## What kind of change does this PR introduce?
Feature. Part of DEPR-279.
## What is the current behavior?
The organization invite page has its own bespoke centered card and
page-level Supabase logo.
## What is the new behavior?
Introduces a minimal shared interstitial layout and migrates `/join`
onto it as the first small connect-surface slice. The invite API and
accept-invite mutation paths are unchanged.
| Before | After |
| --- | --- |
| <img width="1024" height="794"
alt="Supabase-F2325C57-D5DE-445D-8083-12EF8A1EE0CA"
src="https://github.com/user-attachments/assets/b23dcc7a-c649-4b59-9393-9232d74f0c6b"
/> | <img width="1024" height="794" alt="Join Organization
Supabase-66CDA329-0531-4B12-AC32-A7E21931F876"
src="https://github.com/user-attachments/assets/454917ce-1a96-4e50-b003-6c16a541b39a"
/> |
| <img width="1060" height="822" alt="CleanShot 2026-03-13 at 11 04
43@2x-2616AECB-8203-4439-A1CD-45AB18FC4CA8
1-584A0600-CCE0-4F16-9111-9BEB94BE85EC"
src="https://github.com/user-attachments/assets/871c7dcb-120e-40cd-afc8-2cec95e4b7ae"
/> | <img width="1024" height="794" alt="Join Organization
Supabase-26AD978E-4CF9-4600-9885-082084349E94"
src="https://github.com/user-attachments/assets/ee9bfaff-dde4-4366-abae-77dc8a95c4ef"
/> |
| <img width="1024" height="794"
alt="Supabase-4993D74C-D62B-43B7-9681-826BE1591AC4"
src="https://github.com/user-attachments/assets/1c411ae0-90e7-481d-a4cc-3eac26267291"
/> | <img width="1024" height="794" alt="Join Organization
Supabase-C84D4E4C-24F5-463D-B1D6-D11D3256596F"
src="https://github.com/user-attachments/assets/688387a4-3c49-41db-b89c-7c5531e91aed"
/> |
| <img width="1024" height="794"
alt="Supabase-D9BD2601-98A4-489D-A51D-CEB73F51FA6F"
src="https://github.com/user-attachments/assets/6d1da65f-d655-4047-9f6a-db65f8c0a729"
/> | <img width="1024" height="794" alt="Join Organization
Supabase-50065F40-179A-4BD6-8F1D-6106FFD8A15C"
src="https://github.com/user-attachments/assets/e61809f9-dcec-4e51-ba94-91b04010ec50"
/> |
## Testing notes
Staging invite emails are generated with the fixed staging dashboard
origin, for example:
```text
https://supabase.green/dashboard/join?token=...&slug=...
```
To test this PR preview with a real invite token, keep the path and
query string from the email but replace the origin with the Vercel
preview origin, for example:
```text
https://studio-staging-git-dnywh-featconnect-interstitial-join-supabase.vercel.app/dashboard/join?token=...&slug=...
```
### Manual state checks
- **Signed out:** open the swapped invite URL in an incognito window or
a browser signed out of Studio. Expected: `View invitation`,
sign-in/create-account actions, and no loading skeleton hang.
- **Wrong account:** sign in to the PR preview as an account that is not
the invite recipient, then open the swapped invite URL. Expected: `Wrong
account`, warning callout, and `Sign out`.
- **Happy path:** sign in as the invited email address, then open the
swapped invite URL. Expected: `Join {Organization}`, signed-in account
row, `Accept invite`, and `Decline`. Accepting should join the
organization.
- **Invalid token:** alter one character in the token in the swapped
invite URL. Expected: invalid invite state.
- **No longer valid:** accept the invite once, then open the same
swapped invite URL again. Expected: no-longer-valid/already-used state,
depending on the backend response.
### Test-covered states
Expired invites, generic backend error, loading, and
create-account-disabled states are harder to force manually in staging.
They are covered by `tests/components/OrganizationInvite.test.tsx`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Redesigned the organization invitation experience with an interstitial
layout, clearer early-return flows for signed-out, loading,
expired/invalid, wrong-account, and accepted-invite states; primary CTA
now reads “Accept invite”.
* Streamlined error and sign-out flows with clearer, focused messaging.
* **New Features**
* Added a reusable interstitial layout and compact account row for
invitation screens.
* **Tests**
* Added comprehensive tests covering invite states, accept/decline
actions, and error handling.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45774)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Hides the 'Project last paused on' date shown in the paused state for
free-plan projects, as the date returned by the API is currently
incorrect (API team is investigating)
Related ticket: FE-3149
## Summary
Adding an in-dashboard banner for the Fly.io May 31 suspension. Banner
targets users on a Fly project (or with a Fly project in their
currently-selected org) and surfaces a per-project breakdown of what's
affected in a dialog. Detection is self-correcting: as soon as the user
migrates off Fly, the banner disappears with no follow-up.
<img width="557" height="502" alt="Screenshot 2026-05-11 at 5 08 22 PM"
src="https://github.com/user-attachments/assets/7bafb712-3490-4555-9667-66e9909f1b1a"
/>
<img width="1675" height="536" alt="Screenshot 2026-05-11 at 3 55 06 PM"
src="https://github.com/user-attachments/assets/6c1bf9d1-4dcc-4aac-a679-2ed477d2ed1c"
/>
## Changes
- **Detection hook** (`useFlyDeprecationProjects`): reads only from
already-cached data — `useSelectedProjectQuery` for the current project,
plus `useOrgProjectsInfiniteQuery` scoped to the selected org. Zero
cross-org fan-out: worst case is one paginated query per session (the
same one the project list page already makes).
