37638 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Steven EubankandClaude Sonnet 4.6	e905bf78e6	chore: restore NavigationMenu.constants.ts to master ... Not part of this PR — nav changes belong in a separate branch. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-31 12:53:05 +02:00
Steven Eubank	ad36512ed7	Remove pricing and improve guidance ... these docs changes had already been merged, before the rollout for pricing was halted pre July 1st. - let's remove pricing specific language - added more helpful context to guide users to control usage around ingest and query	2026-07-31 12:36:08 +02:00
Nik Richers	2d7cbb5663	docs(security): add GDPR, ISO 27001, and DDoS coverage to security guide ... The /docs/guides/security landing page and regions guide had no mention of GDPR, ISO 27001, or DDoS protection despite Supabase covering these in one place or another. Adds a dedicated GDPR compliance guide (data residency + DPA), quick-win ISO 27001 and DDoS paragraphs to the landing page, and a data residency section to the regions guide. Closes DOCS-354.	2026-07-29 09:17:42 -07:00
Charis	4c8ed105d2	feat(studio): logs SQL execution wiring + source-aware run gestures (#48414) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature (SQL editor: execution wiring for logs-source snippets). Part of the stacked SQL-editor "Database vs Logs" query-source series. ## What is the current behavior? The SQL editor only ever runs queries against the user's Postgres database. There is no execution path for a logs (`log_sql`) snippet, and the run-button telemetry event carries no backend discriminator. ## What is the new behavior? - `useRunSource(id)` derives the run backend from the snippet type; a `log_sql` snippet resolves to `{ type: 'logs', dateRange }`, pairing the run with its session time range (default: last hour). - `useLogsSqlExecution` runs a promoted `SafeLogSqlFragment` against the analytics OTEL (ClickHouse) endpoint with the resolved time range as `iso_timestamp_start`/`iso_timestamp_end` request params. The endpoint is **pinned to OTEL** — a snippet's dialect must not flip with org migration. - The run gestures (toolbar button and Cmd+Enter) branch on the source and promote with the matching `acceptUntrusted*` right at the user action, preserving the auditable promotion-at-gesture boundary. pg intellisense is gated off for logs snippets. - The `sql_editor_query_run_button_clicked` telemetry event gains a required `{ source: 'database' | 'logs' }` property, fired from both execution paths. - Capability guard: a `log_sql` snippet is reachable by direct URL regardless of the (later) entry-point flag gating, so `executeLogsQuery` short-circuits when `otelLegacyLogs` is off — recording a clear "not available yet" result message instead of firing a request that would only return an opaque backend error on a non-ClickHouse project. This is a guard on the gesture, not endpoint selection. - Tests: `useRunSource` routing, `useLogsSqlExecution` endpoint/range/structured-error/capability-guard, and a reusable `flags` option on `renderSqlEditorHook`. No UI entry points are added — the feature runs dark until the flag-gated creation/nav PRs later in the stack. ## Additional context Stacked on the query-source series; base branch is `master` now that PR 4 (log date range domain + session state, #48401) is merged. Follow-ups in the stack add the toolbar/creation UI (with a run-affordance gate on `otelLegacyLogs`), nav section, AI dialect support, and reports guard. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for running log queries directly from the SQL editor. * Log query results, errors, and time ranges are now handled within the editor session. * Added automatic selection between database and log query execution, including support for custom date ranges. * SQL assistance is disabled while editing log queries where database definitions do not apply. * **Tests** * Added coverage for log query execution, date ranges, feature availability, and execution source selection. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-29 10:43:48 -04:00
kemal.earth	67c983caef	fix(design-system): small chart and metric card fixes (#48439) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? This fixes the following: - Our `<MetricCard />` and `<LogsBarChart />` which use `<ChartTitle />` were rendering the wrong font style for the title. The `font-mono` class being overwritten by recent changes, this helps sort cascade so it renders correct. - In our design system, the warning variable for charts was rendering black, this should be fixed to be our warning yellow. - There was an odd padding on `<MetricsCard />` content area, meaning our line chart wasn't flush to the edges, this required a small extension to `twMerge` so it could resolve. Please have a look around studio in places we have charts to double check nothing is broken. Also compare live design system vs. this branch by checking Logs Bar Chart, Charts and Metrics Card pages. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Refined heading typography for more consistent font and weight styling. * Improved class merging for custom spacing utilities. * **Bug Fixes** * Adjusted composed chart Y-axis sizing for clearer layouts. * Improved warning color fallbacks in log bar charts. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-29 13:50:56 +01:00
Andrey A.	0695579870	docs(self-hosted): add a guide covering custom pg extensions (#48203)	2026-07-29 14:17:18 +02:00
Saxon FletcherandAlaister Young	ad203ae277	Merge compute and disk into Infrastructure (#48370) ... ## Summary This is the final step in merging compute and disk with infrastructure to become a single place to manage everything. This moves everything we've done in compute and disk over to infrastructure along with redirects. - Makes Infrastructure canonical for the completed compute and disk configuration and usage charts. - Moves Service Versions to General Project Settings. - Removes the legacy Infrastructure activity implementation and constants. - Updates settings navigation, shortcuts, banners, billing links, warning CTAs, usage pages, support suggestions, and other internal entry points. - Adds the permanent `/settings/compute-and-disk` redirect, removes its Next and TanStack routes, regenerates the route tree, and updates the migration checklist. - Preserves query parameters and legacy metric anchors, including `#cpu`. ## Stack 1. #48368 2. #48369 3. #48370 (this PR) ## How to test 1. Check out `chore/infra-compute-3-cutover`. 2. Test the Next implementation with `pnpm dev:studio`, then stop it and test TanStack with `STUDIO_FRAMEWORK=tanstack pnpm dev:studio`. 3. In each implementation, open `/project/<ref>/settings/infrastructure`. Confirm the page contains the usage charts and the Scaling, Compute, Disk, and Advanced configuration sections. 4. Open `/project/<ref>/settings/general`. Confirm Service Versions appears there with its existing name, content, and styling, and no longer appears on Infrastructure. 5. Open `/project/<ref>/settings/compute-and-disk?upgrade=micro#disk`. Confirm it permanently redirects to `/project/<ref>/settings/infrastructure?upgrade=micro#disk`, preserving the query string and hash. 6. Confirm the settings menu exposes Infrastructure and no longer exposes Compute and Disk. Repeat with platform and self-hosted settings. 7. Follow representative entry points from billing usage, resource warning CTAs, upgrade banners, shortcuts, and support suggestions. Confirm they land on Infrastructure and preserve any query parameters or metric anchors such as `#cpu`. 8. Smoke-test compute and disk updates from Infrastructure, including validation, the sticky review footer, and warning/critical chart states. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Consolidated compute and disk management under the **Infrastructure** project settings page. * Added a **Service versions** section to **General** project settings. * **Bug Fixes** * Updated links and upgrade CTAs across the product to route to the correct **Infrastructure** or **Service versions** destinations. * Added permanent redirects from legacy **Compute and Disk** to **Infrastructure**, preserving query/hash. * Improved resource warning upgrade routing for compute scenarios. * **Tests** * Expanded automated coverage for **Infrastructure**, **Service versions**, redirects, and warning-link routing. * **Chores** * Updated ESLint rule baseline configuration for the studio app. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>	2026-07-29 19:26:28 +08:00
Joshen Lim	6fea2be680	Joshen/fe 4027 telemetry for database connections (#48435) ... ## Context Adding telemetry for the following actions on the database connections page - Toggling of live mode - Applying the various filters - Clicking on the overview metric cards - Clicking of terminate CTA + Confirm terminate <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Accessibility** - Added a descriptive label to the AI Assistant actions menu trigger for improved screen-reader support. - **Observability** - Added tracking for database connections interactions: live-mode toggles, session filter updates, blocker-view toggles, clicks on observability metric cards, and the session termination flow (both the terminate action and confirmation submission). <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-29 18:36:55 +08:00
