<!-- ccr-slack-attribution -->
_Requested by **Ivan Vasilov** · [Slack
thread](https://supabase.slack.com/archives/C0161K73J1J/p1784635673434979)_
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Chore / cleanup — removes a scheduled GitHub Actions workflow.
## What is the current behavior?
The `Dashboard PR Reminder` workflow
(`.github/workflows/dashboard-pr-reminder.yml`) runs on a schedule and
posts a "Dashboard PRs Older Than 24 Hours" reminder to Slack. It has
become too noisy — Jordi flagged that it fired 5 times in 3 days. The
#team-frontend team agreed to remove it rather than reschedule it.
## What is the new behavior?
The workflow and its exclusively-used supporting scripts are deleted, so
the Slack reminder no longer runs.
Files removed (each used exclusively by this workflow):
- `.github/workflows/dashboard-pr-reminder.yml` — the reminder workflow
itself.
- `scripts/actions/find-stale-dashboard-prs.ts` — helper invoked only by
this workflow's run step; not referenced anywhere else in the repo.
- `scripts/actions/send-slack-pr-notification.ts` — helper invoked only
by this workflow's run step; not referenced anywhere else in the repo.
(This leaves `scripts/actions/` empty, so the directory is removed too.)
No shared files were touched. The workflow's `sparse-checkout` of
`scripts`/`patches`, `.nvmrc`, and `pnpm-lock.yaml` are repo-wide and
remain in place.
## Additional context
Verified via a full-repo grep that the two scripts and the workflow file
are referenced nowhere outside this workflow before deleting them.
---
_Generated by [Claude
Code](https://claude.ai/code/session_01RynCtzP874KrpN8CPf7n7n)_
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Ali Waseem <waseema393@gmail.com>
## TL;DR
Restores handling for functions with `search_path` set to `''` editing
them in the UI was failing with a Postgres `zero-length delimited
identifier` error since the SafeSql refactor dropped the empty-string
sentinel conversion
## ref
- closes#48149
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Preserved empty `search_path` configuration values when updating
database functions.
* Prevented empty configuration values from being altered or lost during
function updates.
* **Tests**
* Added coverage verifying that function definitions can be updated
without changing an existing empty `search_path` setting.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
- Updates the publish date of the "Supabase Pipelines is now in Public
Alpha" blog post from July 15 to July 21
- Renames the post file to match the new date
- Updates the `date` frontmatter field
## What is the current behavior?
The post is dated 2026-07-15.
## What is the new behavior?
- The post is dated 2026-07-21 to match the public launch date
- File renamed to
`apps/www/_blog/2026-07-21-supabase-pipelines-public-alpha.mdx`
- Frontmatter `date` set to `'2026-07-21'`
## Additional context
N/A
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the publication date for the Supabase Pipelines public alpha
blog post to July 21, 2026.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Ana <ana1337x@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
- Add a new blog post:
`apps/www/_blog/2026-07-15-supabase-pipelines-public-alpha.mdx`,
announcing that Supabase Pipelines is moving from private to public
alpha
- Covers new schema change support (add/remove/rename columns,
nullability/default changes), a faster parallelized initial copy, and
new destination request forms for ClickHouse, Snowflake, and DuckLake
- Authored by `riccardo_busetti`
## What is the current behavior?
N/A — this is a new blog post page at
`/blog/supabase-pipelines-public-alpha`.
## What is the new behavior?
- New post published at `/blog/supabase-pipelines-public-alpha`
## Additional context
n/a
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
- **Announcements**
- Published a new blog post announcing **Supabase Pipelines** is now
available in **Public Alpha**, with updates on improved performance and
operability since private alpha.
- **Documentation**
- Documented **schema change support**, **faster initial copy** via
parallelized table copying, and the pipeline lifecycle based on
**Postgres logical replication**.
- Added details for the first destination (**BigQuery**), destination
request forms (ClickHouse/Snowflake/DuckDBLake), plus **roadmap**,
**pricing**, **getting started**, and **public-alpha caveats**.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Ana <ana1337x@users.noreply.github.com>
Co-authored-by: Riccardo Busetti <riccardo.busetti@supabase.io>
## Summary
- Adds design-system guidance for the shared Connect interstitial layout
used by authorisation, invite, marketplace, CLI, and credit flows
- Includes a glanceable example showing the centred 400px card for
partner authorise and wrong-account invite states
- Documents Studio helpers (`InterstitialLayout`, logo helpers, account
row, `OrganizationSelector`) so future surfaces reuse one pattern
instead of bespoke shells
## Context
Most of the Studio Connect UI work from this effort has already landed.
This PR keeps the documentation and design-system example so the pattern
stays discoverable.
Related: [Shared Connect UI for Authorization and Partner
Flows](https://linear.app/supabase/project/shared-connect-ui-for-authorization-and-partner-flows-94587ac29d38)
## Test plan
- [ ] Open `/docs/ui-patterns/connect-interstitials` in the design
system
- [ ] Confirm the page appears under UI Patterns in the nav
- [ ] Confirm the example renders the authorise and wrong-account cards
side by side
- [ ] Skim the guidance for accuracy against current Studio
`InterstitialLayout` usage
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added new design-system “Connect Interstitials” example demos,
including branding variations (single vs dual logos) and a complete
connect-card flow with account row and sign-out action.
* Registered the new Connect Interstitials examples in the design-system
example registry.
* **Documentation**
* Added a “Connect Interstitials” UI Patterns page covering when to use
the pattern, recommended card/layout structure, branding/logo guidance,
and conventions for states, actions, and copy.
* Updated the documentation sidebar to include the new page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Studio UI polish for the Vercel deploy-button new-project connect flow
(DEPR-616 follow-up).
