https://github.com/user-attachments/assets/0b9e4bd1-e2b6-4a58-b47e-803e2b34a32e
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix.
## What is the current behavior?
Every page in `apps/docs` crashes at runtime with `Error: supabaseUrl is
required.`
Regression from #46757, which flipped `NEXT_PUBLIC_IS_PLATFORM` to
`"true"` in `apps/docs/.env.development` and, in the same diff,
duplicated a
`NEXT_PUBLIC_MARKETPLACE_API_URL`/`NEXT_PUBLIC_MARKETPLACE_PUBLISHABLE_KEY`
block where `NEXT_PUBLIC_SUPABASE_URL`/`NEXT_PUBLIC_SUPABASE_ANON_KEY`
should have been. With `IS_PLATFORM` now `true`, `Feedback.tsx`
(rendered on every docs page) unconditionally calls `createClient()`
with an undefined URL/key, throwing synchronously on every page load.
Closes DOCS-1208 / FE-3980.
## What is the new behavior?
- `apps/docs/.env.development`: renamed the mislabeled duplicate block
back to `NEXT_PUBLIC_SUPABASE_URL`/`NEXT_PUBLIC_SUPABASE_ANON_KEY`.
- `apps/docs/components/Feedback/Feedback.tsx`: widened the guard to
`IS_PLATFORM && supabaseUrl && supabaseAnonKey`, mirroring the existing
pattern in `app/api/ai/docs/route.ts`, so a future env misconfiguration
degrades gracefully (feedback votes silently skipped) instead of
crashing every page.
Verified locally by running `pnpm dev:docs` with no GitHub credentials
set:
- No more `"supabaseUrl is required."` anywhere; the Feedback widget
renders and fires its vote request instead of throwing.
- A normal guide page renders fine.
- `/guides/database/database-advisors` still shows its existing graceful
fallback admonition.
- `/guides/graphql` (federated content, absent on a clean checkout)
returns a clean 404 rather than crashing — confirming the related goal
of running docs dev locally without federated content already works (via
#48205 + existing `notFound()` handling), no extra changes needed there.
## Additional context
A related but separate gap was found in
`apps/docs/app/guides/database/extensions/wrappers/[[...slug]]/page.tsx`.
A new Linear issue is created:
https://linear.app/supabase/issue/DOCS-1209/wrappers-guide-page-crashes-on-unhandled-github-fetch-failure-without
## Manual testing
1. Checkout branch locally and run `pnpm run dev:docs` with no GitHub
credentials set. Confirm it starts without errors.
2. Open any guide page on docs locally and confirm no `supabaseUrl is
required` error, and the Feedback widget renders and responds to clicks.
3. Open `/docs/guides/database/database-advisors`. Confirm it renders
and does not crash.
4. Open `/docs/guides/graphql`. Confirm a clean 404, not a server error.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved feedback functionality by safely handling missing
configuration.
* Feedback votes and comments are skipped when the required service
configuration is unavailable, preventing errors.
* **Chores**
* Updated documentation-site configuration to use the appropriate
content service settings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
## Summary
TanStack Start's quickstart only ever wired up an anonymous
`supabase-js` client — no cookies, no `@supabase/ssr`, no auth. This
ports the real `@supabase/ssr` client/server split and password-based
auth flow (already shipped in `apps/ui-library`) into the quickstart and
adds a matching tab to the SSR guide.
## Where this changed
- `apps/docs/content/guides/getting-started/quickstarts/tanstack.mdx` —
quickstart now installs the cookie-based auth flow via the Supabase UI
Library registry and queries data through the SSR-aware server client.
- `apps/docs/content/guides/auth/server-side/creating-a-client.mdx` —
new TanStack Start tab (client/server setup + protecting routes).
- `examples/auth/tanstack/` (new) — source files backing the
`$CodeSample` snippets above, ported from `apps/ui-library`'s registry.
## Test plan
- [x] Scaffolded a real TanStack Start app and ran the quickstart
commands end-to-end
- [x] Confirmed SSR loader + protected-route redirect work as documented
- [x] `pnpm lint:mdx` and `pnpm build:guides-markdown` pass
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added TanStack Start SSR setup examples for Supabase, including
browser and server client helpers with cookie-based session support.
* Included a protected route example that checks authentication on the
server and redirects unauthenticated users to the login page.
* Added a server-side claims fetch helper for authorization checks.
* **Documentation**
* Expanded the “creating a client” guide with TanStack Start-specific
route protection and environment variable examples.
* Updated the TanStack Start quickstart to use the official CLI and
refined server-side authorization guidance.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What
Updates the Dart/Flutter reference
(`apps/docs/spec/supabase_dart_v2.yml`) for features shipped in
[`supabase/supabase-flutter`](https://github.com/supabase/supabase-flutter)
in July (through the July 17 storage CDN-cache additions).
