## Problem
When [#46812](https://github.com/supabase/supabase/pull/46812) was
scoped down to "sidebar visual changes only", Kemal's UI redesign of the
Unified Logs sidebar banners was unintentionally reverted back to the
older full-bleed strip layout. The shared `UnifiedLogsBanner` component
survived, but his actual visual design did not.
This PR brings back just Kemal's banner UI changes, with nothing else
from that branch.
## Changes
- **promo variant** (`LogsSidebarMenuV2`): bordered card with a "New"
badge, an "Introducing unified logs" heading, and an "Enable preview"
button + "More information" tooltip button
- **utility variant** (`FilterSideBar`): bordered card for the "Go back
to old logs" action with a "Switch back" tooltip button
- Restore the `mx-4 mt-4` placement in both consumers
Adapted to the current `Button` `variant` API (the original used the
now-removed `type` prop).
## Testing
- `pnpm lint --filter=studio`
- Visual check of the Logs sidebar for an account eligible for Unified
Logs (promo card) and one already on Unified Logs (utility card)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a "New" badge indicator to the logs interface.
* **Style**
* Redesigned the unified logs banner with a new card-based layout.
* Updated the "Go back to old logs" option with improved visual
presentation and tooltip guidance.
* Adjusted spacing and alignment of the banner component for better
visual hierarchy.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: kemal <hello@kemal.earth>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
## Context
Dashboard currently doesn't have any support for managing stored
procedures. In the event that the security advisor surfaces a warning
about a stored procedure, users hence run into a dead-end as there's
currently no way to self-remediate via the dashboard
## Changes involved
We're hence adding support for managing stored procedures within
Database Functions
<img width="1082" height="546" alt="image"
src="https://github.com/user-attachments/assets/2598a5fe-e58f-4e8a-ad2f-9cb6d0eb2f53"
/>
Creating a function now shows a dropdown to select the type
<img width="500" alt="image"
src="https://github.com/user-attachments/assets/acc9249d-7b25-4416-aae8-89c630e1c62b"
/>
In which if stored procedure is selected, the following fields will be
hidden since they're irrelevant for stored procedures
- Return type
- Behaviour (Under advanced settings)
Some other minor UI changes as well:
- Field inputs are re-ordered a little, opting to group "Schema" and
"Name" into one section, followed by "Type" and "Return type"
- Opting to show "Return type" when editing a function but disabled
- Add schema filter for fetching database functions to reduce
unnecessary load on the database
## To test
- [ ] Can create, update, delete, read stored procedures via database
functions page
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary
- **New Features**
- Added PostgreSQL **procedure** support alongside functions, including
a **Type** selector in the create/edit flow.
- Updated Functions UI with a new **Type** column and procedure-aware
return/argument details.
- **Improvements**
- Refreshed create/edit headers and language help text for clearer
context.
- Improved argument parsing/display, including better handling of
procedure argument modes.
- **Bug Fixes**
- Corrected routine-type handling during function/procedure delete and
update SQL operations.
- **Tests**
- Updated unit snapshots and end-to-end UI flows/labels for the new “New
function” control.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Having a custom report block on the project home page with a SQL that
returns a large set of results (e.g > 100k rows) causes a client side
crash with "Maximum call stack size exceeded"
<img width="400" alt="image"
src="https://github.com/user-attachments/assets/e4bb5b73-e114-4687-9d0b-a7bff328167c"
/>
This is happening due to an array spread in `computeYAxisWidth` in
`Math.max` - which am hence opting to use a `reduce` instead to mitigate
the problem.
Am also opting to apply the same autolimit logic in the SQL editor into
the `QueryBlock` here, so that we don't unnecessarily fetch a large
dataset in this UI. Added a UI indicator as well if auto limit has been
applied (So this also overlaps into dashboard scalability too)
<img width="1383" height="465" alt="image"
src="https://github.com/user-attachments/assets/08b66398-f3b8-49ce-b4a4-23c91510bd54"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Report query blocks now feature automatic SQL limiting functionality,
which restricts query results to a maximum of 100 rows when enabled
* When active, query result blocks display an informational notice to
users, clearly indicating the row restriction that has been applied
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
Our `<Button>` component breaks the default `button` contract by
redefining the `type` prop to set its variant (`primary`, `default`,
etc) instead of the button type (`submit`, `button`, etc).
This is confusing and forces to write more code when using it with
shadcn components that expect/inject the standard button props.
## Solution
- rename the `type` prop to `variant`
- rename the `htmlType` prop to `type`
- propagate the changes where necessary
- format code
## How to test
As this is just prop renaming, if it builds it's ok
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
Addresses the issue of parallel tool approvals freezing Assistant and
causing UX ambiguity around what happens if only part of multiple
dependent invocations is approved.
Two layers at which this is addressed:
1. Tightens prompt to clarify approval tools must be issued one per
step, not in parallel.
2. In case something slips past the prompt, this also auto-denies all
but the first `approval-required` tool call when the model issues
multiple in the same step, so the model is forced to reissue them
sequentially.