## What is the current behavior?
- Deploy-button project creation still used
`VercelIntegrationWindowLayout` (top bar + Docs/Support footer) while
install and choose-project already use shared `InterstitialLayout`
- The remove-integration note sat as a floating admonition above the
form
- Advanced / internal-only config sections could show double dividers,
and the Oriole radio bottom border could clip inside the collapsible
## What is the new behavior?
- Deploy-button new-project uses `InterstitialLayout` with
`VercelIntegrationLogo` and `VercelIntegrationFooter`, matching the
other Vercel connect surfaces
- Regular `/new` project creation is unchanged; Panel chrome is only
flattened when `isVercelIntegrationFlow` is set
- Removes unused `VercelIntegrationWindowLayout` /
`IntegrationWindowLayout`
- Fixes Advanced/Internal-only dividers and collapsible border clipping
| Before | After |
| --- | --- |
| <img width="965" height="1107" alt="Supabase"
src="https://github.com/user-attachments/assets/99c1225c-c9e5-4fac-bd64-17920403e447"
/> | <img width="965" height="1107" alt="Create Vercel Project Supabase"
src="https://github.com/user-attachments/assets/c42bff96-5f9f-4c8b-8f3c-093e380f90ed"
/> |
## Additional context
### Testing
With Studio running locally and while signed in:
1. Open
`http://localhost:8082/integrations/vercel/<your-org-slug>/deploy-button/new-project`
2. Confirm the interstitial card: Vercel + Supabase logo pair, “Create a
new project” title, form fields, and the muted remove-integration footer
under the card
3. Confirm there is no old window chrome (no “Marketplace Connector” /
“Deploy Button” top bar, no Docs/Support footer)
4. Optionally submit and confirm project creation still works
5. Spot-check `/new` to confirm the normal project creation form is
unchanged
If you have advanced config enabled, expand Advanced Configuration and
confirm single dividers (not doubles) and that the Oriole option’s
bottom border is not clipped.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* Added configurable width to the shared interstitial layout for Vercel
project creation.
* Updated the Vercel “new project” flow to use the interstitial UI.
* **Bug Fixes**
* Prevented child borders/shadows from being clipped in expandable
configuration sections.
* **Refactor**
* Removed legacy Vercel/window layout components and updated routing to
rely on the interstitial flow.
* Switched advanced and internal-only configuration sections to render
inside panel content.
* **Documentation**
* Refreshed Vercel integration route guidance in the migration checklist
and inline route comments.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
The cron job form has no default value for the timeout input. However,
if left empty, the zod schema default it to 0 which fails validation.
By setting a default value on the input we ensure:
- a value is actually provided
- validation triggers if users clear the input
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Cron job forms now use a consistent 1-second timeout default across
function and HTTP request types.
* Changing the cron job “Type” clears any previously generated snippet
and resets the timeout back to the shared default.
* Form initialization and reset behavior were improved to prevent stale
timeout/snippet state when creating or editing cron jobs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- ccr-slack-attribution -->
_Requested by **Ivan Vasilov** · [Slack
thread](https://supabase.slack.com/archives/C0161K73J1J/p1784639352877839?thread_ts=1784625513.046239&cid=C0161K73J1J)_
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix.
## What is the current behavior?
Running `pnpm --filter=docs run build:guides-markdown` standalone — as
`apps/www`'s prebuild does, without first running
`build:federated-content` — crashes with `ENOENT ... ai-skills.json`
(and the equivalent for `terraform.schema.json`).
The `AiSkillsIndex` and `TerraformProviderSchema` markdown-schema
handlers `readFileSync` a gitignored, build-time-generated JSON artifact
unconditionally. In the full docs build these files exist because
`build:federated-content` runs first (via the docs `prebuild`), but in
the standalone / www path they do not, so the read throws.
These unguarded reads were introduced in #48045 (ai-skills) and #48010
(terraform), which surfaced as the www Vercel build failure.
## What is the new behavior?
Both handlers now render an empty section (return an empty string) when
the generated artifact is absent, so `build:guides-markdown` succeeds in
the standalone / www path.
When the artifact IS present (the full docs build, which runs
`build:federated-content` first), behavior is byte-for-byte unchanged —
the file is parsed and rendered exactly as before. The full docs build
is not affected.
## Additional context
Implemented with a minimal `existsSync` guard (from the already-imported
`node:fs`) in each handler:
- `apps/docs/internals/markdown-schema/AiSkillsIndex.ts`
- `apps/docs/internals/markdown-schema/TerraformProviderSchema.ts`
No changes to any `package.json`, `.gitignore`, or the generators — the
fix is confined to the two handlers.
---
_Generated by [Claude
Code](https://claude.ai/code/session_01RynCtzP874KrpN8CPf7n7n)_
Co-authored-by: Claude <noreply@anthropic.com>
## Summary
- Simplify CPU messaging on the Compute and Disk docs page and in
Studio's compute size UI to keep it generic rather than
architecture-specific.
## Test plan
- [x] Unit tests pass
- [x] Typecheck passes
- [x] Lint passes
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Simplified compute size labels across the UI by removing
cloud-provider architecture details from CPU text.
* Standardized CPU descriptions to show core counts and whether
resources are shared or dedicated.
* Updated the “Compute Size” pricing/specs table in the compute & disk
guide to use generic CPU labels while keeping pricing, memory, and
database size guidance the same.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Chore / tooling — adds new ESLint rules for `valtio` and
`react-hook-form`.
## What is the current behavior?
Studio uses `valtio` and `react-hook-form` heavily, but neither
library's dedicated ESLint plugin was installed, so their common API
pitfalls were only caught at runtime.
## What is the new behavior?
Adds `eslint-plugin-valtio` and `eslint-plugin-react-hook-form` (6 rules
total) as `warn`, wired into the existing lint ratchet
(`scripts/ratchet-rules.json` + baselines) so current violations are
grandfathered and only new ones fail CI — no existing code is changed.
Since `eslint-plugin-react-hook-form@0.3.1` still calls the removed
ESLint 8 `context.getScope()`, it is wrapped with `fixupPluginRules`
from `@eslint/compat` so its rules run under flat config / ESLint 9.
## Additional context
Baselines captured: `valtio/state-snapshot-rule` (1),
`valtio/avoid-this-in-proxy` (1), `react-hook-form/no-use-watch` (77),
and the three recommended react-hook-form rules (0 each).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Code Quality**
* Expanded linting for Valtio state usage, including safer proxy usage
and snapshot-related patterns.
* Added React Hook Form lint rules to encourage safer form state
handling and discourage problematic watch usage.
* Updated accessibility lint configuration and improved ESLint
reliability by enabling an ESLint 8→9 compatibility shim for affected
rules.