Built on the **new reference pipeline** (#47224 / #47994): each method's
section is inherited from the nearest section-header entry in the YAML,
and subcategory overviews are committed partials under
`spec/reference/dart/v2/partials/`. `common-client-libs-sections.json`
is **not** touched.
Scoped to items **not** already covered by #47728 (OAuth server
authorization details, custom providers admin, `explain` format,
realtime `onHeartbeat` and filter examples). Rebased onto `master` now
that #47994 and #47728 have landed.
## New reference entries
**Storage**
- Vector buckets (new **Vector Buckets** section):
create/get/list/delete bucket, index create/get/list/delete/access, and
vector put/get/list/query/delete (`supabase.storage.vectors`)
- Analytics (Iceberg) buckets (new **Analytics Buckets** section):
`createAnalyticsBucket`, `listAnalyticsBuckets`,
`deleteAnalyticsBucket`, and the `analyticsCatalog()` accessor
- `listPaginated` (list files v2), under File Buckets
- `downloadStream()` (streaming file downloads), under File Buckets
- `purgeCache()` (object CDN cache invalidation) and
`purgeBucketCache()` (bucket CDN cache invalidation)
**Auth**
- `signInWithWeb3`
- OAuth server `listGrants` and `revokeGrant` (in the **OAuth Server**
section, `supabase.auth.oauth`)
**Database**
- `stripNulls()` modifier
## Enrichments to existing entries
- Storage: `cacheNonce` on `getPublicUrl` / `createSignedUrl` /
`download`; filter/sort/pagination options on `listBuckets`
- Auth: `channel` on `mfa.challenge()`; `currentPassword` on
`updateUser`; async `getSession()` note and example; `friendlyName` on
`registerPasskey()` and `passkey.startRegistration()`
- Functions: `abortSignal` on `invoke`
## Pipeline plumbing
- New partials: `analytics-buckets.json`, `vector-buckets.json`,
`oauth-server.json`
- `generate-dart-reference.ts`: registers `analytics-buckets`,
`vector-buckets`, and `oauth-server-api` group-header ids in
`HEADER_IDS` so they render as section overviews rather than methods
## Source PRs
supabase-flutter: #1547, #1554, #1557, #1559, #1561, #1563, #1578,
#1579, #1580, #1585, #1588, #1590, #1591, #1593, #1603, #1607, #1608
## Verification
`pnpm codegen:references:dart` builds cleanly: the generator writes 141
method declarations (all ids resolve to a section, no invalid method
names, no slug collisions), and the nav renders the Analytics Buckets,
Vector Buckets, and OAuth Server sections with the expected methods.
## Notes
- Skipped (no reference home / would need product decisions): Iceberg
namespace/table management (the full `IcebergRestCatalog` API, which
lives in a standalone `iceberg-js` package upstream), `dryRun`,
functions exception subtypes, trace-context headers, `persistSession`,
configurable postgrest timeout/retry.
- `storageanalytics-from` maps to Dart's `analyticsCatalog(bucketId)`
(the Iceberg catalog entry point), since Dart has no `analytics.from()`
equivalent.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Expanded Dart docs with Web3 sign-in plus passkey, MFA channel, and
OAuth grant listing/revocation.
* Added storage APIs/examples for listing buckets with options, CDN
cache bypass via `cacheNonce`, and cache/purge support.
* Documented `stripNulls()` database modifier and cursor-based paginated
storage listing.
* **Documentation**
* Updated auth references with optional `currentPassword`,
`friendlyName`, and clarified `currentSession` vs `getSession()`.
* Added `abortSignal` support and examples for
`supabase.functions.invoke()`.
* **Bug Fixes**
* Improved Dart reference generation so analytics/vector bucket sections
aren’t emitted as method declarations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Brings the Log Drains docs up to the same standard as the Metrics API
page.
- Replaces the plain destination table with a visual
`LogDrainDestinationCards` component — a 3-column card grid
that mirrors the product UI destination picker. Cards link to anchors on
the same page (no sub-pages needed since
setup is simpler than Metrics).
- Adds a "What you can do" intro section and a consistent "Required
configuration + Steps" structure for every
destination.
- Adds two destinations that were missing from the docs entirely:
**Last9** and **Syslog** (both are live in the
product). Config fields sourced from `LogDrainDestinationSheetForm.tsx`.
- Cleans up raw `<ul><li>` HTML to markdown lists.
- Adds an "Additional resources" footer (pricing, Metrics API, JS SDK
tracing).
