mirror of
https://github.com/supabase/supabase.git
synced 2026-10-10 11:55:05 +03:00
rs/debug-flag-not-enabled
5081
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Danny White
|
791fc74412 |
feat(studio): shared connect layout for organisation invites (#45774)
## What kind of change does this PR introduce? Feature. Part of DEPR-279. ## What is the current behavior? The organization invite page has its own bespoke centered card and page-level Supabase logo. ## What is the new behavior? Introduces a minimal shared interstitial layout and migrates `/join` onto it as the first small connect-surface slice. The invite API and accept-invite mutation paths are unchanged. | Before | After | | --- | --- | | <img width="1024" height="794" alt="Supabase-F2325C57-D5DE-445D-8083-12EF8A1EE0CA" src="https://github.com/user-attachments/assets/b23dcc7a-c649-4b59-9393-9232d74f0c6b" /> | <img width="1024" height="794" alt="Join Organization Supabase-66CDA329-0531-4B12-AC32-A7E21931F876" src="https://github.com/user-attachments/assets/454917ce-1a96-4e50-b003-6c16a541b39a" /> | | <img width="1060" height="822" alt="CleanShot 2026-03-13 at 11 04 43@2x-2616AECB-8203-4439-A1CD-45AB18FC4CA8 1-584A0600-CCE0-4F16-9111-9BEB94BE85EC" src="https://github.com/user-attachments/assets/871c7dcb-120e-40cd-afc8-2cec95e4b7ae" /> | <img width="1024" height="794" alt="Join Organization Supabase-26AD978E-4CF9-4600-9885-082084349E94" src="https://github.com/user-attachments/assets/ee9bfaff-dde4-4366-abae-77dc8a95c4ef" /> | | <img width="1024" height="794" alt="Supabase-4993D74C-D62B-43B7-9681-826BE1591AC4" src="https://github.com/user-attachments/assets/1c411ae0-90e7-481d-a4cc-3eac26267291" /> | <img width="1024" height="794" alt="Join Organization Supabase-C84D4E4C-24F5-463D-B1D6-D11D3256596F" src="https://github.com/user-attachments/assets/688387a4-3c49-41db-b89c-7c5531e91aed" /> | | <img width="1024" height="794" alt="Supabase-D9BD2601-98A4-489D-A51D-CEB73F51FA6F" src="https://github.com/user-attachments/assets/6d1da65f-d655-4047-9f6a-db65f8c0a729" /> | <img width="1024" height="794" alt="Join Organization Supabase-50065F40-179A-4BD6-8F1D-6106FFD8A15C" src="https://github.com/user-attachments/assets/e61809f9-dcec-4e51-ba94-91b04010ec50" /> | ## Testing notes Staging invite emails are generated with the fixed staging dashboard origin, for example: ```text https://supabase.green/dashboard/join?token=...&slug=... ``` To test this PR preview with a real invite token, keep the path and query string from the email but replace the origin with the Vercel preview origin, for example: ```text https://studio-staging-git-dnywh-featconnect-interstitial-join-supabase.vercel.app/dashboard/join?token=...&slug=... ``` ### Manual state checks - **Signed out:** open the swapped invite URL in an incognito window or a browser signed out of Studio. Expected: `View invitation`, sign-in/create-account actions, and no loading skeleton hang. - **Wrong account:** sign in to the PR preview as an account that is not the invite recipient, then open the swapped invite URL. Expected: `Wrong account`, warning callout, and `Sign out`. - **Happy path:** sign in as the invited email address, then open the swapped invite URL. Expected: `Join {Organization}`, signed-in account row, `Accept invite`, and `Decline`. Accepting should join the organization. - **Invalid token:** alter one character in the token in the swapped invite URL. Expected: invalid invite state. - **No longer valid:** accept the invite once, then open the same swapped invite URL again. Expected: no-longer-valid/already-used state, depending on the backend response. ### Test-covered states Expired invites, generic backend error, loading, and create-account-disabled states are harder to force manually in staging. They are covered by `tests/components/OrganizationInvite.test.tsx`. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Redesigned the organization invitation experience with an interstitial layout, clearer early-return flows for signed-out, loading, expired/invalid, wrong-account, and accepted-invite states; primary CTA now reads “Accept invite”. * Streamlined error and sign-out flows with clearer, focused messaging. * **New Features** * Added a reusable interstitial layout and compact account row for invitation screens. * **Tests** * Added comprehensive tests covering invite states, accept/decline actions, and error handling. [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45774) <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ali Waseem
|
13e6b04004 |
fix(studio): hide incorrect 'last paused' date in project paused state (#45805)
Hides the 'Project last paused on' date shown in the paused state for free-plan projects, as the date returned by the API is currently incorrect (API team is investigating) Related ticket: FE-3149 |
||
|
Pamela Chia
|
e55411da5e |
feat(studio): Fly.io deprecation banner (#45778)
## Summary Adding an in-dashboard banner for the Fly.io May 31 suspension. Banner targets users on a Fly project (or with a Fly project in their currently-selected org) and surfaces a per-project breakdown of what's affected in a dialog. Detection is self-correcting: as soon as the user migrates off Fly, the banner disappears with no follow-up. <img width="557" height="502" alt="Screenshot 2026-05-11 at 5 08 22 PM" src="https://github.com/user-attachments/assets/7bafb712-3490-4555-9667-66e9909f1b1a" /> <img width="1675" height="536" alt="Screenshot 2026-05-11 at 3 55 06 PM" src="https://github.com/user-attachments/assets/6c1bf9d1-4dcc-4aac-a679-2ed477d2ed1c" /> ## Changes - **Detection hook** (`useFlyDeprecationProjects`): reads only from already-cached data — `useSelectedProjectQuery` for the current project, plus `useOrgProjectsInfiniteQuery` scoped to the selected org. Zero cross-org fan-out: worst case is one paginated query per session (the same one the project list page already makes). - **Banner component** (`FlyDeprecationBanner.tsx`): mounted in `AppBannerWrapper`. Dynamic title (primaries / branches / both), dialog lists affected projects with org name, numbered migration steps, links to backup/restore CLI + Dashboard backup + branching docs. List truncates to 5 entries with "…and N more." tail when more are affected. - **Telemetry**: `fly_deprecation_banner_exposed` and `fly_deprecation_banner_dismissed` events emitted via `useTrack` (auto-injects project + org groups). Properties: `primaryCount`, `branchCount`. CTA click tracking intentionally omitted — migration outcome is measured via warehouse `cloud_provider = 'FLY'` decay. - **LocalStorage**: dated dismissal key `FLY_DEPRECATION_2026_05_31`; orphan `FLY_POSTGRES_DEPRECATION_WARNING` from PR #33510 removed in the same change so users who dismissed the Feb 2025 banner still see this one. - **Support contact**: email `success@supabase.io` only (no support ticket link), per Brian's outreach copy in the Linear issues. ## Coverage trade-off Banner renders on project pages (selected-project check) and pages where the selected org's projects list is cached (org overview, project list). It does **not** render on `/dashboard` home or other pages without org context. Email outreach from GROWTH-817 / GROWTH-819 handles those users. This was a deliberate trade-off to avoid cross-org fan-out load. ## Lifecycle Banner expires `2026-06-01T00:00:00Z` (right after the May 31 deadline). Stale client bundles stop rendering it without a redeploy. Cleanup PR planned post-deadline to remove the component, hook, localStorage key, and telemetry events. ## Testing Tested on the Vercel preview with React Query cache overrides to mock a Fly project: - [x] Banner renders for a user with at least one project where `cloud_provider === 'FLY'` - [x] Banner does **not** render for a user with no Fly projects - [x] Banner does **not** render on `/sign-in` - [x] Title varies by primaries-only / branches-only / both - [x] Dialog lists affected projects with org name in parens - [x] Dialog list truncates to 5 with "…and N more." for larger sets - [x] Migration guide / Dashboard backup / branching links open in a new tab - [x] Dismiss (×) closes the banner and persists across hard reload (localStorage `fly-deprecation-2026-05-31-dismissed`) - [x] PostHog receives one `fly_deprecation_banner_exposed` per mount with `primaryCount` + `branchCount` and `$groups.organization` populated - [x] PostHog receives one `fly_deprecation_banner_dismissed` on close with the same property shape ## Linear - fixes GROWTH-817 - fixes GROWTH-819 |
||