* **Maintenance**
* Updated ESLint rule baselines and ratcheting settings to match newly
enabled rules.
* Added required ESLint plugins to the Studio linting setup.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add `useSiwcQueryParamOptIn`, which flips on the ChatGPT sign-in rollout
localStorage flag when `?siwc-enabled=1` is present, and call it from
both pages/sign-in.tsx and pages/sign-up.tsx.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for enabling the sign-in experience via
`?siwc-enabled=1`, automatically updating the stored opt-in flag on both
sign-in and sign-up pages.
* **Tests**
* Added coverage confirming the stored flag is updated only for
`siwc-enabled=1`, and not for missing, non-`1`, `0`, or repeated/array
values.
* Added assertions that the behavior is triggered consistently when
rendering the sign-in and sign-up pages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
Line-style report charts (auth processing time, percentiles, edge
functions, realtime, etc.) hardcoded `stackId="1"` on every `<Area>`, so
recharts summed the series additively instead of overlaying them.
When multiple series share a value (e.g. Max/Min/Avg all `153.98`), they
rendered as three stacked bands at 1x/2x/3x the value, even though the
tooltip showed the true identical values.
## Fix
Default each area to its own `stackId` (its attribute name) so series
overlay, while still honoring an explicit per-attribute `stackId` from
config — matching the existing bar-chart path directly above it.
`normalizeVisibleStackToPercent`, the only flag that would make stacked
areas intentional, is never enabled anywhere.
## Before / after
Before: three equal values drawn at `0→153.98`, `153.98→307.96`,
`307.96→461.94`.
After: all three overlay at `153.98`.
Affects every line-style multi-series report, not just auth.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Improved stacked chart behavior by consistently applying configured
series stacking settings.
- Ensured area charts can overlay correctly when no explicit stacking
configuration is provided.
- Added safeguards for missing or invalid chart attribute data.
- **Tests**
- Added coverage for configured stack IDs, fallback behavior, empty
values, and invalid inputs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Only applies for local development - adds a way to filter feature flags
in the dev toolbar
<img width="1385" height="223" alt="image"
src="https://github.com/user-attachments/assets/323d29f6-209e-4fc3-a7d0-4160b62b5707"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added search and filtering for feature flags from PostHog and
ConfigCat.
* Added a clear button for quickly resetting searches.
* Added an informative empty state when no feature flags match the
search.
* Search terms reset automatically when switching between flag
providers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Only applies for local development - adds a way to mock org restrictions
with the dev toolbar
<img width="1392" height="484" alt="image"
src="https://github.com/user-attachments/assets/64b8b0c6-c59a-453a-88fa-ffbc2565cd87"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added organization-level warning controls to the development toolbar,
including a new “Organization warnings” section to simulate restriction
status variants (none, grace periods, restricted, and overdue-invoice
scenarios, including an “other org” option).
* Updated the existing project-warning controls’ guidance to reference
the current organization or project.
* **Bug Fixes**
* Improved cleanup so resetting or closing warning overrides reliably
restores the real organization and invoice warning data, including after
navigation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Initial work for Top for Postgres - adds a "Sessions" section under a
new Observability segment "Database Connections"
NOTE: All the copywriting and naming might change - not sure what's an
ideal title for this
We'll also be iteratively building on top of this UI, adding more
actionable signals instead of just information
Changes are featured flagged, off for public
- This would essentially replace the "View ongoing queries" in the SQL
Editor by providing a dedicated UI
- It checks against `pg_stat_activity` as per the ongoing queries UI
- We'll also subsequently deprecate the "Ongoing queries" UI in the SQL
editor
- Defaults into a "live mode" where the data is refreshed every 3
seconds via long-polling
<img width="983" height="474" alt="image"
src="https://github.com/user-attachments/assets/16402fe4-0b53-4f9e-9342-cdda26e3778a"
/>
- Supports filtering by state
<img width="374" height="282" alt="image"
src="https://github.com/user-attachments/assets/562f8fbe-2dc6-48e7-8ec0-de7ffb8348d1"
/>
- Users can also terminate queries through here
<img width="247" height="164" alt="image"
src="https://github.com/user-attachments/assets/23a639dc-8f96-473a-a823-605b0bab02ee"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
# Release Notes
* **New Features**
* Added an Observability **Database Connections** page with a live
**Sessions** activity table (state/roles filtering, blocked-by details,
session duration, and per-session termination with confirmation).
* Included a **Live/Pause** toggle to control automatic refresh (~3
seconds).
* **Enhancements**
* Improved Reports selection filtering: supports optional option
quantities, better popover styling, sorted apply behavior, and shows
quantity inline.
* Query performance duration formatting now supports configurable
decimal precision.
* Tooltips can now render richer content (string or React node).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Fixes FE-3955 /
[SUPABASE-APP-K41](https://supabase.sentry.io/issues/7613475596/) — a
crash affecting 101 users (502 occurrences, escalating) since the
"maximise AI assistant" feature (#47954) shipped on 2026-07-15.
`DefaultLayout` calls `panelRef.current.collapse()` / `.resize()` on the
`panel-content` resizable panel whenever the AI assistant sidebar is
maximised. Below the `md` breakpoint, `LayoutSidebar` renders no panel
at all (the sidebar shows as a mobile sheet instead), leaving
`panel-content` as the *only* panel in the `ResizablePanelGroup`.
`react-resizable-panels`' resize algorithm assumes a neighboring panel
exists to pivot against, so with a single panel it computes an invalid
pivot index of `-1` and throws `Panel constraints not found for index
-1`.
This guards the effect with the same `isMobile` breakpoint check
`LayoutSidebar` already uses, so we never call `collapse()`/`resize()`
when there's no sibling panel to resize against.
## Test plan
- [ ] On a narrow viewport (or actual mobile device), open the AI
assistant and toggle maximise — should no longer throw
- [ ] On desktop, confirm maximise/minimise still resizes the content
panel as before
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed a mobile layout issue where the sidebar could collapse or resize
incorrectly, leading to runtime errors.
* Improved the sidebar’s resize/collapse behavior on mobile devices to
keep the layout stable.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
A11y cleanup follow-up to #47984 /
[DEPR-626](https://linear.app/supabase/issue/DEPR-626).