**Demo**
The following chats demo me explicitly asking Assistant to run those
approval-gated tools in parallel, and the Assistant correctly invokes
them sequentially instead.
| Parallel `execute_sql` request | Parallel `deploy_edge_function`
request |
|--------|--------|
| <img width="1820" height="4240" alt="CleanShot 2026-06-16 at 16 20
23@2x"
src="https://github.com/user-attachments/assets/3ddad61d-24d6-4e5b-8572-c261755f3a03"
/> | <img width="1738" height="2726" alt="CleanShot 2026-06-16 at 16 22
59@2x"
src="https://github.com/user-attachments/assets/77a0aa20-e3cb-4061-b270-ab2a96d1e64a"
/> |
As shown in [this
trace](https://www.braintrust.dev/app/supabase.io/p/Assistant/trace?object_type=project_logs&object_id=5a8d02e5-b3b6-40cc-ba76-ecee286478f4&r=a3a37857-95df-4a95-a5a8-818ea305b2a5&s=a3a37857-95df-4a95-a5a8-818ea305b2a5),
parallel tool calls are still allowed for context gathering tools that
don't require approval:
<img width="1051" height="517" alt="CleanShot 2026-06-16 at 16 25 42@2x"
src="https://github.com/user-attachments/assets/00d208b1-6131-4b8e-910e-e92fd2a79a5b"
/>
Closes AI-803
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Improvements**
* Approval-required operations are now processed sequentially rather
than in parallel within the AI Assistant.
* **Tests**
* Added comprehensive test coverage for the parallel approval prevention
logic.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This PR adds an error state to the usage charts on the Project home
page.
<img width="1708" height="471" alt="Screenshot 2026-06-16 at 18 10 20"
src="https://github.com/user-attachments/assets/cba87dad-5e23-4cd1-b787-0ea699445d7f"
/>
I also added an error state to the charts in the [design
system](https://design-system-git-feat-chart-error-state-supabase.vercel.app/design-system/docs/ui-patterns/charts#chart-states).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Charts now display error states when data retrieval or processing
fails, providing users with clear feedback about issues.
* Improved error visibility and handling across analytics and charting
components for better transparency.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
When a user selects IO2 on compute upgrade, the `0/MB` isn't quite
correct, whilst the costa delta of $0 is correct. We will hide the row
as it adds noise.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed disk management UI to correctly display the throughput
configuration row only when selecting GP3 storage type, ensuring the
interface accurately reflects available options for the selected storage
type.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
When a support ticket submission is rejected by the API's rate limiter,
the form surfaced the raw server exception text to the user and reported
every rejection as an application error. This produced a steady stream
of noisy error reports for what is actually expected, recoverable
behavior.
The rejections are not random: the submit endpoint allows only a small
number of requests in a short window, so a quick second submission (a
fast retry or a follow-up ticket moments later) gets rejected. The first
submission usually succeeds; it's the immediate follow-up that fails.
Surfacing the raw error and logging it made this look worse than it is.
Separately, the success screen had only top padding, leaving its actions
flush against the bottom edge of the card.
## Fix
- Detect the rate-limit response and show a clear, friendly message that
tells the user how long to wait before trying again, instead of the raw
exception text.
- Stop reporting rate-limit rejections as errors to our monitoring. They
are expected and recoverable, so they no longer add noise.
- Give the success state the same vertical padding as the rest of the
form so its actions are not flush against the card edge.
## How to test
- Open the support form and simulate a 429 from the submit endpoint.
- Expected: a friendly message telling the user when they can retry, and
no error reported to monitoring.
- Submit a ticket successfully and confirm the success screen has even
padding above and below its content.
## Notes
This covers the user-facing handling. The rate-limit threshold itself is
tuned conservatively on the API and can be revisited separately so that
ordinary, legitimate resubmissions are not caught.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved support form handling for rate-limited (429) submissions by
suppressing unnecessary error reporting while still showing the error
and returning the form to editing.
* Fixed inconsistent support form spacing so padding is consistent
regardless of submission outcome.
* **Improvements**
* Propagated backend error `code` through the support-ticket submission
flow so the UI can react more intelligently to failures (including 429
retry-window messaging).
* Enhanced retry timing extraction for rate-limited errors by using
`Retry-After` with a fallback to rate-limit reset data.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Problem
The homepage usage section had two implementations gated by the
`newHomepageUsageV2` ConfigCat flag, with the legacy V1 as the fallback.
That flag has been at 100% in production for months, so V1 is dead code
and the flag branch is unnecessary.
## Fix
- Make V2 the default by removing the `newHomepageUsageV2` flag check in
`Home.tsx`.
- Delete the V1 section (`Home/ProjectUsageSection.tsx`), its chart
(`Home/ProjectUsage.tsx`), and the now-orphaned
`project-log-requests-count-query` plus its query key.
- Shared code (`useProjectLogStatsQuery`, `UsageApiCounts`,
`ProjectLogStatsVariables`) is kept since V2 and other modules still use
it.
The `newHomepageUsageV2` flag can be removed from ConfigCat after this
merges.
## How to test
- Open a project homepage on platform.