Saxon FletcherandAlaister Young	b455d871e5	Add compute and disk usage charts (#48369) ... ## Summary This is the second step towards merging compute and disk with infrastructure. There are some usage charts on the current infrastructure page that are useful to have in the context of compute and disk settings. This branch adds two charts which give a general sense of usage and whether an upgrade needs to happen. Other data points in infrastructure can be found within observability and organisation usage. - Adds rolling seven-day Compute and Disk charts to the existing Compute and Disk page. - Shows CPU, memory, optional burstable disk IO, and disk usage split into database, WAL, and system data. - Covers loading, error, empty, warning, and critical states, retaining the 75% warning and 90% critical thresholds. - Uses a dedicated PageSection and keeps the charts in two columns from 680px. - Uses the concise primary labels Compute and Disk, removes the database report link, and removes tooltip icons from secondary metrics. - Adds transformation, summary, and component tests covering dedicated IO behavior, legacy anchors, responsive layout, rolling refetch, and tooltip behavior. ## Stack 1. #48368 2. #48369 (this PR) 3. #48370 ## How to test 1. Check out `chore/infra-compute-2-charts` and start Studio with `pnpm dev:studio`. 2. Open `/project/<ref>/settings/compute-and-disk` on a project with recent metrics. 3. Confirm the charts are in their own page section with standard spacing below the page header. 4. Confirm the Compute chart shows CPU and memory, plus disk IO when applicable, and the Disk chart splits usage into database, WAL, and system data. 5. Confirm the primary labels are Compute and Disk, secondary metrics do not show tooltip icons, and there is no Database Observability/report link. 6. Resize across 680px. The charts should remain in two columns at and above the breakpoint and stack into two rows below it. 7. Exercise loading, error, empty, warning, and critical responses with the metrics mocks or response overrides. Confirm warning styling begins at 75%, critical styling begins at 90%, and an error or empty response does not break the configuration form. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added compute and disk usage charts to the disk management interface, including metric cards for CPU, memory, disk I/O, database, WAL, and system. * Added usage status indicators, peak calculations, tooltips, and a detailed disk breakdown with placeholders when data is missing. * Added special handling for dedicated-I/O instances to hide burst-only disk I/O. * **Style** * Simplified the disk space display by removing supplemental explanatory text. * **Tests** * Added comprehensive test coverage for chart rendering, loading/error/empty states, status/peak calculations, and rolling 7-day data window behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>	2026-07-29 17:57:10 +08:00
Alaister YoungandAlaister Young	0009b4bcdf	chore(claude): hoist static form references in RHF skill example (#48434) ... Quick follow-up to #48431 addressing Ivan's post-merge feedback: the canonical form example now defines `FORM_ID`, the zod schema, and static `defaultValues` at module level so they're stable references rather than being recreated on every render, with a note to use `useMemo` (runtime-dependent schemas) or the `values:` option (server-driven defaults) when hoisting isn't possible. ## To test - Skim the diff — docs-only change to `.claude/skills/react-hook-form/SKILL.md` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated the React Hook Form guidance with a canonical example using stable, module-level form configuration. * Clarified that schemas, inferred types, default values, and form identifiers should be defined outside the component. * Documented how submit buttons outside the form should reference the shared form identifier (and cautioned to use per-instance IDs when the component may mount multiple times). <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>	2026-07-29 17:17:15 +08:00
Joshen Lim	ded5bc525b	Joshen/fe 4000 activity table to show queries which are blockers (#48383) ... ## Context One for Database Connections - allow a user to view the root blocking queries Adds an additional filter button here that toggles the view <img width="738" height="142" alt="image" src="https://github.com/user-attachments/assets/9fea17ba-c6f6-419d-8847-47dba67fc00a" /> When toggled, will render a list of the _root_ blocking queries - these are queries that are at the end of the blocking chain (or otherwise the problematic ones causing other queries to be blocked) <img width="964" height="420" alt="image" src="https://github.com/user-attachments/assets/5300f523-6abe-49b6-92d0-7e16bbddd291" /> Within this view - you can expand the row to view the blocking chain <img width="950" height="335" alt="image" src="https://github.com/user-attachments/assets/bb07095a-3841-4db6-8959-ac2bb264ebf6" /> ## Other changes involved - Realised that "Top blocker" overview metric card logic is incorrect - Was previously naively checking the length of the `blocked_by` array, but it should be consider the nested chain length instead, so this PR fixes that <img width="364" height="108" alt="image" src="https://github.com/user-attachments/assets/89beccef-f6f0-43d1-9dcf-fc35958b09e5" /> - Clicking the PID if highlighted on a metric card will not scroll to the PID if it's already selected. This PR fixes that <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a **Root blockers** view to highlight sessions that block others, with expandable blocking chains revealing related waiting activity. * **Bug Fixes** * Updated blocking metrics to use **transitive** blocker counts and improved cycle protection and behavior when activity records are missing. * The blockers view now consistently affects state/application/role quantities, and **reset filters** clears the view. * **Refactor / UI** * Improved the sessions table with grouped/nested rows, clearer waiting indicators, and more consistent expand/collapse behavior. * **Tests** * Expanded coverage for blocking/waiting chain traversal and branching scenarios. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-29 16:55:28 +08:00
Alaister YoungandAlaister Young	d845768fcf	chore(claude): add react-hook-form skill (#48431) ... Adds a Claude skill encoding correct React Hook Form usage, so AI-written form code follows best practices instead of copying the anti-patterns common in older Studio code (prop-form `form.watch()`/`formState` subscriptions, subscription-only watches, unguarded `valueAsNumber`, `?? undefined` controlled values, defaults computed from unloaded queries). **Added:** - `.claude/skills/react-hook-form/SKILL.md` — subscription model (`useWatch`/`useFormState` with `control`), canonical zod + `FormField` composition (layout deferred to `studio-ui-patterns`), `values:` option for async data, null normalization for controlled inputs, number-input handling, dirty-state and gating rules, plus a fix-what-you-touch policy aligned with the `no-use-watch` lint ratchet **Changed:** - `.claude/CLAUDE.md` and `apps/studio/CLAUDE.md` — register the skill in the skill lists/table - `.coderabbit.yaml` — add the skill to the existing Studio code-guidelines entry so CodeRabbit applies it when reviewing Studio code Benchmarked on three real form tasks (adding a live-updating field to `ThroughputField`, a new sheet form with async + nullable data, a review-changes step in `EditBucketModal`), each run with and without the skill: 13/13 assertions with the skill vs 8/13 baseline. The baseline shipped a genuine bug in one task — a `null` server default flowed into a `''` its own schema rejected, making Save unreachable — which the skill run avoided. ## To test - Ask Claude Code to add a field to any Studio form and check it loads the skill (it's in the studio CLAUDE.md skill table) and uses `useWatch({ control, name })` rather than `form.watch` - Skim `SKILL.md` for anything that contradicts current form conventions — `apps/design-system` demos remain the layout source of truth <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added a new monorepo “react-hook-form” skill guide with recommended patterns for safe form subscriptions, wiring, default values, reset/submission flows, and common anti-patterns. * Updated Studio skills/load guidance to expand and reorder the skills matrix, including form logic and copywriting guidance. * Updated required skill coverage so `react-hook-form` is included for any form-related work. * **Chores** * Expanded automated review enforcement so Studio form code is checked against the new “react-hook-form” skill guidance. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>	2026-07-29 16:52:03 +08:00
Joshen Lim	bb9e3d8168	Joshen/fe 3967 support top for postgres in self hosted and local (#48386) ... ## Context Allow self-host / local dashboard to access the "Observability" pages Currently only Query Performance will be accessible - eventually once Database Connections is publicly ready, it'll also be accessible here too <img width="518" height="312" alt="image" src="https://github.com/user-attachments/assets/18e5f6c7-ca77-4e90-81ec-c303bd31dc33" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Navigation, sidebar, and mobile menus now consistently display **Observability** and **Logs** based on enabled features, including the unified logs preview. * **Observability** destinations now adapt to platform and settings so users land on the correct Query Performance view. * **Bug Fixes** * Improved Query Performance loading layout for a smoother loading experience. * Database selection is now shown only on supported platform environments. * **Tests** * Updated navigation/menu tests to match the new routing behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-29 16:07:57 +08:00
Saxon FletcherandAlaister Young	618e003136	Modernize compute and disk configuration (#48368) ... ## Summary This is a precursor to unifying "compute and disk" and "infrastructure pages". First step is just updating the existing compute and disk page to make use of standard page and form patterns. - Reorganizes the existing Compute and Disk form into the established settings layout pattern, with Scaling, Compute, Disk, and Advanced sections. - Moves billing deltas to section headers while retaining the sticky review footer. - Adds animated notices, validation-error scrolling, and a responsive compute-size selector (2 columns by default, 3 from 680px, and 4 from 900px). - Preserves permissions, entitlements, cooldowns, read-only warnings, replica pricing, GP3 validation, Nano/PITR locks, and the free Micro upgrade treatment. - Keeps the redesigned experience on `/settings/compute-and-disk` so it can be reviewed independently of the route cutover. ## Stack 1. #48368 (this PR) 2. #48369 3. #48370 ## How to test 1. Check out `chore/infra-compute-1-config` and start Studio with `pnpm dev:studio`. 2. Open `/project/<ref>/settings/compute-and-disk`. 3. Confirm the page header and Scaling, Compute, Disk, and Advanced sections follow the standard settings-page spacing, with the plan notice directly below the Scaling header. 4. Change the compute size and disk configuration. Confirm billing deltas appear in the relevant section headers and the sticky review footer summarizes and applies the pending changes. 5. Enter invalid GP3 IOPS or throughput values and submit. Confirm the validation message is shown and the first invalid field is scrolled into view. 6. Exercise representative project states: insufficient permissions, read-only mode, resize cooldown, Nano with PITR, a project with read replicas, and a free Micro upgrade. Confirm the existing locks, warnings, pricing, and upgrade treatment remain intact. 7. Resize the viewport and confirm the compute cards use 2 columns by default, 3 columns from 680px, and no more than 4 columns from 900px. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Reworked the Compute and Disk settings UI into clearer sectioned pages, including smoother navigation to the first validation error. - Added a transitional in-form NoticeBar for consistent alert rendering. - Improved billing change badges to reflect accurate before/after totals. - **Bug Fixes** - Fixed disk IOPS/throughput pricing to include replica-based charges. - Strengthened disk sizing validation (GP3 limits, legacy/size edge cases, spend-cap behavior, and provider-specific constraints). - **Refactor** - Updated key form field layouts for improved readability. - **Tests** - Expanded schema validation and pricing/billing badge test coverage. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>	2026-07-29 10:56:19 +10:00
