Add entitlement check for storage image transformations to properly
control access based on organization's plan.
### Changes
- Add `storage.image_transformations` entitlement check to Storage
Settings
- Add `storage.max_file_size.configurable` entitlement check to Storage
Settings
- Disable image transformation toggle based on entitlement instead of
just free tier check
- Wait for entitlement loading before initializing form values
- Use entitlement value as fallback when setting default
imageTransformationEnabled state
- Consolidate all loading states into a single isLoading variable for
cleaner code
### Testing
- Head to `/project/_/storage/files/settings` with an Org on the Free
Plan
- Assert that the Image Transformations toggle is disabled
- Head to `/project/_/storage/files/settings` with an Org on the Free
Plan
- Assert that the Image Transformations toggle is enabled
- Toggle it, save and refresh the page to assert that your changes were
correctly saved
### Changes
Replace hard-coded plan checks with `assistant.advance_model`
entitlement for AI model access control.
- `AIAssistant.tsx` & `ModelSelector.tsx`: Use
`useCheckEntitlements('assistant.advance_model')` instead of `plan.id
!== 'free'`
**Server-side:**
- `org-ai-details.ts`: Check `assistant.advance_model` entitlement via
new `checkEntitlement()` helper
- `entitlements-query.ts`: Add `checkEntitlement()` function with auth
headers support for server-side calls
### Test 1: Free Plan (No Entitlement)
- Open AI Assistant with a Free plan org
- Check model selector defaults to gpt-5-mini
- Click dropdown - verify gpt-5 shows "Upgrade" badge
- Click gpt-5 - should redirect to billing page
- Assert that you can send a message to the Assistant and that you get a
response
<img width="335" height="156" alt="image"
src="https://github.com/user-attachments/assets/2458cbd1-46ab-46cd-babb-09a47e163fd0"
/>
### Test 2: Paid Plan (Has Entitlement)
- Switch to Pro/Team/Enterprise org
- Check model selector defaults to gpt-5
- Click dropdown - verify gpt-5 shows checkmark (no badge)
- Switch to gpt-5-mini, then back to gpt-5 - should work without
redirect
- Assert that you can send a message to the Assistant and that you get a
response
Enables Braintrust tracing for AI Assistant chats to support debugging
and future online evals.
**Code Changes**
- Wraps `generateAssistantResponse` in a Braintrust `traced()` span,
logging the user's latest message as input along with metadata
(`chatId`, `chatName`, `projectRef`, `userId`, `orgId`, `planId`, etc.)
- Threads JWT claims from `apiWrapper` → handler to log `userId` in
Braintrust without an extra API call (+ expanded `apiWrapper` tests)
- Threads `orgId` and `planId` from `getOrgAIDetails` to log in
Braintrust
**Infrastructure Changes**
- Created a "Vercel" service account in Braintrust
- Added `BRAINTRUST_API_KEY` and `BRAINTRUST_PROJECT_ID` env vars to the
studio-staging project in Vercel using a service token for the above
service account
- Added an "Overview" view to the Logs tab in the Braintrust Assistant
project to surface the new metadata
**Precautions**
- HIPAA sensitive projects are excluded from logging (see
https://github.com/supabase/supabase/pull/42787 for the detection logic)
- Production is temporarily excluded from logging until we're confident
in the setup
**Testing steps**
- Chat with the AI Assistant in the [studio-staging preview
build](https://github.com/supabase/supabase/pull/42963#issuecomment-3917178023)
below
- Visit the [Logs tab in the Braintrust Assistant
project](https://www.braintrust.dev/app/supabase.io/p/Assistant/logs)
and inspect the trace
<img width="4680" height="962" alt="CleanShot 2026-02-18 at 17 43 55@2x"
src="https://github.com/user-attachments/assets/c3a11b21-4e7f-4e90-bdab-a25ab8ee0d1f"
/>
<img width="2632" height="1288" alt="CleanShot 2026-02-18 at 17 45
04@2x"
src="https://github.com/user-attachments/assets/6c7b6ebc-5090-4ede-8f71-859ff7e386aa"
/>
**References**
- https://www.braintrust.dev/docs/integrations/sdk-integrations/vercel
- https://www.braintrust.dev/docs/instrument/custom-tracing
Closes AI-438
This PR updates @supabase/*-js libraries to version 2.97.1-canary.0.