- Confirm the usage section still renders (the V2 layout) with no flag
dependency.
- Verify no console errors and no broken imports.
- Expected result: identical homepage usage section to what production
shows today.
## Notes
- This is independent of the in-flight service-health usage charts work
(PR #46373), which is behind its own `newHomepageUsageDeltas` flag.
Whichever merges second will resolve a small conflict on the
`UsageSection` selection in `Home.tsx`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Removed project usage statistics section from the home page.
* Simplified the home page experience by consolidating feature flag
variants into a standardized implementation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
## Context
As per PR title - prevents refetch on focus and reconnect for /query
requests that failed due to statement timeouts, presumably that those
requests will run into the same problem either way so this minimizes
unnecessary impact to the database
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved handling of statement timeouts to prevent automatic retry
attempts after window focus or reconnection.
* Enhanced query execution request identification for better query
tracking.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Visual cleanup of the Logs sidebar (unified logs):
- Restyle the "Go back to old logs" and "Try Unified Logs" banners as
full-bleed bordered strips (no card), with an icon-only switch-back
button and a tooltip
- Add a "Beta" badge next to the "Logs" sidebar title
- Rename the product from "Logs & Analytics" to "Logs"
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Unified Logs banner with “Try Unified Logs” and “More
information” actions, plus a “Go back to old logs” utility layout.
* Show a **“Beta”** badge for Unified Logs eligibility.
* **UX Updates**
* Updated the Logs experience to consistently display under the
**“Logs”** product layout.
* **Tests / Documentation**
* Updated end-to-end checks and examples to expect the **“Logs”**
heading text exactly.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: kemal <hello@kemal.earth>
## Problem
On pages that needs to check conditions for which data is loaded
asynchronously, the navigation links in the sidebar appear disabled for
a split second:
<img width="1394" height="1636" alt="image"
src="https://github.com/user-attachments/assets/0681966d-676d-4c8c-8bd4-852dcf93ddb7"
/>
## Solution
Check whether the required data is loading and override the styles so
that the links are still disabled to avoid errors but appear as normal.
## How to test
- Open the project setting page
- Check the styles of the sidebar items carefully while it load (might
require to refresh a few times to be sure)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Navigation buttons, menu items, and settings menus now display loading
states while project data is being fetched, providing visual feedback
and preventing interaction during data loading operations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Bug fix / UI polish
## What is the current behavior?
Visiting `/authorize` without an `auth_id` renders a bare `Card` outside
the shared Connect interstitial — no centered layout, no Supabase logo,
inconsistent with every other `/authorize` state (loading, error, form,
approved).
Two edge cases also produce poor UX: a blank flash while
`router.isReady` is false, and a silent empty page when the
authorization query succeeds but returns no requester.
## What is the new behavior?
- **Missing `auth_id`**: `ApiAuthorizationInvalidScreen` now uses
`InterstitialLayout` with `SupabaseLogo`, a user-facing title ("Missing
authorization link"), warning admonition, and "Back to dashboard" —
matching the error screen and CLI missing-params pattern.
- **Router not ready**: `authorize.tsx` shows
`ApiAuthorizationLoadingScreen` instead of `null`.
- **Empty requester**: `ApiAuthorization.Valid.tsx` renders
`ApiAuthorizationErrorScreen` instead of returning `null`.
Tests updated in `ApiAuthorization.test.tsx`; added `authorize.test.tsx`
for router-not-ready loading.
| Before | After |
| --- | --- |
| <img width="524" height="455" alt="Authorize API Access
Supabase-DCB404EC-7D65-4DD1-A6E0-B720DC765DA7"
src="https://github.com/user-attachments/assets/8d2b68fc-e008-4145-aa74-3154a883083c"
/> | <img width="524" height="455" alt="Authorize API Access
Supabase-6B642066-D0BE-4EDC-A186-A0290B4B5634"
src="https://github.com/user-attachments/assets/b04bee93-6b23-411f-8e36-9a0fff8a975d"
/> |
## To test
Please do a visual check on `http://localhost:8082/authorize` (no
`auth_id` or other parameters).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved the UI and copy shown when the authorization link is missing.
* Updated behavior to show an explicit error screen when authorization
requester data is unavailable.
* **New Features**
* Added a loading state for the authorization page while router
parameters are initializing.
* **Tests**
* Updated component expectations for the missing authorization and
“unable to load” scenarios.
* Added a page test to verify the loading message when the router is not
ready.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
## Context
There's certain areas in the dashboard where we're calling
`useTablesQuery` without a schema filter, in which case the dashboard
then fires a query against the project's database to fetch _all_ tables
across _all_ schemas - this could easily be a heavy query if there's a
large number of relations in the project's database.
Am hence opting to either add a schema filter if appropriate, or
otherwise opt to use the infinite loading behaviour
## Changes involved
- Add schema filter to `useTablesQuery` in database triggers and
publications
- Use infinite loading for tables in Cmd K for "Run query on table" and
"Search database tables"
## To test
- [x] Verify that database triggers + publications still function as
expected
- [x] Verify that CMD K "Run query on table" and "Search database
tables" still function as expected (including search)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Implemented debounced infinite-scrolling table search in the command
menu and SQL editor command flow.
