
6e17d85e55 |
feat: update mgmt api docs (#46045)
This PR updates mgmt api docs automatically. Co-authored-by: phamhieu <689843+phamhieu@users.noreply.github.com> |
||
|
Joshen Lim
|
b7312ad40a |
Fix method toggle column in unified logs (#45965)
## Context Addresses the toggling of column visibility not working for dynamic columns (e.g method, status, and event_message) <img width="293" height="262" alt="image" src="https://github.com/user-attachments/assets/c404c063-d6b2-49bf-86ec-bf91f7e35bd2" /> The main problem was actually just because of this in `UnifiedLogs.tsx`: <img width="569" height="165" alt="image" src="https://github.com/user-attachments/assets/5ae7be01-a7d6-4f64-99ad-87886dbf75f9" /> `dynamicColumnVisibility` is a fixed value determined by which columns are dynamic from the log data (as the default value) `columnVisibility` is a dynamic value that we're retrieving and updating with local storage just need to shift `dynamicColumnVisibility` to be before `columnVisibility` so that `columnVisibility` can override the values correctly from local storage ### Other changes Other resolves DEBUG-102, adds a border top to the table to better visually anchor the side panel <img width="1157" height="301" alt="image" src="https://github.com/user-attachments/assets/c0b7a90c-0ccb-4b65-8299-a8380e2a76fa" /> ## To test - [ ] Verify that the toggles work for method, pathname and event_message <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Adjusted date column width in logs view for improved readability. * Updated column visibility handling so the intended columns display consistently. * **UI Improvements** * Added a top border to the main logs panel for clearer visual separation. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45965?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
85743d7215 |
feat: branching support for temporary access (#45411)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? feature ## Additional context Needs API deployment, adds a toggle to allow roles to only be available on branch projects <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a "Branches only" option for JIT database access grants; included when grants are submitted. * **UI** * Configuration UI shows an informational notice and hides temporary-access controls when preview branches are managed from the main branch. * Feature preview label changed to "Temporary access"; badge text now reads "Preview". * **Tests** * Unit test updated to cover branches-only serialization. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45411?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com> Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Tyler
|
bde9d536ba | fix: authType in functions template should be authMode (#45811) | ||
|
Danny WhiteandJoshen Lim
|
f45a6085f4 |
feat(studio): add auth email template reset flow (#45572)
## What kind of change does this PR introduce? Feature. Resolves AUTH-879. ## What is the current behavior? Studio does not provide a way to reset an Auth email template back to the default subject and body once it has been customised. ## What is the new behavior? Studio shows a `Reset template` action when Platform reports that the selected Auth email template subject or body has been customised. The action opens a confirmation dialog, calls the dedicated Platform reset endpoint, and refreshes the editor with the default subject and body returned by the API. The Auth config save/reset mutations now run their user-facing success handling before refreshing Auth lint data, so the success toast and local editor cleanup are not delayed by lint refetches. ## Additional context Depends on supabase/platform#32417. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Reset email templates to defaults via a confirmation dialog; button appears when custom content is detected and respects update permissions. * Typed email-template definitions and improved template variable display and descriptions. * **Tests** * Added tests covering template reset visibility, confirmation flow, state updates, permission handling, and toast notifications. * **Documentation** * Example email template placeholders updated for internationalization and provider snippets. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45572) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Joshen Lim
|
179f00cceb |
Fix duplicate empty state in unified logs (#45969)
## Before <img width="2280" height="1564" alt="image" src="https://github.com/user-attachments/assets/08d91834-a188-4b09-b266-d9d4b7c88959" /> ## After Also centralized the empty state <img width="1448" height="960" alt="image" src="https://github.com/user-attachments/assets/3ee1d386-b98e-49ee-b8ea-6a1c6b4359ab" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved infinite scroll data table display when loading or empty * "No more data to load" message now appears only when data exists, reducing redundant messaging * Refined table styling for better visual presentation during different states <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45969) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Prashant Sridharan
|