|
Ignacio DobronichandJoshen Lim
|
a4f964e452 |
fix: in-arrears transition in upcoming invoice (#45765)
## Show notice when plan fee is prepaid for the upcoming invoice When a subscription's plan fee has already been billed for the current period (e.g. transitioning to in-arrears billing), the upcoming invoice no longer contains a plan line item. Previously this rendered as an empty plan row with a `-`, which was confusing. <img width="2178" height="538" alt="image" src="https://github.com/user-attachments/assets/1fa289d9-60ae-48b1-b779-34770bc2c242" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Billing breakdown now detects when the plan fee was already paid upfront, hides the redundant plan line, and notes only usage will be invoiced; shows the organization plan name when available. * Backup restoration: added an optional recovery time target for physical backups. * Expanded supported AWS instance types for deployments. * **UI** * Compute and Replica Compute docs links now use inline linking for a smoother in-app experience. [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45765) <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Ignacio Dobronich
|
27f31ef692 |
feat(billing): prepaid credits in upcoming invoice (#45475)
## Summary - Display a "Prepaid Credits" line in the upcoming invoice breakdown, shown directly below Current Costs when the upcoming invoice contains a `Prepaid Credits` line item - Surfaces the credit amount being applied (e.g. `-$300`) so users can see how prepaid credits offset their projected bill - Consolidates the projected tax items into the tooltip for `Projected Costs` <img width="1416" height="426" alt="image" src="https://github.com/user-attachments/assets/b3455e82-d03b-40c3-ad5f-493a56004ddf" /> ## Test plan - [x] On an org with prepaid credits applied, verify the "Prepaid Credits" row appears below Current Costs with the negative amount and a tooltip showing the backend description - [x] On an org without prepaid credits, verify the row is not rendered <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **Improvements** * Clarified the "Upcoming Invoice" explanatory copy for non–AWS Marketplace-managed organizations: it now notes the invoice will continue updating until the end of your billing cycle. * Improved invoice breakdown: compute charges and compute credits are distinguished, and a dedicated "Prepaid Credits" row is shown before projected costs for clearer billing totals. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
ChloeGarciaMillerandandGildas Garcia
|
2c48c6a002 |
fix: improve accessibility for icon buttons in LayoutHeader (#45790)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Bug fix (accessibility improvement in LayoutHeader) ## What is the current behavior? Icon-only buttons do not have explicit accessible names for screen readers. ## What is the new behavior? All icon-only buttons now have explicit accessible names using visually hidden text (sr-only), ensuring proper screen reader support. ## Additional context Tooltip text is preserved for visual users. No visual changes were introduced. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Accessibility** * Added hidden screen-reader labels to multiple toolbar and menu buttons (Settings, Advisor Center, AI Assistant, SQL Editor, Help) so icons are announced by assistive technologies, improving navigation and discoverability across the studio interface. [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45790) <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com> |
||
|
Ali Waseem
|
920571fcf7 |
feat(studio): rewrite secret key reveal flow without react-query [FE-3206] (#45792)
## Summary
Rewrites the secret API key reveal flow in `ApiKeyPill` to remove its
dependency on React Query, replacing it with a lightweight custom hook.
## Changes
- **`useRevealedSecret` (new hook)**
A simple, reusable hook that:
- Fetches the unmasked secret key via `getAPIKeysById`
- Exposes `data`, `isLoading`, `reveal()`, and `clear()`
- Keeps sensitive data in local component state (no global cache)
- **`ApiKeyPill` (refactored)**
- Removes all React Query imports (`useQueryClient`, `useAPIKeyIdQuery`,
`apiKeysKeys`)
- Uses `useRevealedSecret` for reveal / copy operations
- Preserves existing UX:
- 10-second auto-hide timer
- Permission-based gating (`canManageSecretKeys`)
- Loading states on toggle / copy
- **`api-key-id-query.ts` (cleaned up)**
- Removes the now-unused `useAPIKeyIdQuery` hook
- Retains the `getAPIKeysById` fetcher for direct use
## Motivation
The previous React Query–based flow had to aggressively disable caching
(`staleTime: 0`, `gcTime: 0`) and manually purge queries from the cache
on every interaction, which was cumbersome and leaked implementation
details into the component. A plain fetch + local state is simpler and
safer for transient, sensitive data.
## Testing
- [x] Toggle reveal on a secret API key
- [x] Verify 10-second auto-hide
- [x] Copy a secret key (both revealed and unrevealed states)
- [x] Verify restricted users cannot reveal/copy
---
Resolves [FE-3206](https://linear.app/supabase/issue/FE-3206)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Improved API key reveal/copy flow: uses a dedicated reveal/clear
mechanism, preserves permission checks and 10s auto-hide, and shows
reveal/copy failures via user-facing toasts. Copy now falls back to
masked key when needed and the reveal toggle behavior is more reliable.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45792)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
|
||
|
|
b934e148a3 |
fix(reports): replace explicit any with number in tickFormatter callbacks (#45794)
## Problem Recent database report PRs introduced `(value: any)` type annotations in recharts `tickFormatter` callbacks, pushing the `@typescript-eslint/no-explicit-any` ESLint ratchet from baseline 1014 to 1017 and blocking all PR merges. ## Fix Replace `(value: any)` with `(value: number)` in all affected `tickFormatter` callbacks across the three flagged files. Recharts always passes a number to tick formatters, so this is a safe and accurate type. ## How to test - Run `pnpm lint --filter=studio` and confirm no new `@typescript-eslint/no-explicit-any` violations appear in the three changed files - Check the ESLint ratchet count is back at or below baseline 1014 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Improved type safety for Y‑axis tick formatters across observability charts (Memory, Swap, Network throughput, Disk IOPS/throughput/usage, Replication Lag), ensuring tick values are treated as numeric for more consistent chart rendering and reliability. [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45794) <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Ali Waseem <waseema393@gmail.com> |
||
|
Alaister YoungandAlaister Young
|
d676c832f3 |
fix(studio): pre-empt React 19 regressions in tests + Support form (#45784)
Four React-19-sensitive patterns that pass on React 18 today but break
under React 19 (verified on the in-flight TanStack Start branch).
Landing on master now so the eventual React 19 upgrade is a no-op for
tests, instead of a separate cleanup pass under upgrade pressure.
Each fix is a strict superset / less-fragile equivalent of the existing
pattern, so master (React 18) stays green.
**Changed:**
- `hooks/misc/useStateTransition.ts` — fire on entry into `newTest` from
any state other than `newTest`, instead of requiring exactly `prevTest →
newTest`. React 18+ auto-batches dispatches across awaits (e.g.
`dispatch SUBMIT` in the handler, `dispatch ERROR` in `onError`),
collapsing `editing → submitting → error` into a single render where the
intermediate `submitting` tick is never observed. Strict superset of the
old check for our reducers — `success`/`error` are only reachable from
`submitting`.
- `Support/CategoryAndSeverityInfo.tsx` — guard `onValueChange` against
Radix Select's spurious `''` emission. When the controlled value
transitions from `undefined` to a defined value whose `SelectItem` isn't
mounted yet (dropdown closed → items haven't registered), Radix's hidden
`BubbleSelect` fires `onValueChange('')` and clobbers the field. No
`SelectItem` can have `value=""` (Radix throws), so any `''` is
guaranteed spurious — drop it before calling `field.onChange`.