* Added a schema selector dropdown to publications management for easier
navigation.
* **Improvements**
* Removed the “Schema” column from the publications tables UI.
* Updated search guidance and table-picker status (counts/loading)
during infinite browsing.
* Trigger table listings now follow the selected schema context.
* Refined command menu list height and improved the database-tables
placeholder text.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Code cleanup. Resolves DEPR-570.
## What is the current behavior?
The old `APIAuthorizationLayout` component still exists in Studio even
though the API/OAuth, CLI, Stripe, invite, credits, and AWS connect
surfaces have moved onto the shared interstitial layout.
## What is the new behavior?
Removes the unused `APIAuthorizationLayout` component.
`IntegrationWindowLayout` and `VercelIntegrationWindowLayout` are still
required for upcoming Vercel connection UI clean up work.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Removed unused layout component from the API authorization flow,
streamlining the codebase and improving maintainability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This PR disabled generating snippet titles when running and disables the
"generate titles" buttons in Rename Snippet and Save Snippet dialogs
(which is accessed through the side SQL Editor).
How to test:
1. Disable AI for an org.
2. Try to run a new snippet, it shouldn't be renamed automatically.
3. Right click it, click Rename. The "generate title" in the dialog
should be disabled with a reason in a tooltip.
4. Open the side SQL Editor, write "select 1", click Save snippet. The
"generate title" in the dialog should be disabled.
Testing the same flows for HIPAA projects should say `This feature is
not available for HIPAA projects.`
<img width="715" height="833" alt="Screenshot 2026-06-15 at 23 02 15"
src="https://github.com/user-attachments/assets/f9b68f2f-5a5a-4a66-bd0d-9245f4e2f78e"
/>
<img width="948" height="845" alt="Screenshot 2026-06-15 at 23 02 01"
src="https://github.com/user-attachments/assets/b0c9a90e-6cc1-4262-a246-88617cec41dc"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* AI feature availability is now gated by organization-level AI opt-in
settings instead of subscription-based HIPAA add-ons.
* **Bug Fixes**
* Updated "Generate with AI" buttons to display disabled state with
contextual messaging (missing API key, organization AI opt-out, HIPAA
project restriction, or generation in progress).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Bug fix / UI polish. Resolves DEPR-597.
## What is the current behavior?
In shared Connect / interstitial surfaces, partner logos in `LogoPair`
often have baked-in backgrounds (e.g. Figma white, Cursor black, CLI
`bg-black`), while `SupabaseLogo` uses the default `LogoBox` `bg-muted`
and can look washed out in dark mode.
The OAuth redirect footnote on `/authorize` also lacked `text-balance`,
unlike other interstitial footnotes.
## What is the new behavior?
- `SupabaseLogo` now uses `bg-surface-75` on its `LogoBox` for better
contrast alongside partner logos in light and dark mode, without the
harsh fixed-white pairing on flows like CLI login.
- The `/authorize` redirect footnote uses `text-balance` for cleaner
wrapping of long redirect URLs.
| Before | After |
| --- | --- |
| <img width="524" height="455" alt="Authorize CLI
Supabase-206F0310-3508-41F6-8255-6840FD1DFB21"
src="https://github.com/user-attachments/assets/86a41a79-4074-4263-abba-e9db97dd1f9d"
/> | <img width="524" height="455" alt="Authorize CLI
Supabase-25A580E2-5353-4CA4-BDA7-C6953154A5FE"
src="https://github.com/user-attachments/assets/83046770-f9fc-4648-b7c4-428423510f53"
/> |
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
## What kind of change does this PR introduce?
Bug fix. Resolves FE-3469.
## What is the current behavior?
On auth email template pages, the Docs button builds anchor hashes from
the Studio URL slug (derived from user-facing titles), not from
canonical template IDs.
E.g. **Reset password** links to `#authemailtemplateresetpassword`, but
the docs section is `#authemailtemplaterecovery`.
12 of 13 templates had broken Docs links.
## What is the new behavior?
Docs links use an explicit `EMAIL_TEMPLATE_DOCS_ANCHORS` map keyed by
`template.id`, matching the anchors in
[customizing-email-templates.mdx](https://supabase.com/docs/guides/local-development/customizing-email-templates).
Examples:
- Reset password → `#authemailtemplaterecovery`
- Magic link or OTP → `#authemailtemplatemagic_link`
- Password changed → `#authemailnotificationpassword_changed`
Dashboard URL slugs (`reset-password`, etc.) are unchanged.
## Additional context
- Added `EMAIL_TEMPLATE_DOCS_ANCHORS` in `EmailTemplates.constants.ts`
with `satisfies Record<AuthTemplateType, string>` for exhaustiveness
- Added `EmailTemplates.constants.test.ts` to verify all template types
are covered and anchors match docs heading paths
**Test plan**
- [x] `pnpm --filter studio test EmailTemplates.constants`
- [ ] Spot-check Docs button on Reset password, Magic link or OTP, and
Password changed templates
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added automated checks to ensure every authentication email template
has the correct documentation anchor mapping.