## Files changed
- `apps/docs/content/guides/telemetry/log-drains.mdx` — core of the
changes
- `apps/docs/components/LogDrainDestinationCards.tsx` — new card grid
component
- `apps/docs/components/LogDrainDestinationCards.data.ts` — destination
data (9 entries)
- `apps/docs/internals/markdown-schema/LogDrainDestinationCards.ts` —
markdown fallback renderer
- `apps/docs/features/docs/MdxBase.shared.tsx` — register new component
- `apps/docs/internals/generate-guides-markdown.ts` — register new
component
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
docs update
## What is the current behavior?
not supanice, also missing syslog and last9
<img width="619" height="687" alt="image"
src="https://github.com/user-attachments/assets/58e8f07c-eb40-4d30-a5e2-3988d1af87c2"
/>
## What is the new behavior?
hopefully more supanice, also added syslog and last9
<img width="568" height="667" alt="image"
src="https://github.com/user-attachments/assets/be61e67f-58aa-4e8c-be0d-44206f1b16de"
/>
## Additional context
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Reorganized the Log Drains guide with destination-specific sections
and a new destination chooser.
* Added support and setup guidance for Last9 and Syslog destinations.
* Clarified HTTP batching, JSON delivery, compression, authentication,
and endpoint requirements.
* Updated OpenTelemetry, Datadog, Loki, Amazon S3, Sentry, and Axiom
instructions.
* Added Edge Function examples covering compressed and uncompressed
payloads.
* Added links to pricing, Metrics API, and JavaScript tracing resources.
* **UI Improvements**
* Updated destination listings with clearer, consistent icons and
presentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Nik Richers <nik@validmind.ai>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES/NO
## What kind of change does this PR introduce?
Bug fix, feature, docs update, ...
## What is the current behavior?
Please link any relevant issues here.
## What is the new behavior?
Feel free to include screenshots if it includes visual changes.
## Additional context
Add any other context or screenshots.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added Wendie Cheung to the team listing on the documentation site.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update.
## What is the current behavior?
I am not included 😢
## What is the new behavior?
I am included 😄
## Additional context
Onboarding task
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added Anna Baker to the project contributors list.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Reverts supabase/supabase#48144
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Documentation generation now surfaces missing or unreadable AI skills
and Terraform schema data instead of silently producing empty sections.
* This improves visibility into incomplete documentation builds and
helps ensure generated reference content is available and accurate.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Ali Waseem <waseema393@gmail.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Make it clear what users can and can't do on `realtime` schema.
## What is the current behavior?
After https://github.com/supabase/realtime/pull/1993 creating or
altering the realtime schema is no longer allowed, but some users are
still trying to execute `ALTER TABLE realtime.messages ENABLE ROW LEVEL
SECURITY` or trying to create objects on that schema.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Clarified Realtime schema protections, including a caution about how
the `realtime` schema is restricted and what permission errors to expect
when creating objects there.
* Confirmed that row level security is enabled by default on
`realtime.messages`, and that managing its RLS policies is supported.
* Documented the additional binary-capable function,
`realtime.send_binary`, alongside the existing `realtime.send` behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Updates humans.txt to include new Supabase team member, me. 😄
## What is the current behavior?
It's missing a new team member.
## What is the new behavior?
Added me to the list!
## Additional context
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added Shaun Newman to the team listings in the documentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- ccr-slack-attribution -->
_Requested by **Ivan Vasilov** · [Slack
thread](https://supabase.slack.com/archives/C0161K73J1J/p1784639352877839?thread_ts=1784625513.046239&cid=C0161K73J1J)_
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix.
## What is the current behavior?
Running `pnpm --filter=docs run build:guides-markdown` standalone — as
`apps/www`'s prebuild does, without first running
`build:federated-content` — crashes with `ENOENT ... ai-skills.json`
(and the equivalent for `terraform.schema.json`).
The `AiSkillsIndex` and `TerraformProviderSchema` markdown-schema
handlers `readFileSync` a gitignored, build-time-generated JSON artifact
unconditionally. In the full docs build these files exist because
`build:federated-content` runs first (via the docs `prebuild`), but in
the standalone / www path they do not, so the read throws.
These unguarded reads were introduced in #48045 (ai-skills) and #48010
(terraform), which surfaced as the www Vercel build failure.
## What is the new behavior?
Both handlers now render an empty section (return an empty string) when
the generated artifact is absent, so `build:guides-markdown` succeeds in
the standalone / www path.
When the artifact IS present (the full docs build, which runs
`build:federated-content` first), behavior is byte-for-byte unchanged —
the file is parsed and rendered exactly as before. The full docs build
is not affected.
## Additional context
Implemented with a minimal `existsSync` guard (from the already-imported
`node:fs`) in each handler:
- `apps/docs/internals/markdown-schema/AiSkillsIndex.ts`
- `apps/docs/internals/markdown-schema/TerraformProviderSchema.ts`
No changes to any `package.json`, `.gitignore`, or the generators — the
fix is confined to the two handlers.
---
_Generated by [Claude
Code](https://claude.ai/code/session_01RynCtzP874KrpN8CPf7n7n)_
Co-authored-by: Claude <noreply@anthropic.com>
## Summary
- Simplify CPU messaging on the Compute and Disk docs page and in
Studio's compute size UI to keep it generic rather than
architecture-specific.
## Test plan
- [x] Unit tests pass
- [x] Typecheck passes
- [x] Lint passes
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Simplified compute size labels across the UI by removing
cloud-provider architecture details from CPU text.