([radix-ui/primitives#3381](https://github.com/radix-ui/primitives/issues/3381))
- `EditSecretModal.test.tsx` — `getByLabelText` → `findByLabelText`.
Under React 19's scheduling, the decrypted-value query resolves on a
separate render tick, so form fields appear one tick after the skeleton.
- `LogsPreviewer.test.tsx` — `addEventListener('click', spy)` instead of
`loadOlder.onclick = vi.fn()`. React 19 reassigns `.onclick` on managed
elements as part of its event wiring, clobbering the direct-property
spy.
## To test
### Unit tests
- `pnpm --filter studio test` — all unit tests pass on master (React 18)
### Support form URL prefill (Radix Select guard)
- `/support/new?category=Problem` → category dropdown reads "APIs and
client libraries" on first paint
- `/support/new?category=dashboard_bug` → "Dashboard bug"
(case-insensitive match)
- `/support/new?category=invalid_garbage` → falls back to "Select an
issue" placeholder, no crash
- `/support/new?subject=My%20issue&message=Details%20here` → subject and
message inputs are prefilled
- `/support/new?projectRef=<your-ref>&category=Problem` → both project
selector and category set, library selector appears
- With a prefilled URL, click the category dropdown and pick a different
option — the new value sticks (this is the path that surfaced the Radix
bug, want to confirm we didn't break user selection)
- DevTools console on first load should be clean — no React hydration
mismatch warning
### Support form submit (`useStateTransition` success + error branches)
- Submit a valid support form → green toast "Support request sent"
appears **once**, view swaps to the success screen, one `POST
/platform/feedback/send` in the network panel
- Block `POST /platform/feedback/send` in DevTools → submit → red error
toast appears **once** (not twice — if you see two toasts the relaxed
transition is firing more than it should), form stays editable with all
inputs preserved
- Unblock and submit again → success path runs cleanly
### Sidebar support form (same reducer + `useStateTransition`, separate
component)
- Open the support widget in the side nav (`SupportSidebarForm`)
- Repeat the success and error paths — should behave identically
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed category selector to prevent selected values from being
unexpectedly cleared during form interactions.
* **Tests**
* Improved test reliability for modal field rendering and event handling
assertions.
* **Chores**
* Clarified internal comments for form initialization logic.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45784)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
|
||
|
Jordi Enric
|
f38872c7a6 | refactor(reports): use LazyComposedChartHandler for replication lag (#45748) | ||
|
Jordi Enric
|
c29ea9a0fa | feat(reports): add swap usage chart to database report (#45746) | ||
|
supabase-supabase-autofixer[bot]andgithub-actions[bot]
|
bbebbe3109 |
[bot] Decrease ESLint ratchet baselines (#45755)
Automated weekly decrease of ESLint ratchet baselines. Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> |
||
|
Vaibhav
|
ff3f733dd1 |
fix: foreign key shortcut (#45761)
## TL:DR `cmd + enter` in the foreign key dialog was also saving the parent column too early and dropping the foreign key relation now this fix stops the parent save shortcut while the foreign key dialog is open so the relation saves properly ## before: https://github.com/user-attachments/assets/5a8040a8-d527-424b-8df8-14a794a30c43 ## after: https://github.com/user-attachments/assets/c2f058e2-e2dd-4730-b7fb-a63b181f2ac8 ## ref: - closes https://github.com/supabase/supabase/issues/45759 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved foreign key selector state management to properly reset when the column editor becomes visible, ensuring clean state between editing sessions. * Enhanced action bar visibility logic to only display when the column editor is active and the foreign key selector is closed, providing a clearer editing interface. [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45761) <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Vaibhav
|
ef2d21b9bf |
fix: restore rls check (#45723)
## TL;DR Policies created with a `WITH CHECK` clause in sql editor still reopen with the that section hidden and the checkbox unmarked this fixes that by restoring the saved check block when editing the policy ## Before <img width="667" height="408" alt="image" src="https://github.com/user-attachments/assets/0a859172-2ab2-444a-968c-49325505786f" /> ## After <img width="602" height="462" alt="image" src="https://github.com/user-attachments/assets/a7f5799a-e073-4b2c-807b-2997ac76edfd" /> ## ref: - Closes https://github.com/supabase/supabase/issues/45720 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed the policy editor to properly display and enable the "with check" section when loading existing policies that contain check conditions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordi EnricandClaude Opus 4.7
|
52fccc7b3b |
feat(reports): add network throughput chart to database report (#45747)
## Problem The Database report in Observability has no view of network traffic. Inbound/outbound throughput is useful for spotting saturation, large unexpected egress, or correlating spikes with disk I/O. Closes [FE-3193](https://linear.app/supabase/issue/FE-3193/add-network-in-and-out-charts). ## Fix Add a new \`network-throughput\` chart entry to \`getReportAttributesV2\` in [apps/studio/data/reports/database-charts.ts](apps/studio/data/reports/database-charts.ts), placed right before \`disk-iops\`. Uses the existing \`network_receive_bytes\` and \`network_transmit_bytes\` infra-monitoring attributes (series already exist, no backend work needed). Pattern mirrors the \`disk-throughput\` chart: bytes-per-second Y-axis, \`stackedAreaLine\` default, same \`syncId\`. \`showMaxValue\` is \`false\` because there is no provisioned network max to render as a reference line. ## Test plan - [ ] Open \`/project/<ref>/observability/database\` and confirm a "Network throughput" chart renders with two series (Network in / Network out) and a \`bytes/s\` Y-axis. - [ ] Switch the date range and confirm the chart respects it (auto-wired via \`REPORT_ATTRIBUTES.flatMap\`). - [ ] Use the global refresh button and confirm both series invalidate with the rest. 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a network throughput chart that visualizes inbound and outbound network throughput metrics with real-time speed data visualization. [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45747) <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> |
||
|
Jordi EnricandClaude Sonnet 4.6
|
d640d1e67d |
fix(studio): tighten Version column width in Extensions table FE-3204 (#45786)
## Problem On the Database Extensions page, the Version column takes up disproportionate horizontal space compared to the Description column, making the table harder to read. ## Fix Added `w-28` to the Version `TableHead` and its corresponding `TableCell` in `ExtensionRow`. This constrains the column to a width appropriate for short version strings and gives the Description column more room. ## How to test 1. Open a project in Studio and navigate to Database > Extensions. 2. Confirm the Version column is now narrow and the Description column has proportionally more space. 3. Verify all version strings are still fully visible (e.g. `1.4.8`, `2.5.2`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Fixed the "Version" column and its cells to a consistent width for improved table alignment. * Preserved monospace styling and spacing in version cells for readability. * Removed the max-width limit on comment text cells so comments can use more space while retaining hover tooltips for full text. [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45786) <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
4e98217500 |
fix(studio): remove Supabase logo from Logs sidebar items (#45787)
## Summary - Removes the `SupaIcon` component (inline Supabase SVG logo) from `LogsSidebarMenuV2.tsx` - Removes the `icon` prop from the Collections and Database operations sidebar items - Makes `icon` optional in `LogsSidebarItem` so the span is only rendered when an icon is provided Closes FE-3203 ## Test plan - [ ] Navigate to Logs & Analytics in Studio - [ ] Confirm Collections and Database operations sidebar items no longer show the Supabase logo - [ ] Confirm Saved Queries items still show the SQL editor icon (unaffected) 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Updated the logs sidebar component to make icon display optional. * Removed icons from sidebar items in the logs navigation to streamline the interface presentation. [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45787) <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Saxon Fletcher
|