- **Banner component** (`FlyDeprecationBanner.tsx`): mounted in
`AppBannerWrapper`. Dynamic title (primaries / branches / both), dialog
lists affected projects with org name, numbered migration steps, links
to backup/restore CLI + Dashboard backup + branching docs. List
truncates to 5 entries with "…and N more." tail when more are affected.
- **Telemetry**: `fly_deprecation_banner_exposed` and
`fly_deprecation_banner_dismissed` events emitted via `useTrack`
(auto-injects project + org groups). Properties: `primaryCount`,
`branchCount`. CTA click tracking intentionally omitted — migration
outcome is measured via warehouse `cloud_provider = 'FLY'` decay.
- **LocalStorage**: dated dismissal key `FLY_DEPRECATION_2026_05_31`;
orphan `FLY_POSTGRES_DEPRECATION_WARNING` from PR #33510 removed in the
same change so users who dismissed the Feb 2025 banner still see this
one.
- **Support contact**: email `success@supabase.io` only (no support
ticket link), per Brian's outreach copy in the Linear issues.
## Coverage trade-off
Banner renders on project pages (selected-project check) and pages where
the selected org's projects list is cached (org overview, project list).
It does **not** render on `/dashboard` home or other pages without org
context. Email outreach from GROWTH-817 / GROWTH-819 handles those
users. This was a deliberate trade-off to avoid cross-org fan-out load.
## Lifecycle
Banner expires `2026-06-01T00:00:00Z` (right after the May 31 deadline).
Stale client bundles stop rendering it without a redeploy. Cleanup PR
planned post-deadline to remove the component, hook, localStorage key,
and telemetry events.
## Testing
Tested on the Vercel preview with React Query cache overrides to mock a
Fly project:
- [x] Banner renders for a user with at least one project where
`cloud_provider === 'FLY'`
- [x] Banner does **not** render for a user with no Fly projects
- [x] Banner does **not** render on `/sign-in`
- [x] Title varies by primaries-only / branches-only / both
- [x] Dialog lists affected projects with org name in parens
- [x] Dialog list truncates to 5 with "…and N more." for larger sets
- [x] Migration guide / Dashboard backup / branching links open in a new
tab
- [x] Dismiss (×) closes the banner and persists across hard reload
(localStorage `fly-deprecation-2026-05-31-dismissed`)
- [x] PostHog receives one `fly_deprecation_banner_exposed` per mount
with `primaryCount` + `branchCount` and `$groups.organization` populated
- [x] PostHog receives one `fly_deprecation_banner_dismissed` on close
with the same property shape
## Linear
- fixes GROWTH-817
- fixes GROWTH-819
## Show notice when plan fee is prepaid for the upcoming invoice
When a subscription's plan fee has already been billed for the current
period (e.g. transitioning to in-arrears billing), the upcoming invoice
no longer contains a plan line item. Previously this rendered as an
empty plan row with a `-`, which was confusing.
<img width="2178" height="538" alt="image"
src="https://github.com/user-attachments/assets/1fa289d9-60ae-48b1-b779-34770bc2c242"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Billing breakdown now detects when the plan fee was already paid
upfront, hides the redundant plan line, and notes only usage will be
invoiced; shows the organization plan name when available.
* Backup restoration: added an optional recovery time target for
physical backups.
* Expanded supported AWS instance types for deployments.
* **UI**
* Compute and Replica Compute docs links now use inline linking for a
smoother in-app experience.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45765)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## Summary
- Display a "Prepaid Credits" line in the upcoming invoice breakdown,
shown directly below Current Costs when the upcoming invoice contains
a `Prepaid Credits` line item
- Surfaces the credit amount being applied (e.g. `-$300`) so users can
see how prepaid credits offset their projected bill
- Consolidates the projected tax items into the tooltip for `Projected
Costs`
<img width="1416" height="426" alt="image"
src="https://github.com/user-attachments/assets/b3455e82-d03b-40c3-ad5f-493a56004ddf"
/>
## Test plan
- [x] On an org with prepaid credits applied, verify the "Prepaid
Credits" row appears below Current Costs with the negative amount and a
tooltip showing the backend description
- [x] On an org without prepaid credits, verify the row is not rendered
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **Improvements**
* Clarified the "Upcoming Invoice" explanatory copy for non–AWS
Marketplace-managed organizations: it now notes the invoice will
continue updating until the end of your billing cycle.
* Improved invoice breakdown: compute charges and compute credits are
distinguished, and a dedicated "Prepaid Credits" row is shown before
projected costs for clearer billing totals.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix (accessibility improvement in LayoutHeader)
## What is the current behavior?
Icon-only buttons do not have explicit accessible names for screen
readers.
## What is the new behavior?
All icon-only buttons now have explicit accessible names using visually
hidden text (sr-only), ensuring proper screen reader support.
## Additional context
Tooltip text is preserved for visual users.
No visual changes were introduced.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Accessibility**
* Added hidden screen-reader labels to multiple toolbar and menu buttons
(Settings, Advisor Center, AI Assistant, SQL Editor, Help) so icons are
announced by assistive technologies, improving navigation and
discoverability across the studio interface.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45790)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
N/A
## What is the current behavior?
N/A
## What is the new behavior?
N/A
## Additional context
N/A
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated team information in metadata.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Rewrites the secret API key reveal flow in `ApiKeyPill` to remove its
dependency on React Query, replacing it with a lightweight custom hook.