* Standardized CPU descriptions to show core counts and whether
resources are shared or dedicated.
* Updated the “Compute Size” pricing/specs table in the compute & disk
guide to use generic CPU labels while keeping pricing, memory, and
database size guidance the same.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fix broken "Dashboard integrations" link with missing `/docs/` in the
[Partner Catalog docs
page](https://docs-git-fix-docs-dashboard-integrations-link-supabase.vercel.app/docs/guides/integrations/partner-catalog).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Clarified the difference between the Partner Catalog and Dashboard
Integrations.
* Explained that Dashboard Integrations are installed directly from a
Supabase project in the dashboard.
* Updated the Dashboard Integrations link.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds Kimi Code to the MCP server setup and AI coding agent plugins docs:
### MCP Server config
<img width="755" height="703" alt="image"
src="https://github.com/user-attachments/assets/b350aca0-ff0d-442b-b6f3-b3b4355d8fcd"
/>
### AI coding agent plugins
<img width="753" height="475" alt="image"
src="https://github.com/user-attachments/assets/100d5893-4627-4f48-9ab6-16e0c6457467"
/>
Closes AI-933
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added **Kimi Code** as a selectable plugin client in the plugins
panel.
* Added **Kimi-specific installation/setup instructions**, including
guidance on placing `mcp.json`, confirming the trust prompt, and using
`/plugins` plus `/mcp` and `/mcp-config`.
* Extended the **MCP URL builder** to generate Kimi Code HTTP-based
server configuration.
* Included **Kimi** in the **IDE** client group with a dedicated **Kimi
icon** for UI display.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
> **Stacked on #47994** (`docs/dart-reference-categories-in-yaml`).
Review/merge that first; GitHub will retarget this to `master` once it
lands.
## What
Adds Dart client library reference entries
(`apps/docs/spec/supabase_dart_v2.yml`) for features shipped in
[`supabase/supabase-flutter`](https://github.com/supabase/supabase-flutter)
(parity with `supabase-js`).
Rebuilt on the **new reference pipeline** (#47224 / #47994): each
method's section comes from `category` / `subcategory` fields on its own
YAML entry, with subcategory overviews as committed partials under
`spec/reference/dart/v2/partials/`. As a result this PR no longer
touches `common-client-libs-sections.json` or `supabase_js_v2.yml` (the
earlier shared-nav id rename is unnecessary now that Dart no longer
reads that file).
## Changes
**Auth (OAuth 2.1 server)** — new **OAuth Server** section
- `oauth.getAuthorizationDetails()`, `oauth.approveAuthorization()`,
`oauth.denyAuthorization()`
**Auth admin** — new **Custom Provider Admin** section
-
`admin.customProviders.listProviders/createProvider/getProvider/updateProvider/deleteProvider`,
including `customClaimsAllowlist`
**Realtime**
- `onHeartbeat`
- `onPostgresChanges` examples for the new pattern/negated filter
operators, multiple filters, and column selection
**Postgrest**
- `explain()` `format` option (`ExplainFormat.text` / `.json`)
## Pipeline plumbing
- New partials: `oauth-server.json`, `custom-provider-admin.json`
- `generate-dart-reference.ts`: registers `oauth-server-api` and
`admin-custom-providers-api` group-header ids in `HEADER_IDS`
## Source PRs
supabase-flutter: #1499, #1516, #1517, #1519, #1526
## Verification
`pnpm codegen:references:new` builds cleanly and the nav renders the new
**OAuth Server**, **Custom Provider Admin**, and Realtime
**onHeartbeat** entries.
## Notes
- `RealtimeChannelConfig.replicationReady` (#1526) is omitted since
there is no reference slot for channel-config options.
- The **OAuth Server** section also appears in #47971 (which adds
`listGrants` / `revokeGrant`). Whichever lands second should drop the
duplicate section header/partial and keep both sets of methods.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added OAuth 2.1 server consent-flow methods for retrieving, approving,
and denying authorization requests.
* Added admin APIs for managing custom OIDC/OAuth providers.
* Added Realtime heartbeat monitoring and advanced Postgres change
filters.
* Added text and JSON output options for query explanations.
* **Documentation**
* Expanded Dart API reference coverage across Auth, MFA, Passkeys,
Database, Realtime, and Storage.
* Added dedicated reference sections for OAuth Server and Custom
Provider administration.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What
Addresses @jeremenichelli's feedback that the Dart v2 reference required
maintaining section metadata separately from the spec. The reference now
derives every method's section from the spec YAML itself, with **no
per-method metadata**.
## How
Each **section-header** entry in `supabase_dart_v2.yml` carries the
`category` and optional `subcategory` that every method after it
inherits, up to the next header:
- Existing subcategory headers gain a `category`/`subcategory`:
`auth-mfa-api`, `passkey-api`, `admin-api`, `admin-passkey-api`,
`file-buckets`, `using-modifiers`, `using-filters`.
