## Summary
Fixes the Remix and React Router sections of the SSR "creating a client"
guide, which showed three separate `_index.tsx` snippets (Loader,
Action, Component) with two different `loader` exports that cannot
coexist in one route, leaving readers unsure which to use.
Each framework now has a short intro plus a single coherent
`_index.tsx`: one `loader` that creates the server client and returns
the env vars, one `action`, and a browser-client component that reads
those env vars via `useLoaderData`. Along the way this also fixes three
React Router bugs: the invalid `'@react-router'` import, the dropped
cookie `options` argument in `setAll`, and the incomplete `return ...`
in the component.
One thing worth a reviewer check: a loader that both sets cookies and
returns data must return through the `json` (Remix) / `data` (React
Router v7) helper with `{ headers }` rather than a plain object, so the
`Set-Cookie` headers are preserved.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **Documentation**
* Updated the server-side “creating a client” guide for Remix and React
Router SSR examples.
* Refreshed the example structure to a single end-to-end route setup
with `loader`, `action`, and one default page component.
* Improved SSR cookie and header handling to better match practical
server/client behavior.
* Passes the required Supabase URL and publishable key from the server
to the browser so the client can be initialized with `useLoaderData`.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Miranda Limonczenko <miranda.limonczenko@supabase.io>
## Context
As per PR title - we're pausing the development of the RLS Tester
feature preview while we re-evaluate its direction. Have also updated
the GH discussion
[here](https://github.com/orgs/supabase/discussions/45233) RE this! 🙏
Removes the RLS Tester UI + Sandbox functionality
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Removed Features**
* Removed the RLS Tester feature preview, banner, and database policy
testing workflow.
* The related SQL testing, role selection, policy summaries, sandbox
management, and result views are no longer available.
* **Bug Fixes**
* Improved accessibility on the database policies page by adding a label
to the clear-filter button.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The free-plan paused project notice was a dense paragraph, so the key
points (data is safe, resume window, download-after-expiry, upgrade)
were easy to skip.
## Fix
Present those points as a scannable bullet list, keeping the dynamic
day-count tooltip, restore-deadline timestamp, and the existing
Pro-wording variant.
Also adds a "Project Status" tab to the dev toolbar (local and staging
only) with a select for forcing the current project's status, so the
paused state and other statuses are easy to preview without touching the
backend. It overrides the status in the React Query cache and reverts on
close, project navigation, or reset.
## How to test
- Run Studio locally against the platform API
- Open the dev toolbar, go to the Project Status tab, and select
INACTIVE
- Navigate to a project page and confirm the paused screen renders
- On a free-plan org, confirm the notice now shows the details as bullet
points with the day-count tooltip and restore-deadline date intact
- Click "Reset to real data" (or close the toolbar) and confirm the
status reverts
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a development toolbar “Project Status” tab to simulate project
status and pause states in non-production environments.
* Status and pause-state overrides persist locally, can be reset, and
are reflected across project detail and paused-state views.
* **Style**
* Refined paused-project messaging: updated the heading and reworked the
free-plan explanation into bullet points, while keeping paid-plan
messaging paragraph-based for readability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Use bg-accent for selected state across elements. This fix is specific
to the feature preview dialog.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Updated feature preview selection styling for clearer visual
distinction between selected and unselected items.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update
## What is the current behavior?
We do not discuss the current settings in the configuration docs:
- max_logical_replication_workers
- max_sync_workers_per_subscription
## What is the new behavior?
Shows users they can update the following pg_settings with the CLI:
- max_logical_replication_workers
- max_sync_workers_per_subscription
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the custom PostgreSQL configuration guide with additional
CLI-supported parameters.
* Added documentation for logical replication and subscription
synchronization worker settings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES (in fact, this PR makes a tiny change!)
## What kind of change does this PR introduce?
Docs and config file changes to fix up some outdated docs and improve
the onboarding experience a little bit:
- [x] Fixes up the `pnpm` versioning guidance in `DEVELOPERS.md` (as
well as some small formatting cleanups)
- [x] Introduces a lightweight `mise.toml` file for
[mise](https://mise.en.dev/) users. We use mise in other codebases in
the @supabase org — if you have mise installed and you open your
terminal into this codebase, mise will read the `mise.toml` file and
automatically set up the Node/pnpm versions set in the
`.nvmrc`/`package.json` files.
- [x] Cleans up a TOC in `CONTRIBUTING.md` that looked ill-formatted —
the numbered list appears on one line, which I don't believe is intended
(see
[here](https://github.com/supabase/supabase/blob/561e43b36c02cb5576e7ea3d3a11f9349ace0bcc/CONTRIBUTING.md)).
I opted to remove the TOC wholesale as opposed to fixing the formatting
since the GitHub UI has a native TOC viewer.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated contributor and developer guides to improve navigation and
clarify setup instructions.