Danny White	5712eefe06	fix(docs): polish homepage AI setup prompt (#48318) ... ## What kind of change does this PR introduce? Bug fix / docs UI polish. ## What is the current behavior? The homepage AI Prompt panel: - Has an `expandable` feature but its overflow contents are ~1 line extra - Expanding it affects the cover height and causes layout shift - Below `xl`, the hero stacked and the logo sat alone above the title on small screens. ## What is the new behavior? - Shows the full AI setup prompt by default and removes the unused `expandable` machinery from `PromptPanel` - Keeps both tab panes in a shared grid cell so the panel height stays stable when switching tabs - Keeps logo + title in a row at all sizes, and starts the side-by-side hero (copy + prompt) at `lg` instead of `xl` | Before | After | | --- | --- | | <img width="1279" height="722" alt="15728" src="https://github.com/user-attachments/assets/c61fdbbc-706c-47cf-8b47-4245d4c96215" /> | <img width="1280" height="722" alt="Supabase Docs" src="https://github.com/user-attachments/assets/ab3a97a4-d725-4d9e-92bf-6f564a22f1bd" /> | | <img width="1279" height="722" alt="Supabase Docs" src="https://github.com/user-attachments/assets/42906c4b-4f82-4fbc-8bab-3f5d9530aa54" /> | <img width="1280" height="722" alt="Supabase Docs" src="https://github.com/user-attachments/assets/177a17d7-536c-4bd6-a8d0-1a2bc10f3ac9" /> | | <img width="1012" height="722" alt="96312" src="https://github.com/user-attachments/assets/032a3b43-078f-4d13-a67d-9a36c76a9be5" /> | <img width="1012" height="722" alt="Supabase Docs" src="https://github.com/user-attachments/assets/f3ff3c0a-6df8-4e61-bfcb-ab99e99cccea" /> | ## To test Play around with the docs homepage AI Prompt panel on the Vercel preview at various breakpoints: https://docs-git-dnywh-docs-ai-prompt-expanded-supabase.vercel.app/ <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Improved prompt panel tab navigation with manual activation for more predictable switching and enhanced accessibility. - Inactive tab panels now remain mounted while reflecting active/inactive state for smoother transitions. - **Style** - Refined the documentation homepage cover layout, including responsive alignment, logo sizing behavior, and updated heading/paragraph spacing. - Updated setup prompt presentation and refined expandable prompt sizing and control styling. - **Bug Fixes** - Inactive prompt content is now hidden and non-interactive, preventing unintended interaction. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-29 06:24:37 +10:00
Danny White	a99c83fe03	fix(studio): give Search nav trigger a visible hover state (#48319) ... ## What kind of change does this PR introduce? Bug fix / UI polish. ## What is the current behavior? The Studio header "Search..." command menu entry point has no useful hover state in light mode. It used `hover:bg-surface-100`, which maps to elevated `--card` and brightens toward white, so the hover effectively disappears against the near-white header. It also lacked `cursor-pointer` and used a weaker border than nearby header controls like Connect. ## What is the new behavior? `CommandMenuTriggerInput` now matches the Connect button's default variant interaction: - `cursor-pointer` - `border-strong` with `hover:border-stronger` - `hover:bg-selection` (same fill as Connect; aliased to accent) Studio `LayoutHeader` drops the redundant `bg-transparent` override now that transparent is the shared default. | After | | --- | | <img width="2561" height="267" alt="CleanShot 2026-07-24 at 17 06 09@2x" src="https://github.com/user-attachments/assets/5a855512-9b7e-40b8-861f-647c87d472a7" /> | ## Additional context Docs top nav also consumes `CommandMenuTriggerInput`, so it picks up the same trigger styling. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **Style** * Updated the command menu trigger appearance with a transparent background and stronger border. * Improved hover styling for clearer visual feedback. * Standardized command menu trigger styling across platform and non-platform layouts. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-29 06:23:57 +10:00
Danny White	37dded67d1	feat: unify SkipToContent across studio, docs, www, and design-system (#48314) ... ## What kind of change does this PR introduce? Feature / a11y polish ## What is the current behavior? Studio and Docs each had their own skip-to-content link (different styling and behaviour). www and design-system had none. ## What is the new behavior? Shared `SkipToContent` in `ui-patterns`, adopted by Studio, Docs, www, and design-system. Documented as a fragment with a short note under Accessibility → Jumping ahead. Tab once to reveal the button (top-left), Enter to jump to a content-only `<main>`. | After | | --- | | <img width="836" height="324" alt="CleanShot 2026-07-24 at 14 08 47@2x" src="https://github.com/user-attachments/assets/6df29452-e53a-4eca-8f64-946f2b9f605d" /> | ## To test Shared steps for every app: enable Tab key navigation if needed, load the preview, press **Tab** once — skip button should slide in top-left. Press **Enter** — focus jumps to main content (no blue ring on `<main>`). Press **Tab** again — first interactive control in the page body, not the sidebar/nav. Hover the skip button — solid fill, clear hover state, no chrome showing through. - **Studio** — [preview](https://studio-staging-git-dnywh-featskip-to-content-supabase.vercel.app) → sign in → any project page - **Docs** — [preview](https://docs-git-dnywh-featskip-to-content-supabase.vercel.app) → any docs page with sidebar - **www** — [preview](https://zone-www-dot-com-git-dnywh-featskip-to-content-supabase.vercel.app) → homepage or any marketing page with the default nav - **Design system** — [preview](https://design-system-git-dnywh-featskip-to-content-supabase.vercel.app) → any docs page (confirm Tab from content does **not** walk the sidebar), plus [Skip to Content fragment](https://design-system-git-dnywh-featskip-to-content-supabase.vercel.app/docs/fragments/skip-to-content) ## Additional context Follow-up to #47694 / #48303 (Studio) and #47515 (Docs). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added a reusable “Skip to content” accessibility link across key layouts and pages. - Updated main landmarks to support keyboard focus and skip-link navigation (`id="main"`). - **Accessibility** - Skip links now follow consistent landmark-target conventions and remain hidden until focused. - Improved documentation for skip links/jump shortcuts in persistent chrome layouts. - **Documentation** - Added a dedicated Skip to Content fragment, navigation entry, and expanded accessibility guidance. - Updated button description wording in component docs. - **Tests** - Added component tests for SkipToContent. - **Chores** - Exposed SkipToContent via additional public package entry points. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-29 06:21:50 +10:00
Daniel Guerra	944b41c708	Add Daniel Guerra to humans.txt (#48412) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Add myself (Daniel Guerra) to `humans.txt` as part of my onboarding. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added Daniel Guerra to the team information listed in the project’s public documentation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 12:38:44 -06:00
Charis	d5436ae826	feat(studio): log date range domain + session logRange state (#48401) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature (+ a small refactor and a docs/convention note). PR 4 of the stacked SQL-editor query-source series (Database vs Logs). ## What is the current behavior? The SQL editor has no representation of a logs query's time range: `querySource.ts` only knows how to map a snippet type to a source (`getSnippetSource`), and session state (`sql-editor-session-state.ts`) tracks results and the row limit but not a per-snippet time range. The Logs date picker's pure range helpers (`parseCustomInput`, `generateDynamicHelper`, the `Unit` type) are trapped inside the `Logs.DatePickers.tsx` React component. ## What is the new behavior? - **Logs time-range domain** in `querySource.ts`: branded `IsoDateTimeString` + `isoDateTimeString()`, `RelativeTimeUnit`, a `LogDateRange` discriminated union (relative/absolute), `DEFAULT_LOG_DATE_RANGE`, a single date-picker parser (`datePickerValueToLogDateRange` / `logDateRangeToDatePickerValue` — handles the five presets *and* dynamic `2h`/`30m` helpers; `calcTo === ''` means "now"; unparseable helpers degrade to absolute), and `resolveLogRunRange` which re-resolves relative ranges against `now` at run time (reusing the existing `ResolvedLogDateRange` shape). - **Session state**: per-snippet `logRange` + `setLogRange` — session-only, never written to snippet content, so it works on read-only shared snippets and is cleaned up in `clearForSnippet`. - **Refactor**: extracted the picker's framework-free helpers into a new pure `Logs.datePickerHelpers.ts`; the logs domain now shares the `Unit` type and reuses `generateDynamicHelper` instead of duplicating them. Importers point at the new module directly (no re-export shim). Hardened the amount parse against `NaN`. - **Full unit coverage** in `querySource.test.ts`. Recorded the no-shim refactoring convention in the `studio-best-practices` skill. Verification: `pnpm typecheck` clean, lint ratchet improved, 43 tests pass (querySource + Logs.Datepickers), Prettier clean. ## Additional context <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added robust Logs date-range modeling with support for relative (e.g., last N units) and absolute time periods. - SQL Editor sessions now remember log date ranges per snippet. - **Bug Fixes** - Safer handling of invalid or missing date inputs, with sensible fallback to default/current time. - **Tests** - Added/expanded automated coverage for date-range conversion, helper parsing, and resolution behavior. - **Refactor** - Centralized date-picker helper utilities for reuse across the Logs and SQL query experience. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 13:49:11 -04:00