## Changes
- **`useRevealedSecret` (new hook)**
A simple, reusable hook that:
- Fetches the unmasked secret key via `getAPIKeysById`
- Exposes `data`, `isLoading`, `reveal()`, and `clear()`
- Keeps sensitive data in local component state (no global cache)
- **`ApiKeyPill` (refactored)**
- Removes all React Query imports (`useQueryClient`, `useAPIKeyIdQuery`,
`apiKeysKeys`)
- Uses `useRevealedSecret` for reveal / copy operations
- Preserves existing UX:
- 10-second auto-hide timer
- Permission-based gating (`canManageSecretKeys`)
- Loading states on toggle / copy
- **`api-key-id-query.ts` (cleaned up)**
- Removes the now-unused `useAPIKeyIdQuery` hook
- Retains the `getAPIKeysById` fetcher for direct use
## Motivation
The previous React Query–based flow had to aggressively disable caching
(`staleTime: 0`, `gcTime: 0`) and manually purge queries from the cache
on every interaction, which was cumbersome and leaked implementation
details into the component. A plain fetch + local state is simpler and
safer for transient, sensitive data.
## Testing
- [x] Toggle reveal on a secret API key
- [x] Verify 10-second auto-hide
- [x] Copy a secret key (both revealed and unrevealed states)
- [x] Verify restricted users cannot reveal/copy
---
Resolves [FE-3206](https://linear.app/supabase/issue/FE-3206)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Improved API key reveal/copy flow: uses a dedicated reveal/clear
mechanism, preserves permission checks and 10s auto-hide, and shows
reveal/copy failures via user-facing toasts. Copy now falls back to
masked key when needed and the reveal toggle behavior is more reliable.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45792)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES/NO
## What kind of change does this PR introduce?
Bug fix, feature, docs update, ...
## What is the current behavior?
Please link any relevant issues here.
## What is the new behavior?
Feel free to include screenshots if it includes visual changes.
## Additional context
Add any other context or screenshots.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added Beta channel section documenting pre-release Supabase CLI
installation for macOS, Windows, Linux, and npm.
* Updated CLI update instructions with beta-specific commands for
Homebrew, Scoop, and npm.
* Enhanced troubleshooting guide with reference to beta channel
documentation.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45734)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: avallete <8771783+avallete@users.noreply.github.com>
## Problem
Recent database report PRs introduced `(value: any)` type annotations in
recharts `tickFormatter` callbacks, pushing the
`@typescript-eslint/no-explicit-any` ESLint ratchet from baseline 1014
to 1017 and blocking all PR merges.
## Fix
Replace `(value: any)` with `(value: number)` in all affected
`tickFormatter` callbacks across the three flagged files. Recharts
always passes a number to tick formatters, so this is a safe and
accurate type.
## How to test
- Run `pnpm lint --filter=studio` and confirm no new
`@typescript-eslint/no-explicit-any` violations appear in the three
changed files
- Check the ESLint ratchet count is back at or below baseline 1014
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Improved type safety for Y‑axis tick formatters across observability
charts (Memory, Swap, Network throughput, Disk IOPS/throughput/usage,
Replication Lag), ensuring tick values are treated as numeric for more
consistent chart rendering and reliability.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45794)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Ali Waseem <waseema393@gmail.com>
This PR syncs the latest troubleshooting guides from the
supabase/troubleshooting repository.
Co-authored-by: github-docs-bot <github-docs-bot@supabase.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
1. Cleaned up older go pages and removed them from the index. Source
code remains in case we ever want to look back or copy tactics.
2. Modified the Dash 2026 dinner page to reflect venue and time
3. Implemented Notion as a destination for the Dash 2026 dinner form
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Published NYC 2026 Executive Dinner page with venue (Manhatta), timing
(cocktails 6:30 PM, dinner 7:00 PM), event image, and RSVP integration.
* **Updates**
* Thank-you page copy updated to confirm RSVP and include event timing.
* RSS feed updated with new article: "Supabase Is Now an Official
ChatGPT App"
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45733)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Four React-19-sensitive patterns that pass on React 18 today but break
under React 19 (verified on the in-flight TanStack Start branch).
Landing on master now so the eventual React 19 upgrade is a no-op for
tests, instead of a separate cleanup pass under upgrade pressure.
Each fix is a strict superset / less-fragile equivalent of the existing
pattern, so master (React 18) stays green.
**Changed:**
- `hooks/misc/useStateTransition.ts` — fire on entry into `newTest` from
any state other than `newTest`, instead of requiring exactly `prevTest →
newTest`. React 18+ auto-batches dispatches across awaits (e.g.
`dispatch SUBMIT` in the handler, `dispatch ERROR` in `onError`),
collapsing `editing → submitting → error` into a single render where the
intermediate `submitting` tick is never observed. Strict superset of the
old check for our reducers — `success`/`error` are only reachable from
`submitting`.
- `Support/CategoryAndSeverityInfo.tsx` — guard `onValueChange` against
Radix Select's spurious `''` emission. When the controlled value
transitions from `undefined` to a defined value whose `SelectItem` isn't
mounted yet (dropdown closed → items haven't registered), Radix's hidden
`BubbleSelect` fires `onValueChange('')` and clobbers the field. No
`SelectItem` can have `value=""` (Radix throws), so any `''` is
guaranteed spurious — drop it before calling `field.onChange`.
([radix-ui/primitives#3381](https://github.com/radix-ui/primitives/issues/3381))
- `EditSecretModal.test.tsx` — `getByLabelText` → `findByLabelText`.
Under React 19's scheduling, the decrypted-value query resolves on a
separate render tick, so form fields appear one tick after the skeleton.
- `LogsPreviewer.test.tsx` — `addEventListener('click', spy)` instead of
`loadOlder.onclick = vi.fn()`. React 19 reassigns `.onclick` on managed
elements as part of its event wiring, clobbering the direct-property
spy.