- New top-level category headers mark the sections that previously had
no header: `auth-api`, `functions-api`, `database-api`, `realtime-api`.
`generate-dart-reference.ts` walks the spec in order, tracking the
current section from the most recent header, and tags each method's
declaration with it. A method may still set `category`/`subcategory`
explicitly to override, and the converter errors if a method appears
before any header.
## Why this is less work
- **Authoring a new method:** place it in the right section. No
`category`/`subcategory` fields, no nav file edit.
- **Adding a section:** one header entry (with `category`/`subcategory`)
plus its overview partial.
- `common-client-libs-sections.json` is not touched (it still drives the
legacy-pipeline SDKs).
## Verification
The generated navigation (`content/reference/dart/v2/sections.json`,
`bySlug.json`) is **byte-for-byte identical** to the previous output.
`pnpm codegen:references:new` writes 105 method declarations across 5
categories with no orphaned methods and no slug collisions.
Supersedes the earlier per-method-`category` approach on this branch.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Improved Dart/Flutter API reference organization by leveraging
spec-provided `category` and `subcategory` taxonomy for clearer grouping
(Auth, Passkey, Edge Functions, Database, Realtime, Storage, and
database modifiers/filters).
* Updated reference generation to use structured in-spec section
headers, resulting in more consistent published categorization and
navigation.
* **Bug Fixes**
* Enhanced validation and error messaging for entries that can’t be
assigned to a section/category, including clearer guidance on how to fix
incomplete spec items.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Chore / dependency tooling update.
## What is the current behavior?
The repo is pinned to pnpm 10.24.0. Closes
https://linear.app/supabase/issue/FE-3673/migrate-the-repo-to-use-pnpm-v11.
## What is the new behavior?
The repo is pinned to pnpm 11.13.1, pnpm v11 workspace settings are
migrated to `allowBuilds`, and the Studio Dockerfile installs pnpm
11.13.1.
## Additional context
Validated with `CI=true mise exec node@22 -- pnpm install
--frozen-lockfile`, `mise exec node@22 -- pnpm run typecheck`, and `mise
exec node@22 -- pnpm run lint`; full Prettier check still fails on
existing generated docs/router files outside this migration.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated tooling requirements (pnpm **11.13.1**, Node **>=22.13**) and
aligned container build tooling accordingly.
* Adjusted package manager behavior (scoped registry override, update
notifications disabled) and workspace build/engine validation settings.
* **Maintenance**
* Updated `clean` scripts across apps/packages to remove only
build/cache artifacts (no longer delete installed dependencies).
* Reduced Turbo `clean` task output to **errors-only** for cleaner logs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes DOCS-1176
## Summary
This PR adds documentation-writing guidance for humans and agents, then
applies it to the “Securing your API” guide.
## Changes
- Add a documentation word list based on Google’s style guide and
existing MDX lint rules.
- Add a shared `docs-guides` Agent Skill with Cursor and Claude
integration.
- Expand contributing guidance for information types, procedures,
chunking, links, admonitions, grammar, and terminology.
- Restructure “Securing your API” into contextual and procedural
sections.
- Add section navigation, cross-references, transitions, and procedural
outcomes.
- Reduce repeated admonitions and improve scannability.
## Manual testing
1. Open `/docs/guides/api/securing-your-api` in Preview and compare to
Live.
https://docs-git-docs-restructure-api-supabase.vercel.app/docs/guides/api/securing-your-api
2. See that the content is improved and clear with no important context
removed.
3. See the Admonitions that are no longer marked as admonitions. See the
content still makes sense.
4. Review the diff of `CONTRIBUTING.md` and `WORD_LIST.md`.
5. See that you agree with the new rules and that they are clear.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated documentation-writing guidelines with clearer standards for
structure, formatting, components, diagrams, terminology, and
navigation.
* Added a comprehensive word and style reference for consistent
documentation language.
* Reworked the API security guide with clearer guidance on grants, RLS,
dedicated schemas, pre-request checks, rate limiting, and API keys.
* Added documentation authoring workflow guidance, including validation
and formatting steps.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
Keyboard navigation on docs tabs is confusing:
- tab panels can be focused but without any indication that they are
- code example buttons can be focused with keyboard but stay invisible
- copy code button has no label and do not notify screen reader users
about its status
## Solution
- Make tab panels non focusable
- Ensure buttons are visible when focused
- Add a label to the copy code buttons
- Add a live region for the copy code status
## How to test
1. Go to
https://docs-git-gildasgarcia-docs-1156-cannot-keyboard-140a35-supabase.vercel.app/docs/guides/local-development/cli/getting-started
2. Go to a tab list with _Tab_ key
3. Verify you can choose the tab value with Arrow keys and select it
with space
4. Tab again and verify you now have focused the code example first
button and it is visible
5. Tab again and the copy code button should be focused and visible
If you enable Voice over, clicking the copy code button should announce
that the code has been copied
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **Bug Fixes**
* Improved code block copy feedback so the “copied” state resets more
reliably after interaction.