Alaister YoungandAlaister Young	ca2b50a0a7	chore(ui-patterns): collapse the admonition shim into ui-patterns/Admonition (#48377) ... Follow-up to #48344: collapses the two resolution paths for the Admonition module into one. `src/admonition.tsx` was a back-compat shim re-exporting `src/Admonition/`. Two ways to resolve one module is exactly what produced the macOS self-import bug fixed in #48344, and the local typecheck errors that #48374 worked around. This removes the shim and standardizes on the PascalCase subpath, matching every other export in the package. **Changed:** - Codemodded all 246 `ui-patterns/admonition` imports to `ui-patterns/Admonition` (240 `.tsx`, 5 `.mdx`, 1 `.ts` across studio, docs, www, design-system, and lite-studio) - Pointed the 5 internal `'../admonition'` imports back at the `'../Admonition'` directory **Removed:** - `packages/ui-patterns/src/admonition.tsx`, and its `./admonition` entry in the exports map (regenerated with `pnpm gen:exports`) ## To test - `grep -r "ui-patterns/admonition" --include='*.ts*'` → no hits - `pnpm test:case-hazards` → passes - `pnpm typecheck` → all 15 tasks green - `pnpm --filter studio run lint:ratchet` → passes - `pnpm --filter ui-patterns vitest run src/Admonition` → 11 tests pass <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Standardized Admonition component imports across the application and documentation. * Improved compatibility with case-sensitive environments by using the canonical component path. * Removed the legacy Admonition import entry point. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>	2026-07-29 00:48:56 +08:00
Miranda Limonczenko	9bf513f8bf	Update humans.txt (#48407) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Cleans up a name that was missed.	2026-07-28 10:47:44 -06:00
TheOtherBrian1	e6623a49ab	updated pg config docs with new settings (#47939) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? docs update ## What is the current behavior? 1. Certain [supautils](https://github.com/supabase/postgres/blob/47d3ff319a0ead8a5a9a2e7dad5950a487834c58/ansible/files/postgresql_config/supautils.conf.j2#L14) and [CLI settings](https://github.com/supabase/platform/blob/master/api/apps/mgmt-api/src/routes/v1/projects/ref/config/postgresql.dto.ts) have not yet been added to the customizing config page. 2. We also list that pg_net settings can be changed at the role level. That is not the case. 3. We state that certain settings are only configurable via the MGMT API. They've now been exposed through the CLI ## What is the new behavior? 1. Updated list of exposed settings to include everything referenced in our supautils and MGMT API config files 2. Removed pg_net references 3. Removed the warning that some settings can only be changed with the MGMT API ## Additional context [Linear](https://linear.app/supabase/issue/CE-50/outline-all-grafana-metrics) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated the custom Postgres configuration guide to clarify which settings require superuser privileges. * Added additional CLI-supported logging and cron configuration options. * Removed outdated guidance about Management API-only parameters and restart requirements. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 12:44:14 -04:00
Charis	fa5eb17277	feat(studio): discriminated snippet union + source-aware writes (#48313) ... Stacked on #48305. ## What PR 3 of the stacked SQL-editor query-source series (Database vs Logs). Stacked on the PR 2 branch `charislam/log-sql-content-shape`. Turns `SnippetWithContent` into a discriminated union on `type` and makes all snippet writes source-aware: - `data/content/sql-folders-query.ts`: `SnippetWithContent` is now `{ type: 'sql'; content?: SqlSnippets.Content } | { type: 'log_sql'; content?: LogSqlSnippets.Content } | { type: 'report'; content?: never }`. `report` is kept (the content endpoints' wire type carries it) but has no SQL content — its body is `Dashboards.Content`, loaded through the separate `Content` union. - `setSql` brands per type (`untrustedLogSql` vs `untrustedSql`). - `buildUpsertPayload` persists `snippet.type` (no longer hardcoded `'sql'`). - `createSqlSnippetSkeletonV2({ source })` emits the matching type + content shape with the `as any` cast removed. - New `components/interfaces/SQLEditor/querySource.ts`: `SqlSnippetSource` + `getSnippetSource`. - `seedSnippet` test helper gains a `source` arg. - New `remapWireSnippet` boundary helper in `content-remap.ts` concentrates the single wire->domain assertion, so `content-id-query` / `content-upsert-mutation` call sites are cast-free (no `as unknown as`). - Collateral: query result types aligned to the union; `updateSnippet` no longer accepts `type` (source is immutable); db-only editor read paths narrow away `log_sql`. ## Why Impossible-states-impossible typing: a snippet's brand follows its content type, so logs SQL and database SQL can never cross execution paths. No behavior change for existing database snippets. ## Testing - \`pnpm typecheck\` — clean - \`pnpm --filter studio run lint:ratchet\` — no new warnings - \`pnpm test:studio\` (data/content, SQLEditor, state/sql-editor) — passing, including new tests for \`getSnippetSource\`, source-aware \`setSql\`, type-aware \`buildUpsertPayload\`, and both skeleton shapes. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added source-aware creation for SQL editor snippets, including log-based SQL snippets. * Introduced backend source mapping so log snippets are treated as log_sql. * **Bug Fixes** * Improved SQL retrieval/prettification so log snippets no longer use the wrong fallback content. * Ensured log snippets are sanitized and preserve correct type, content, identifiers, and statuses during save/upsert flows. * **Tests** * Expanded unit and integration coverage for log snippet creation, source mapping, editing, prettification, and upsert payloads. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 12:28:36 -04:00
Chris Opland	6263fb0f21	chore(docs): add Chris Opland to humans.txt (#48399) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Add "Chris Opland" to humans.txt ## What is the current behavior? My name is not in the humans.txt ## What is the new behavior? My name IS in humans.txt ## Additional context Add any other context or screenshots. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added Chris Opland to the project contributors list. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 11:26:34 -05:00
Charis	7743fee3ab	feat(studio): log_sql content shape + remap content.sql to unchecked_sql (#48305) ... ## What PR **2 of 9** in the SQL-editor query-source (Database vs Logs) stack. **Base:** `charislam/snippet-source-typing` (#48301) — this is a stacked PR; review/merge that one first. Client-side rename only — **the wire format is unchanged** (the platform API still stores and returns `content.sql`). This moves the frontend `LogSqlSnippets.Content` field to the branded `unchecked_sql`, matching `SqlSnippets.Content`, and hardens the remap boundary so the rename can't silently drop saved query text. ## Changes - **`types/userContent.ts`** — `LogSqlSnippets.Content`'s plain `sql: string` becomes `unchecked_sql: UntrustedLogSqlFragment` (the brand added in PR 1). Shape kept minimal: `{ content_id, unchecked_sql, schema_version }`. - **`data/content/content-remap.ts`** — extend `remapSqlContentField`/`unmapSqlContentField` to `log_sql`, branding **per type** (`untrustedLogSql` for logs, `untrustedSql` for database) and never mixing brands. **Defensive unmap**: content missing `unchecked_sql` is never clobbered with `sql: undefined`; a residual raw `sql` field (a missed save-path rename) throws in development to surface the bug loudly, while production no-ops safely. - **Legacy Logs Explorer consumers** updated to the branded field: the explorer save/update paths, `SavedQueriesItem`, `RecentQueriesItem`, and the recent-queries page. - **Two db-only write sites** that leaned on `LogSqlSnippets.Content.sql`: `EditorPanel` now saves `unchecked_sql`, and `MoveQueryModal` switches to the SQL-editor-specific `getSqlSnippetById` so its content is typed as `SqlSnippets.Content` — no narrowing or casting. ## Tests - **content-remap**: `log_sql` remap/unmap round-trip with the logs brand; the defensive-unmap no-op (prod) and dev throw. - **content-upsert-mutation**: a `log_sql` payload reaches the wire as a plain `content.sql` and the response remaps back to `unchecked_sql` (the data-loss-critical round-trip shared by both explorer save-new and `SavedQueriesItem` update). ## Verification - `pnpm --filter studio run typecheck` ✓ - `pnpm --filter studio run lint:ratchet` ✓ (no new warnings) - `pnpm test:studio` for `data/content` + `Settings/Logs` — 139 passing ✓ - Prettier ✓ Nothing is user-visible yet — logs snippet entry points arrive later in the stack behind the `sqlEditorLogsSource` flag. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Improved handling of saved and recent log queries across the SQL editor and Logs Explorer. - Log SQL now uses `unchecked_sql` (branded as untrusted) consistently when creating, editing, moving, and reopening queries, with correct remapping to/from the API boundary. - Fixed saved-query update payloads to preserve the right query content and omit legacy fields. - **Tests** - Added/expanded Vitest coverage for saved log query editing, recent-log normalization, and `log_sql` remap/upsert request/response behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 10:47:43 -04:00