* Removed an extra table of contents from the contributing guide.
* Refined dependency/version guidance and formatting in the development
guide.
* **Chores**
* Updated local tooling settings to better support version-file based
workflows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added pre-release pages for Supabase Pipelines’ new destinations,
including early-access signup, thank-you confirmation, and related
resources.
* Added destination options for ClickHouse, Snowflake, and DuckLake.
* **Bug Fixes**
* Improved form validation for grouped required checkboxes.
* Added clearer checkbox labels and descriptions.
* Forms now explain which required option groups still need a selection.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Ana <30495040+ana1337x@users.noreply.github.com>
## Summary
1. **Extract pure logic** out of the 1056-line `SQLEditor.tsx` monolith
into unit-tested functions in `SQLEditor.utils.ts`.
2. **Remove `rawSql()` from the SQL editor** and tighten the
untrusted→safe boundary per the `safe-sql-execution` model.
## Extracted functions (+ tests)
- `getEditorSql(editor, snippetContent?)` — selection → full value →
snippet fallback. Returns an **`UntrustedSqlFragment`** so
editor/snippet SQL keeps its provenance.
- `computeErrorHighlightLine(error, startLineNumber)` — parses the `LINE
n:` marker + selection offset.
- `assembleCompletionDiff(meta, text)` — before/selection/after assembly
for the AI completion diff.
- `buildExplainSql(sql, impersonatedRoleState)` — takes an already-safe
fragment; EXPLAIN ANALYZE + role impersonation + rollback wrapping.
- `buildDebugPromptText(sql, errorMessage)` — the assistant debug prompt
string.
## Safe-SQL boundary
- `rawSql()` is no longer used anywhere in the SQL editor.
- `executeQuery` / `executeExplainQuery` now **require a
`SafeSqlFragment`** — safe by construction, so they can never auto-run
untrusted SQL.
- `acceptUntrustedSql` promotion happens **only in the small run/explain
gesture handlers** (`executeQueryFromButton`, `handleRunShortcut`,
`handleRunExplain`, and the warning-modal confirm handlers), never
buried in the long helpers.
## Verification
- `vitest` — 156 pass (11 characterization + 145 utils, incl. new cases)
- `pnpm --filter studio typecheck` — clean for all SQL editor files (two
unrelated `@sentry/tanstackstart-react` module-resolution errors exist
on current master pre-install; not touched by this PR)
- `eslint` — 0 errors
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Enhancements**
* Improved SQL execution and EXPLAIN workflows with safer handling at
run and analysis actions.
* Enhanced SQL selection and snippet handling in the editor.
* Improved error highlighting to more accurately identify affected
lines.
* Refined completion previews and debugging prompts for clearer results.
* EXPLAIN ANALYZE now supports rollback-wrapped execution and avoids
duplicate wrapping.
* **Bug Fixes**
* Improved behavior when working with selected, empty, or missing SQL
content.
* Prevented existing EXPLAIN statements from being unnecessarily
modified.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix / polish
## What is the current behavior?
Unified logs row selection checkboxes only respond to clicks on the
checkbox itself, so it's easy to miss. Log type icons in the table also
don't match the ServiceFlow panel (16px / muted vs 14px / lighter /
strokeWidth 1.5).
## What is the new behavior?
- Expand the select checkbox tap target with `hit-area-2`, and add a
visible `hover:border-foreground-muted` affordance (matching the older
logs explorer intent; the base Checkbox hover is a no-op after the
colour-system token collapse).
- Align log type icons with ServiceFlow: 14px,
`text-foreground-lighter`, `strokeWidth={1.5}` on both the table column
and ServiceFlow section headers.
## Additional context
Older logs used an `absolute inset-0` wrapper for the same hit-area
problem; unified logs uses the design-system `hit-area` utility instead.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Refined unified log visuals with more consistent icon sizing, stroke
weight, and muted coloring.
* Improved checkbox hover styling and expanded its clickable area for
easier selection.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
UI polish
## What is the current behavior?
Unified logs row chrome is slightly misaligned (checkbox vs filter
toggle, uneven gaps around the level dot), success grey is too dark and
doesn’t match the Level key, and log-type icons read a bit heavy.
## What is the new behavior?
- Aligns the row checkbox with the filter sidebar toggle and spaces the
level dot evenly between checkbox and timestamp
- Drops the checkbox `translate-y` nudge in favour of normal middle
alignment
- Introduces `--chart-success` so the chart and Level key/dots share a
lighter grey
- Softens log-type icon colour on each row
| Before | After |
| --- | --- |
| <img width="1024" height="759" alt="1293"
src="https://github.com/user-attachments/assets/af7ab83f-8917-41cb-99f3-1c1f92df769e"
/> | <img width="1024" height="759" alt="52159"
src="https://github.com/user-attachments/assets/9b859308-2101-4a02-bdc1-75e5750f84fa"
/> |
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Improved Unified Logs table spacing and alignment, including narrower
selection and level columns.