* **Accessibility Improvements**
* Code block controls now appear on keyboard focus (not just hover) and
include an assistive live announcement when copying succeeds.
* Enhanced code block semantics with clearer ARIA labeling.
* Prevented tab panels from being reachable through normal tab
navigation to reduce unintended focus stops.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds a docs guide, "Choosing a server-side package", that explains when
to use `supabase-js`, `@supabase/ssr`, or `@supabase/server` when
working with Supabase from JavaScript on the server. It includes a
decision table and a short code example for each, with one rule up
front: cookie-based sessions in SSR frameworks use `@supabase/ssr`,
per-request header auth in Edge Functions and other backend runtimes
uses `@supabase/server`, and `supabase-js` is the base client both wrap.
The guide is surfaced from the Auth overview page and the sidebar, and
is cross-linked from the `supabase-js` and `@supabase/server` reference
introductions so it is reachable from where developers start. It also
states that the packages coexist and are not replacements for each
other, and keeps combining `@supabase/server` with `@supabase/ssr` as an
advanced section.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Added a guide explaining how to choose between Supabase server-side
JavaScript packages.
- Added the guide to Auth navigation and the getting-started content
listings.
- Added links to the new guidance throughout relevant JavaScript and
server documentation.
- **Documentation**
- Clarified when to use cookie-based sessions versus header-based
authentication.
- Added package comparisons, usage examples, advanced guidance, and
related next steps.
- Updated spelling support for framework names used in the
documentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Updates Joey Lei to the list of Supabase team members
## What is the current behavior?
Missing joey!
## What is the new behavior?
Adds Joey
## Additional context
None
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added Joey Lei to the team credits listed in the documentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix + partial revert.
## What is the current behavior?
1. `ContentListings.client.tsx` unconditionally derives `hasLightIcon`
from `Boolean(item.icon)`. `GlassPanel` appends `-light.svg` to the icon
path in light mode whenever `hasLightIcon` is true. Framework icons
(react, nuxt, hono, redwood, flutter, swift, kotlin, svelte, solidjs,
vue, refine, angular, ionic) have no `-light.svg` variants, causing
broken image requests in light mode for any ContentListings card that
uses them.
2. `getting-started.mdx` uses `<ContentListings
id="getting-started-overview" />` (added in #47097) for the top
three-card grid (Build with AI tools, API Keys, Local Development).
## What is the new behavior?
1. `hasLightIcon` is now an optional field in the item schema (defaults
to `Boolean(item.icon)` for backward compatibility). The component reads
`item.hasLightIcon ?? Boolean(item.icon)`, so data files can opt
specific icons out of the light-mode variant.
2. `<ContentListings id="getting-started-overview" />` is removed and
the original hand-authored GlassPanel grid is restored. The
`gettingStartedGetStarted` data entry and its registry import are also
removed.
ContentListings has no mandate to cover every section of every page: the
goal was for hub and overview pages to have a reasonable, standardized
link section that tooling can lint for. This page doesn't fit that
pattern.
## Additional context
| Check | Result |
|-------|--------|
| `pnpm vitest run lib/content-listings.test.ts` | ✅ 12/12 passed |
| `pnpm lint:mdx` (getting-started.mdx) | ✅ No warnings |
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated the Getting Started guide with dedicated tiles for Build with
AI Tools, API Keys, and Local Development.
* Expanded the available Getting Started content listings.
* **Bug Fixes**
* Improved icon styling in content listings so light icon treatment
reflects each item’s configuration.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Nik Richers <nik@validmind.ai>
## Summary
- Adds the Vercel [`plugins`](https://www.npmjs.com/package/plugins) npm
package as the default, single-command install option (`npx plugins add
supabase-community/supabase-plugin`) on the Supabase AI coding agent
plugin docs page.
- Keeps the existing per-agent manual installation instructions
available below, as an alternative.
Closes AI-929.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a quick-install option for the plugin using a single command.
* Documented the `--yes` flag for skipping the confirmation prompt.
* Updated the manual installation guidance to follow the new
quick-install instructions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- ccr-slack-attribution -->
_Requested by **Lakshan Perera** · [Slack
thread](https://supabase.slack.com/archives/C023E4L60R3/p1784055775538959?thread_ts=1784055775.538959&cid=C023E4L60R3)_
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update.
## What is the current behavior?
Both the "Edge Function bundle size issues" troubleshooting page and the
Edge Functions "Limits" page stated only a single **20 MB** limit. In
practice, that 20 MB figure applies only to **local bundling** with the
Supabase CLI. When a function is deployed via the **Management API or
Dashboard**, bundling runs server-side and is capped at **5 MB** due to
an infrastructure (Lambda) limit. Customers deploying that way were
surprised to hit an error like `Function source code exceeds the maximum
deployment size (5 MB). Reduce the size of your function and try again.`
even though the docs implied 20 MB was available.