## To test
### Unit tests
- `pnpm --filter studio test` — all unit tests pass on master (React 18)
### Support form URL prefill (Radix Select guard)
- `/support/new?category=Problem` → category dropdown reads "APIs and
client libraries" on first paint
- `/support/new?category=dashboard_bug` → "Dashboard bug"
(case-insensitive match)
- `/support/new?category=invalid_garbage` → falls back to "Select an
issue" placeholder, no crash
- `/support/new?subject=My%20issue&message=Details%20here` → subject and
message inputs are prefilled
- `/support/new?projectRef=<your-ref>&category=Problem` → both project
selector and category set, library selector appears
- With a prefilled URL, click the category dropdown and pick a different
option — the new value sticks (this is the path that surfaced the Radix
bug, want to confirm we didn't break user selection)
- DevTools console on first load should be clean — no React hydration
mismatch warning
### Support form submit (`useStateTransition` success + error branches)
- Submit a valid support form → green toast "Support request sent"
appears **once**, view swaps to the success screen, one `POST
/platform/feedback/send` in the network panel
- Block `POST /platform/feedback/send` in DevTools → submit → red error
toast appears **once** (not twice — if you see two toasts the relaxed
transition is firing more than it should), form stays editable with all
inputs preserved
- Unblock and submit again → success path runs cleanly
### Sidebar support form (same reducer + `useStateTransition`, separate
component)
- Open the support widget in the side nav (`SupportSidebarForm`)
- Repeat the success and error paths — should behave identically
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed category selector to prevent selected values from being
unexpectedly cleared during form interactions.
* **Tests**
* Improved test reliability for modal field rendering and event handling
assertions.
* **Chores**
* Clarified internal comments for form initialization logic.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45784)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
## TL;DR
Policies created with a `WITH CHECK` clause in sql editor still reopen
with the that section hidden and the checkbox unmarked
this fixes that by restoring the saved check block when editing the
policy
## Before
<img width="667" height="408" alt="image"
src="https://github.com/user-attachments/assets/0a859172-2ab2-444a-968c-49325505786f"
/>
## After
<img width="602" height="462" alt="image"
src="https://github.com/user-attachments/assets/a7f5799a-e073-4b2c-807b-2997ac76edfd"
/>
## ref:
- Closes https://github.com/supabase/supabase/issues/45720
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed the policy editor to properly display and enable the "with
check" section when loading existing policies that contain check
conditions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The Database report in Observability has no view of network traffic.
Inbound/outbound throughput is useful for spotting saturation, large
unexpected egress, or correlating spikes with disk I/O.
Closes
[FE-3193](https://linear.app/supabase/issue/FE-3193/add-network-in-and-out-charts).
## Fix
Add a new \`network-throughput\` chart entry to
\`getReportAttributesV2\` in
[apps/studio/data/reports/database-charts.ts](apps/studio/data/reports/database-charts.ts),
placed right before \`disk-iops\`. Uses the existing
\`network_receive_bytes\` and \`network_transmit_bytes\`
infra-monitoring attributes (series already exist, no backend work
needed). Pattern mirrors the \`disk-throughput\` chart: bytes-per-second
Y-axis, \`stackedAreaLine\` default, same \`syncId\`.
\`showMaxValue\` is \`false\` because there is no provisioned network
max to render as a reference line.
## Test plan
- [ ] Open \`/project/<ref>/observability/database\` and confirm a
"Network throughput" chart renders with two series (Network in / Network
out) and a \`bytes/s\` Y-axis.
- [ ] Switch the date range and confirm the chart respects it
(auto-wired via \`REPORT_ATTRIBUTES.flatMap\`).
- [ ] Use the global refresh button and confirm both series invalidate
with the rest.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a network throughput chart that visualizes inbound and outbound
network throughput metrics with real-time speed data visualization.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45747)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
### Summary
Changed the Supabase email domain in public facing docs `security.txt`
and `security-testing.mdx`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the official security contact email address across security
documentation, testing guidelines, and policy resources to ensure users,
security researchers, and developers have accurate contact information
for reporting vulnerabilities and coordinating responsible disclosure
efforts.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45772)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
On the Database Extensions page, the Version column takes up
disproportionate horizontal space compared to the Description column,
making the table harder to read.
## Fix
Added `w-28` to the Version `TableHead` and its corresponding
`TableCell` in `ExtensionRow`. This constrains the column to a width
appropriate for short version strings and gives the Description column
more room.
## How to test
1. Open a project in Studio and navigate to Database > Extensions.
2. Confirm the Version column is now narrow and the Description column
has proportionally more space.
3. Verify all version strings are still fully visible (e.g. `1.4.8`,
`2.5.2`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Fixed the "Version" column and its cells to a consistent width for
improved table alignment.
* Preserved monospace styling and spacing in version cells for
readability.
* Removed the max-width limit on comment text cells so comments can use
more space while retaining hover tooltips for full text.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45786)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Summary
- Removes the `SupaIcon` component (inline Supabase SVG logo) from
`LogsSidebarMenuV2.tsx`
- Removes the `icon` prop from the Collections and Database operations
sidebar items
- Makes `icon` optional in `LogsSidebarItem` so the span is only
rendered when an icon is provided
Closes FE-3203
## Test plan
- [ ] Navigate to Logs & Analytics in Studio
- [ ] Confirm Collections and Database operations sidebar items no
longer show the Supabase logo
- [ ] Confirm Saved Queries items still show the SQL editor icon
(unaffected)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Updated the logs sidebar component to make icon display optional.