19c5d467a8 |
github logo color (#45773)
Fixes logo so it makes use of currentColor <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Improved GitHub icon color compatibility to properly adapt across different UI contexts. [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45773) <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ali Waseem
|
c5666f8e76 |
fix(auth): toggle shortcut repeats (#45728)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Remove unneeded checks and its handled by the shortcut <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved the empty state interface in the Third Party Auth integration form, enhancing the display and alignment when no integrations are available. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
d3d6dd0eda |
Revert "studio: debug logging for notice banner 2" (#45727)
Reverts supabase/supabase#45724 |
||
|
Charis
|
cce46e15ab |
studio: debug logging for notice banner 2 (#45724)
<!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Added diagnostic logging to banner components for internal monitoring purposes. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
cf1e95dcd7 |
studio: maintenance banner for shared pooler 2026-05-13 (#45695)
Add a second notice banner (because we need the first one to show the current ToS update). Scoped to ap-southeast-1 and sa-east-1. Haven't linked to the StatusPage maintenance entry yet as it's not up; the placeholder link is just to the generic StatusPage. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a second notice banner that alerts users to upcoming maintenance for affected databases in specific regions; it appears conditionally (based on affected projects) and can be dismissed—dismissal prevents it from reappearing. * The existing “Updated Terms of Service” notice remains unchanged and continues to display on non–sign-in routes until acknowledged. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ali WaseemandJoshen Lim
|
f06b877ac6 |
feat(auth-users): add keyboard shortcuts to users page (#45650)
Closes [FE-3173](https://linear.app/supabase/issue/FE-3173/add-keyboard-shortcuts-to-auth-users-page) ## Shortcuts | Key | Action | |---|---| | `Shift+F` | Focus search input | | `F C` | Reset filters | | `Shift+R` | Refresh users | | `S C` | Reset sort to default | | `Mod+A` | Toggle selection on all loaded users | | `Mod+Backspace` | Open bulk-delete confirm modal | | `Esc` | Clear row selection + cell focus | | `Esc` (panel open) | Close user details panel | | `↑` / `↓` | Move focus into the grid; native arrow nav after | | `Enter` (row focused) | Open user details panel | | `I U` | Open Create user modal | | `I I` | Open Send invitation modal | ## Test plan - [ ] `Shift+F` focuses the search input - [ ] `F C` clears keywords, user type, providers - [ ] In the search input: Esc clears value, Esc again blurs - [ ] `Shift+R` refreshes - [ ] `S C` resets sort; no-op at default - [ ] `Mod+A` toggles all loaded users when ≤ 20 are loaded - [ ] `Mod+Backspace` opens the delete confirmation when a selection exists - [ ] `↑` / `↓` from cold load enters the grid; subsequent arrows navigate cells - [ ] `Enter` on a focused row opens the panel - [ ] `Esc` with panel open closes it; without panel, clears selection + cell focus - [ ] `I U` opens the Create user modal - [ ] `I I` opens the Send invitation modal - [ ] All shortcuts appear in `Cmd+K` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Comprehensive keyboard shortcuts for user management (focus search, refresh, reset filters, bulk select, open delete modal, close panel). * Improved keyboard navigation in the user list with cell-level movement and Enter-to-select behavior. * Search input: Escape clears search/keywords and it can be focused programmatically. * Shortcut hint badges added to "Send invitation" / "Create new user" dropdown items. * **Chores** * Centralized refresh behavior for consistent interaction. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Ali WaseemandDanny White
|
0278672102 |
feat(studio): add Auth sub-page navigation chords (#45696)
## Summary - Adds contextual `A + <letter>` chord shortcuts for jumping between Authentication sub-pages while `AuthLayout` is mounted, mirroring the existing database-nav chord pattern. - Wires the shared `LIST_PAGE_*` shortcuts (focus search, create new, reset filters, schema selector) onto the Auth list pages so they behave like the Database list pages. - Fills in the previously-missing `A + U` chord for the **Users** page so every entry in the Auth menu has a chord. Resolves [FE-3187](https://linear.app/supabase/issue/FE-3187/add-a-u-keyboard-shortcut-for-auth-users-page). ## Auth navigation chords Active anywhere under `/project/<ref>/auth/*`. Press `A` then the listed letter. | Page | Chord | | --- | --- | | Overview | `A` `O` | | Users | `A` `U` | | OAuth Apps | `A` `A` | | Email | `A` `E` | | Policies | `A` `P` | | Sign In / Providers | `A` `I` | | Passkeys | `A` `K` | | OAuth Server | `A` `V` | | Sessions | `A` `S` | | Rate Limits | `A` `R` | | Multi-Factor | `A` `M` | | URL Configuration | `A` `L` | | Attack Protection | `A` `T` | | Auth Hooks | `A` `H` | | Audit Logs | `A` `G` | | Performance | `A` `F` | ## Auth list-page shortcuts Each Auth list page opts into the shared `LIST_PAGE_*` registry — same chords as the Database list pages (`Shift+F`, `Shift+N`, `F` `C`, `O` `S`). Coverage matches the controls each page actually exposes: | List page | Search (`Shift+F`) | New (`Shift+N`) | Reset filters (`F` `C`) | Schema selector (`O` `S`) | | --- | :---: | :---: | :---: | :---: | | Custom Auth Providers | ✓ | ✓ | ✓ | — | | OAuth Apps | ✓ | ✓ | ✓ | — | | Policies | ✓ | — | ✓ | ✓ | | Auth Hooks | — | ✓ | — | — | | Redirect URLs | — | ✓ | — | — | | Third-Party Auth | — | ✓ | — | — | ## Test plan - [x] While anywhere under `/project/<ref>/auth/*`, every chord in the navigation table jumps to the corresponding page. - [x] On each list page in the second table, the marked shortcuts focus the search input / open the create flow / reset filters / open the schema picker as expected. - [x] Chords are not active outside of `/project/<ref>/auth/*` and do not trigger while typing in inputs (where `ignoreInputs` applies). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Global keyboard shortcuts for Auth pages: navigate auth sections, focus/search inputs, reset filters, and open "Add" flows (providers, OAuth apps, hooks, URLs, policies). * "Add" controls in lists respond to shortcuts and show appropriate disabled/tooltip states when unavailable. * Product menu and shortcuts reference now include an "Auth Navigation" section and per-item shortcut hints. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com> |
||
|
Joshen Lim
|
94851d1f8f |
Add assistant CTA for query errors in RLS tester (#45628)
## Context Adding an "Ask Assistant" CTA in the RLS tester if the query executed returns an error <img width="618" height="375" alt="image" src="https://github.com/user-attachments/assets/8b0a5069-3ec5-44aa-aa0b-f1cd8041960d" /> Which will open the Assistant panel with the following prompt (attaches the query as well) <img width="427" height="281" alt="image" src="https://github.com/user-attachments/assets/16debd7b-9447-4b84-bef5-05debd0062ee" /> Theres a chance that the error might be just from the query and not related to the policy hence the last sentence in the prompt <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Integrated AI assistant into the RLS tester so users can open the assistant prefilled with a debug prompt and relevant SQL to troubleshoot policy issues. * Added an "Ask Assistant" action on execution error messages to quickly start guided debugging. * Streamlined error display to prioritize parse errors, then client-code parse errors, then execution errors for clearer diagnostics. * **Chores** * Added telemetry source identifier for the RLS tester to track assistant usage. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
51b45ec715 |
Add project region info in settings and vector buckets + make region clickable in home page instance config (#45665)
## Context Resolves FE-2985 As per PR title - Add project region info in project settings page for convenience <img width="722" height="375" alt="image" src="https://github.com/user-attachments/assets/b32e80ed-42bd-4b12-b9b4-a3e696646335" /> - Add project region info in vector buckets empty state <img width="1110" height="215" alt="image" src="https://github.com/user-attachments/assets/60bfde97-c3e3-4c10-8b86-98ecd0437ad5" /> - Make DB region copyable by clicking in instance config chart on home page <img width="419" height="298" alt="image" src="https://github.com/user-attachments/assets/269b9517-d0eb-42b9-9648-386c59d53842" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Project region is now shown as a read-only field with a descriptive region label in Settings. * Region identifiers are clickable to copy to clipboard, with a “Click to copy” tooltip and success toast. * Storage/empty-state messaging updated to show clearer, region-specific text and tooltip details. * Replica creation time now uses an enhanced timestamp display. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
e6b81c465a |