## What is the current behavior?
Studio had 82 ratcheted `supabase/require-explicit-tabindex` violations
(raw `<button>` / `role="button"` without explicit `tabIndex`).
## What is the new behavior?
- Explicit `tabIndex={0}` (or disabled → `-1`) on those Studio call
sites across nav, `components/ui`, Database, Storage, and the remainder
- Ratchet baseline cleared (**82 → 0**) and the rule **removed from the
Studio ratchet** (debt is gone; ratchet is temporary)
- Rule remains a shared **`warn`** for now — promoting to `error` (and
sweeping www/docs/design-system) is a follow-up
- Also fixed the learn/ui-library call sites that surfaced while
experimenting with error promotion
- Small follow-ups where making controls focusable exposed gaps:
accessible names, disabled/focus consistency, focus-ring polish on
To-test surfaces, home section `KeyboardSensor`, and an E2E locator
tightened after `aria-label="Remove column"`
Prefer migrating to `Button` from `ui` in future touch-ups; this PR
takes the minimal path so Studio debt can stay at zero.
## Additional context
Batches landed together so baseline conflicts stayed simple while
chipping away:
- Hotspots / nav (FirstLevelNav, Marketplace, AttachmentUpload, Column,
Tabs, …)
- `components/ui` shared
- Database + Storage
- Remainder
**Out of scope / intentional deferrals**
- Promoting `supabase/require-explicit-tabindex` to a lint **error**
(follow-up after www/docs/design-system sweeps)
- Tabs/Radio roving, tooltips, context menus, in-menu items
- Full keyboard-accessible tab-close UX (close stays hover +
`tabIndex={-1}`; context menu still closes tabs)
- Data API docs links (`/project/<ref>/api` redirect)
**Reviewer notes**
- Rule only flags raw `<button>` / `role="button"` without a `tabIndex`
prop. `Button` from `ui` already bakes this in
- `tabIndex={-1}` is intentional for disabled controls, in-menu /
roving-focus children, and hover-only tab close
- For dnd-kit grips, put `tabIndex` **after** `{...attributes}` so it
isn’t overwritten (TS2783)
### To test
Use **Safari** with macOS Keyboard navigation **off** (System Settings →
Keyboard). Chrome once for a sanity pass. For each surface below: Tab
until the control is focused, then activate with Enter/Space where
relevant.
1. **API Docs side panel** (Table Editor → open a table → **API docs**)
- Floating API Docs panel — **not** `/project/<ref>/api` (that redirects
to Data API docs; language ToggleGroup uses arrow keys; links are out of
scope)
- Left nav buttons — Tab through several and activate one; active
highlight / navigation still works
2. **Integrations → Marketplace**
- Enable **Integrations layout** feature preview first (avatar menu →
Feature previews)
- `/org/<slug>/integrations` or project integrations marketplace
- “Clear all”, grid/list toggles — Tab + activate
3. **Table Editor → create a table → Columns**
- Drag handles only appear while **creating** (not when editing an
existing table)
- Tab to grip / remove (X) / sensitive-data eye if shown
4. **Project Home** — section drag handles
- Tab to a grip (visible focus ring)
- Optional: Space to pick up, arrows to move, Space/Esc to drop
(KeyboardSensor added)
- Mouse dnd still works
5. **Storage → Policies** — expand/collapse bucket list chevron
(design-system focus ring, no stuck grey open bg)
6. **Support form** (Help → Support) — attachment remove (×) and
add-attachment control when visible
Disabled controls should be **skipped** by Tab.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Accessibility Improvements**
* Improved keyboard navigation throughout Studio by explicitly managing
focus (`tabIndex`) across many interactive controls (menus, tabs,
tables, charts, dialogs, navigation, and form actions).
* Disabled or non-interactive controls are now removed from the tab
order (or made unfocusable), while available actions remain reachable.
* Ensured `type="button"` on relevant controls to prevent unintended
submissions, and refined keyboard focus behavior for various toggles and
copy/remove actions.
* **Chores**
* Updated the ESLint rule baseline configuration to match the new focus
behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
A11y markup + keyboard close for editor tabs (Table Editor open tables /
SQL Editor snippets).
## What is the current behavior?
Editor tabs nest interactive elements (already in prod):
1. Sortable shell spreads dnd-kit `attributes` → `div role="button"
tabindex="0"`
2. Inner `TabsTrigger` → real `<button role="tab">`
3. Close control → `role="button"` nested inside the tab button
Close was hover/pointer-only. There was no clear keyboard path.
## What is the new behavior?
**Markup**
- Sortable shell is a plain `div` (no dnd-kit `attributes` / no
`role="button"`). Safe because tab reorder only uses `PointerSensor`.
- Close is a real `<button type="button">` **sibling** of `TabsTrigger`.
- Same for the non-draggable “New” tab.
**Keyboard close**
- ←/→ still move between tabs (Radix roving tabindex — Tab key does not
walk every tab).
- **Delete** or **Backspace** on a focused tab closes it.
- The **active** tab’s close button is in the tab order
(`tabIndex={0}`); Tab from the active tab reaches ×, then Enter/Space
closes. Inactive closes stay `tabIndex={-1}`.
- Close shows on hover, focus-within, and focus-visible (with focus
ring).
## Test plan
### Markup
- [ ] Inspect DOM: no `role="button"` wrapper around `role="tab"`; close
is not nested inside the tab button
### Mouse
- [ ] Hover → ×; click × closes
- [ ] Drag reorder still works
- [ ] Middle-click / double-click pin / “New” tab close still work
- [ ] Context menu → Close still works
### Keyboard
- [ ] Focus the active tab (Tab into the strip, or click then Tab)
- [ ] ←/→ moves across tabs
- [ ] Delete or Backspace closes the focused tab
- [ ] From the active tab, Tab once focuses × (visible + ring);
Enter/Space closes
- [ ] Delete while focus is in the table grid / SQL editor (not on a
tab) does **not** close tabs
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added dedicated close buttons for tabs, with visibility on hover or
focus.
* Tabs can now be closed using the Delete or Backspace keys when
focused.
* **Bug Fixes**
* Improved tab selection and drag interactions when clicking or pressing
tab close controls.
