## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
- Noticing our code we have many patterns of calling localstorage and
handling those errors
- We should add those in a single well tested file
- Handle those errors in the singleton which makes it easier for us to
debug customer issues. Logger is outputing local storage warnings for
feature we expose
- Side effect of this is random crashes on studio when local storage
isn't available or handled correctly
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Improved browser storage handling across the app for more reliable
persistence and graceful behavior in restricted or non-browser
environments (settings, previews, charts, tabs, sign-in/session flows,
integrations, and UI state).
* **New Features**
* Introduced a safe storage layer to standardize and harden
local/session persistence.
* **Tests**
* Added comprehensive tests covering the new safe storage behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix.
## What is the current behavior?
Advisor dismissals use `useLocalStorageQuery`. When advisor signals
pruning ran, it sometimes invoked `setDismissedKeys` even when nothing
needed to change (no-op updater returning the same array reference).
Separately, `useLocalStorageQuery` would still persist +
`invalidateQueries` even when the computed next value was
reference-equal to the current cached value.
When `useAdvisorSignals` is mounted in two places at once
(`AdvisorSection` + `AdvisorPanel`), those redundant invalidations /
subscriber churn could occasionally cascade into React’s “Maximum update
depth exceeded” error (often surfaced via Radix `composeRefs` in stack
traces). CI saw this as an unhandled error during
`AdvisorSignals.integration.test.tsx`.
## What is the new behavior?
- `useLocalStorageQuery` now **early-returns** when `Object.is(next,
current)` so no-op updates don’t write localStorage or invalidate the
query.
- `useAdvisorSignals` pruning effect now **short-circuits** unless there
is actually a stale banned-IP dismissal to remove.
## Additional context
Follow-up from #44372 (advisor signal items for banned IPs).
Tests run locally:
- `pnpm --filter studio exec vitest run
components/ui/AdvisorPanel/useAdvisorSignals.test.tsx
components/ui/AdvisorPanel/AdvisorSignals.integration.test.tsx
hooks/misc/__tests__/useLocalStorageQuery.test.ts`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Enhanced handling of dismissed security alerts by preventing
unnecessary state updates for stale dismissals, significantly reducing
overhead and improving overall application performance.
* Optimized local storage operations to skip redundant writes to storage
and prevent triggering unnecessary cache updates and query invalidations
when stored data values remain unchanged from the previous operation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Feature. Resolves DEPR-430.
## What is the current behaviour?
The homepage Advisor summary, shared Advisor panel, and top-nav Advisor
indicator only surface lints and notifications. Banned IPs are not
represented as dismissible Advisor items, so network bans are easy to
miss unless a user visits Database Settings directly.
The `public bucket allows listing` warning is no longer part of this PR.
That warning will move to a follow-up Splinter `WARN` lint so it can
flow through the standard lint surfaces instead of a bespoke Studio
signal path.
## What is the new behaviour?
- adds a new Advisor `signal` source for banned IPs on the platform
homepage, in the shared Advisor panel, and in the top-nav Advisor
indicator
- keeps dismissals client-side only for now, scoped by project and exact
IP fingerprint
- keeps banned IP signals at `warning` severity because they still
indicate suspicious traffic and remain actionable if a user wants to
review or remove a ban
- leaves `/project/[ref]/advisors/security` as follow-up work because
that surface is still lint-native, and banned IPs are management-plane
signals rather than Splinter lints
| After |
| --- |
| <img width="1728" height="997" alt="Mallet Toolshed
Supabase-65A60B4A-107E-4D79-B9A8-23F754BEAB08"
src="https://github.com/user-attachments/assets/c08ecbbb-c302-43bd-81bb-6ba7eb18b7b3"
/> |
## Reviewer testing notes
1. Use a throwaway project.
2. Get the database connection string for that project.
3. Attempt to connect with the wrong password 3-4 times until you hit an
`ECONNREFUSED`-style error, which should mean your IP has been banned.
4. Refresh Studio and confirm the project overview shows the new `Banned
IP address` signal.