* **Chores**
* Updated the documentation link behavior for email templates to use a
consistent, predefined anchor mapping—improving reliability and
maintainability of the docs button.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Just some clean up as I was going through stuff
- `useExecuteSqlQuery` is deprecated and not used at all
- As such `execute-sql-query` is technically irrelevant, the more
relevant file is `execute-sql-mutation`
- Hence opting to consolidate `execute-sql-query` into
`execute-sql-mutation`
- Also removing `ExecuteSqlError` since its just re-exporting the
`ResponseError` type
There's a lot of file changes but its essentially just updating the
importing statements across the files
## Summary
The Unified Logs promo banner (shipped in #46847) had two telemetry/UX
gaps I found while auditing the weekly PostHog event review. Its CTA
fired one event for two different user paths with no way to tell them
apart, and clicking "Explore" left the banner in place. This adds an
`is_enabled` property to the CTA event and auto-dismisses the banner on
the Explore path.
## Changes
- Add `is_enabled: boolean` to `unified_logs_banner_cta_button_clicked`.
It is `true` when the user is already enabled and the button navigates
to the logs page ("Explore"), and `false` when not enabled and the
button opens the feature-preview modal ("Enable"). The two cohorts are
now queryable independently, which is what makes the CTA data usable for
measuring adoption.
- Auto-dismiss the banner when an already-enabled user clicks "Explore".
Previously only the X button dismissed it, so an Explore click left the
banner showing on the next project page load. Scoped to the Explore path
on purpose: the not-enabled path only opens a preview modal (it does not
enable), so dismissing there would hide the banner from users who never
enabled.
## Testing
Behavior to verify on the Vercel preview:
- [x] Enabled user clicks "Explore Unified Logs": navigates to the logs
page, banner does not reappear on the next project page load, CTA event
fires with `is_enabled` true.
- [x] Non-enabled user clicks "Enable Unified Logs": preview modal
opens, banner is still present after closing the modal, CTA event fires
with `is_enabled` false.
- [x] X button: banner dismissed as before, dismiss event fires.
Out of scope on purpose: no impression event (it would fire on every
banner render, low-millions of events per month for one banner), so true
click-through rate stays unmeasurable for now.
## Linear
- fixes GROWTH-925
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Improvements**
* Unified Logs banner now intelligently updates behavior based on
feature state.
* When enabled, exploring the feature automatically dismisses the
banner.
* When disabled, the enable action opens the feature preview flow.
* Enhanced tracking for banner interactions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
UTC was buried in the middle of the timezone list. Users managing
servers (which run in UTC) had to scroll or search to find it.
## Fix
Hardcode a UTC entry immediately after "Auto detect" so the two most
common choices are always at the top. The entry uses the standard `UTC`
IANA name and shows the checkmark when selected, consistent with all
other entries.
## How to test
- Open any page in Studio and click your user avatar.
- Open the Timezone submenu.
- Confirm the order is: Auto detect, (UTC) Coordinated Universal Time,
then the rest of the list.
- Select UTC and confirm the checkmark appears and the trigger label
updates.
- Search "UTC" in the search box and confirm it still matches.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added explicit "UTC (Coordinated Universal Time)" option at the top of
the timezone selector dropdown for easier access.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Context
The dashboard has an RQ hook that fetches all table privileges in the
database `useTablePrivilegesQuery`
[here](https://github.com/supabase/supabase/blob/master/apps/studio/data/privileges/table-privileges-query.ts#L21)
which can potentially be a resource heavy query on the database,
especially if the database has a large number of relations.
A recent UI that was added `ProjectNeedsSecuring` uses that query, and
has become a common entry point for all projects as it's rendered when
the user lands on the project's home page, and the project has tables
with RLS issues, in which case if the project has a large number of
tables, the database will face run into resource issues, resulting in
statement timeouts.
## Changes involved
Opting to pass in `includedSchemas` parameter wherever we're calling
`useTablePrivilegesQuery`, which includes:
- `ProjectNeedsSecuring`
- `QueueSettings`
- `column-privileges`
In which we'll hence only fetch the table privileges for the provided
schemas only (rather than the whole DB)
Also did a similar fix for `useColumnPrivilegesQuery` as well as it
likely runs into the same problem
## To test
- [ ] Verify that those 3 UIs are still working as expected (should not
have any visual changes)
- [ ] Verify in the network tab that table / column privileges are now
filtered to the schema provided, rather than fetching for all schemas in
the DB
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved permission-save failure messaging by generating clearer toast
errors from unexpected failures.
* Prevented privilege-related UI from loading until required
configuration is successfully retrieved.
* **Performance**
* Faster, more targeted privilege loading by scoping both table and
column privilege queries to the selected/relevant schema(s), reducing
unnecessary client-side filtering.
* Switched privilege retrieval to schema-aware database metadata queries
for more efficient results.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Ali Waseem <waseema393@gmail.com>
## Context
We're currently fetching _all_ database policies when landing on the
Table Editor which is unnecessarily since only the table in view matters
in that moment.