* Prevented closing a tab from unintentionally activating or dragging
it.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fix broken "Dashboard integrations" link with missing `/docs/` in the
[Partner Catalog docs
page](https://docs-git-fix-docs-dashboard-integrations-link-supabase.vercel.app/docs/guides/integrations/partner-catalog).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Clarified the difference between the Partner Catalog and Dashboard
Integrations.
* Explained that Dashboard Integrations are installed directly from a
Supabase project in the dashboard.
* Updated the Dashboard Integrations link.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds Kimi Code to the MCP server setup and AI coding agent plugins docs:
### MCP Server config
<img width="755" height="703" alt="image"
src="https://github.com/user-attachments/assets/b350aca0-ff0d-442b-b6f3-b3b4355d8fcd"
/>
### AI coding agent plugins
<img width="753" height="475" alt="image"
src="https://github.com/user-attachments/assets/100d5893-4627-4f48-9ab6-16e0c6457467"
/>
Closes AI-933
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added **Kimi Code** as a selectable plugin client in the plugins
panel.
* Added **Kimi-specific installation/setup instructions**, including
guidance on placing `mcp.json`, confirming the trust prompt, and using
`/plugins` plus `/mcp` and `/mcp-config`.
* Extended the **MCP URL builder** to generate Kimi Code HTTP-based
server configuration.
* Included **Kimi** in the **IDE** client group with a dedicated **Kimi
icon** for UI display.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- adds up to: https://github.com/supabase/cli/pull/5862
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added an “Error docs” link in Edge Function testing UI when an
`sb-error-code` header is present.
* **Bug Fixes**
* Improved the Edge Function test proxy to consistently preserve
upstream status, headers (including repeated headers), and response
bodies without transformation.
* Enhanced handling for invalid function URLs and upstream fetch
failures.
* **Tests**
* Added unit, API, and Playwright E2E coverage for error docs linking
and response proxy behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes FE-3954: clicking Skip/Run Query in the AI Assistant did nothing.
## Root cause
`onFinish` synced the AI SDK `Chat` instance's live message array
directly into valtio state (`chat.messages = messages`). valtio's
`proxy()` mutates an object's nested properties in place instead of
cloning them, so this corrupted the SDK's own array with Proxies. The
next approval click hit the SDK's internal `structuredClone()` call and
threw `DOMException: Proxy object could not be cloned` — an unhandled
rejection before any network request, so the buttons silently did
nothing.
## Fix
Assign a sanitized copy of the message array instead of the SDK's live
reference.
## Test plan
- [x] `pnpm --filter studio exec vitest run
state/ai-assistant-state.test.ts` — fails on old code with the exact
DOMException, passes on the fix
- [ ] Manual: approve/skip a suggested query in AI Assistant and confirm
it runs/is skipped
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved AI assistant chat message synchronization to prevent message
corruption.
* Ensured chat messages remain safely cloneable after approval-related
updates.
* **Tests**
* Added coverage verifying that synchronized AI assistant messages can
be cloned successfully.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix
## What is the current behavior?
`text-contrast` / `text-foreground-contrast` resolve to
`--primary-foreground`, which is always the darker of surface /
foreground lightness (text for the green primary fill).
In light mode that is near-black, so contrast text on inverted fills is
wrong: on true black (`bg-black`) it disappears; on dark fills like
`bg-red-900` it shows as a black icon instead of white. Visible
regression on the design-system colour usage page: the `text-contrast`
swatch only shows "Postgres" on hover.
Regression from the colour system rewrite (#47288), which aliased
`--foreground-contrast` → `--primary-foreground`.
## What is the new behavior?
`--foreground-contrast` is defined again as a surface-based inverse of
`--foreground` (light in light mode, dark in dark mode). Tailwind
utilities `text-contrast` and `text-foreground-contrast` map to it.
`--primary-foreground` is unchanged and still used for text on the
primary fill.
## Additional context
### Callsites to test (light mode especially)
| Where to look | What to check |
|---|---|
| [Design system → Colour
usage](https://design-system-git-fix-text-contrast-token-supabase.vercel.app/design-system/docs/color-usage)
| Under **Text**, the `text-contrast` swatch shows "Postgres" without
hovering |
| [Studio staging → Auth
Users](https://studio-staging-git-fix-text-contrast-token-supabase.vercel.app/project/_/auth/users)
→ open any user | Boolean fields (e.g. confirmed): check/X on the black
circle should be **white** (not missing) |
| [Studio staging → Support
new](https://studio-staging-git-fix-text-contrast-token-supabase.vercel.app/support/new)
→ upload a file | Red remove (`X`) badge should be a **white** X (prod
currently shows black) |
| [www →
Contribute](https://zone-www-dot-com-git-fix-text-contrast-token-supabase.vercel.app/contribute)
→ apply at least one filter | Filter count badge: **white** number on
black |
| [Studio staging → Support
link](https://studio-staging-git-fix-text-contrast-token-supabase.vercel.app/support/link)
success state (after linking a ticket) | Check on the brand badge should
use contrast text (light on brand in light mode) |
`Announcement` (`text-foreground-contrast` dismiss icon) is not
currently mounted in any app — covered by the design-system / token
check above.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix / UI polish.
## What is the current behavior?
- The Advisors sidebar attention dot drifts 1–2px sideways on
hover-expand, because its `left` offset was tied to the expanded state
while the nav icon only shifts when the sidebar is persistently open.
- When the Advisor Center header button is selected while in a critical
state, it keeps a destructive outline instead of matching the other
header circles (`bg-foreground`).
## What is the new behavior?
- Sidebar attention dot offset follows the same condition as nav icon
padding (persistently open), so it no longer drifts on hover-expand.
- Selected Advisor Center button matches the other header circles
(foreground fill, no destructive outline). Critical idle styling is
unchanged aside from a destructive hover border. The critical dot is
slightly lighter when selected in light mode so it still contrasts on
the inverted fill.
## Additional context
Earlier commits on this branch experimented with a shared
`useAdvisorAttention` hook to sync the sidebar and header indicators.
That was dropped: the sidebar Advisors route goes to project
security/performance pages, while the header opens Advisor Center
(including org notifications). Those surfaces should not share one
attention definition — thanks Joshen for catching that.