598d664213 | Revised Chatbase case study (#46042) | ||
|
Sean Oliver
|
0eb37adb19 | fix(telemetry): pass signup_timestamp on org_count identify (#46005) | ||
|
Charis
|
12869fcd9f |
studio: flip executeSql signature to SafeSqlFragment (7/7) (#46007)
## Summary Final PR in the SafeSql migration stack. Stacked on top of #46006. Tightens `executeSql`'s `sql` parameter from `string` to `SafeSqlFragment`. Any future raw-string caller is now a compile error — the SafeSql safety property becomes structural rather than convention-based. Also adapts the AI `execute_sql` tool to promote AI-generated SQL via `acceptUntrustedSql(untrustedSql(sql))` inside the `execute` callback. The tool's existing \`needsApproval: true\` gate ensures `execute` only runs after the user has explicitly approved — that approval is the gesture that promotes untrusted to safe. ## Test plan - [x] `pnpm typecheck` passes - [x] Grep for any remaining raw-string `executeSql` calls in `apps/studio` returns nothing - [x] Dev-server smoke: AI tool approval flow executes SQL |
||
|
Charis
|
39ec777d22 |
studio: SafeSql stragglers + remaining tests (6/7) (#46006)
## Summary Part 6 of 7 in the SafeSql migration stack. Picks up the few remaining files that didn't fit cleanly into earlier batches: - `components/Docs/Description.tsx` — comment statements built via `safeSql`. - `components/Integrations/IntegrationOverviewTabV2/InstallIntegrationSheet.test.tsx` — test fixture updated to `SafeSqlFragment`. - `lib/ai/tools/studio-tools.test.ts` — test fixture updated. - `lib/api/generate-v4.test.ts` — test fixture updated. Sets up PR 7, which flips the `executeSql` signature itself. ## Test plan - [x] `pnpm typecheck` passes - [x] Specific Studio unit tests run on top of the stack (`Policies.utils.test.ts`, `SidePanelEditor.utils.createTable.test.ts`, `useQueryInsightsIssues.utils.test.ts`) - [x] Dev-server smoke: Docs panel renders / accepts edits <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Updated test suites to reflect internal type definition changes. * **Refactor** * Internal code improvements to enhance type safety and consistency across the codebase. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46006) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
2d4e87f579 |
studio: SafeSql for reports, query performance, privileges (4/7) (#45998)
## Summary Part 4 of the SafeSql migration stack ([#45897](https://github.com/supabase/supabase/pull/45897), [#45903](https://github.com/supabase/supabase/pull/45903), [#45990](https://github.com/supabase/supabase/pull/45990), this PR, …). Converts the remaining reports, query performance, observability, index advisor, and privileges call sites of `executeSql` to produce `SafeSqlFragment` values. The `ReportQuery.sql` field flips from `string` to `SafeSqlFragment`, which cascades into every consumer — landed here atomically so each branch typechecks cleanly. Touched areas: - `interfaces/Reports/*` — `ReportQuery.sql: SafeSqlFragment`, plus all report definitions/utilities updated - `interfaces/QueryPerformance/useQueryPerformanceQuery.ts` - `interfaces/Database/IndexAdvisor/*` and `data/database/{table-index-advisor,retrieve-index-advisor-result}-query.ts` - `data/privileges/{table-api-access,update-exposed-entities}-mutation.ts` - `interfaces/Storage/StoragePolicies/StoragePolicies.tsx` - `hooks/analytics/useDbQuery.tsx` - `Observability/useSlowQueriesCount.ts` + `useQueryInsightsIssues.utils.test.ts` ## Test plan - [x] `pnpm typecheck` passes - [x] `useQueryInsightsIssues.utils.test.ts` passes - [x] Dev-server smoke test: reports pages, query performance, index advisor, storage policies <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Reworked SQL construction and typings across reporting, query performance, index advisor, and privilege features to use safer SQL fragments, improving reliability and preventing query composition issues. * **Types** * Reporting query types were split to distinguish database vs. logs queries, enabling correct handling and validation. * **Docs/Utils** * Added a helper to consistently generate logs SQL for report hooks. * **Tests** * Updated tests to exercise the new SQL-building API. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45998) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
e925385415 |
studio,pg-meta: SafeSql for functions/policies/triggers (3/7) (#45990)
## Summary
Third PR in the SafeSql migration stack. Flips the input/output types on
`pgMeta.functions/policies/triggers`'s `.create/.update/.remove` to use
`SafeSqlFragment`, and updates every Studio consumer atomically.