## What is the new behavior?
Both pages now state the distinction explicitly:
- **Local bundling (Supabase CLI):** up to **20 MB**.
- **Server-side bundling (Management API or Dashboard):** up to **5
MB**.
The troubleshooting page also adds a "Deploying larger functions"
section pointing customers at the workaround: if a function is under 20
MB but over the 5 MB server-side limit, bundle it locally by running
`supabase functions deploy` with the `--use-docker` flag to force local
bundling and get the higher limit.
## Additional context
**How / files changed:**
-
`apps/docs/content/troubleshooting/edge-function-bundle-size-issues.mdx`
— rewrote the intro to describe both limits, added the "Deploying larger
functions" workaround section, and fixed the frontmatter `keywords`
(replaced `"10MB"` with `"5MB"` and `"20MB"`).
- `apps/docs/content/guides/functions/limits.mdx` — updated the "Maximum
Function Size" line to list both the 20 MB local and 5 MB server-side
limits.
Before, both pages said only 20 MB, so customers deploying via the
API/Dashboard were surprised by a 5 MB error; after, both pages state
the 5 MB server-side vs 20 MB local distinction and point to local
bundling as the workaround.
---
_Generated by [Claude
Code](https://claude.ai/code/session_019bBXmQTRBWJbo3UTpfjPLU)_
Co-authored-by: Claude <noreply@anthropic.com>
## Info architecture change around "Partners"
The www "integrations" now become more partner-driven.
`/partners/integrations` -> now Partner Catalog under
`/partners/catalog` (old links redirect to new paths)
Moved them close together in the nav dropdown and in the footer
<img width="494" height="336" alt="Screenshot 2026-07-09 at 11 06 41"
src="https://github.com/user-attachments/assets/a875fef0-0ab8-47ca-8756-d658b27c4892"
/>
<img width="1149" height="665" alt="Screenshot 2026-07-09 at 11 09 48"
src="https://github.com/user-attachments/assets/9631bb72-fe25-4fb4-b1af-9f14a37d02e7"
/>
## /partners
This page remains untouched in this PR, updates to layout, content and
intake form are delegated to #47874
## /partners/catalog
Listed in the
[catalog](https://zone-www-dot-com-git-feat-www-partners-pages-supabase.vercel.app/partners/catalog)
are now partners. Some partners match with a listing.
<img width="1207" height="866" alt="Screenshot 2026-07-09 at 11 14 17"
src="https://github.com/user-attachments/assets/b65216be-976f-4ef5-91f8-1ad49da87b45"
/>
## /partners/catalog/[partner]
Each partner can have one or more "listings" which are either
- simple guides
- foreign data wrappers
- dashboard integrations
Integrations available in the dashboard now all have a prominent
"Install integration" cta to open it in the dashboard [integrations
page](https://supabase.com/dashboard/project/_/integrations).
<img width="1269" height="776" alt="Screenshot 2026-07-09 at 11 16 51"
src="https://github.com/user-attachments/assets/3c7bb715-ffce-4d0a-905f-9a660c3b1f5a"
/>
## Docs
Update docs →
[Preview](https://docs-git-feat-www-partners-pages-supabase.vercel.app/docs/guides/integrations)
- remove "Supabase marketplace"
- use "Dashboard Integrations and Partner Catalog
- update integrations in sidenav to link to updated /partners/catalog/**
listings
<img width="1520" height="696" alt="Screenshot 2026-07-15 at 12 54 47"
src="https://github.com/user-attachments/assets/9f5a2794-4536-4299-97df-9732d3d75b4c"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a Partner Catalog experience with search, category filters,
official-partner toggle, responsive filtering (sidebar + bottom sheet),
grid/list views, and featured partners.
* Added Partner Catalog detail pages with tabbed listings, MDX-rendered
content, image gallery with zoom overlay, and “add/install” actions.
* **Improvements**
* Updated “Become a Partner” layout and form support for prefilled
values and checkbox-group fields (including validation).
* Updated navigation/footer/docs and partner tile links to use Partner
Catalog routes; expanded redirects from legacy integrations paths.
* Added public agent-skills discovery manifest.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alan Daniel <stylesshjs@gmail.com>
Co-authored-by: Alex Hall <alex.hall@supabase.io>
Co-authored-by: Miranda Limonczenko <miranda.limonczenko@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update
## What is the current behavior?
I am not listed
## What is the new behavior?
I am now listed!
## Additional context
Onboarding task of course.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added Stephanie Jackson to the team credits in the project’s public
documentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
The comparison operator `<<` check if lhs is strictly contained by the
rhs. Meaning a `/32` would return false for `/32` as the lhs is not
contained, but equal to the rhs. The `<<=` is operator checks if a
subnet is strictly contained or equal to which fixes the `/32` case.