Charis	ec1c889349	feat(studio): logs SQL brands + execution data layer (#48301) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature (data layer only — PR 1 of the SQL-editor query-source stack; nothing user-visible yet, no consumers). ## What is the current behavior? The Studio SQL editor only runs queries against Postgres. There is no type-safe brand for user-authored logs SQL and no execution/normalization layer for running SQL against the logs/analytics (ClickHouse) backend. ## What is the new behavior? Pure additions, no behavior change: - `data/logs/safe-analytics-sql.ts` — adds distinct untrusted/safe brands for user-authored logs SQL (`UntrustedLogSqlFragment`, `untrustedLogSql`, `acceptUntrustedLogsSql`), mirroring pg-meta's `UntrustedSqlFragment` but kept intentionally disjoint so Postgres and logs SQL can never cross boundaries. - `data/logs/execute-logs-sql-mutation.ts` (new) — `executeLogsSql` wraps `executeAnalyticsSql`, attaches the resolved time range as request params (`iso_timestamp_start/end`, never spliced into SQL), and normalizes to `{ rows, error? }`; `mapLogsError` normalizes the analytics backend's structured 200-body error into the `{ message }` shape the result pane reads; `useExecuteLogsSqlMutation` collapses transport and 200-body errors into React Query's single `onError` path. - Unit tests for `mapLogsError`, the brands (including compile-time disjointness vs pg-meta brands), and safe composition. Verification: `pnpm test:studio` (new suites, 26 passed), `pnpm typecheck`, `lint:ratchet` (no new warnings), and Prettier all pass. ## Additional context <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added the ability to run user-authored logs SQL with resolved start/end timestamps. * Normalized query error handling so failures surface a clear message (including sensible fallbacks) and integrates with mutation error flows (with a default error toast when not customized). * Introduced safety branding for logs SQL fragments, including promotion to runnable safe SQL. * **Tests** * Added tests covering error normalization across multiple malformed/empty error shapes. * Added tests ensuring logs SQL branding preserves/accepts only the intended types and rejects unsafe inputs. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 10:26:30 -04:00
claude[bot]andClaude	35b2e82852	feat(www): add Data Processing Addendum legal page (#48269) ... <!-- ccr-slack-attribution --> _Requested by **Nicole Kramer** · [Slack thread](https://supabase.slack.com/archives/C0161K73J1J/p1784836047880599?thread_ts=1784836047.880599&cid=C0161K73J1J)_ ## What kind of change does this PR introduce? Feature — a new marketing-site legal page. ## What is the current behavior? There is no Data Processing Addendum page under Customer Legal Resources. The only DPA content is a legacy `/legal/dpa` page that links out to a static PDF. ## What is the new behavior? **Before:** no DPA page under Customer Legal Resources; DPA content lived only on the legacy `/legal/dpa` page (static PDF link). **After:** a new DPA page at `/legal/customer-resources/data-processing-addendum`, styled like the Terms of Service page — a version dropdown ready for future versions, a "Last Modified: 1 June 2026" line, and the full DPA text (14 clauses + 3 schedules). A "Data Processing Addendum" link is added to the Legal Hub under Customer Legal Resources, using the same FileText icon as Terms of Service. **How:** - New versioned MDX at `apps/www/data/legal/customer-resources/data-processing-addendum/v1.mdx`. - New page `apps/www/pages/legal/customer-resources/data-processing-addendum.tsx`, modeled on the ToS / integration-partner-addendum pattern and rendering via the shared `LegalDocVersions` component (`versions` entry: `{ id: 'v1', label: 'Version 1', effectiveDate: 'June 1, 2026' }`). - Legal Hub link added in `apps/www/pages/legal/index.tsx` with `type: 'document'`. ## Preview Please review on the Vercel preview deploy. Two URLs to check: - `/legal/customer-resources/data-processing-addendum` - `/legal` ## Notes for reviewers - Content was converted faithfully from the provided .docx (normalized word-content diff: 5678/5678 words, zero missing/extra). The source has no tables. - The legacy `/legal/dpa` page (static PDF link) is left untouched — flag if it should be redirected to the new route or retired. - Typecheck/lint could not be run in the build sandbox due to an unrelated JSR-registry 403 during `pnpm install`; Prettier was run and passes. Please confirm CI (typecheck + lint) is green. ## Additional context Version dropdown is single-version for now and is set up to accept future DPA versions. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- _Generated by [Claude Code](https://claude.ai/code/session_01JA6SATQGc9J8kApnH2NvCz)_ --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-07-28 15:07:55 +02:00
Illia Basalaievandgithub-actions[bot]	6331386a44	realtime egress faq troubleshooting (#47962) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? docs update ## What is the current behavior? ## What is the new behavior? Realtime Egress FAQ <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added a Realtime Egress FAQ page explaining what counts toward the Realtime Egress metric and what’s excluded. * Clarified why billed egress can exceed payload size due to delivered events, protocol overhead, concurrency, and overlapping subscriptions. * Added a troubleshooting checklist to re-derive expected delivered events (including overlap and reconnect patterns) before escalating, plus links to related guides. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-07-28 14:02:02 +02:00
Cemal Kılıç	b8310dbf23	feat(studio): move SIWC rollout gate to ConfigCat (#48360) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Replace the deploy-gated `dashboard_auth:sign_in_with_chatgpt` AND-gate with useFlag('ShowSignInWithChatGptButton') OR'd against the existing localStorage opt-in switch, so rollout/rollback no longer requires a frontend deploy. Remove the now-dead static flag, its only consumer was this gate. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * ChatGPT sign-in availability now responds to either the local opt-in setting or the updated configuration flag. * GitHub sign-in continues to follow its dedicated feature setting. * **Bug Fixes** * Corrected identity provider visibility across different sign-in configuration combinations. * **Chores** * Removed the obsolete ChatGPT sign-in feature setting. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 10:31:17 +02:00
Danny WhiteandJoshen Lim	69f3c43118	fix(studio): close Vercel create popup on cancel (#48371) ... ## What kind of change does this PR introduce? Bug fix / UX polish. ## What is the current behavior? Cancel on the Vercel create interstitial redirects to Vercel’s `next` URL. That finishes the install flow and shows “Completing installation…” / “Installation complete”, even though the user cancelled. The Deploy Button job still proceeds and fails. The button was also labelled “Return to Vercel”, which read like an alternate success path. | Before | | --- | | <img width="719" height="118" alt="Create Vercel Project Supabase" src="https://github.com/user-attachments/assets/c7ad261a-f132-4226-b460-21ec267595c0" />| | <img width="800" height="599" alt="95801" src="https://github.com/user-attachments/assets/6d235c4b-be90-4d5e-89bc-a68933f9dc46" /> | ## What is the new behavior? - _Return to Vercel_ button now labelled **Cancel** - **Cancel** closes the popup via `window.close()` (same honest abort as manually closing the window) - If the browser blocks programmatic close, Cancel is replaced by muted fallback copy: “Close window to cancel” (`role="status"` / `aria-live="polite"`) - Cancel is left-aligned with `justify-between` when there’s no additional-costs block; with costs, both actions stay on the right - Removes the free-limit hint line about returning to Vercel (Cancel makes that self-evident) - Success path is unchanged: after create, we still redirect via `next` - `/new` Cancel still navigates into Studio (`cancelAction: 'studio'`). This is unchanged behaviour | After (Fallback) | | --- | | <img width="713" height="103" alt="img" src="https://github.com/user-attachments/assets/95aafc0d-1c3d-4093-9681-88ad0a40f9fe" /> | ## Additional context Follow-up to #48311. Vercel’s `next` URL has no documented cancel/abort status, so closing the popup is the correct escape hatch. ### To test Full Deploy Button popup cancel can’t be verified on prod until this merges. Locally: 1. Open Studio on this branch. 2. In `ProjectCreationFooter.tsx`, temporarily force the fallback: ```ts const [showCloseWindowHint, setShowCloseWindowHint] = useState(true) ``` 3. Load create-project UI: - Free org / no costs: Confirm Cancel is left, Create is right (`justify-between`). With the forced hint, Cancel is replaced by “Close window to cancel”. - Paid org with additional costs: Confirm costs on the left; hint/Create on the right. 4. Revert `useState` to `false`. 5. Optional: open a Vercel create interstitial URL in a normal tab (not a popup), click Cancel. `window.close()` fails and the hint should replace Cancel after ~100ms. 6. On `/new/[slug]`, Confirm Cancel still returns to the Studio dashboard (not close-window). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Updated Project Creation Cancel to close the popup window directly when applicable, with a “close window to cancel” hint when closing isn’t available. * **Bug Fixes** * Removed Vercel-specific “return and restart” messaging and related return-url handling. * Standardized Cancel navigation for non-popup flows to return to the last relevant location (or the organizations page). * **Refactor** * Improved Project Creation footer layout/visibility for additional cost details. * **Chores** * Simplified the free-project limit warning configuration by removing an unused option. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com>	2026-07-28 15:28:00 +10:00
Joshen Lim	0987824674	Clean up + add unit tests for database connections (#48372) ... ## Context As per PR title - no functional / visual changes, just some code clean up / refactor + adding unit tests <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added database connection metrics covering active, blocked, and idle-in-transaction queries. * Enhanced insights for the longest-running query and the top blocker (most queries blocked), including warning indicators based on duration thresholds. * **Bug Fixes** * Improved consistency and accuracy of database-activity calculations in the connection overview. * **Refactor** * Centralized metric derivation so the UI uses the same computed logic everywhere. * **Tests** * Added metric-calculation tests with controlled time to validate multiple scenarios and warning behaviors. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 13:15:51 +08:00