Some problems with RLS editor (#45662)
## Context Addresses some issues found with the RLS editor from recent changes - Creating a "SELECT" or "INSERT" policy via templates wasn't working (might have been [this PR](https://github.com/supabase/supabase/pull/45560)) that introduced the bug) - SELECT -> SQL error as we were incorrectly adding a with check statement in the query - INSERT -> UI issue, there's a bit of complexity as we're using 1 code editor for `using` and `check` statements - Badge color for "UPDATE" based templates is off <img width="446" height="114" alt="image" src="https://github.com/user-attachments/assets/66fd0c1a-c20c-406d-983e-2c02680bb235" /> - Renaming a policy, the initial alter query statement shouldn't be using the new name <img width="596" height="288" alt="image" src="https://github.com/user-attachments/assets/0b6822d5-e5f5-440e-8942-8e19bd7bf4c3" /> ## To test - [ ] Verify that you can create a policy for all templates in the Auth policies page + Realtime policies page (as long as no SQL error - some templates are using tables as examples that might not exist in the DB) - [ ] Likewise, verify that you can manually create + update policies as well <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Updated UPDATE template badge styling to a darker blue color scheme with reduced opacity. * **Bug Fixes** * Fixed policy name display logic to correctly show the selected policy's existing name during renaming operations. * Improved SQL fragment loading and check expression handling for INSERT command policy templates. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
5d155df42b |
RLS Tester needs to consider policies for 'ALL' operation (#45623)
## Context Missed another case here - RLS tester when retrieving policies associated with query needs to consider policies with the `ALL` operation <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Added comprehensive tests for Row-Level Security policy filtering, covering schema/table matching, role handling (including public/service-role cases), command/operation semantics, and combined filter behavior. * **Refactor** * Centralized and clarified RLS policy filtering logic used by the tester for improved maintainability and consistency. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Alaister YoungandAlaister Young
|
409a38a4ea |
[FE-3145] feat(studio): use data_api_revoke_default_privileges flag (#45683)
Swap the project-creation revoke from custom `db_sql` over to the new `data_api_revoke_default_privileges` API field. Same behaviour, just delegated to the platform so non-studio flows (branches, CLI, terraform) can apply the same revoke logic — addresses [FE-3145](https://linear.app/supabase/issue/FE-3145/swap-frontend-to-use-revoke-default-privileges-flag). Backend support landed in supabase/platform#32158 and supabase/platform#32493 (FUP that decoupled the flag from `data_api_use_api_schema`). **Changed:** - `apps/studio/data/projects/project-create-mutation.ts` — accepts `dataApiRevokeDefaultPrivileges` and forwards it as `data_api_revoke_default_privileges` - `apps/studio/pages/new/[slug].tsx` — drops the inline `buildDefaultPrivilegesSql('revoke')` injection in `dbSql`, passes the flag instead - `apps/studio/pages/integrations/vercel/[slug]/deploy-button/new-project.tsx` — same swap on the Vercel deploy-button flow - `packages/api-types/types/platform.d.ts` — adds the new field to `CreateProjectBody` **Preserved:** - The `dataApiRevokeOnCreateDefault` PostHog flag still gates the default checkbox state and telemetry — only the SQL application changes - `data_api_use_api_schema: false` stays as-is — projects keep `public` + `graphql_public` exposed, no project-shape change ## To test - Project creation form (`/new/<org>`): - With PostHog flag off: "Automatically expose new tables" defaults to checked → request body has `data_api_revoke_default_privileges: false` - Manually uncheck the box → request body has `data_api_revoke_default_privileges: true`, project ends up with revoked default grants on `public` - With "Enable Data API" off → `data_api_revoke_default_privileges: false` (no point revoking when nothing's exposed) - Vercel deploy-button flow (`/integrations/vercel/<slug>/deploy-button`): - Same checkbox behaviour as above - Migration SQL from the GitHub repo still runs as `db_sql` separately <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for a dedicated `dataApiRevokeDefaultPrivileges` option during project creation. * **Refactor** * Simplified Data API privilege configuration by using a dedicated parameter instead of SQL-based management across project creation flows. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Saxon FletcherandGildas Garcia
|
ae66a6a9c0 |
Connect GitHub during project creation (#44884)
<img width="1289" height="863" alt="image" src="https://github.com/user-attachments/assets/d661f107-b358-4894-8531-80441d60ab91" /> GitHub integration is now available on the free plan and so we'd like to start promoting code-first workflows as much as possible. One way to do that is to set the tone straight away by asking a user to connecting their GitHub repository to a project as part of project creation. This PR: - decouples GitHub connection and repo selection into a separate component we can make use of in integration settings and project creation. - Adds new GitHub fields to project creation form and sends them off to project creation endpoint - Pre-fills project name based on repo selection To test locally: - Ensure you have GitHub integration set up locally (using ngrok etc) - Ensure you are on the connected platform branch - Open create a new project page - Connect GitHub as part of the creation form and select a repo - Create the project and wait for status to be healthy - Check project settings integrations page and ensure repo is connected Note: - this requires changes on the management api end to accept new GitHub fields - it might make sense to pull out GitHub connection/authorization from GitHub repository selection but in the current state they are tied together. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **New Features** * GitHub repository selection now available during project creation with integrated authorization flow * GitHub connection status and compute availability indicators now displayed on project dashboard * Project name auto-populates from selected GitHub repository name when available <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com> |
||
|
Saxon FletcherandGildas Garcia
|
4452e0ac2e |
Support form sidebar (#45203)
Refactors our help sidebar within Studio to include the actual support form itself when contact is selected. This PR also cleans up the initial state of the sidebar and the options within. ## To test: - Open an org and click the help icon top right - Click contact support - Submit a support ticket - Click done to return to support sidebar state <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Support form V3 and support sidebar with status button; direct-email helper and URL prefill * Success screen supports onFinish callback and customizable finish label * AI Assistant and Help options accept optional click callbacks; resource items gain keyboard/accessibility support * **Refactor** * Help panel split into home/support views with back navigation * Support components accept flexible align/className props and layout/styling tweaks * Initial URL params loader added for support form * **Tests** * New/updated tests for support flows, success screen, and help options interactions <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com> |
||
|
Danny WhiteandAli Waseem
|
f32977f04d |
chore(studio): show active shortcuts in reference sheet (#45614)