## Changes involved
- Ensure that fetching policies is filtered by the current schema in the
table editor to avoid fetching all policies in the DB
- ^ Applied the same fix on the Auth Policies page as well since it
faces the same issue
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved database policy fetching so it respects the currently
selected schema and won’t run when the table context is missing.
* Enhanced project status updates by aligning cached updates with the
infinite-list query structure.
* **Refactor**
* Streamlined auth policy schema handling by deriving exposed schemas
via shared utilities and requesting only the needed configuration field
for subsequent policy queries.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This PR disables the following features on Multigres projects
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Enhanced replication interface with improved visual states.
* **Bug Fixes**
* Added validation to prevent incompatible database configuration
combinations.
* **Changes**
* High Availability projects now display informational notices
indicating unavailable features: Realtime, Replication, and PITR
backups.
* **Removed**
* Removed redundant UI component from the application.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com>
## Problem
Deleting a custom report waited for the API round trip before updating
the UI. The confirmation modal showed a loading spinner, the report
stayed visible in the sidebar until the request resolved, and the
interaction felt sluggish.
## Fix
The delete now applies optimistically. On confirm, the report is removed
from the sidebar immediately and the user is navigated away. The actual
delete runs in the background. If it fails, the cached list is rolled
back to its previous state and an error toast is shown.
The optimistic behavior lives inside `useContentDeleteMutation` (via
`onMutate` snapshot + `onError` rollback), so any current or future
caller of that hook gets it for free, no per-call wiring required.
## How to test
- Open a project with at least one custom report
- Click the kebab menu on a report and choose Delete report, then
confirm
- Expected result: the report disappears from the sidebar instantly and
a success toast appears
- To test rollback: throttle/offline the network or force the delete
endpoint to fail, then delete again
- Expected result: the report reappears in the sidebar and an error
toast is shown
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Improvements**
* Deletion flows now provide explicit loading, success and error
feedback; UI updates immediately on delete and will restore if the
action fails.
* **Removals**
* Removed the reports menu and individual report menu item UI components
(affects report-level rename/delete dropdowns and related menu
navigation).
* **Tests**
* Added tests covering content deletion behavior, multiple-deletion
cases, and data integrity after removals.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Problem
The Disk Size section in the database report used raw HTML headings and
unstyled spans without semantic Tailwind tokens, resulting in
inconsistent typography and spacing compared to the rest of the report.
## Fix
- Replace bare `<h5>` labels with `<p className="text-sm
text-foreground-light">` for consistent muted label styling
- Add `font-semibold text-foreground` to stat values so they stand out
clearly
- Simplify the stat row layout from a brittle `inline-grid grid-cols-12
gap-12` to `flex flex-wrap items-center gap-8` with `ml-auto` on the
action button
- Replace `<h3 className="mt-8 text-sm">` with a properly styled `<p>`
label for the Large Objects sub-section
- Style the empty-state "No large objects found" message with `text-sm
text-foreground-light`
## How to test
- Go to `/project/<ref>/observability/database`
- Scroll to the Database Size section
- Confirm the Space used and Provisioned disk size labels are muted and
values are bold/prominent
- Confirm the layout is clean and the Increase disk size button sits to
the right
- Confirm the Large Objects sub-section label and empty state are
consistently styled
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Updated the visual layout and styling of the Database Size widget's
summary area, improving the presentation of disk space metrics.
* Enhanced the styling of the Large Objects section header and
empty-state messaging for better visual consistency.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
As part of hibernation (suspend and wake), wakes via PostgREST happen
automatically. However, if a user goes straight to the dashboard, we
want to ensure the project wakes up from it's slumber. I've decided to
add this logic at a very central point that will prevent most
project-ref related pages to load (purposely).
The project ref details endpoint returns whether the project is
hibernating or not - so for any regularly running project, none of the
added logic will be invoked and there is no extra network calls, so no
negative perf impact for these checks.
Eventually with v3 architecture none of this is needed as wakes are done
at the proxy/network layer, but this is a necessary change for v2 for
more graceful wakes.
Adjusted network restrictions as it would query before the project loads
and potentially time out while still loading
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Automatic wake-up for hibernating projects restores functionality
without manual intervention.
* **Platform API Enhancements**
* New conversation management endpoints for escalation, synchronization,
and resolution.
* New project wake endpoint for managing dormant project states.
* Updated read-replica operation response codes for improved API
consistency.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Cases with cloudflares http/3 the content-length header is optional, so
in many cases we need to make sure in this case `openapi-fetch` can
safely parse this (i.e ignore when the body is empty and no header is
present)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Fixed JSON parsing failures when successful API responses contain
empty bodies without `Content-Length` headers. Improves compatibility
with HTTP/3 and similar response types.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Extends the SQL editor's destructive query detection to catch dangerous
operations (DROP, DELETE, TRUNCATE) hidden within dynamic SQL execution
patterns like `EXECUTE`, `EXECUTE format()`, `OPEN cursor FOR EXECUTE`,
and `RETURN QUERY EXECUTE`.