5. Open the Advisor Center and confirm:
- the top-nav Advisor dot turns warning yellow
- the signal detail shows `Entity`, `Issue`, and `Resolve`
- `Edit network bans`, `Dismiss`, and `Learn more` are present
6. Open Database Settings > Network bans and confirm your banned IP
appears there and can be unbanned.
7. Note that `/project/[ref]/advisors/security` will not show this item.
That page is still lint-only, and this banned IP work is a short-term
client-side signal rather than a true lint.
Longer term, we likely want a more durable event model here so banned
IPs can power notifications, webhooks, emails, and other project-level
alerts.
---------
Co-authored-by: kemal <hello@kemal.earth>
Co-authored-by: Charis Lam <26616127+charislam@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
* Migrate all uses of invalidateQueries to use object syntax.
* Migrate the remainder of useInfiniteQuery.
* Migrate all setQueriesData.
* Migrate all fetchQuery uses.
* Migrate some leftover functions from RQ.
* Fix issues found by Charis.
* init new unified page
* moar logs
* init
* add infinite and live logs example
* Update useLogsPreview.tsx
* add more sources
* wrapped auth logs with edge logs
* add role and user id
* move unified logs
* init
* move demo pages. create a new directory to work in
* extracted beta unified logs into own components
* add example base page and components
* add new files to use actual logging query
* more organization
* change import
* adds new logs page. adds new query
* add data table to UI pacakges
* revert
* table styles
* text size
* add timestamp, table, icons for log types, status code styling
* add host
* add log count to edge functions
* starts to add dynamic filtering
* spiking trace UI
* Update status-code.ts
* add new linik
* now using POST
* fix chart data for default 1 hour view
* update API to accept POST requests
* new filters
* Update level.ts
* fixed up chart to work on level filter. split up the logic into new files
* prep for log type
* prepped query for WHERE
* fix: issue with white space in url param column parsing
* level param now being removed correctly.
* fix issue with chart showing wrong buckets for different time ranges
* remove old query
* refactor the queries into function for each source
* total count fixed
* lots of layout
* start fixing log counts
* comment out min and max for a while
* added trace logging prototype in
* random trace logs added for demo
* added logs and ui to view logs if any
* add Auth user
* fix the live logs issue
* some left over code
* Midway
* First pass refactor + clean up + reorganize files
* Fix TS issues
* Remove unused files
* Clean up
* Final clean up
* more clean up
* More clean up
* Remove unused packages
* Fix
* Lint
* Add feature flag for unified logs
* Refactor
* Remove trace UI
* Snake case log types
* more clean up
* More clean up
* Fix ts
* more clean up
* fixes
* add flag check and redirect if flag is false
* Update middleware.ts
* Nit lint
* Fix
* Last refactors
---------
Co-authored-by: Jonathan Summers-Muir <MildTomato@users.noreply.github.com>
* Set up banning and unbanning user, although untested due to API CORs issue
* Update search filter UI for users management V2
* Update API types
* Minoir
* Small fix
* Update UI
* Add support for resizing and re-ordering columns
* Add google profile image url to csp
* Revert test button
* Implement toggling of columns
* Fix loading
* Fully implement banning/unbanning user
* Fix
* Update apps/studio/components/interfaces/Auth/Users/UserOverview.tsx
Co-authored-by: Alaister Young <alaister@users.noreply.github.com>
* Fallback non CSP supported avatar urls to user icon
* Fix some bugs
* Remove prism-react-renderer from studio, add to ui patterns
* Migrate users query from API to studio
* Address some feedback
---------
Co-authored-by: Alaister Young <alaister@users.noreply.github.com>
* Add nuqs package.
* Add useSchemaQueryState hook.
* Use the new hook in all places where there's is a schema selector.
* Make the useQueryState work with SSR in playwright.
* Fix the saving to local storage to happen as a side effect without any additional rerenders.
* Move all studio files from /studio to /apps/studio.
* Move studio specific prettier ignores.
* Fix the ui references from studio.
* Fix the css imports.
* Fix all package.json issues.
* Fix the prettier setup for the studio app.
* Add .turbo folder to prettierignore.
* Fix the github workflows.
Ali Waseem