### pg-meta
- `pgMeta.functions/policies/triggers` `.create/.update/.remove` now
return `{ sql: SafeSqlFragment }` and accept branded input parameters
(`PGFunctionCreate`, `PGSavedFunction`, `PolicyCreate/UpdateParams`,
`PGTriggerCreate` with branded condition).
- `QueryModifier.toSql()` returns `SafeSqlFragment`.
### Studio consumers updated to the new branded API
- `data/database-functions/*` (query, create/update/delete mutations)
- `data/database-policies/*` (create, update mutations)
- `data/database-triggers/database-trigger-update-transaction-mutation`
- `components/Database/Triggers/TriggerSheet`
- `components/Database/Functions/CreateFunction`
- `components/Auth/Policies/PolicyEditorPanel`
These consumers land atomically with the pg-meta API change because the
input-type strictness flip (string → `SafeSqlFragment` for SQL fields)
forces every call site to update together.
## Stack
- 1/7: #45897 (merged)
- 2/7: #45903 (merged)
- 3/7: this PR
- 4/7–7/7: upcoming
## Test plan
- [x] `pnpm typecheck` passes
- [x] `pnpm --filter @supabase/pg-meta test` passes
- [x] Dev-server smoke test: function editor, policy editor, trigger
sheet
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Strengthened SQL safety across policy, function, and trigger workflows
by converting raw SQL strings to typed SQL fragments and safer
composition
* Updated editor behavior to handle policy conditions/checks as typed
SQL fragments with improved initialization and template handling
* Aligned query and modifier interfaces to return typed SQL fragments
for safer composition
* **Tests**
* Updated tests to use typed SQL fragments and synchronous builders
where applicable
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45990)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
|
||
|
Gildas Garcia
|
4d9879d62d |
chore: remove slider shadcn suffix (#45992)
## Problem The `_Shadcn_` suffix isn't needed anymore on slider components ## Solution - Remove the `_Shadcn_` suffix - Simplify UI package exports <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Improved internal component export structure and import organization for better code maintainability. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45992) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
aedd91a9bb |
chore: remove <HoverCard> _Shadcn_ suffix (#45987)
## Problem The `_Shadcn_` suffix isn't needed anymore on `HoverCard` components ## Solution Remove it. No other changes <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Standardized hover-card component usage across the apps and design system for consistent behavior and markup. * No user-facing changes — hover previews, tooltips, snippet/template previews, and code hover panels retain the same appearance and interactions. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45987) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
426f150e02 |
chore: remove <Breadcrumb> _Shadcn_ suffix (#45984)
## Problem The `_Shadcn_` suffix isn't needed anymore on breadcrumb components ## Solution Remove it. No other changes <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Standardized breadcrumb component exports across the codebase by removing internal aliasing and using direct component exports. No UI, behavior, or public API changes; end-user experience unchanged. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45984) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
5d97339d41 |
chore: remove <Select> _Shadcn_ suffix (#45988)
## Problem The `_Shadcn_` suffix isn't needed anymore on `Select` components ## Solution Remove it. No other changes <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Updated internal component architecture to standardize and simplify the codebase. These changes improve code maintainability and consistency across the application without affecting existing functionality or user experience. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45988) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