* Removed icons from sidebar items in the logs navigation to streamline
the interface presentation.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45787)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## Summary
Google Search Console flagged 4 "URL not allowed" errors on
`sitemap_www.xml` — malformed URLs like
`https://supabase.comdata/legal/terms/v1` (missing slash, non-existent
path). The generator was globbing `data/**/*.mdx`, picking up the 4
content-source MDX files under `data/legal/` that are imported by
`pages/terms.tsx` and `pages/enterprise-terms.tsx` but are not
themselves routed. With no path replacement mapping `data/...` to a
route and no leading slash, the URL template concatenated to garbage.
The real `/terms` and `/enterprise-terms` URLs come from the
`pages/*.tsx` glob and are unaffected.
## Changes
- Remove `data/**/*.mdx` glob (and its companion `!data/*.mdx` exclude)
from the sitemap generator. `apps/www/data/` has no routed MDX, only
content sources imported into pages.
- Anchor the `pages` prefix replace: `.replace('pages', '')` →
`.replace(/^pages/, '')`. String-form replace is first-occurrence and
would mangle any future filename containing `pages` as a non-prefix
substring (e.g., `_blog/about-pages.mdx` → `/blog/about-`). No current
files trigger this; defensive hardening.
## Testing
Regenerated the sitemap locally and verified:
- [x] `grep -c "supabase.comdata" public/sitemap_www.xml` → `0` (was 4)
- [x] `<loc>https://supabase.com/terms</loc>` and
`<loc>https://supabase.com/enterprise-terms</loc>` still present
- [x] Every `<loc>` matches
`^<loc>https://supabase\.com(/[a-zA-Z0-9].*)?</loc>$` (no malformed URLs
of any kind)
- [x] Total loc count stable across both commits (regression-free for
the anchor change)
Local count is lower than prod (527 vs 906) because
`.next/server/pages/**` partner/expert/feature HTML globs only resolve
after a full build — runs correctly via `postbuild` on Vercel.
After deploy lands, resubmit `sitemap_www.xml` in Google Search Console
to force a re-crawl (otherwise daily-ish). Expect status to flip from "4
errors" to "Success" and Discovered pages: 906 → 902.
## Linear
- fixes GROWTH-837
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Chores**
* Improved sitemap generation to properly index specific content
sections (blog, case studies, customers, events, and alternatives) with
refined route path processing for better search engine discoverability.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45775)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Eliminates the Google Search Console "Missing field 'item' (in
'itemListElement')" critical error on 230 `/docs/guides/*` pages. The
schema was emitting `ListItem`s without an `item` field for intermediate
category nodes that lack a URL in the docs nav. Per [Google's
spec](https://developers.google.com/search/docs/appearance/structured-data/breadcrumb),
`item` is required on every BreadcrumbList position except the last leaf
— so url-less items are filtered out instead.
Also fixes a smaller quality gap surfaced during preview verification:
the `auth` section root in `NavigationMenu.constants.ts` was missing a
`url`, so auth trails were dropping the "Auth" breadcrumb level (`Docs >
Guides > JSON Web Tokens (JWT) > Overview` instead of `Docs > Guides >
Auth > JSON Web Tokens (JWT) > Overview`). Every other section root
already has a `url`; auth was the lone outlier.
## Testing
Tested locally via vitest (`pnpm --filter docs exec vitest run
lib/json-ld.test.ts`):
- [x] All-urls chain: every `itemListElement` has string `item` and
`name`
- [x] Leaf-url-mismatch: leaf uses `pathname` even when the chain leaf
URL differs
- [x] All-url-less chain: returns `null`
- [x] Empty chain: returns `null`
Tested on the preview deploy against 7 representative GSC-flagged paths:
- [x] `/docs/guides/getting-started/ai-prompts` — 4 positions, 0 missing
- [x] `/docs/guides/getting-started/ai-skills` — 4 positions, 0 missing
- [x] `/docs/guides/auth/jwts` — 4 positions, 0 missing (after auth fix:
includes "Auth")
- [x] `/docs/guides/auth/social-login/auth-google` — 4 positions, 0
missing (after auth fix: includes "Auth")
- [x] `/docs/guides/database/postgres-js` — 4 positions, 0 missing
- [x] `/docs/guides/storage/quickstart` — 4 positions, 0 missing
- [x]
`/docs/guides/platform/migrating-within-supabase/dashboard-restore` — 5
positions, 0 missing
Post-merge:
- [ ] validator.schema.org against deployed URL: 0 errors
- [ ] GSC "Validate fix" on the breadcrumb issue (1-2 week re-crawl
window)
## Linear
- fixes GROWTH-835
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved breadcrumb validation to filter incomplete entries and avoid
broken documentation links.
* Restored root link for the Auth navigation section so the Auth menu
item now navigates to /guides/auth.
* **Tests**
* Added comprehensive tests covering breadcrumb generation and edge
cases.
* **Refactor**
* Streamlined breadcrumb JSON‑LD schema generation for clearer output
and maintainability.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45744)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
`apps/www/public/rss.xml` is committed to the repo AND rewritten on
every `pnpm dev`, `pnpm build`, and `pnpm typecheck` run via
`content:build` -> `apps/www/scripts/generateStaticContent.mjs`. Anyone
working in `apps/www` (or running `pnpm typecheck` from the monorepo
root) sees a phantom `M apps/www/public/rss.xml` in `git status` every
session. Easy to accidentally commit, otherwise has to be repeatedly
stashed.
The sibling `changelog-rss.xml` (written by the same script) is already
gitignored. This aligns the main blog rss with the same treatment.