**Source**: manual
**Changes**:
- Updated @supabase/supabase-js to 2.97.1-canary.0
- Updated @supabase/auth-js to 2.97.1-canary.0
- Updated @supabase/realtime-js to 2.97.1-canary.0
- Updated @supabase/postgest-js to 2.97.1-canary.0
- Refreshed pnpm-lock.yaml
This PR was created automatically.
Co-authored-by: mandarini <6603745+mandarini@users.noreply.github.com>
This pull request upgrades the `react-resizable-panels` dependency from
version 2.x to 3.x. It also includes some minor improvements to
component props and key usage for React elements.
**Dependency upgrade:**
* Upgraded `react-resizable-panels` from version 2.1.4 to 3.0.0.
**Component improvements:**
* Added a `key` prop to the `ResizablePanelGroup` in `LogTable.tsx` and
to action buttons in `UnifiedLogs.tsx` to help React identify elements
more efficiently.
* Ensured unique `key` props for icons rendered in a map in
`FilterSideBar.tsx` to prevent React warnings.
## What kind of change does this PR introduce?
Grammar corrections in comments and user-facing text.
## What is the current behavior?
Several files have minor grammar issues:
- Missing contraction: "it an error" (should be "it's an error")
- Subject-verb disagreement: "a users loads" (should be "a user loads")
- Missing possessive apostrophe: "a users organization" and "a users
language" (should be "a user's")
## What is the new behavior?
All grammar issues are corrected:
- `apps/studio/instrumentation-client.ts` — "it's an error" + "a user
loads"
- `apps/docs/instrumentation-client.ts` — "a user loads"
- `apps/www/data/partners/index.tsx` — "a user's organization"
-
`apps/docs/content/troubleshooting/customizing-emails-by-language-KZ_38Q.mdx`
— "a user's language"
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
We had these error ignores inside of sentry, doesn't make sense and
rather should live next to the code
## What kind of change does this PR introduce?
Grammar corrections across documentation and test descriptions.
## What is the current behavior?
Multiple docs and test files use "a" before acronyms that start with a
vowel sound when pronounced:
- "a HTTP" (pronounced "aitch-tee-tee-pee") should be "an HTTP"
- "a API" (pronounced "ay-pee-eye") should be "an API"
- "a RLS" (pronounced "arr-ell-ess") should be "an RLS"
- "the all users" is redundant (should be "all users")
## What is the new behavior?
All instances corrected to use proper English indefinite articles:
### Docs files (11 files):
- `firebase-auth.mdx` — "the all users" -> "all users" (2 occurrences)
- `log-drains.mdx` — "a HTTP drain" -> "an HTTP drain"
- `securing-your-api.mdx` — "a HTTP 402" and "a HTTP 420" -> "an HTTP"
- `scan-error-*.mdx` — "a HTTP 500" -> "an HTTP 500"
- `roboflow.mdx` — "a HTTP interface" -> "an HTTP interface"
- `auth-hooks.mdx` — "A HTTP Hook" -> "An HTTP Hook", "a HTTP hook" ->
"an HTTP hook", "a HTTP error" -> "an HTTP error"
- `auth-mfa.mdx` — "a HTTP 401" -> "an HTTP 401"
- `password-verification-hook.mdx` — "a HTTP request" -> "an HTTP
request"
- `before-user-created-hook.mdx` — "a HTTP implementation" -> "an HTTP
implementation"
- `pgtap-extended.mdx` — "a API exposed schema" -> "an API exposed
schema"
- `error-codes.mdx` — "a RLS policy" -> "an RLS policy"
- `broadcast.mdx` — "a RLS" -> "an RLS"
### Studio files (1 file):
- `CronJobs.utils.test.ts` — "a HTTP request" -> "an HTTP request" (9
test descriptions) + "notationa" typo -> "notation"
## Additional context
The rule: use "an" before acronyms pronounced with a leading vowel
sound. "HTTP" starts with "aitch" (vowel sound), "API" starts with "ay"
(vowel sound), and "RLS" starts with "arr" (vowel sound).
## What kind of change does this PR introduce?
Documentation and copy corrections.