## What kind of change does this PR introduce? UI chore. ## What is the current behavior? The Keyboard shortcuts sheet renders shortcut definitions from the static registry, so contextual Database navigation shortcuts appear in the sheet even when `DatabaseLayout` is not active. This makes the Navigation section noisy as more product-specific navigation shortcuts are added. ## What is the new behavior? The shortcuts sheet now reads the mounted, enabled shortcut set at runtime. Global navigation remains under Navigation when it is the only navigation scope, and splits into _**Global** Navigation_ plus _**Database** Navigation_ when contextual database shortcuts are active. This also replaces the one-off `DatabaseNavShortcuts` component with a reusable `ProductMenuShortcuts` registrar so future product layouts can register scoped navigation shortcuts from their product menu model. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added keyboard shortcut support for product menu navigation items with router integration * **Improvements** * Keyboard shortcuts are now organized into logical groups (Global Navigation and Database Navigation) * Shortcut reference dynamically displays only active shortcuts instead of static definitions <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Ali Waseem <waseema393@gmail.com> |
||
|
Sean OliverandJoshen Lim
|
b14ecb5b1e |
fix: align grace-period banner copy on org usage page (#45652)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Bug fix — copy + visibility logic on the org Usage page. ## What is the current behavior? On `/org/<slug>/usage` during a grace period, customers see two banners that read as contradictory: 1. *"Organization plan has exceeded its quota — grace period until {date}."* 2. *"You have not exceeded your Pro Plan quota in this billing cycle."* <img width="1680" height="372" alt="image" src="https://github.com/user-attachments/assets/13826260-55dd-4b55-a3dc-5afc51e6436e" /> Both are individually correct. The first is sticky from the previous cycle's overage (`org.restriction_status`); the second is a live scan over the current cycle. Neither anchors to which cycle it's talking about, so together they read like the dashboard contradicting itself. Surfaced by support off SU-368527 and SU-368395. ## What is the new behavior? - Top chrome banner copy: *"Organization exceeded its quota in the previous billing cycle / You have a grace period until {date} to bring usage back under quota."* - Inline `<Restriction />` grace-period alert switches from "is over its quota" to "went over its quota in the previous billing cycle." Same temporal anchor. - The "…in this billing cycle" summary line in `<TotalUsage>` is hidden whenever `restriction_status` is set. Mirrors the precedence rule `<Restriction />` already applies internally — backend status flag wins over the live cycle scan. <img width="1678" height="937" alt="CleanShot 2026-05-06 at 12 58 02" src="https://github.com/user-attachments/assets/df55eaed-1029-4f39-bea0-df77bcc5151e" /> ## Additional context Left the `gracePeriodOver` copy alone on purpose — it doesn't make a current-overage claim, so there's nothing to contradict, and adding "previous cycle" would muddy which cycle "previous" refers to. **Verified** - Lint and typecheck pass on `apps/studio`. **Before merge** - [ ] Load a grace-period org locally: confirm new copy on top banner and inline `<Restriction />`, and that the "not exceeded in this billing cycle" line is gone. - [ ] Copy review with support — happy to workshop wording. GROWTH-823 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Updates** * Updated grace period alert messaging to clarify organization quota status * Refined date formatting in billing restriction notifications * Modified usage display to conditionally hide certain information when account restrictions are active <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Terry Sutton
|
4f88620c1a |
Fix jwxs format (#45697)
<img width="1244" height="1146" alt="CleanShot 2026-05-07 at 17 07 32" src="https://github.com/user-attachments/assets/475cce46-a066-4a8b-a0e0-82261e1e4e73" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Public key display in JWT key details now shows a pretty-printed JWKS (JSON Web Key Set) with updated JWKS-oriented labeling. * The key textarea is wrapped in a positioned container for improved layout and readability. * **New Features** * Added an overlaid Copy button labeled “Copy JWKS” to copy the displayed JWKS directly from the key details view. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
K-Dog (Kevin)
|
5082c9b35d |
chore(billing): use new balance endpoint (#45481)
New billing credits balance endpoint for improved transparency |
||
|
Greg Richardson
|
538f9e3e82 |
fix: prevent AI assistant from soliciting sensitive creds (#45692)
Adds prompt guardrails and evals to prevent the AI assistant from asking users to share sensitive data (API keys, `.env` contents, etc.) and to warn when credentials are shared. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Stronger safety behavior: assistant now refuses requests to share full environment files, asks for variable names only, and directs users to secure secret-management tooling. * Immediate warning and guidance if credentials or other sensitive values are pasted in chat, without repeating exposed secrets. * **Behavior** * Clarified evaluation rules so responses more consistently follow the new safety guidance. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordi Enric
|
bef828ae48 |
feat(studio): apply timezone picker to observability/reports charts (#45667)
## Problem The dashboard's timezone picker (#45517) propagates to log timestamps and the shared TimestampInfo component, but observability and reports charts still render their X-axis labels, range labels, and tooltip headers in the browser's local timezone. The result is jarring once a user picks a non-local timezone: hover a chart and you get one tz, hover a log row and you get another. ## Fix Routes all display-side timestamp formatting in the chart layer through the existing picker-aware helpers (\`useFormatDateTime\` / \`formatDateTime\`) so chart UI matches the rest of the dashboard. - **ComposedChart.utils** \`CustomTooltip\` (the hotspot — drives every observability dashboard tooltip): reads the active timezone via \`useTimezone\` for both the header label and the formatted timestamp. - **AreaChart** / **BarChart**: introduce a \`formatChartDate\` helper that honours each component's existing \`displayDateInUtc\` prop, otherwise routes through the picker. - **ChartBlock**: the two recharts \`labelFormatter\` arrows now close over \`useFormatDateTime\`. - **ChartHighlightActions**: range labels in the zoom dropdown migrated to the same hook. Intentionally untouched (must stay UTC): - \`ChartHandler\` / \`ChartBlock\` \`startDate\`/\`endDate\` (API range params, day boundary). - \`ChartBlock.tsx:166\` explicit \`.utc()\` data-key normalisation. - \`useFillTimeseriesSorted\` and friends (range math, no display). ## How to test - Sign in. Open the avatar dropdown, pick a timezone different from your browser local (e.g. Asia/Tokyo). - Visit any project, then \`/project/<ref>/reports/database\` (or any \`/observability/...\` page). - Hover any chart series — the tooltip header should display the chosen IANA name and times in that timezone. - Click-drag a range on a chart to open the zoom dropdown — start/end labels in the menu should also be in the chosen timezone. - Switch back to "Auto detect" and confirm everything reverts to browser-local. - For an AreaChart/BarChart that uses \`displayDateInUtc\` (e.g. some legacy reports), confirm those still render in UTC regardless of picker. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Standardized date/time formatting across charts, tooltips, axis labels, header/footer labels, and highlight range labels in Reports and chart components. * Switched to a shared, timezone-aware formatter that respects UTC display mode or the selected picker/timezone, ensuring consistent, human-readable timestamps throughout the UI. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordi EnricandClaude Sonnet 4.6
|
2ef843fb17 |
feat: add Syslog log drain type (#45278)
## Summary - Adds `syslog` as a new log drain destination type in Studio - Implements RFC 5424 syslog over TCP or TLS with octet-counting framing (backed by the existing Logflare syslog backend) - All fields match the Logflare backend config: `host`, `port`, `tls`, `structured_data`, `cipher_key`, `ca_cert`, `client_cert`, `client_key` - TLS cert fields (CA cert, client cert, client key) are shown only when the TLS toggle is on - Cross-field validation: `client_cert` and `client_key` must be provided together - Gated behind a `syslogLogDrain` feature flag (consistent with other drain types) closes FE-2865 ## Test plan - go to log drains - create a syslog log drain - it creates it 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Syslog added as a new log drain destination with configurable host, port (0–65535), TLS toggle, and optional RFC5424 structured data. * Supports CA and client certificate/key input for TLS or mTLS; client certificate and key must be provided together. * Form validation, inline defaults, initial values for Syslog fields, and availability controlled by a feature flag. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
kemal.earth