## Changes
- Add `/public/rss.xml` to `apps/www/.gitignore` (alongside the existing
changelog-rss entries; renamed the section header from "Changelog
generated feeds" to "Generated feeds" to reflect what it now covers).
- `git rm --cached apps/www/public/rss.xml` so git stops tracking the
file. The on-disk copy is preserved for local dev.
## Testing
No behavior change — the file is still generated by `content:build` and
served from `public/` at build time.
- [x] `git check-ignore -v apps/www/public/rss.xml` resolves to
`apps/www/.gitignore:36`
- [x] `apps/www/public/rss.xml` still on disk after `git rm --cached`
- [ ] On a fresh clone + `pnpm install + pnpm --filter www build`, the
file regenerates and is served at `/rss.xml` on the resulting build
(Vercel preview will confirm via deploy).
## Linear
- fixes GROWTH-836
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated repository configuration to properly manage auto-generated
files.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45745)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
New blog post
## What is the current behavior?
No blog post exists for this topic.
## What is the new behavior?
Adds a new blog post announcing that Supabase is now an official ChatGPT
app. Covers what you can do with the integration (database management,
branching, edge functions, etc.), how to get started, and supported
plans.
## Additional context
N/A
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Documentation
- Published blog post announcing Supabase is now available as an
official ChatGPT app
- Describes 29 integrated tools for SQL operations, schema management,
security, project workflows, branching, edge functions, and
documentation search
- Includes setup guide, plan compatibility information, and video
tutorial
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Ana <ana1337x@users.noreply.github.com>
This PR adds a color palette to the Design system for easier reference.
<img width="1325" height="1200" alt="Screenshot 2026-05-08 at 17 18 51"
src="https://github.com/user-attachments/assets/7de77c15-f6c6-4691-9875-eea72919ff7d"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added an interactive color palette: displays named colors with 12
scale steps; click a swatch to copy its CSS variable and see brief
"Copied!" feedback.
* **Documentation**
* Added a "Color palette" section to the color usage docs with
instructions and an embedded palette for exploring and copying CSS
variables.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Remove unneeded checks and its handled by the shortcut
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved the empty state interface in the Third Party Auth integration
form, enhancing the display and alignment when no integrations are
available.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Updates reference docs based on recent **stable** releases across
supabase-js, supabase-flutter, and supabase-py. Only changes that landed
in a stable tag are documented.
## Changes analyzed
| SDK | Repo | Stable tag range | Notes |
|-----|------|-----------------|-------|
| js | supabase/supabase-js | `v2.105.0` → `v2.105.3` | Bug fixes and
type improvements; no doc-worthy API changes |
| dart | supabase/supabase-flutter | → `supabase_flutter-v2.13.0` |
`anonKey` deprecated → `publishableKey` |
| py | supabase/supabase-py | `v2.29.0` → `v2.30.0` | New: `.select()`
chaining on write builders |
| swift | supabase/supabase-swift | `v2.46.0` | Dependency bumps only |
| kt | supabase-community/supabase-kt | `3.6.0` | Test coverage
improvements only |
| csharp | supabase-community/supabase-csharp | `v1.1.2` | No changes |
> **Note**: The JS `storage.from().exists()` breaking behavior change
and `PostgrestError instanceof` fix were intentionally excluded — they
are only in the `v3.0.0-next` pre-release branch, not in any stable
`v2.x` tag.
## Documentation updates
### `apps/docs/spec/supabase_dart_v2.yml`
- Rename `anonKey` parameter → `publishableKey` in
`Supabase.initialize()` to match the deprecation in
[supabase-flutter#1360](https://github.com/supabase/supabase-flutter/pull/1360)
(landed in `supabase_flutter-v2.13.0`)
- Update Flutter example to use `publishableKey:` named argument
- Note that `anonKey` is still accepted but deprecated
### `apps/docs/spec/supabase_py_v2.yml`
- Add `.select()` chaining examples to `insert()`, `update()`,
`upsert()`, and `delete()` write builders, newly supported in
[supabase-py v2.30.0](https://github.com/supabase/supabase-py/pull/1383)
- Add notes to each write method mentioning select chaining capability
---
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Documentation**
* Dart SDK: Updated client initialization to use `publishableKey`
parameter; deprecated `anonKey` remains supported for backward
compatibility.
* Python SDK: Added examples demonstrating how to chain `.select()` with
write operations (`insert()`, `update()`, `upsert()`, `delete()`) to
retrieve specific columns from modified rows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added diagnostic logging to banner components for internal monitoring
purposes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add a second notice banner (because we need the first one to show the
current ToS update). Scoped to ap-southeast-1 and sa-east-1.
Haven't linked to the StatusPage maintenance entry yet as it's not up;
the placeholder link is just to the generic StatusPage.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a second notice banner that alerts users to upcoming maintenance
for affected databases in specific regions; it appears conditionally
(based on affected projects) and can be dismissed—dismissal prevents it
from reappearing.
* The existing “Updated Terms of Service” notice remains unchanged and
continues to display on non–sign-in routes until acknowledged.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Feature
## What is the current behavior?
The /events page only loads events from the Notion "Developer Events"
database and the Luma Community API. MDX files under `apps/www/_events/`
(including webinars like agency-webinar, sentry, datadog, figma-make)
are not surfaced on the listing, and past events could still appear
until the moment they ended because the filter compared against `now()`
rather than the current day.
Addresses
[DEBR-85](https://linear.app/supabase/issue/DEBR-85/events-page-powered-by-notion-page).
## What is the new behavior?
- New `getMdxEvents()` reads `apps/www/_events/*.mdx`, parses
frontmatter with `gray-matter`, and returns today-and-future events as
`SupabaseEvent`s.