Danny White	4bda3bfe72	refactor(docs): unify homepage icon link tiles (#48317) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs UI refactor. ## What is the current behavior? Framework quickstarts and several other homepage grids used `IconPanel` / `IconPanelWithIconPicker`, which brought redundant tooltips (duplicating the visible title), inconsistent hover treatment, and circular icon tiles that didn't match the intended squarish look. | Before | | --- | | <img width="1744" height="626" alt="CleanShot 2026-07-24 at 14 29 44@2x" src="https://github.com/user-attachments/assets/1e145be2-19c9-4bd0-bf06-17516acbc774" /> | ## What is the new behavior? Introduces a shared `IconLink` used across the docs homepage (and reference index) so icon+label tiles share the same composition and hover: icon tile fill matches the surrounding surface (`surface-100`), with a stronger border on hover, and the row uses `hover:bg-accent`. Framework quickstarts keep the larger tile size; other sections keep the smaller size. Also aligns Explore more GlassPanels with Build your backend by using the same bordered background treatment. | After | | --- | | <img width="2478" height="906" alt="CleanShot 2026-07-24 at 15 09 48@2x" src="https://github.com/user-attachments/assets/dd516845-c162-47e4-8b86-9a7fa0e73290" /> | ## Additional context Removes the unused `IconPanelWithIconPicker` wrapper now that homepage/reference consumers go through `IconLink`. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added reusable `IconLink` UI for consistent docs tiles, including `IconLinkList`, menu icon, and light/dark icon rendering. * Introduced `FrameworkQuickstarts` to generate quickstart links based on feature-flag-enabled SDKs. * **UI / Improvements** * Updated the docs home and API reference pages to use the new list-based icon-link layout. * Refreshed migration guides and “Explore more”/self-hosting sections (including accessibility and updated CTA text). * **Bug Fixes** * Migration guide items now omit entries missing required details. * **Chores / Cleanup** * Removed the older icon panel picker-based UI component and its usage. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 15:12:13 +10:00
Joshen Lim	8aeae070c2	Fix import statements casing for Admonition (#48374) ... ## Context Was running into typecheck errors when running the ts check locally - this should resolve it <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Corrected component references across confirmation dialogs, error displays, privacy settings, and SQL-to-REST views. * Improved compatibility for environments with case-sensitive file handling. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 11:19:54 +08:00
Tarun Khandelwal	0f314982da	Add Tarun Khandelwal to humans.txt (#48356) ... Adding myself to the humans.txt as part of the onboarding ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES/NO ## What kind of change does this PR introduce? humans.txt update for `Tarun Khandelwal` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added Tarun Khandelwal to the team information listed in the documentation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-28 08:22:13 +05:30
Miranda LimonczenkoandClaude Sonnet 5	52cb1c2600	feat(docs) Dynamically E2E test all docs-owned content (#48320) ... Closes DOCS-1203 ## Problem The docs E2E workflow only ever tested one hardcoded page: the Next.js quickstart. All other docs content had no E2E coverage. ## Solution This PR expands the initial scaffolding to generalize the Next.js quickstart tests, page runs and checks local links, to all pages affecting Docs content: - Add `resolveDocsScope` (`e2e/docs/utils/resolve-docs-scope.ts`) to map changed guide and troubleshooting `.mdx` files to their `/docs/...` page paths, and to expand changed `_partials` to every page that includes them (including transitively, through partials nested inside other partials). Federated guide sections (`graphql`, `database/extensions/wrappers`, `ai/python`, `deployment/terraform`, `deployment/ci`) and reference docs stay out of scope, and resolution is capped at 20 pages to keep runtime bounded. - Replace the single `quickstarts.spec.ts` test with a generic `docs-pages.spec.ts` that loads whatever pages are resolved, asserting each renders with an `<h1>` and that its docs-owned links resolve. - Add `run-e2e-docs.ts` so `pnpm e2e:docs` resolves scope locally (from commits since `origin/master`, plus staged/unstaged changes) and skips Playwright entirely when nothing in scope changed. - Update `.github/workflows/docs-e2e.yml` to widen the trigger paths to all guides/troubleshooting/partials, resolve scope in a dedicated step, skip the rest of the job when scope is empty, and accept a `page_paths` input for manual `workflow_dispatch` runs. - Rewrite `e2e/docs/README.md` to document the new scoping behavior, the override envs (`DOCS_E2E_PAGE_PATHS`, `DOCS_E2E_BASE_REF`), and how CI uses the suite. - `pnpm e2e:docs:all` is also added to run tests on every page locally. Good for scoping issues but should not be included in CI. ## Manual testing Walk through the following steps to verify this works: - [x] `pnpm e2e:docs` from repo root resolves the expected pages for a local guide edit and can run against local dev **Note:** Challenges with testing on local in part because of the long lag for first page load. Recommendation to use a hosted URL is added to docs. - [x] Editing a shared `_partials` file resolves to every page that includes it (including through nested partials) - [x] `pnpm e2e:docs` exits cleanly with no Playwright run when no in-scope files changed - [x] `git diff --name-only ... | pnpm -C e2e/docs resolve-docs-scope` prints the expected page list for a sample diff - [x] Workflow run on a PR that only touches `e2e/docs`/workflow files skips the Playwright steps - [x] Manual `workflow_dispatch` run with `page_paths` set tests only those pages - [x] Run `pnpm e2e:docs:all` to run the suite on all docs content, which takes awhile ## Next steps After this PR merges, we have the scaffolding to add more fun tests like a11y 😁 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added scoped Docs E2E runs that target eligible doc pages based on changes, plus manual page-targeted runs and an “all eligible pages” mode. * Introduced `DOCS_E2E_PAGE_PATHS` (and updated base ref/base URL behavior) to control which pages are tested. * **Bug Fixes** * Automatically skips Playwright setup when no relevant pages are in scope; Playwright reporting now uploads only on failure. * **Documentation** * Updated the Docs E2E README with new run/CI behavior, troubleshooting notes, and commands to inspect the resolved page list. * **Tests** * Added a Docs-owned pages E2E suite; removed the Next.js quickstart E2E spec. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-28 00:04:58 +00:00
Danny WhiteandJoshen Lim	c9ed51c99e	fix(studio): add return to Vercel escape hatch (#48311) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Bug fix / UX improvement for the Vercel Deploy Button create-project interstitial. ## What is the current behavior? On the Vercel create-project step, the organization picker is locked (correct — the integration is bound to that org) and Cancel is hidden. If the org can't create a free project (member free-project limits), users hit a dead end: Upgrade may not help, and there's no way out of the popup. Also includes a small capitalisation nit on the Vercel install page. | Before | | --- | | <img width="800" height="629" alt="Create Vercel Project Supabase" src="https://github.com/user-attachments/assets/2acdc7a3-eb99-43c6-9135-557370647da1" /> | ## What is the new behavior? - Replaces `hideCancelButton` with `cancelAction: 'studio' | 'vercel' | 'hidden'` - Vercel create flow shows **Return to Vercel**, which redirects to the install `next` URL (closing the popup cleanly) - Free-project-limit admonition adds a Vercel-only hint pointing at that button: “Or return to Vercel and restart with a different organization.” - Main `/new` Cancel behaviour is unchanged - Org picker stays disabled ## Additional context Org switching mid-create is intentionally not allowed. That would orphan the Vercel install. Returning to Vercel is the safe escape hatch so users can restart Deploy Button with another org, or free a project slot / upgrade and try again. ## To test As far as I can tell, this is impossible to test on prod. Shortly after merge though, you could test the following: - [ ] Happy path: create still works; Return to Vercel is secondary and does not block submit - [ ] Free-limit blocked org: Create disabled, Return to Vercel visible and redirects to `next` - [ ] Main `/new`: Cancel still goes to last org / organizations <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Enhanced project creation flow for Vercel: when a valid return destination is available, users can choose **“Return to Vercel”**. - Added additional messaging in the free-project-limit warning to guide users back to Vercel and restart with a different organization (when applicable). - **Bug Fixes** - Improved cancel behavior and routing consistency by only enabling Vercel return when the destination is valid. - **Style** - Updated the Vercel integration interstitial title capitalization for consistency. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com>	2026-07-28 08:14:01 +10:00
Leandro Pereiraandgithub-actions[bot]	7838676902	fix: update realtime-warn-sending-broadcast-message (#48366) ... Update to reflect actual funcionality and give more tips to fix the issue. ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Update troubleshoot guides. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Clarified when missing daily partitions trigger the `WarnSendingBroadcastMessage` warning. - Updated guidance to explain that partitions are created only after a client connects via WebSocket. - Removed the tenant health check endpoint as a described partition-creation trigger. - Added troubleshooting steps for connection/authentication failures, including checking realtime logs, using the Realtime Inspector, and verifying JWT settings/remediation. - Revised janitor timing and partition maintenance behavior, including scenarios where clients cannot connect. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-07-27 15:03:43 -04:00
supabase-supabase-autofixer[bot]andsupabase-workflow-trigger[bot]	b77f4f678c	feat: update @supabase/*-js libraries to v2.110.9 (#48363) ... This PR updates @supabase/*-js libraries to version 2.110.9. **Source**: supabase-js-stable-release **Changes**: - Updated @supabase/supabase-js to 2.110.9 - Updated @supabase/auth-js to 2.110.9 - Updated @supabase/realtime-js to 2.110.9 - Updated @supabase/postgest-js to 2.110.9 - Refreshed pnpm-lock.yaml --- ## Release Notes ## v2.110.9 ## 2.110.9 (2026-07-27) ### 🩹 Fixes - **auth:** downgrade stale refresh token console noise ([#2559](https://github.com/supabase/supabase-js/pull/2559)) - **realtime:** preserve presence refs ([#2566](https://github.com/supabase/supabase-js/pull/2566)) - **repo:** override sharp to >=0.35.0 to clear libvips advisory ([#2548](https://github.com/supabase/supabase-js/pull/2548)) - **repo:** populate symbols in sdk-compliance so capabilities are verifiable ([#2547](https://github.com/supabase/supabase-js/pull/2547)) - **repo:** bump postcss, babel, next to clear audit advisories ([#2561](https://github.com/supabase/supabase-js/pull/2561)) ### ❤️ Thank You - Katerina Skroumpelou @mandarini - Vaibhav @7ttp This PR was created automatically. Co-authored-by: supabase-workflow-trigger[bot] <266661614+supabase-workflow-trigger[bot]@users.noreply.github.com>	2026-07-27 18:41:03 +03:00