|
dcca71f694 |
fix(studio): query performance detail panel metadata (#45690)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Tailwind 4 applies `divide` a little bit differently, so a small fix applied here to get it back to how it looked. | Header | Header | |--------|--------| | <img width="485" height="488" alt="Screenshot 2026-05-07 at 16 41 18" src="https://github.com/user-attachments/assets/d7f678fb-1179-4153-99fa-bfbe247fe519" /> | <img width="485" height="487" alt="Screenshot 2026-05-07 at 16 41 24" src="https://github.com/user-attachments/assets/a2ce53d4-5296-475c-a4d8-38b0820e820c" /> | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Adjusted metadata header spacing and list item padding in the Query Performance interface for improved visual consistency and layout alignment. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ivan VasilovandClaude Sonnet 4.6
|
afd690ada5 |
chore: Migrate all apps to use Tailwind CSS configs (#45530)
This PR migrates all tailwind configs in the apps to be CSS configs. They import a shared CSS Tailwind config from the `config` package (which in turns imports the old JS config). The shared JS config will be migrated to CSS in a followup PR. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Centralized Tailwind into a config-driven entrypoint and updated the app build flow to use the new build step; many apps now import unified global styles. * **Style** * Migrated global styles to a Tailwind v4-style setup, added project-wide content scanning, consolidated theme imports, standardized theme tokens (including new --container-site max-width), and added a small prose utility to remove paragraph margins. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
Gildas Garcia
|
678aec3845 |
chore: migrate Input usages to Shadcn component in various screens/components (#45604)
## Screenshots ### Table editor: foreign record selector Before: <img width="802" height="213" alt="image" src="https://github.com/user-attachments/assets/82ee3ce6-ac72-4b49-b1b0-2e635688cbb1" /> After: <img width="609" height="194" alt="image" src="https://github.com/user-attachments/assets/e9cc09c1-1c6b-4099-8cae-abe08f50fda9" /> ### Account - Add TOTP Before: <img width="527" height="679" alt="image" src="https://github.com/user-attachments/assets/b9f4a626-e24b-46e3-8385-700ef181308b" /> After: <img width="531" height="684" alt="image" src="https://github.com/user-attachments/assets/549745a7-9655-4a7d-9e0e-51f75b6a1c61" /> ### Organisation Audit Logs Details Before: <img width="673" height="1321" alt="image" src="https://github.com/user-attachments/assets/0bb360cf-6f27-4574-b9af-485a3836b17b" /> After: <img width="669" height="1273" alt="image" src="https://github.com/user-attachments/assets/0382c662-e270-41fd-a8ee-08528dedfce3" /> ### Data API Integration Docs Before: <img width="1115" height="891" alt="image" src="https://github.com/user-attachments/assets/db0c7698-53b7-4422-aac3-5e674b0bf151" /> After: <img width="1193" height="1272" alt="image" src="https://github.com/user-attachments/assets/927e5c43-413b-49c1-9b71-8ab628179c70" /> ### Edge Function Edit Secret Before: <img width="599" height="255" alt="image" src="https://github.com/user-attachments/assets/d6aa2f87-e247-4724-9e43-02b71933241c" /> After: <img width="596" height="261" alt="image" src="https://github.com/user-attachments/assets/d94acb41-07e1-497f-9697-830390526f4a" /> ### JWT Key Details Before: <img width="536" height="549" alt="image" src="https://github.com/user-attachments/assets/43672adc-dc0e-4e65-b7d4-b4537d22f6ea" /> After: <img width="523" height="517" alt="image" src="https://github.com/user-attachments/assets/e501e8a8-7f41-46a0-bb69-d240cea594f0" /> ### Realtime Filter Popover Before: <img width="403" height="576" alt="image" src="https://github.com/user-attachments/assets/73842450-ba87-456b-98fc-625b99149449" /> After: <img width="387" height="564" alt="image" src="https://github.com/user-attachments/assets/f2b35035-947c-4342-84dd-3548f9bd5e9f" /> ### Realtime broadcast message dialog Before: <img width="520" height="393" alt="image" src="https://github.com/user-attachments/assets/4f4a1a93-e0cf-4268-ae4e-baf8b8a62e74" /> After: <img width="525" height="392" alt="image" src="https://github.com/user-attachments/assets/e1c1934a-1812-4013-8606-9b846dc2498d" /> ### Impersonation Popover Before: <img width="604" height="501" alt="image" src="https://github.com/user-attachments/assets/9abdc604-94f8-4ed4-9a95-4688e6504e76" /> <img width="587" height="599" alt="image" src="https://github.com/user-attachments/assets/5293c80c-9abd-43eb-899f-da759c83b598" /> After: <img width="594" height="585" alt="image" src="https://github.com/user-attachments/assets/5eaf2162-2d7f-444c-9052-c9afb00080f6" /> <img width="590" height="597" alt="image" src="https://github.com/user-attachments/assets/149dc7c1-689c-4e0f-a884-c6f5b0228ebc" /> ### Storage move item Before: <img width="521" height="285" alt="image" src="https://github.com/user-attachments/assets/7d0f945f-add5-412b-813a-9325b260ab28" /> After: <img width="529" height="274" alt="image" src="https://github.com/user-attachments/assets/ab0891a1-b31b-40b6-be53-92afc95095ea" /> ### Table Editor - Spreadsheet import Before: <img width="673" height="506" alt="image" src="https://github.com/user-attachments/assets/7a722908-10c2-4c04-95fb-b12d3c23557c" /> After: <img width="671" height="638" alt="image" src="https://github.com/user-attachments/assets/689b1fb6-031c-4a02-9e7f-739356c1453d" /> ### Org Billing downgrade survey Before: <img width="788" height="655" alt="image" src="https://github.com/user-attachments/assets/c7a0d4c6-e9b9-4c6c-9cf1-e7d05016233f" /> After: <img width="1630" height="1354" alt="image" src="https://github.com/user-attachments/assets/e3f5473b-db9a-42b1-9242-40480c25fc02" /> ### Project API Docs Before: <img width="1030" height="396" alt="image" src="https://github.com/user-attachments/assets/95643b21-811a-4ba7-918a-5e655c262ac1" /> After: <img width="1012" height="457" alt="image" src="https://github.com/user-attachments/assets/d5559646-bb89-43b6-ad62-c5684b54b3fb" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Standardized form field layouts across panels, dialogs, and modals for a more consistent editing and reading experience. * Replaced several Input-based textareas with dedicated TextArea/ExpandingTextArea controls and aligned labels with wrapper layouts for clearer accessibility. * Introduced grouped/composable input controls, added additional read-only detail fields and labeled value/copy blocks, and tightened header/layout spacing and control alignment. * Swapped notice styles for improved warning/admonition presentation. * **Chores** * Removed a deprecated AutoTextArea component. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Vaibhav
|
7e405cbe6d |
fix: observability expand (#45644)
## before <img width="1545" height="548" alt="image" src="https://github.com/user-attachments/assets/c6d84d77-1c66-4316-9c04-f3b343f6b9c3" /> ## after <img width="1524" height="882" alt="image" src="https://github.com/user-attachments/assets/c2e0e40e-2f12-4d82-97b6-a5021b6bd59c" /> ## ref: - closes https://github.com/supabase/supabase/issues/45557 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved text wrapping for query parameters in reports to prevent content overflow and enhance readability. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Vaibhav
|
e7163da1bd |
fix: cron regression (#45675)
## TL;DR fixes cron losing http body/headers when values contain backslashes, broken by: - #45560 parser now handles escape-string literals (`E'...'`) emitted by `literal()` ## ex: Before: https://github.com/user-attachments/assets/9f7c3c13-5c49-448d-aac1-b64e27e269f4 After: https://github.com/user-attachments/assets/2c517c4d-9eaa-412f-9b40-5eaacc2c2b2d ## ref: - closes https://github.com/supabase/supabase/issues/45674 - broken by / adds upto: #45560 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **Bug Fixes** * Improved reliability of cron job HTTP POST request parsing when using special characters and escape sequences in headers and body parameters. * Enhanced support for extracting headers from cron job commands configured with escaped SQL literals. * **Tests** * Added test coverage for HTTP cron job command parsing with escaped SQL string literals and special character handling. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ali Waseem
|
551f334446 |
fix(studio): suppress stale notice banner on old client bundles (#45653)