- `/events` now merges Notion + mdx + Luma events.
- Past events are hidden across all sources by comparing against the
start of today (UTC) instead of `now()`, so events running today stay
visible throughout the day.
## Additional context
Links on mdx events point at the main_cta URL when it's an external
\`http(s)\` URL, otherwise fall back to the built \`/events/{slug}\`
page so on-demand recordings remain reachable.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Events can be sourced from MDX files and merged into site event
listings.
* Luma supports multiple calendars (community and hackathon) for richer
feeds.
* **Improvements**
* Events now exclude anything before the start of the current UTC day.
* Added a “Community Event” category filter and included it in counts.
* Event title typography adjusted for improved readability.
* “Hosted by” text now only shows when hosts exist; host fallbacks
standardized.
* **Chores**
* Build env updated to include hackathon API key.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Renames the docs page title, sidebar label, description, and body text
from **"Supabase Agent Plugin"** to **"Supabase Plugin for AI coding
Agents"** across `plugins.mdx`, `ai-skills.mdx`, `mcp.mdx`, and the
navigation constants
More context in this [Slack
thread](https://supabase.slack.com/archives/C0254JUR2DU/p1778165488699219)
Close
[AI-710](https://linear.app/supabase/issue/AI-710/rename-supabase-agent-plugin-docs-title)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Renamed the AI tool throughout docs and navigation to "Supabase Plugin
for AI Coding Agents" (previously "Supabase Agent Plugin").
* Updated getting-started and plugin pages, installation guidance, and
sidebar labels to use the new name while preserving existing links and
instructions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
## Context
Adding an "Ask Assistant" CTA in the RLS tester if the query executed
returns an error
<img width="618" height="375" alt="image"
src="https://github.com/user-attachments/assets/8b0a5069-3ec5-44aa-aa0b-f1cd8041960d"
/>
Which will open the Assistant panel with the following prompt (attaches
the query as well)
<img width="427" height="281" alt="image"
src="https://github.com/user-attachments/assets/16debd7b-9447-4b84-bef5-05debd0062ee"
/>
Theres a chance that the error might be just from the query and not
related to the policy hence the last sentence in the prompt
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Integrated AI assistant into the RLS tester so users can open the
assistant prefilled with a debug prompt and relevant SQL to troubleshoot
policy issues.
* Added an "Ask Assistant" action on execution error messages to quickly
start guided debugging.
* Streamlined error display to prioritize parse errors, then client-code
parse errors, then execution errors for clearer diagnostics.
* **Chores**
* Added telemetry source identifier for the RLS tester to track
assistant usage.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Resolves FE-2985
As per PR title
- Add project region info in project settings page for convenience
<img width="722" height="375" alt="image"
src="https://github.com/user-attachments/assets/b32e80ed-42bd-4b12-b9b4-a3e696646335"
/>
- Add project region info in vector buckets empty state
<img width="1110" height="215" alt="image"
src="https://github.com/user-attachments/assets/60bfde97-c3e3-4c10-8b86-98ecd0437ad5"
/>
- Make DB region copyable by clicking in instance config chart on home
page
<img width="419" height="298" alt="image"
src="https://github.com/user-attachments/assets/269b9517-d0eb-42b9-9648-386c59d53842"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Project region is now shown as a read-only field with a descriptive
region label in Settings.
* Region identifiers are clickable to copy to clipboard, with a “Click
to copy” tooltip and success toast.
* Storage/empty-state messaging updated to show clearer, region-specific
text and tooltip details.
* Replica creation time now uses an enhanced timestamp display.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Feature and design-system update. Resolves DEPR-551.
This is a narrower redo of #45302 after the revert in #45535.
## What is the current behaviour?
The reverted implementation made Admonition more flexible, but it also
changed Studio callsites, touched shared Alert styling, renamed the
design-system Tailwind config, and changed Docs-facing content/API
assumptions in a way that broke production docs static generation.
## What is the new behaviour?
Admonition now supports description-only content, children-only content,
optional `title`, legacy `label`, and `type="success"` without touching
`apps/docs/content/**` or shared Alert styling.
`title` wins over `label` when both are provided. The runtime component
props stay backwards-compatible for existing MDX and Studio usage, while
`AdmonitionStrictProps` captures the stricter new-usage contract for
tests and future callsites.
The design-system docs and registry include description-only and success
examples, and the Admonition tests cover the rendering paths that broke
production previously.
| After |
| --- |
| <img width="1668" height="1768" alt="CleanShot 2026-05-06 at 17 35
13@2x"
src="https://github.com/user-attachments/assets/1c00ea7f-e3ca-45eb-8af9-3536b657c341"
/> |
## Additional context
These things that were in #45302 have been left out (unless checked):
- [ ] Studio callsite rewrites from title/label to description
- [ ] Shared Alert text-colour changes
- [ ] Design-system Tailwind config rename
- [ ] Design-system global CSS changes
- [ ] Any docs content migration or label deprecation
- [ ] Any production docs workaround
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added success admonition variant with dedicated styling and icon.
* Introduced description-only admonition example.
* **Documentation**
* Expanded admonition guidance on title vs description usage and best
practices.
* Added example sections showcasing description-only and success
variants.