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## Summary
Fixes FE-3948: two success toasts were firing after a disk upgrade. Now
the immediate toast is skipped when a disk resize is requested, since
the polling effect already shows a completion toast once the resize is
applied.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved disk settings update notifications to prevent premature
success messages while configuration changes are still being applied.
* Success confirmation now appears after disk resizing is fully
completed.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
> **Stacked on #47994** (`docs/dart-reference-categories-in-yaml`).
Review/merge that first; GitHub will retarget this to `master` once it
lands.
## What
Adds Dart client library reference entries
(`apps/docs/spec/supabase_dart_v2.yml`) for features shipped in
[`supabase/supabase-flutter`](https://github.com/supabase/supabase-flutter)
(parity with `supabase-js`).
Rebuilt on the **new reference pipeline** (#47224 / #47994): each
method's section comes from `category` / `subcategory` fields on its own
YAML entry, with subcategory overviews as committed partials under
`spec/reference/dart/v2/partials/`. As a result this PR no longer
touches `common-client-libs-sections.json` or `supabase_js_v2.yml` (the
earlier shared-nav id rename is unnecessary now that Dart no longer
reads that file).
## Changes
**Auth (OAuth 2.1 server)** — new **OAuth Server** section
- `oauth.getAuthorizationDetails()`, `oauth.approveAuthorization()`,
`oauth.denyAuthorization()`
**Auth admin** — new **Custom Provider Admin** section
-
`admin.customProviders.listProviders/createProvider/getProvider/updateProvider/deleteProvider`,
including `customClaimsAllowlist`
**Realtime**
- `onHeartbeat`
- `onPostgresChanges` examples for the new pattern/negated filter
operators, multiple filters, and column selection
**Postgrest**
- `explain()` `format` option (`ExplainFormat.text` / `.json`)
## Pipeline plumbing
- New partials: `oauth-server.json`, `custom-provider-admin.json`
- `generate-dart-reference.ts`: registers `oauth-server-api` and
`admin-custom-providers-api` group-header ids in `HEADER_IDS`
## Source PRs
supabase-flutter: #1499, #1516, #1517, #1519, #1526
## Verification
`pnpm codegen:references:new` builds cleanly and the nav renders the new
**OAuth Server**, **Custom Provider Admin**, and Realtime
**onHeartbeat** entries.
## Notes
- `RealtimeChannelConfig.replicationReady` (#1526) is omitted since
there is no reference slot for channel-config options.
- The **OAuth Server** section also appears in #47971 (which adds
`listGrants` / `revokeGrant`). Whichever lands second should drop the
duplicate section header/partial and keep both sets of methods.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added OAuth 2.1 server consent-flow methods for retrieving, approving,
and denying authorization requests.
* Added admin APIs for managing custom OIDC/OAuth providers.
* Added Realtime heartbeat monitoring and advanced Postgres change
filters.
* Added text and JSON output options for query explanations.
* **Documentation**
* Expanded Dart API reference coverage across Auth, MFA, Passkeys,
Database, Realtime, and Storage.
* Added dedicated reference sections for OAuth Server and Custom
Provider administration.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What
Addresses @jeremenichelli's feedback that the Dart v2 reference required
maintaining section metadata separately from the spec. The reference now
derives every method's section from the spec YAML itself, with **no
per-method metadata**.
## How
Each **section-header** entry in `supabase_dart_v2.yml` carries the
`category` and optional `subcategory` that every method after it
inherits, up to the next header:
- Existing subcategory headers gain a `category`/`subcategory`:
`auth-mfa-api`, `passkey-api`, `admin-api`, `admin-passkey-api`,
`file-buckets`, `using-modifiers`, `using-filters`.
- New top-level category headers mark the sections that previously had
no header: `auth-api`, `functions-api`, `database-api`, `realtime-api`.
`generate-dart-reference.ts` walks the spec in order, tracking the
current section from the most recent header, and tags each method's
declaration with it. A method may still set `category`/`subcategory`
explicitly to override, and the converter errors if a method appears
before any header.
## Why this is less work
- **Authoring a new method:** place it in the right section. No
`category`/`subcategory` fields, no nav file edit.
- **Adding a section:** one header entry (with `category`/`subcategory`)
plus its overview partial.
- `common-client-libs-sections.json` is not touched (it still drives the
legacy-pipeline SDKs).
## Verification
The generated navigation (`content/reference/dart/v2/sections.json`,
`bySlug.json`) is **byte-for-byte identical** to the previous output.
`pnpm codegen:references:new` writes 105 method declarations across 5
categories with no orphaned methods and no slug collisions.
Supersedes the earlier per-method-`category` approach on this branch.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Improved Dart/Flutter API reference organization by leveraging
spec-provided `category` and `subcategory` taxonomy for clearer grouping
(Auth, Passkey, Edge Functions, Database, Realtime, Storage, and
database modifiers/filters).
* Updated reference generation to use structured in-spec section
headers, resulting in more consistent published categorization and
navigation.
* **Bug Fixes**
* Enhanced validation and error messaging for entries that can’t be
assigned to a section/category, including clearer guidance on how to fix
incomplete spec items.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
chore / bug fix
## What is the current behavior?
The new `ssl_enforcement_required` state is not handled
## What is the new behavior?
Displays the correct message
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved temporary database access messaging when SSL enforcement is
required.
* Added a direct action to open database settings and enable SSL
enforcement before activating temporary access.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Chore / dependency tooling update.
## What is the current behavior?
The repo is pinned to pnpm 10.24.0. Closes
https://linear.app/supabase/issue/FE-3673/migrate-the-repo-to-use-pnpm-v11.
## What is the new behavior?
The repo is pinned to pnpm 11.13.1, pnpm v11 workspace settings are
migrated to `allowBuilds`, and the Studio Dockerfile installs pnpm
11.13.1.
## Additional context
Validated with `CI=true mise exec node@22 -- pnpm install
--frozen-lockfile`, `mise exec node@22 -- pnpm run typecheck`, and `mise
exec node@22 -- pnpm run lint`; full Prettier check still fails on
existing generated docs/router files outside this migration.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated tooling requirements (pnpm **11.13.1**, Node **>=22.13**) and
aligned container build tooling accordingly.