* Refined checkbox and date-cell presentation for a cleaner layout.
* Updated log type icons to use muted foreground styling.
* **Bug Fixes**
* Success statuses and chart indicators now consistently use the
dedicated success color across light and dark themes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The Multigres log type is available in the legacy logs collections but
was missing from the new unified logs, so Multigres logs could not be
selected or viewed there.
## Fix
Wire the `multigres_logs` source into unified logs the same way the
other single-source types (Realtime, Supavisor, PgBouncer) are: a
display label, a filter condition, the derived `log_type` expression, a
display-casing entry, and a sidebar icon.
## How to test
- Open a project with Multigres logs and go to the new unified logs view
- Open the Log Type filter and confirm "Multigres" appears as an option
- Select "Multigres" and confirm rows from the `multigres_logs` source
are returned and labeled "Multigres" with the network icon
- Expected result: Multigres logs are filterable and display correctly,
matching the legacy logs behavior
## Notes
Level/severity uses the shared `severity_text` fallback that all
non-HTTP sources rely on. If Multigres rows come back always classified
as success, the OTEL pipeline may not populate `severity_text` for this
source (legacy logs read the level from a JSON `event_message`), which
would need a source-specific level branch.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for the **Multigres** log type in Unified Logs (labels,
icon, and derived filtering/grouping/counting).
* Unified Logs now renders Multigres **event_message** by extracting the
`msg` field from valid JSON, with correct capitalization.
* Unified Logs row click telemetry now recognizes **Multigres**.
* The **Multigres** log type option is hidden when the selected project
is not high-availability.
* **Tests**
* Added/updated unit tests for Multigres event-message parsing and
shared event-message display behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
## What kind of change does this PR introduce?
Bug fix / polish
## What is the current behavior?
On the add-destination sheet for read replicas, “Learn more” sits as a
stray sibling next to the cost copy.
## What is the new behavior?
Cost copy and “Learn more” are one paragraph, with the link inline and
styled like `InlineLink` (underline, pointer cursor, hover colour):
> New replica will cost an additional $16.25/month. Learn more
| Before | After |
| --- | --- |
| <img width="1258" height="120" alt="CleanShot 2026-07-10 at 12 21
21@2x"
src="https://github.com/user-attachments/assets/bb47461e-e856-4cf2-b81a-f8e9aa9ebf75"
/> | <img width="1256" height="114" alt="CleanShot 2026-07-10 at 12 23
48@2x"
src="https://github.com/user-attachments/assets/094332be-ad2e-4782-94ac-08c8775a4665"
/> |
_Note that the grey icon square is being fixed separately in
https://github.com/supabase/supabase/pull/47794._
## To test
On the staging preview, open Database → Replication → Add destination →
Read replica, and check the footer cost line in light and dark mode —
“Learn more” should sit inline, show a pointer cursor, and change colour
on hover.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* Added estimated monthly pricing to the read replica pricing dialog
trigger (“additional {cost}/month”).
* **UI Improvements**
* Moved the pricing/cost impact messaging from the form footer to the
pricing dialog area.
* Refined the “Learn more” link/button styling and layout for a cleaner
presentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Two related docs changes for debugging Supabase, consolidated into one
PR.
## 1. New "Debugging" guide (`guides/telemetry/debugging`)
A methodology and entry page for debugging any Supabase issue, added
next to Logging in the Telemetry nav. It covers:
- **The debugging loop** — read the exact error, isolate the failing
layer, gather evidence, fix, verify.
- **The Supabase request stack** — the gateway fans out to PostgREST,
GoTrue, Storage, and Realtime as parallel services (not a chain), with
Postgres underneath. Explains why an API-layer permission or
empty-result error is usually a Postgres RLS/privilege issue.
- **Reading logs** — the narrow-query discipline (one source, bounded
window, widen along an anchor), linking the Logs Explorer guide rather
than duplicating query syntax.
- **Symptom to guide routing table** — maps each symptom to its layer
and the specific troubleshooting guide, acting as a front door to the
troubleshooting collection. All 47 links verified live.
This puts the debugging methodology in docs (owned and updatable)
instead of only in the agent skill.
## 2. Log-query best practices (`guides/telemetry/logs`)
Adds the three practices the existing Best practices list was missing,
all engine-agnostic: query one source at a time, follow a request across
sources with an anchor, and reference only confirmed field names.