## What is the current behavior?
Several docs and one Studio file contain grammar, spelling, and
capitalization issues:
- JS v1 upgrade guide: "we'll continuing" (should be "we'll continue"),
"Some the [PR]" (should be "See the [PR]"), extra space before comma
- Realtime docs: "PostgresSQL" (should be "PostgreSQL") in 2 files
- Kotlin SDK installing docs: "Websockets" (should be "WebSockets"),
"Checkout the" (should be "Check out the")
- Broadcast guide: "Websockets" (should be "WebSockets") in code
comments (5 occurrences)
- Prisma troubleshooting: "Checkout this" (should be "Check out this")
- Edge function template: "Websocket Server Example" (should be
"WebSocket Server Example")
## What is the new behavior?
All grammar, spelling, and capitalization issues are corrected:
- **Grammar**: "we'll continue" (verb tense), "See the [PR]" (correct
word), removed extra space
- **Spelling**: "PostgreSQL" (correct product name)
- **Capitalization**: "WebSocket" / "WebSockets" follows the official
W3C/IETF naming convention
- **Word splitting**: "Check out" as a phrasal verb (two words), vs
"checkout" the noun
## Files changed (8)
- `apps/docs/docs/ref/javascript/v1/upgrade-guide.mdx` — grammar fixes
(3 issues)
- `apps/docs/docs/ref/self-hosting-realtime/introduction.mdx` —
PostgresSQL -> PostgreSQL
- `apps/docs/docs/ref/realtime/realtime.mdx` — PostgresSQL -> PostgreSQL
- `apps/docs/docs/ref/kotlin/v2/installing.mdx` — WebSockets + Check out
- `apps/docs/docs/ref/kotlin/installing.mdx` — WebSockets + Check out (2
occurrences)
- `apps/docs/content/guides/realtime/broadcast.mdx` — Websockets ->
WebSockets (5 occurrences)
- `apps/docs/content/troubleshooting/prisma-error-management-Cm5P_o.mdx`
— Check out
- `apps/studio/components/interfaces/Functions/Functions.templates.ts` —
WebSocket template name
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed timestamp display in request logs to ensure accurate time
representation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
* Upgraded `@radix-ui/react-tooltip` from version `^1.1.6` to `^1.2.8`
in `package.json` and all relevant entries in `pnpm-lock.yaml` to use
the latest release.
## Context
Ensure that project's logs pages are accessible irregardless of
project's status, given that logs are mutually exclusive from the
project's database and doesn't require the database to be online for it
to be functional.
## Other changes
Mainly around simplifying some logic within ProjectLayout
- Remove `disabled` prop in `SideBarNavLink` component, given that
`route` prop already has a `disabled` param
- Define `disabled` within `NavigationBar.utils.tsx` -> just have one
place to define the "configuration" of a route
- Minimize manually declaring specific routes to render specific UI (for
Restore failed)
- All of these can be grouped under `routesToIgnoreDBConnection`
## To test
- [ ] Verify that you can access the logs page while the project is
coming up
- [ ] Verify that you can access the logs page on a paused project (and
also use it)
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix
## What is the current behavior?
<img width="300" height="300" alt="image"
src="https://github.com/user-attachments/assets/dd39485d-0c04-43c9-bed4-bd21db0ebdcd"
/>
It allows you to attempt to create a branch even when that branch is
used.
We then get a vague error that the branch creation has failed.
<img width="200" height="50" alt="image"
src="https://github.com/user-attachments/assets/7d7c9d1f-93d1-4278-ac88-766bb02c5aa3"
/>
## What is the new behavior?
<img width="350" height="400" alt="image"
src="https://github.com/user-attachments/assets/fc0562cb-4478-417b-9a1b-f192ba24076a"
/>
## Additional context
Add any other context or screenshots.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Prevented users from linking the same GitHub branch to multiple local
branches, with clear error messages shown during both branch creation
and editing.
* Enhanced validation checks to ensure branch linkage uniqueness and
provide real-time feedback on invalid selections.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Ali Waseem <waseema393@gmail.com>
## What kind of change does this PR introduce?
Documentation improvement for Realtime Presence.
## What is the current behavior?
The Presence documentation doesn't explain that during a `sync` event,
clients may receive `join` and `leave` events simultaneously even when
no users are actually joining or leaving. This can be confusing for
developers new to Presence.
## What is the new behavior?
Added an explanatory note clarifying that:
- During `sync`, you may receive `join` and `leave` events at the same
time
- This is normal and expected
- It reflects state reconciliation with the server, not real user
movement
This helps developers understand this behavior upfront rather than
having to discover it through debugging.