* Adjusted package manager behavior (scoped registry override, update
notifications disabled) and workspace build/engine validation settings.
* **Maintenance**
* Updated `clean` scripts across apps/packages to remove only
build/cache artifacts (no longer delete installed dependencies).
* Reduced Turbo `clean` task output to **errors-only** for cleaner logs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
With `STUDIO_FRAMEWORK=tanstack`, `pnpm dev:studio-local` ran Studio in
platform mode against the management API instead of the local CLI stack
(`/` redirected to `/org` instead of `/project/default`). Vite selects
env files by *mode* while the Next dev server selects them via
`NODE_ENV=test`, so the tanstack dev server never loaded `.env.test` and
the developer's `.env.local` (`NEXT_PUBLIC_IS_PLATFORM="true"`) won. The
shell `NODE_ENV=test` also gets inlined into the dev client bundle by
Vite, flipping `API_URL` to the vitest-only MSW host.
`vite dev --mode test` isn't a viable fix: TanStack Start's dev-server
plugin treats mode `test` as "running under vitest" and skips installing
its SSR middleware, so every route 404s. Instead, dev keeps mode
`development` and overlays the env cascade named by `MODE` on top.
**Changed:**
- `dev:studio-local` now also sets `MODE=test` (the same knob
`build:tanstack` / `e2e:setup:selfhosted` already use)
- `vite.config.ts` dev server: loads the `MODE`-named env cascade for
the `NEXT_PUBLIC_*` client defines and seeds it into `process.env` for
SSR, without clobbering shell-provided values (matching `serve.js`
semantics, and safe against TanStack's own load-env plugin since
`loadEnv` gives existing `process.env` priority)
- `vite.config.ts` dev server: remaps a shell `NODE_ENV=test` to
`development` so it can't be baked into the client bundle (mirrors `next
dev` behavior)
Platform-mode `pnpm dev:studio` sets no `MODE`, so the overlay is a
no-op there. Build (`--mode test`), `serve.js`, and vitest (separate
`vitest.config`) paths are unchanged.
## To test
- `supabase` CLI installed, then: `STUDIO_FRAMEWORK=tanstack pnpm
dev:studio-local`
- Visit http://localhost:8082 — it should redirect to `/project/default`
(not `/org`) and the Default Project page should load with data from the
local stack (network requests go to `localhost:8082/api/platform/...`,
no `api.supabase.(com|green)` calls)
- `pnpm dev:studio` (platform mode, tanstack) still behaves as before —
redirects to `/org`
- Next path regression check: plain `pnpm dev:studio-local` (no
`STUDIO_FRAMEWORK`) still works
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved local Studio development and test-mode environment handling.
* Prevented test settings from being incorrectly embedded in the client
application.
* Ensured environment values are loaded consistently across development
and test scenarios.
* **Chores**
* Updated the local Studio development command to explicitly use test
mode.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
## Context
Just refactors `ObservabilityMenu` to retrieve the menu items via a hook
+ scaffold the Top for Postgres menu item
No functional changes here
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a keyboard shortcut (`U`, then `C`) for quickly opening
Observability Connections.
* Improved observability navigation with feature-aware sections and
consistent URL parameter preservation.
* Custom reports are now sorted alphabetically and include available
actions directly in the menu.
* **Bug Fixes**
* Improved handling of missing report details and duplicate or
unsupported query parameters.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds ClickHouse as a replication destination type in Studio.
- New ClickHouse option in the destination type selector, gated behind
the
`etlEnableClickHousePrivateAlpha` organization feature flag (off by
default).
- ClickHouse settings form: URL, user, password (optional), database,
and
- Client-side URL validation requires HTTPS and rejects URLs targeting
internal addresses (loopback, RFC 1918, link-local, CGNAT, IPv6
loopback/link-local/ULA, and IPv4-mapped/NAT64 forms). Server-side
validation remains authoritative.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## New Features
- Added **ClickHouse** as a replication destination option (private
alpha), including support in destination selection/panel, replication
diagram rendering, and destination icons.
- Introduced a ClickHouse destination form with fields for URL, user,
optional password (masked toggle), database, and engine selection.
- Added ClickHouse destination config handling for create/update flows,
with normalization and engine support.
## Tests
- Expanded unit tests to cover ClickHouse validation and destination
config building/normalization, including HTTPS-only and blocking
localhost/internal targets.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## Context
Adds support for multiple custom auth providers in custom-content
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for multiple custom sign-in providers via a new plural
configuration.
* Updated the sign-in page to render all configured custom provider
options while maintaining compatibility with the legacy single-provider
setting.
* Improved the custom provider button display to remove internal
prefixes from provider names.
* **Documentation**
* Updated the configuration schema, examples, and sample data to
document the new multi-provider setting.
* Marked the legacy single-provider configuration as deprecated in favor
of the plural option.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes DOCS-1176
## Summary
This PR adds documentation-writing guidance for humans and agents, then
applies it to the “Securing your API” guide.
## Changes
- Add a documentation word list based on Google’s style guide and
existing MDX lint rules.
- Add a shared `docs-guides` Agent Skill with Cursor and Claude
integration.
- Expand contributing guidance for information types, procedures,
chunking, links, admonitions, grammar, and terminology.
- Restructure “Securing your API” into contextual and procedural
sections.
- Add section navigation, cross-references, transitions, and procedural
outcomes.
- Reduce repeated admonitions and improve scannability.
## Manual testing
1. Open `/docs/guides/api/securing-your-api` in Preview and compare to
Live.
https://docs-git-docs-restructure-api-supabase.vercel.app/docs/guides/api/securing-your-api
2. See that the content is improved and clear with no important context
removed.
3. See the Admonitions that are no longer marked as admonitions. See the
content still makes sense.
4. Review the diff of `CONTRIBUTING.md` and `WORD_LIST.md`.
5. See that you agree with the new rules and that they are clear.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated documentation-writing guidelines with clearer standards for
structure, formatting, components, diagrams, terminology, and
navigation.
* Added a comprehensive word and style reference for consistent
documentation language.