[1] https://www.postgresql.org/docs/17/functions-net.html#FUNCTIONS-NET
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the `before-user-created` hook SQL example to use the correct
IP/CIDR containment syntax for both allow and deny network checks.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Chris Stockton <chris.stockton@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
This PR converts link sections in the self-hosting overview page to the
`ContentListings` component, puts conceptual guidance before deployment
options, and adds badge support for the Docker card (minor).
Relates to DOCS-1137
## Current behavior
`self-hosting.mdx` uses hand-authored `<GlassPanel>` / `<Link>` JSX for
two sections:
- **Get started**: Docker card with a JSX title containing a `<Badge>`
element (was previously deferred for this reason).
- **Community-driven projects**: Two cards with trivial `<span>`-wrapped
string titles.
Get started and Community cards appear at the top of the page, before
the conceptual overview. The Support and community section uses
hand-authored bullet lists for GitHub, Discord, and Reddit links.
## New behavior
- The self-hosting overview page now uses data-driven `ContentListings`
instead of hand-written cards and bullet lists.
- Conceptual content (how self-hosting differs, your responsibilities,
telemetry) comes first; deployment options and community resources
follow.
- Section intro text lives in listing data rather than inline MDX.
- Brand icons added to all listing cards (Docker, Kubernetes, Traefik,
GitHub, Discord, Reddit).
- Minor: Added support for badges to content listings, such as
"Official" in the Docker tile
Data lives in `self-hosting.data.ts` (5 groups, 8 links) and is
registered in `content-listings/index.ts`.
## Additional context
### Icon usage rights
New brand icons (Kubernetes, Traefik, Reddit) are sourced from [Simple
Icons](https://simpleicons.org) (CC0 1.0). Existing icons (Docker,
GitHub, Discord) reuse assets already in `apps/docs/public/img/icons/`.
Use is non-commercial documentation only — consistent with existing docs
icon usage and trademark fair-use for identifying linked third-party
services.
### To do:
- [ ] Check with @aantti if he's on board with switching the page to
content listings we can lint for and the content restructure to match
other overview pages
## Verification
| Gate | Result |
|------|--------|
| `pnpm vitest run lib/content-listings.test.ts` | ✅ 12/12 passed |
| `pnpm build:guides-markdown` | ✅ 744 files generated |
| `pnpm lint:mdx` (self-hosting.mdx) | ✅ No warnings on changed file |
### Proof: restructured self-hosting page with ContentListings and icons
| [Before (production)](https://supabase.com/docs/guides/self-hosting) |
[After (PR
preview)](https://docs-git-nikrichers-docs-1137-self-hosting-supabase.vercel.app/docs/guides/self-hosting)
|
|---|---|
|
|
|
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated the self-hosting guide to use dynamic content listings for
“Get started,” community resources, support options, and sharing
experiences.
* Added richer listing cards with optional badges and improved icon
handling.
* Expanded self-hosting resource groups to surface more relevant links
in docs navigation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Nik Richers <nik@validmind.ai>
Closes DOCS-1174
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## Problem
Links from docs to studio can break. There's no way to programmatically
check.
## Solution
Add a unit test to check that `/dashboard` relative links from docs is
absolute.
## Testing
1. Pull this branch to your local machine.
1. Break the link in `apps/docs/data/content-listings/database.data.ts`
— change: `href: 'https://supabase.com/dashboard/project/_/sql',` to:
`href: '/dashboard/project/_/sql',`
1. Run: cd `apps/docs && pnpm exec vitest run
lib/content-listings.test.ts`. You should see dashboard content listing
hrefs fail. Restore the absolute URL when you’re done.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added validation to ensure dashboard links in documentation content
listings use complete, canonical URLs.
* Added coverage for identifying dashboard links across all content
listing groups.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Fixes the Remix and React Router sections of the SSR "creating a client"
guide, which showed three separate `_index.tsx` snippets (Loader,
Action, Component) with two different `loader` exports that cannot
coexist in one route, leaving readers unsure which to use.
Each framework now has a short intro plus a single coherent
`_index.tsx`: one `loader` that creates the server client and returns
the env vars, one `action`, and a browser-client component that reads
those env vars via `useLoaderData`. Along the way this also fixes three
React Router bugs: the invalid `'@react-router'` import, the dropped
cookie `options` argument in `setAll`, and the incomplete `return ...`
in the component.
One thing worth a reviewer check: a loader that both sets cookies and
returns data must return through the `json` (Remix) / `data` (React
Router v7) helper with `{ headers }` rather than a plain object, so the
`Set-Cookie` headers are preserved.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **Documentation**
* Updated the server-side “creating a client” guide for Remix and React
Router SSR examples.
* Refreshed the example structure to a single end-to-end route setup
with `loader`, `action`, and one default page component.
* Improved SSR cookie and header handling to better match practical
server/client behavior.
* Passes the required Supabase URL and publishable key from the server
to the browser so the client can be initialized with `useLoaderData`.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Miranda Limonczenko <miranda.limonczenko@supabase.io>
Miranda Limonczenko