## Additional context
As mentioned in the issue, this behavior is discussed in [this community
discussion](https://github.com/orgs/supabase/discussions/26748) where
the solution had to be discovered by users.
Fixes#41175
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Clarified behavior during sync events in the Realtime Presence guide.
Added explanation that simultaneous join and leave events may occur due
to state reconciliation rather than actual user movement changes.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Related to this previous PR
[here](https://github.com/supabase/supabase/pull/42321)
Table Editor: Adding a CTA to the `HighQueryCost` UI to allow users to
proceed with fetching data despite the high query cost warning, to
prevent completely blocking the users from their workflows (realised
that certain heavy queries are required and this safeguard shouldn't be
creating dead-ends for users)
<img width="1159" height="264" alt="image"
src="https://github.com/user-attachments/assets/5fa01f7f-4442-4349-91f2-f4275e177f89"
/>
Clicking "Load more" will open a confirmation dialog, in which
proceeding to load the data will thereafter suppress this preflight
check for the table, for the rest of the browser session
<img width="450" height="305" alt="image"
src="https://github.com/user-attachments/assets/d3197a5d-a861-47a8-95da-e157972ce092"
/>
## Other changes
- Also bumped the query cost threshold from 100,000 to 200,000 - the
former might have been too aggressive 😓
- (Unrelated) Added query cost tooltip for cron jobs high query cost
warning
<img width="450" height="230" alt="image"
src="https://github.com/user-attachments/assets/d2c66972-7c4c-4f99-818c-e90a0991c2f5"
/>
## What kind of change does this PR introduce?
Documentation fix
## What is the current behavior?
In `apps/docs/content/guides/platform/billing-on-supabase.mdx`, the
"Control your costs" link has an empty URL (`[Control your costs]()`),
making it non-functional. Users clicking this link are not taken to the
cost control documentation.
## What is the new behavior?
The link now correctly points to `/docs/guides/platform/cost-control`,
which is the existing page that covers Spend Cap, Billing Alerts, and
other cost control features.
## Additional context
The other two links in the same list (`Your monthly invoice` and `Manage
your usage`) already have correct URLs. This appears to be an oversight
where the cost-control page was created but the link in the billing
overview was not updated.
## Context
In database/tables (Schema visualizer), if the schema has no tables,
clicking on "Auto layout" causes a client error as we're trying to run
the `dagre.layout` on a graph with 0 nodes and edges
Opting to hide all actions on the Schema Visualizer if there's no tables
(understandably we've been leaning towards disabled states rather than
hiding, but in this case i was thinking hiding is better since that's an
empty state - unless some actions were applicable in the empty state,
but in this case none of the actions are)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Improved reliability of the database schema interface by strengthening
empty state handling
* Ensured database actions are properly hidden when no tables exist in
the schema
* **Refactor**
* Consolidated schema state validation logic for better code
maintainability
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Related to FE-2461
More refactoring to clean up usage of `useQueryStateWithSelect`, mainly
in the database pages
- Roles
- Triggers
- Functions
- Enumerated Types
## To test
In each of those pages, verify that
- [ ] Clicking the "new" cta updates the URL params, and refreshing
should re-open the sheet
- [ ] Editing an existing item should update URL params, and refreshing
should re-open the sheet with the right item
- Verify that if the URL param has the wrong id, page should not open
the sheet, show a toast, and reset the URL param
- [ ] Deleting an existing item should update URL params, and refreshing
should re-open the sheet with the right item
- Verify that if the URL param has the wrong id, page should not open
the sheet, show a toast, and reset the URL param
---------
Co-authored-by: Ali Waseem <waseema393@gmail.com>
Database migration — adds a new table.
## What is the current behavior?
There is no table to cache AI-derived incident metadata.
## What is the new behavior?
Adds an `incident_status_cache` table for caching AI-derived incident
metadata.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Minor amount of tests for Realtime because we have zero E2E coverage
here
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added comprehensive end-to-end test coverage for the Realtime
Inspector: channel join/leave, start/stop listening, broadcast
workflows, message display, JSON validation, and cleanup to improve
reliability.
* Added supporting test helpers/utilities to enable deterministic
navigation, channel operations, message waiting, and modal interactions
for stable test execution.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Feature
## What is the current behavior?
The Functions counter on the Home page is only displayed in platform
environments.