claude[bot]andClaude	4893c396db	fix(studio): split cron_job_cleanup dialog-open from enable to stop double-counting (#48348) ... <!-- ccr-slack-attribution --> _Requested by **Pam Chia** · [Slack thread](https://supabase.slack.com/archives/C076KTY11DF/p1785115156767339?thread_ts=1785115156.767339&cid=C076KTY11DF)_ ## What kind of change does this PR introduce? Bug fix (telemetry). ## What is the current behavior? Clicking the header "Enable cleanup" button fires `cron_job_cleanup_enable_button_clicked` when it merely OPENS the confirmation dialog (`origin: 'header'`), and fires it AGAIN when the dialog is confirmed (`origin: 'dialog'` + `retentionInterval`). So every successful enable logs the event twice, and a naive `count(cron_job_cleanup_enable_button_clicked)` roughly doubles the true number of cleanups enabled. The dual-fire was introduced in #48200. ## What is the new behavior? Opening the dialog fires a new `cron_job_cleanup_dialog_opened` event, and `cron_job_cleanup_enable_button_clicked` fires only on confirm — when cleanup is actually scheduled. Each event now maps 1:1 to a distinct user action. **How:** - Added `cron_job_cleanup_dialog_opened` to the shared telemetry catalog (`packages/common/telemetry-constants.ts`). - Removed the now-redundant `origin` property from `cron_job_cleanup_enable_button_clicked` (the two events encode what `origin` used to); kept `retentionInterval`. - Updated the emit sites in `apps/studio/components/interfaces/Integrations/CronJobs/CronJobsTab.EnableCleanupButton.tsx`: the header open now sends `cron_job_cleanup_dialog_opened`; the dialog confirm sends `cron_job_cleanup_enable_button_clicked` with just `retentionInterval`. ## Additional context `origin` already technically separated the two paths (`count(origin='dialog')` gave the true number), but splitting into two named events removes the footgun of anyone aggregating the raw event. Note for reviewers: I kept the existing event key `cron_job_cleanup_enable_button_clicked` for the confirm path rather than renaming it to something like `cron_job_cleanup_enabled` — happy to rename if preferred, but keeping the key avoids churn on such a new event. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Analytics** * Improved tracking for the cron job cleanup flow by distinguishing when the cleanup confirmation dialog is opened from when cleanup is enabled. * Updated event details to more accurately reflect the cleanup scheduling and confirmation steps. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-07-27 23:29:36 +08:00
Pamela Chia	01541b95cb	fix(studio): keep organization_slug in oauth signup redirect (#48352) ... Email signups inside a partner OAuth flow lose `organization_slug` on the post-confirmation redirect: the OAuth branch in `SignUpForm` hand-builds the `/authorize` return URL from only `auth_id` and `token`, and the component's nuqs hook never reads the param at all. The consent screen uses `organization_slug` to preselect and lock the partner's requested org, so affected multi-org users land on an empty picker and the partner's requested org is silently dropped. The GitHub-OAuth signup path goes through `buildPathWithParams` and preserves the param, which is how this went unnoticed. I validated the drop in production traffic before fixing: joining sign-up pageviews to their post-signup `/authorize` return on the `auth_id` URL param (30d), 28 of 36 resolvable flows came back without the slug, and the 8 that kept it were the GitHub branch. ## To test Needs a partner OAuth authorize link that includes an org, opened signed-out: `/dashboard/authorize?auth_id=<id>&organization_slug=<slug>` (note `auth_id` records expire quickly, so generate a fresh authorize request from an OAuth app). - [x] Sign up with email from that flow; after confirmation the redirect lands on `/authorize` with `organization_slug` still in the URL - [ ] Consent screen shows the requested org preselected and locked - [x] Same flow without `organization_slug` behaves as before (no trailing empty params in the redirect URL) ## Linear - fixes GROWTH-1031 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved sign-up redirects during authentication flows by preserving invitation tokens and organization information. * Enhanced handling of sign-up links containing organization details. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-27 23:02:05 +08:00
claude[bot]andClaude	a72259b3f0	feat(www): group careers page jobs by department (#48358) ... <!-- ccr-slack-attribution --> _Requested by **Dasha Nikolov, Ivan Vasilov** · [Slack thread](https://supabase.slack.com/archives/C0161K73J1J/p1785158372513869?thread_ts=1785158372.513869&cid=C0161K73J1J)_ **Before:** the careers page lists open roles under one heading per individual team (Auth, Data API, Functions, Realtime, Storage, ...). **After:** roles are grouped under their top-level department heading (Engineering, Design, ...), collapsing the per-team split. ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature / enhancement to the marketing site (`apps/www`) careers page. ## What is the current behavior? Open positions on the careers page are grouped by individual team, producing one `<h3>` heading per team (Auth, Data API, Functions, Realtime, Storage, ...). This fragments the list into many small groups. ## What is the new behavior? Roles are grouped under their top-level department heading (Engineering, Design, ...), so related teams are collapsed under a single department section. **How:** added a `department: string` field to `JobItemProps` and group on `job.department` (from the Ashby public job-board API, which returns both `department` and `team` as top-level strings per posting) instead of `job.team`. `groupJobsByTeam` is replaced by `groupJobsByDepartment` (it had no other callers), `getServerSideProps` now calls it, and the render loop was updated to key on and display the department heading. All styling, keys, and job rendering are unchanged. ## Additional context A Vercel preview deploy will show the result on the careers page. --- _Generated by [Claude Code](https://claude.ai/code/session_01GEvKydFSLsHhpBbNJ2PEzg)_ --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-07-27 16:51:38 +02:00
ChloeGarciaMillerandandGildas Garcia	da847254d5	fix: ESLint errors relating to accessibility (alt attribute and tableEditor components) (#48186) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Improvements for screen readers: - Added `alt` attributes to image components - Added `aria-label` attributes and Tooltip to buttons ## What is the current behavior? `aria-label`, `alt` attributes and Tooltip were missing ## What is the new behavior? Buttons have now `aria-label` attributes and Tooltip. Images have `alt` attributes ## Additional context I’ve added `aria-label` attributes to the buttons in the Pagination.tsx component, but these buttons don’t trigger any action. Shouldn’t we be using non-interactive elements here? No visual changes have been made. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Accessibility** * Added a tooltip to the “date options” control when the value is nullable. * Improved screen-reader labeling by adding an `aria-label` to the number editor input. * Added explicit `aria-label` text to pagination footer buttons for loading, error, and help/estimate states (and marked the error-state button as disabled). * **UI** * Updated the pagination loading-state button to rely on the button’s built-in loading behavior instead of a custom spinner icon. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com>	2026-07-27 14:32:41 +02:00
Kunal Gupta	f01ac83ebc	Fix Studio contributor README links and Node version note (#47571) ... ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? docs update ## Description - Replace the broken checklist link in apps/studio/README.md with the main contributing guide. - Update the Studio setup note in apps/studio/README.md to match the repo Node pin in .nvmrc. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated the contribution instructions to point to the main contributing guide. * Bumped the recommended Node.js version in the developer quickstart from v20 to v22. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-27 19:19:49 +08:00
Riccardo Busetti	6f8fe470a6	ref(pipelines): Update pricing descriptions given new egress calculation (#48241)	2026-07-27 12:52:37 +02:00
Joshen Lim	6058ee7962	Add focus states for spans in overview cards (#48354) ... ## Context Tiny one to address for a11y stuff for the spans in the metric cards for database connections overview section <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Improved hover and keyboard-focus styling for process ID details in database observability metrics. * Added a pointer cursor and smoother visual transitions to make interactive details easier to identify. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-27 18:50:56 +08:00
Joshen Lim	22284f1786	Use table for roles tooltip instead (#48353) ... ## Context Opting to use native `table` element instead for the roles tooltip in `DatabaseConnections` to better handle varying role name lengths ### Before <img width="314" height="226" alt="image" src="https://github.com/user-attachments/assets/f8a5f7a2-be2f-4ad6-a1f0-7a7812800819" /> ### After <img width="332" height="191" alt="image" src="https://github.com/user-attachments/assets/dcb30f5d-641c-4b42-b31d-bf6d76086791" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Improved the layout and readability of the “Connections by roles” tooltip in database observability metrics. * Role labels and connection counts are now presented in a clearer tabular format. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-27 18:50:38 +08:00