Previously, only direct statements like `DROP TABLE users` triggered
warnings. Dynamic SQL inside PL/pgSQL blocks bypassed detection
entirely.
Closes FE-3603 and https://github.com/supabase/supabase/issues/46876
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved detection of potentially destructive SQL across many
execution styles, including DROP/DELETE/TRUNCATE, ALTER ... DROP COLUMN,
and dynamic/executed or string-constructed queries to reduce missed
destructive cases.
* **Tests**
* Expanded test coverage for SQL validation with extensive positive and
negative scenarios covering dynamic execution patterns (EXECUTE
variants, concatenation, dollar-quoted and escaped strings) to reduce
false positives and negatives.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Update to support text area for functions
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Secret inputs now accept and preserve multi-line values and
auto-resize to fit content.
* Secret values can be masked/unmasked via a show/hide toggle with
tooltip; masking uses styled concealment.
* Per-secret controls refined: clearer row layout, dedicated remove
icon, and add/save controls moved to the card footer.
* **Tests**
* Added tests validating multi-line secret entry and that submitted
payloads include embedded newlines.
* Updated tests to assert masking/unmasking behavior via visual security
styling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: kemal <hello@kemal.earth>
<img width="1521" height="967" alt="image"
src="https://github.com/user-attachments/assets/8d7bed1f-3ed8-4311-bd4b-92345ae02a52"
/>
Updates project settings integration page to more aligned with our
updated layout guidance (as defined in layout.mdx in design system).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Refined the integrations settings page layout and visual design across
AWS PrivateLink, GitHub, and Vercel integration sections for improved
consistency.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Makes it possible to reset password from the connect sheet. Once reset
the password is shown temporarily in the connection string for copy. The
copy prompt action does not copy the password.
<img width="1043" height="953" alt="image"
src="https://github.com/user-attachments/assets/fe1a33bb-839f-47e3-b07f-7a5fa1df2b8d"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Session Pooler notice for direct connections on IPv4 networks
* Option to show a temporary database password during direct-connection
setup
* **Improvements**
* New password reset dialog with strength checks and generation
* Connection-copy behavior now redacts temporary passwords and produces
cleaner copy prompts
* **Tests**
* Added tests covering connection-string password insertion/replacement
and copy-prompt behavior
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix
## What is the current behavior?
returnTo is not correctly validated
## What is the new behavior?
returnTo is validated
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved validation of redirect URLs used after organization creation;
when a return URL is provided it is now validated before redirecting,
while auth-related query parameters are still preserved.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Adds a one time banner to the `<BannerStack />` to promote Unified Logs
becoming available. This also fixes the `<BannerStack />` components
issue with stacking varying height banners.
https://github.com/user-attachments/assets/40f02709-0d67-43a9-ab95-750d9a4a582a
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a dismissible "Unified Logs" banner with an animated sample-log
carousel, CTA to Unified Logs, and a preview/enable flow for non-enabled
users. Dismissal is persisted locally and telemetry is recorded for CTA
and dismiss actions; banner appears only for eligible projects.
* **Refactor**
* Banner stack UI updated to display a single front banner with animated
"peek" slivers and refined hover/animation behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix
## What is the current behavior?
Closes#46824
In the Studio table editor, when inserting a new row into a table with
an auto-generated primary key (or any non-text column with a default
value), clearing the field after editing it sends an empty string `""`
in the insert payload. This causes Postgres to reject the insert with:
```txt
ERROR: 22P02: invalid input syntax for type bigint: ""
```
## What is the new behavior?
When inserting a new row, cleared fields that are
identity/default-backed and non-text are now omitted from the insert
payload, so Postgres applies the column default or identity generation
instead of receiving an empty string.
For example:
- id bigint generated by default as identity cleared → omitted, Postgres
auto-generates id.
- created_at timestamptz default now() cleared → omitted, Postgres
applies now().
- name text cleared → preserved as "", because empty string is a valid
explicit text value.
## Additional context
After the fix:
https://github.com/user-attachments/assets/78e9eb9c-9518-4894-8547-d18ffa78869a
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* New-record saving now respects column defaults and identity behavior:
empty inputs for identity or defaulted non-text columns are omitted so
defaults are applied, while intentional empty strings for text fields
are preserved.
* **Tests**
* Added test coverage validating new-row creation behavior with
default/identity handling and empty-text preservation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Ali Waseem <waseema393@gmail.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix.
## What is the current behavior?
Closes#46829.
When a cron job's command uses `jsonb_build_object(...)` header syntax,
`parseCronJobCommand` captures the argument list with `([^)]*)`
(stopping at the first `)`) and splits it on every `,`. A header name or
value that legitimately contains a comma or parenthesis is split into
the wrong pairs, shifting every following header and leaving a trailing
header with an undefined value. Because the edit sheet rebuilds the
command from these parsed fields, saving a job (even just changing its
schedule) silently rewrites its stored headers.
## What is the new behavior?
The `jsonb_build_object` argument list is parsed with a scanner that
respects single-quoted SQL literals (`''` escapes) and nested
parentheses, splitting only on top-level commas. Header names and values
containing commas or parentheses now round-trip unchanged. Added four
regression tests in `CronJobs.utils.test.ts`.