* **Tests**
* Added comprehensive tests covering admonition variants and
rendering/precedence behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Addresses some issues found with the RLS editor from recent changes
- Creating a "SELECT" or "INSERT" policy via templates wasn't working
(might have been [this
PR](https://github.com/supabase/supabase/pull/45560)) that introduced
the bug)
- SELECT -> SQL error as we were incorrectly adding a with check
statement in the query
- INSERT -> UI issue, there's a bit of complexity as we're using 1 code
editor for `using` and `check` statements
- Badge color for "UPDATE" based templates is off
<img width="446" height="114" alt="image"
src="https://github.com/user-attachments/assets/66fd0c1a-c20c-406d-983e-2c02680bb235"
/>
- Renaming a policy, the initial alter query statement shouldn't be
using the new name
<img width="596" height="288" alt="image"
src="https://github.com/user-attachments/assets/0b6822d5-e5f5-440e-8942-8e19bd7bf4c3"
/>
## To test
- [ ] Verify that you can create a policy for all templates in the Auth
policies page + Realtime policies page (as long as no SQL error - some
templates are using tables as examples that might not exist in the DB)
- [ ] Likewise, verify that you can manually create + update policies as
well
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Updated UPDATE template badge styling to a darker blue color scheme
with reduced opacity.
* **Bug Fixes**
* Fixed policy name display logic to correctly show the selected
policy's existing name during renaming operations.
* Improved SQL fragment loading and check expression handling for INSERT
command policy templates.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Missed another case here - RLS tester when retrieving policies
associated with query needs to consider policies with the `ALL`
operation
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added comprehensive tests for Row-Level Security policy filtering,
covering schema/table matching, role handling (including
public/service-role cases), command/operation semantics, and combined
filter behavior.
* **Refactor**
* Centralized and clarified RLS policy filtering logic used by the
tester for improved maintainability and consistency.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Swap the project-creation revoke from custom `db_sql` over to the new
`data_api_revoke_default_privileges` API field. Same behaviour, just
delegated to the platform so non-studio flows (branches, CLI, terraform)
can apply the same revoke logic — addresses
[FE-3145](https://linear.app/supabase/issue/FE-3145/swap-frontend-to-use-revoke-default-privileges-flag).
Backend support landed in supabase/platform#32158 and
supabase/platform#32493 (FUP that decoupled the flag from
`data_api_use_api_schema`).
**Changed:**
- `apps/studio/data/projects/project-create-mutation.ts` — accepts
`dataApiRevokeDefaultPrivileges` and forwards it as
`data_api_revoke_default_privileges`
- `apps/studio/pages/new/[slug].tsx` — drops the inline
`buildDefaultPrivilegesSql('revoke')` injection in `dbSql`, passes the
flag instead
-
`apps/studio/pages/integrations/vercel/[slug]/deploy-button/new-project.tsx`
— same swap on the Vercel deploy-button flow
- `packages/api-types/types/platform.d.ts` — adds the new field to
`CreateProjectBody`
**Preserved:**
- The `dataApiRevokeOnCreateDefault` PostHog flag still gates the
default checkbox state and telemetry — only the SQL application changes
- `data_api_use_api_schema: false` stays as-is — projects keep `public`
+ `graphql_public` exposed, no project-shape change
## To test
- Project creation form (`/new/<org>`):
- With PostHog flag off: "Automatically expose new tables" defaults to
checked → request body has `data_api_revoke_default_privileges: false`
- Manually uncheck the box → request body has
`data_api_revoke_default_privileges: true`, project ends up with revoked
default grants on `public`
- With "Enable Data API" off → `data_api_revoke_default_privileges:
false` (no point revoking when nothing's exposed)
- Vercel deploy-button flow
(`/integrations/vercel/<slug>/deploy-button`):
- Same checkbox behaviour as above
- Migration SQL from the GitHub repo still runs as `db_sql` separately
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for a dedicated `dataApiRevokeDefaultPrivileges` option
during project creation.
* **Refactor**
* Simplified Data API privilege configuration by using a dedicated
parameter instead of SQL-based management across project creation flows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
<img width="1289" height="863" alt="image"
src="https://github.com/user-attachments/assets/d661f107-b358-4894-8531-80441d60ab91"
/>
GitHub integration is now available on the free plan and so we'd like to
start promoting code-first workflows as much as possible. One way to do
that is to set the tone straight away by asking a user to connecting
their GitHub repository to a project as part of project creation.
This PR:
- decouples GitHub connection and repo selection into a separate
component we can make use of in integration settings and project
creation.
- Adds new GitHub fields to project creation form and sends them off to
project creation endpoint
- Pre-fills project name based on repo selection
To test locally:
- Ensure you have GitHub integration set up locally (using ngrok etc)
- Ensure you are on the connected platform branch
- Open create a new project page
- Connect GitHub as part of the creation form and select a repo
- Create the project and wait for status to be healthy
- Check project settings integrations page and ensure repo is connected
Note:
- this requires changes on the management api end to accept new GitHub
fields
- it might make sense to pull out GitHub connection/authorization from
GitHub repository selection but in the current state they are tied
together.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* GitHub repository selection now available during project creation with
integrated authorization flow
* GitHub connection status and compute availability indicators now
displayed on project dashboard
* Project name auto-populates from selected GitHub repository name when
available
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com>
Refactors our help sidebar within Studio to include the actual support
form itself when contact is selected. This PR also cleans up the initial
state of the sidebar and the options within.
## To test:
- Open an org and click the help icon top right
- Click contact support
- Submit a support ticket
- Click done to return to support sidebar state
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Support form V3 and support sidebar with status button; direct-email
helper and URL prefill
* Success screen supports onFinish callback and customizable finish
label
* AI Assistant and Help options accept optional click callbacks;
resource items gain keyboard/accessibility support
* **Refactor**
* Help panel split into home/support views with back navigation
* Support components accept flexible align/className props and
layout/styling tweaks
* Initial URL params loader added for support form
* **Tests**
* New/updated tests for support flows, success screen, and help options
interactions
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com>
Christian Funkhouser