Bobbie Soedirgo	60e6a89f9d	fix: make high availability in project creation form public (#48338) ... Move "High availability" from internal-only to public. Closes MUL-668. ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Bug fix ## What is the current behavior? "High availability" is an internal-only config <img width="724" height="1126" alt="Screenshot 2026-07-26 at 8 15 57 PM" src="https://github.com/user-attachments/assets/83e1856b-9020-4b65-a019-27e3cc29bae9" /> ## What is the new behavior? "High availability" is a public user-facing config <img width="724" height="1036" alt="Screenshot 2026-07-26 at 8 15 31 PM" src="https://github.com/user-attachments/assets/4f369058-ce91-4bcf-bd3c-120277363b1a" /> Still hidden without the org entitlement, i.e. currently not available anywhere on prod <img width="724" height="931" alt="Screenshot 2026-07-26 at 8 18 58 PM" src="https://github.com/user-attachments/assets/3e1deb76-210c-416b-b716-45ff6e3b0afd" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a High availability option directly to the project creation form. * The option is shown when available for the account and hidden when unavailable. * Enabling High availability automatically selects AWS as the cloud provider. * **Bug Fixes** * Corrected validation for incompatible High availability and OrioleDB selections. * **Tests** * Added coverage for High availability visibility, eligibility, and form submission behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-27 18:11:35 +08:00
3 people	b9ab634cd0	fix(studio): stop 403'd integration queries from looping on remount (#48350) ... Resolves FE-4014 A user with a project-scoped role opening any project integration overview (e.g. Cron) hits an unbounded request loop — the page sits on a skeleton forever while hammering the platform API until it gets rate limited. **Changed:** - `useProjectOAuthIntegrationData` now passes `retryOnMount: false` to its five queries, so a 403 settles as a terminal error instead of refetching on every consumer mount ## Why Project-scoped roles have no org-level permissions, so `GET /platform/organizations/{slug}/oauth/apps` 403s. We don't retry 4xx, so the query settles into `error` with no data — and an errored query with no data is never fresh, so it refetches on *every* new observer mount. That feeds a loop: refetch → `isLoading` true → `IntegrationPage` swaps its whole subtree to a skeleton → `<Component />` unmounts → 403 lands → `isLoading` false → remounts → mounts fresh observers → refetch. Measured ~20 req/s (480 observer add/removes and 120 requests in a 6s window) until the API 429s it, then it continues at the retry cadence indefinitely. The other four queries in that hook can 403 the same way for restricted roles, and any one of them alone sustains the loop — hence the option on all five. Not fixed here: `IntegrationPage` tearing down its subtree whenever `isLoading` flips (`pages/project/[ref]/integrations/[id]/[pageId]/[childId]/index.tsx:58-94`) is the amplifier that turns a wasted request into a loop, and will still reset UI state on any background refetch. Worth a follow-up. ## To test Needs an account with a project-scoped role in a shared org (not an org owner/admin). - Open `/project/{ref}/integrations` for that project, click into Cron (or any integration) → overview should render, not sit on a skeleton - Network tab: `organizations/{slug}/oauth/apps?type=authorized` should fire once and 403, not repeat - Console should show 1 error, not hundreds ending in a 429 - As an org owner, integration overviews should behave exactly as before <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Prevented repeated refetching of integration data after handled authorization/403 errors, avoiding refetch loops on remount. * Improved consistency on integration landing screens by standardizing how related integration queries are enabled and retried. * **Enhancements** * Added permission-aware loading/error handling for OAuth integration data, showing OAuth results only when the selected organization grants read access. * **Chores** * Updated permission-check typings to treat an explicitly empty project reference as absent. * **Tests** * Extended integration settings tests with permission fixtures to cover OAuth read access. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> Co-authored-by: Joshen Lim <joshenlimek@gmail.com>	2026-07-27 17:58:32 +08:00
Pamela Chia	9113c2ba04	feat: markdown alternate tags + llms.txt cleanup (#48287) ... The June/July marketing redesign (#47271, #47228) rebuilt the homepage and product pages off the Pages Router, silently dropping their `<link rel="alternate" type="text/markdown">` head tags, and llms-full.txt has been accidentally embedding every blog/customer/event page via an `MD_CONTENT` spread. I restored the tags behind a shared helper, added a CI drift test so a future redesign can't drop them silently again, and trimmed both llms files to the agreed docs-index shape. **Changed:** - **Markdown siblings advertised again**: homepage, the 5 product pages, pricing, and blog emit absolute `.md` alternate URLs via a new `mdAlternates(slug)` helper (the one documented consumer of the tag parses it from `<head>` and fetches the `.md` sibling, so tags must point at the sibling, never the page itself). - **Drift test**: a vitest file walks `content/md/**` and asserts every markdown-served slug's page wires the helper (or is covered by the Pages Router `_app.tsx` mechanism, whose alternate-link wiring the test also asserts directly so removing it fails CI too). Source-level assertions by design: page modules can't be imported under www's vitest config. Fails correctly when wiring is removed (verified by hiding a page and by altering the `_app.tsx` tag). - **Vector orphan fixed**: `content/md/vector.md` moved to `modules/vector` matching the live route (the page previously had no negotiation or tag, and `/modules/vector.md` 404'd); `/vector.md` now 308s to `/modules/vector.md` and the legacy `/llms/vector.txt` redirect no longer chains. - **llms.txt + llms-full.txt**: the `## Product Overview` sections are gone from both, each keeps a `## Pricing` section. This deletes the hand-maintained links array (a drift trap) and fixes the accidental ~470-page embed, shrinking llms-full.txt from ~9.8MB to ~4.9MB and dropping the 4.1MB generated content module from that route's serverless bundle. **Note:** this PR is scoped to apps/www only. The docs side (troubleshooting pages and the rest of the docs surface) is handled separately through a consolidated manifest-gated mechanism; an earlier troubleshooting-tag commit was reverted out of this branch to keep the scopes clean. <details> <summary>Why alternate tags matter (background)</summary> Agents ingest markdown far more efficiently than our rendered HTML: a fraction of the tokens and no extraction step. Since #47770 removed UA-based serving (UA sniffing broke a major AI app's fetcher and poisoned CDN caches), markdown is served only on explicit request: a `.md` suffix URL, an `Accept: text/markdown` header, or llms.txt. That's the right serving model, but it makes the markdown twin invisible to any agent that doesn't already know our URL convention, and the major AI fetchers send browser/wildcard Accept headers, so bare URLs hand them HTML. The `<link rel="alternate" type="text/markdown">` head tag is the standards-based advertisement of the sibling. It has a documented consumer today: an agent CLI that parses the tag from `<head>` and then fetches the `.md` sibling, which is also why the tag must point at a real sibling URL and never at the page itself. Peer docs sites ship this tag as table stakes. These www pages used to carry it until the June/July marketing redesign silently dropped it; the drift test in this PR turns that regression class into a CI failure. </details> ## To test Tested locally (www + docs dev servers): - [x] `/llms.txt` renders `## Documentation` + single-link `## Pricing`, no Product Overview - [x] `/llms-full.txt` renders `# Supabase` → `## Pricing` → `## Documentation`, no Product Overview, ~4.9MB - [x] Full www suite: 6 files / 71 tests green; drift test fails correctly when a page is removed or the `_app.tsx` wiring is altered - [x] `generateMdContent.mjs` emits `modules/vector`, bare `vector` slug gone On the Vercel preview (browser-verified with Playwright): - [x] Alternate tag present on `/`, `/auth`, `/database`, `/storage`, `/edge-functions`, `/realtime`, `/pricing`, and a blog post: exactly one tag each, href = preview origin + `.md` sibling - [x] `/vector.md` → 308 → `/modules/vector.md`, renders as markdown (`# Supabase Vector`) - [x] `/llms.txt` shows single-link `## Pricing`, no Product Overview - [x] Coverage sweep: all 482 `MD_PAGES` slugs + changelog index/entry curled on the preview; 471 pages carry exactly one tag, all `.md` siblings 200 as `text/markdown`. The 11 misses are legacy blog slugs whose HTML 308-redirects away (stale `MD_PAGES` entries predating this PR, no head to tag; follow-up tracked in Linear) Post-merge prod: - [ ] Full llms.txt link sweep (every linked URL 200s; previews can't cover the docs-hosted links) ## Linear - fixes GROWTH-1013 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Markdown alternate links across key product, pricing, blog, and troubleshooting pages. * Added Supabase Vector documentation covering features, use cases, workflows, and technical details. * Updated AI-focused documentation indexes with dedicated pricing content. * Added redirects for updated Vector documentation URLs. * **Tests** * Added coverage to verify Markdown documentation links stay aligned with available pages. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-27 17:06:16 +08:00
fadymak	19dfbd250a	feat(auth): expose access token expiry under auth settings (#48236) ... Exposes the access token expiry (`JWT_EXP`) under `Auth -> Sessions` settings as opposed to the Legacy JWT settings previously used. <img width="1632" height="1199" alt="Screenshot 2026-07-23 at 10 06 33" src="https://github.com/user-attachments/assets/85356e57-da95-404c-852a-21cf9cab2b74" /> <img width="1198" height="1119" alt="Screenshot 2026-07-23 at 10 06 19" src="https://github.com/user-attachments/assets/bfa64b3b-1902-45eb-83ed-ca8bc12673af" /> <img width="1237" height="513" alt="Screenshot 2026-07-23 at 10 03 44" src="https://github.com/user-attachments/assets/85779e9b-30f2-48c5-9faa-4c650d450227" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added an **Access Tokens** section to configure JWT expiration with dedicated Save/Cancel controls and success/error toasts. * Enforced a maximum JWT expiration value (must be **less than 604800 seconds**). * **Bug Fixes** * Updated the Sessions auth page text to better clarify configuration for access tokens, refresh tokens, and user sessions. * **Documentation** * Updated JWT expiration guidance to point to **Auth settings → Access Tokens** (replacing legacy JWT secret references). * **Chores** * Expanded automated tests covering Access Tokens saving and validation. * **Refactor** * Removed JWT expiration editing from the legacy JWT Secrets area, consolidating it under Access Tokens. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-27 10:13:10 +02:00