## Additional context
Verified locally: `vitest` cron suite 48/48 pass (the 4 new tests fail
without the fix), `tsc --noEmit` clean, ESLint clean, Prettier clean,
and `next build` succeeds.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Corrected HTTP header parsing in cron jobs so header values with
commas, parentheses, escaped quotes, or escape-string prefixes are
preserved and don't corrupt adjacent arguments.
* Ensured commas inside header values no longer swallow following body
arguments.
* **New Features**
* Added robust SQL-literal and JSONB-argument parsing to reliably
extract name/value pairs from JSONB-style headers.
* **Tests**
* Added tests covering complex header value cases and
whitespace/escaping edge cases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
- closes https://github.com/supabase/supabase/issues/46818
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved truncation detection in the table row editor to consider
column data formats, yielding more accurate handling of JSON and array
field values and avoiding incorrect truncation/skipped updates.
* **Tests**
* Updated and added tests to validate format-aware truncation behavior,
including multidimensional array cases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This PR improves the replication UI in the following ways:
- Adds a new selecion picker for destinations which is split by the
destination location and it's clearer and can scale more when we add
more destinations.
- Adds a much improved section on lag, highlighting new metrics that
could help debug issues more easily.
- Improves the copy across the whole code.
- Fixes the 2d topological view of replication with better status
handling.
### Screenshots
<img width="1270" height="777" alt="image"
src="https://github.com/user-attachments/assets/0ffc890e-2f80-47e5-bdb1-75071adda024"
/>
<img width="1665" height="656" alt="image"
src="https://github.com/user-attachments/assets/23a27a02-acb2-4891-af95-5bc1d6ec7bfe"
/>
<img width="1454" height="247" alt="image"
src="https://github.com/user-attachments/assets/c8799983-aa63-42b2-9370-ae4e009c1573"
/>
<img width="1120" height="340" alt="image"
src="https://github.com/user-attachments/assets/20a18ad6-e5a9-40ec-80d4-42d6f783d868"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Live slot health indicators, legend, and connection badges.
* Grouped destination type dropdown with alpha badges.
* **Improvements**
* Clearer UI copy for external destinations, alpha disclaimers, and
onboarding flows.
* Consolidated "n/a" handling for lag displays and richer metric
tooltips.
* Simplified replication diagram visuals and clearer table/row
status/lag presentation.
* Replication status responses now include expanded slot health and lag
metrics.
* **Tests**
* New test suites covering destination selection and destination row
states.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Follow-up to the upgrade CTA placement experiment (#45858). The
`PlanUsageCard` count metrics (Monthly active users) were abbreviated to
`50k`, which reads ambiguously. This shows them in full with thousands
separators (`50,000`) to match the pricing page.
- `Monthly active users` row now renders e.g. `8,200 / 50,000` instead
of `8.2k / 50k`.
- Collapses the two count formatters (`formatCount` /
`formatCountLimit`) into one `toLocaleString()` call so the current
value and limit always use the same format.
- GB metrics (Egress, Database size, File storage) are unchanged.
## Test plan
- [ ] On the org projects page with the `org_projects_list` variant, the
Monthly active users row shows full numbers (`0 / 50,000`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated plan usage display formatting to show full numbers with
thousands separators instead of abbreviated notation, improving clarity
when viewing usage limits.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Details of change
Adds Snowflake to the Studio replication destination flow:
- destination selection and display
- create/edit form fields
- validate/create/update payload serialization
- generated Platform API types
Snowflake remains gated behind `etlEnableSnowflakePrivateAlpha`.
**Note:** I have configured `etlEnableSnowflakePrivateAlpha` in
ConfigCat ("all" in staging and tied to my own org id in prod).
## Details of Verification Process
- Studio focused Vitest coverage for form serialization and diagram
mapping
- Studio typecheck
- ESLint on changed Studio replication files
- Local `mise fullstack:dev` smoke test to confirm the Snowflake form
renders ok.
<img width="937" height="569" alt="image"
src="https://github.com/user-attachments/assets/8d6b3a87-1f9d-4a59-91da-be719714ea49"
/>
Full create/validate E2E depends on the Platform PR and ETL runtime
rollout.
## Review Requests
Please check the Snowflake wire payload matches the Platform/ETL
contract and that gating/edit/display behavior follows the existing ETL
destination patterns.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Snowflake added as a supported replication destination (private-alpha
gated), including UI for selecting and configuring connection and auth
(account, user, database, schema, role, private key, optional
passphrase).
* **Validation**
* Form validation and submission now handle Snowflake-specific
required/optional fields.
* **Tests**
* Unit tests added for Snowflake form behavior and replication-type
detection.
* **API**
* Destination create/update/validate flows extended to accept Snowflake
payloads.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Reword the "I'm purchasing as a business" tooltip to frame it around
needing a tax ID rather than being "tax-registered."
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated payment method setup guidance to clarify when to enable tax ID
information and confirm receipts remain available regardless of this
setting.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