## Summary - Adds a hardcoded `BANNER_EXPIRES_AT` constant to `NoticeBanner` so long-lived tabs running an old client bundle stop displaying outdated notices once the relevant date passes. - Self-suppresses on every bundle that ever shipped — no server-side flag flip, no refresh, no over-suppression on unrelated deploys. - The existing `showNoticeBanner` ConfigCat boolean stays in place as the emergency kill-switch. For future banners, set `BANNER_EXPIRES_AT` to the time the notice should stop rendering (e.g. end of a maintenance window, or a generous tail after a TOS effective date). Closes [FE-3175](https://linear.app/supabase/issue/FE-3175/suppress-stale-maintenance-banner-on-old-client-bundles). ## Test plan - [x] Locally set `BANNER_EXPIRES_AT` to a past date and confirm the banner does not render. - [x] Set it to a future date and confirm the banner renders as before. - [x] Confirm flipping `showNoticeBanner` off in ConfigCat still hides the banner. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added automatic expiration for notice banners, ensuring outdated notices no longer display after a specified date. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
08efb963f9 |
chore(studio): add custom instance type input to project creation GENCOMP-76 (#45660)
## Summary - Adds a "Custom instance type" input on the new-project modal, rendered directly below the existing custom Postgres version field and gated behind the same non-prod check. - Wires the value through `custom_supabase_internal_requests.ami.instance_type`, merged with the existing AMI search-tag payload so both can be set independently. <img width="312" height="133" alt="Screenshot 2026-05-07 at 12 32 41 PM" src="https://github.com/user-attachments/assets/d4190a0f-0a54-46e6-ac0b-967548a3903f" /> ## Test plan - [x] On a non-prod build, open the new-project modal and confirm the "Custom instance type" field appears below "Custom Postgres version". - [ ] Submit with only an instance type set and verify the request body includes `custom_supabase_internal_requests.instance_type` and no `ami` block. - [x] Submit with both fields set and verify both `ami.search_tags` and `instance_type` are sent. - [x] Submit with neither set and verify `custom_supabase_internal_requests` is omitted. - [x] Verify the field is hidden in prod builds. 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added instance type field to project-creation wizard. * Added an internal-only configuration panel for advanced customization. * **Refactor** * Simplified Advanced Configuration panel layout and behavior. * **Documentation** * Updated documentation links to use internal reference URLs. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Kalleby Santos
|
f584fdc975 |
feat: refactor edge-functions templates (#45234)
## What kind of change does this PR introduce? feature ## What is the new behavior? Update dashboard templates to use new `@supbase/server` SDK <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Updates** * Standardized edge function templates to use a unified request handler with built-in Supabase context, improved secret-based flows, and consistent handling of OPTIONS, streaming, binary, and websocket responses. * Unified error handling to return consistent JSON error and simplified success/unauthorized payloads across AI, database, storage, webhook, email, image, and websocket templates. * **Documentation** * Guide examples and text updated to use the revised auth mode naming (ctx.authMode). <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Danny White
|
c05083aa80 |
chore(studio): improve contrast on frozen table editor columns (#45620)
## What kind of change does this PR introduce? UI styling consistency for table grid frozen-column borders ## What is the current behavior? The custom style targeted a non-existent React Data Grid class (`.rdg-cell-frozen-last`), so the frozen column divider was not visible. ## What is the new behavior? - Frozen-column divider now targets the actual rendered structure: - body: `.rdg-row .rdg-cell-frozen:nth-last-child(1 of .rdg-cell-frozen)` - header: `.rdg-header-row .rdg-cell-frozen:nth-last-child(1 of .rdg-cell-frozen)` - Header bottom border remains consistent on the last frozen column. - Dark mode now applies a balanced divider contrast using `border-r-strong` for the last frozen divider (header + body), avoiding both faint and overly harsh appearance. | Before | After | | --- | --- | | <img width="1167" height="690" alt="colors Table Editor Chisel Toolshed Supabase-A1CB0078-936B-4213-B931-B2D23C5FCCA9" src="https://github.com/user-attachments/assets/1f2c89c0-55d0-4fc9-9d9a-c66cda66ec4b" /> | <img width="1167" height="690" alt="colors Table Editor Chisel Toolshed Supabase-4E3F8C10-0E40-4035-8D5F-1BCDD0AF75D3" src="https://github.com/user-attachments/assets/55a3053b-c30b-441b-a3f2-98bc403fdf27" /> | | <img width="1167" height="690" alt="colors Table Editor Chisel Toolshed Supabase-7BFFFBC0-8F9A-4895-B141-275AFF206CAB" src="https://github.com/user-attachments/assets/faa50426-7547-4986-bf25-5c1c39199b72" /> | <img width="1167" height="690" alt="colors Table Editor Chisel Toolshed Supabase-C179A558-89BA-4913-993B-1C7DFDBC5299" src="https://github.com/user-attachments/assets/a6f8bf17-b061-4079-b471-ad26be277470" /> | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Enhanced the visual appearance of frozen grid columns with refined border styling for the last frozen column, ensuring improved consistency across both light and dark themes. * Optimized frozen column header and cell styling for better visual presentation across all color schemes, delivering a more polished and cohesive user interface experience. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
116faefcda |
studio: convert more executeSql callers to SafeSqlFragment (#45645)
## Summary - Converts ~27 `executeSql` call sites in `apps/studio/data/**` to build SQL through `safeSql` / `ident` / `literal` / `keyword` / `joinSqlFragments` instead of raw template-string interpolation. - Tightens the `useDatabaseCronJobCreateMutation` and `useDatabaseEventTriggerCreateMutation` `sql`/`query` parameter types from `string` to `SafeSqlFragment` (callers already produce one). - Updates `getDeleteEnumeratedTypeSQL` in `packages/pg-meta` to return `SafeSqlFragment`. - Fixes a bug noticed while testing where Queues integration does not correctly handle queues with uppercase names. ## Pages to manually test - Integrations > Cron Jobs - Integrations > Queues - Database > Triggers > Event Triggers - Database > Indexes - Reports > Query Performance - Storage <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **Bug Fixes** * Queue lookups now correctly handle case-insensitive queue names. * Queue table references are now properly managed and consistently applied throughout the queue management interface. * Improved queue name display normalization in the user interface. * **Chores** * Enhanced SQL query safety across the database layer through parameterized query construction and safer templating approaches. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kemal.earth
|
3864f25336 |
fix(studio): unified logs ui quriks (#45648)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Spotted a couple of Tailwind 4 migration UI quirks. This PR should fix them. #### 1. Outline around table body | Before | After | |--------|--------| | <img width="1036" height="240" alt="Screenshot 2026-05-06 at 16 37 17" src="https://github.com/user-attachments/assets/fc16a530-8457-4b4e-892c-19f5027e4d58" /> | <img width="976" height="270" alt="Screenshot 2026-05-06 at 16 54 11" src="https://github.com/user-attachments/assets/72d8eddc-6b3f-40ba-a211-e8939a104c36" /> | #### 2. Gap between header buttons | Before | After | |--------|--------| | <img width="236" height="81" alt="Screenshot 2026-05-06 at 16 47 34" src="https://github.com/user-attachments/assets/5daaef6e-c7f1-46e7-81e1-3e1fd3290825" /> | <img width="187" height="51" alt="Screenshot 2026-05-06 at 16 54 15" src="https://github.com/user-attachments/assets/017f8399-4f5d-4ae6-b2ff-7ffbdbee3f8b" /> | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Refined spacing in action controls layout for improved visual hierarchy * Updated focus outline styling to enhance keyboard navigation accessibility <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ivan Vasilov
|
ea0523ce02 |
Fix the Connect button to show the text. (#45646)
The connect button was missing its text Before: <img width="833" height="244" alt="Screenshot 2026-05-06 at 17 46 23" src="https://github.com/user-attachments/assets/c03e972f-bef6-4bd7-8819-dd51509c58eb" /> After: <img width="678" height="208" alt="Screenshot 2026-05-06 at 17 46 58" src="https://github.com/user-attachments/assets/5b020017-133e-47c3-8138-925c27299665" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved screen reader accessibility in the Connect button by refining how text visibility is handled based on button display mode. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