* Reworked the API security guide with clearer guidance on grants, RLS,
dedicated schemas, pre-request checks, rate limiting, and API keys.
* Added documentation authoring workflow guidance, including validation
and formatting steps.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Feature enhancement
## What is the current behavior?
The features page filters search results by simple substring matching,
treating all matches equally. Features are then sorted alphabetically
regardless of search relevance.
## What is the new behavior?
Search results are now ranked by relevance using a weighted scoring
system:
- Title matches starting with the search term score highest (5 points)
- Title substring matches score 4 points
- Subtitle matches score 2 points
- Description matches score 1 point
Results are sorted by relevance score (highest first), with alphabetical
ordering as a tiebreaker. This ensures users see the most relevant
features first when searching.
## Additional context
The implementation adds:
- `SEARCH_WEIGHT` constant defining the relevance weights for different
match types
- `getSearchScore()` function that calculates a feature's relevance to a
search term
- Updated filtering and sorting logic that uses relevance scoring
The weights are carefully chosen so that any title match always ranks
above features that only match in subtitle/description, improving search
quality without requiring complex algorithms.
https://claude.ai/code/session_01573vYv6WZhrboV14NQSuc4
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Improved feature search with relevance-based matching.
* Search results now prioritize matches in feature titles, especially
title prefixes, followed by subtitles and descriptions.
* Results are displayed in relevance order for faster discovery.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
A11y fix for keyboard focus (esp. Safari), plus a lint rule to keep it
from regressing.
## What is the current behavior?
`Button` already defaults an explicit `tabIndex={0}` (#40458). Other
interactive primitives (Checkbox, bare triggers, etc.) still skip Tab
focus in Safari unless macOS Keyboard navigation is on. Raw `<button>`
call sites have no guardrail.
## What is the new behavior?
- Same explicit `tabIndex` default baked into Checkbox, Accordion
Trigger, Collapsible Trigger, Dropdown Menu / Popover / Dialog / Sheet /
Alert Dialog triggers, Table Head Sort, Command reset, sidebar actions,
and shadcn Button
- `supabase/require-explicit-tabindex` ESLint rule, ratcheted in Studio
(82 existing violations)
- Design-system accessibility docs list which primitives bake this in
Resolves [DEPR-621](https://linear.app/supabase/issue/DEPR-621)
## Additional context
### To test
Use **Safari** with macOS Keyboard navigation **off** (the default).
Chrome once for a sanity pass.
**Storage → Files bucket (list view) — Checkbox**
1. Open an empty folder (or one with only folders). Header “select all”
Checkbox is disabled and skipped by Tab — expected (`columnFiles.length
=== 0`).
2. Upload a file (e.g. an image). Header Checkbox enables.
3. Tab to it and toggle with Space. Row Checkboxes should also be
Tab-reachable.
**Storage → Analytics bucket → bucket details — Accordion Trigger**
On an Analytics bucket with no tables yet, Tab to the “Create your first
table via PyIceberg” Accordion Triggers and open/close with Enter/Space.
**Elsewhere (light smoke)**
- Bare Dropdown / Popover / Collapsible triggers still Tab + activate
- `*Trigger asChild><Button>` (Sheets, Dialogs, menus) still one Tab
stop; open/close fine
- Disabled controls stay out of the Tab order
### Later
Chip-away of the 82 raw Studio buttons (and remove exceptions from
rule). Prefer migrating those to `Button` from `ui` later.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Accessibility Improvements**
* Improved keyboard focus behavior across common interactive controls
(buttons, dialog/popover/dropdown/sheet triggers,
accordions/collapsibles, checkboxes, and sidebar actions).
* Disabled controls now default to `tabIndex={-1}`, while enabled
controls default to `tabIndex={0}`.
* Added explicit `tabIndex` handling for command reset and table sort
header controls.
* **New Features**
* Added a shared `getExplicitTabIndex` utility used by UI components to
standardize focus behavior.
* **Documentation**
* Updated accessibility guidance to clarify which components include
built-in focus/tabIndex handling and which require manual setup.
* **Developer Experience**
* Added an ESLint rule to enforce explicit `tabIndex` on raw button-like
elements, with corresponding baseline updates.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
UI polish / bug fix for the shared Calendar range selection and Logs
date picker.
## What is the current behavior?
- Selected date ranges use opaque `brand-400` / `brand-500` fills that
read too loud in light mode, with black text that is hard to read on
darker endpoints.
- Start/end days are squared off on the connecting edge without
intentional outer rounding.
- Outside days in a selected range are dimmed with `opacity-50`, which
can tint the range wash incorrectly when a range starts in the prior
month.
- The large-range warning in `LogsDatePicker` is a full-bleed yellow
banner that feels too heavy for the popover.
- Time inputs show a clock icon that adds visual noise.
## What is the new behavior?
- Range middle uses a softer `brand-200` wash; start/end stay on
stronger brand fills with readable foreground text.
- Start days round on the left (`rounded-l-md`), end days on the right
(`rounded-r-md`); day hover keeps `rounded-md`.
- Selected outside days and “today” no longer fight the range wash
colours.
- Large-range warning is quiet inline `text-warning` copy that wraps to
the calendar column width.
- Clock icon removed from `TimeSplitInput`.
| Before | After |
| --- | --- |
| <img width="1096" height="1076" alt="CleanShot 2026-07-16 at 17 59
21@2x"
src="https://github.com/user-attachments/assets/eac38022-ed92-4dbe-9932-55f7bf0af934"
/> | <img width="988" height="1064" alt="CleanShot 2026-07-16 at 17 59
34@2x"
src="https://github.com/user-attachments/assets/3dce30dd-9fd8-4da4-82b3-5663250a4ddc"
/> |
## Additional context
Shared `Calendar` changes apply anywhere range mode is used, not only
logs.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Style**
- Refined the date-picker popover layout for start/end controls with
better fit and max-width handling.
- Updated calendar day and range visuals (selection, outside states,
rounding, and hover behavior) to reduce “ghost” styling and improve
consistency.
- Restyled the large-range warning to improve spacing and alignment.
- Simplified the time-splitting input UI by removing the leading clock
icon.
- Adjusted the “Copy range” button feedback color for copied/pasted
states.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Jeremias Menichelli