In self-hosted setups, the counter is hidden due to a platform guard,
even though Functions may be available.
## What is the new behavior?
The Functions counter is now also displayed in self-hosted environments.
This is now possible thanks to the following PRs:
- #40690
- #42322
- #42349
- #42350
These PRs introduce and enable the API required for listing Functions in
Studio, making it feasible to show the Functions count outside of the
platform environment.
## Additional context
Related issues: #36285
This change removes the platform-only restriction around the Functions
card in the Home interface, allowing feature parity between platform and
self-hosted deployments where the Functions API is available.
---------
Co-authored-by: Andrey A. <56412611+aantti@users.noreply.github.com>
Co-authored-by: Charis Lam <26616127+charislam@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
The changes required for this React Doctor need more thought that I can
hammer with AI. Just need to stop this from happening in the future with
Ratchet rules
This PR:
- Adds a new Join types and join modifiers section to the
joins-and-nesting guide.
- Documents default left join semantics for embedded relations.
- Explains !inner for inner-join behavior.
- Explains : aliasing and ! join modifiers (!inner, !foreign_key).
- Adds join/filter examples with expected JSON results.
- Includes query examples across JavaScript, Dart, Swift, Kotlin,
Python, and URL.
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix. One liner.
## What is the current behavior?
The resizable product menu to the left on drag responds with a slow drag
animation.
This is inconsistent with other resizable drag animations.
## What is the new behavior?
the drag animation is consistent and snappy!
## Additional context
As far as I can tell the transition animation on the `ResizablePanel` is
for the open and closing of the menu and not for resizing. It looks like
a just overly broad transition target (`transition-all`).
The react-resizable-panels seems to use flex grow to do the animation.
The `transition-all` which is currently on the `ResizablePanel`
component is causing the flex grow to animate and this in turn is
causing some minor layout thrashing.
<img width="406" height="579" alt="Screenshot 2026-01-21 at 8 40 24 PM"
src="https://github.com/user-attachments/assets/9282731a-f1d6-411d-9092-25f0bddff29f"
/>
After this update the layout thrashing from flex-grow is fixed.
<img width="539" height="520" alt="Screenshot 2026-01-21 at 6 38 00 PM"
src="https://github.com/user-attachments/assets/dc2b2e28-8298-400e-8f19-77edaf6b9884"
/>
Related to [this](https://github.com/supabase/supabase/issues/27801)
issue.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Refined sidebar animation to animate width-related properties only,
delivering smoother and more responsive open/close transitions without
changing timing.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The [spec generation Makefile started
failing](https://github.com/supabase/supabase/actions/runs/22142393017)
with:
```text
ReferenceError: React is not defined
at Object. (/Users/.../_npx/.../node_modules/styled-components/dist/styled-components.cjs.js:1:860)
```
This occurred when `@redocly/cli@2.18.2` was released on Feb 16, 2026.
The error happens because `npx @redocly/cli` installs the package in an
isolated temporary cache without properly resolving peer dependencies
(React is a peer dependency of styled-components).
## Solution
Replace `npx @redocly/cli` with `pnpm exec redocly` to use the installed
version from `packages/generator/package.json`.
This ensures:
1. **Proper dependency resolution** - pnpm installs the full dependency
tree including peer dependencies
2. **Version control** - locked to the version in package.json instead
of always fetching latest
3. **Reproducible builds** - won't break when new versions are released
## Changes
- Replace `npx @redocly/cli` → `cd $(GENERATOR_DIR) && pnpm exec
redocly` (5 places)
- Replace `npm run` → `pnpm run` for consistency with project's package
manager (6 places)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated build configuration to execute documentation generation tasks
from a centralized generator directory with unified package management,
ensuring consistent handling of OpenAPI bundling, TypeScript
documentation, and validation workflows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This PR updates @supabase/*-js libraries to version 2.97.0.
**Source**: supabase-js-stable-release
**Changes**:
- Updated @supabase/supabase-js to 2.97.0
- Updated @supabase/auth-js to 2.97.0
- Updated @supabase/realtime-js to 2.97.0
- Updated @supabase/postgest-js to 2.97.0
- Refreshed pnpm-lock.yaml
This PR was created automatically.
Co-authored-by: supabase-releaser[bot] <223506987+supabase-releaser[bot]@users.noreply.github.com>
Add myself into `humans.txt`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated team information in public metadata.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Joshen Lim