## Follow-up (not in this PR)
The Logs Explorer now defaults to **ClickHouse** (single `logs` table,
`log_attributes` map), but `guides/telemetry/logs.mdx` and the two logs
troubleshooting guides still document the legacy **BigQuery** dialect
(`cross join unnest(metadata)`). They need a coordinated BigQuery to
ClickHouse migration pass:
- `guides/telemetry/logs.mdx`
-
`troubleshooting/how-to-interpret-and-explore-the-postgres-logs-OuCIOj.mdx`
-
`troubleshooting/discovering-and-interpreting-api-errors-in-the-logs-7xREI9.mdx`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a new “Debugging” guide with a step-by-step workflow for
identifying where issues originate versus where they appear.
* Added a symptom-to-layer troubleshooting mapping and linked it from
Telemetry navigation.
* **Documentation**
* Updated Logs Explorer guidance to note its ClickHouse default and that
examples use legacy BigQuery syntax.
* Expanded Logs Explorer best practices, including querying one source
at a time, correlating with anchors, and using only confirmed field
names.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Jeremias Menichelli <jmenichelli@gmail.com>
## Summary
Add some tests for the SQL editor so I can refactor it without
regressions. Tests are not best practice because they are intended to be
temporary and improving them would require refactoring first (currently
they are over-mocking and asserting on internal details).
Stacked on top of #47792 (`charislam/sql-editor-top-bar-controls`).
## What this adds
`apps/studio/tests/components/SQLEditor/SQLEditor.test.tsx` (11 tests):
- Run success → `addResult` + Results tab; EXPLAIN-shaped result
auto-switches to the explain tab; a non-EXPLAIN run switches back.
- Run error with `position` → error-highlight line math +
`deltaDecorations` + `revealLineInCenter`; the next run clears the
highlight.
- Run button refocuses the editor; disabled + short-circuits while a
diff is open.
- Diff request queued before mount drains exactly once (one-shot; no
re-apply on remount).
- Ask-AI widget renders only while the prompt is open (render-time
`editorRef.current` read).
- Destructive query → warning modal → confirm forces the re-run;
confirm-with-RLS appends enable-RLS statements.
## Test approach
Real Monaco / DiffEditor are replaced with lightweight fakes exposing a
controllable editor; child panels + orthogonal context hooks are
stubbed; the execute mutation runs for real against an MSW-mocked
`/platform/pg-meta/:ref/query`. Tests assert on public behavior so they
survive the internal refactor unchanged.
## Verification
- `pnpm --filter studio exec vitest run
tests/components/SQLEditor/SQLEditor.test.tsx` — 11/11 pass (stable
across repeated runs)
- `pnpm --filter studio typecheck` — clean
- `eslint` — 0 errors
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added comprehensive coverage for SQL editor behavior, including query
execution, result and explain views, error highlighting, editor focus,
and diff mode.
* Added validation for destructive-query confirmations, including RLS
confirmation flows.
* Added coverage for queued diff requests and conditional AI prompt
display.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Original intention was to fix the PITR UI for smaller viewports, but
realised that the layout of the UI could be improved as well. (Tbh this
UI could do with a bit of revisiting, but just making patches for now to
improve what's existing)
Fixes also apply to the restore to new project page since they share the
same component
## Changes involved
- Am opting to change the layout of the UI a little such that date
selection is on the left, and time selection is up top
- Fits the user flow a bit better - you select the parameters you want,
and the final message at the bottom is the summary
<img width="1033" height="525" alt="image"
src="https://github.com/user-attachments/assets/614c0327-f5db-4e1f-a2a1-ae8a9ea89978"
/>
- In the confirmation dialog, we were originally showing the top label
as "Local time" which I feel is inaccurate especially if the user has
selected a different timezone from where they're located at.
- Opting to display the full name of the selected timezone instead
<img width="546" height="261" alt="image"
src="https://github.com/user-attachments/assets/cd8838a1-8476-4492-bc86-cac229685e5a"
/>
- RE mobile layout - am currently just opting to have them in a column
fashion although I feel like this isn't ideal either (requires
revisiting of the UI as a whole to adjust the layout on desktop too)
- e.g the Date picker here could be a popover like Unified Logs to
streamline what is essentially a form
<img width="507" height="831" alt="image"
src="https://github.com/user-attachments/assets/c8e055bd-49c3-4d0a-9d8c-e54f53e9fcb4"
/>
- Also fixed the CTA URL for read replicas, was still pointing to
/settings/infrastructure, should point to database/replication
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Point-in-time recovery now includes the selected timezone throughout
the restore workflow.
* Restore confirmations display the chosen timezone and a clear summary
of the target recovery date and time.
* Recovery details now show the earliest and latest available backups
for the selected date, including the two-minute matching window.
* **Bug Fixes**
* Updated the read-replica management link to direct users to database
replication settings.
* **Style**
* Improved restore form layout, calendar presentation, and timezone
selector alignment.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Refactor / UI improvement
## What is the current behavior?
SQL editor controls are split across two rows: a bar between the editor
and results (tabs, download,
run/save/format/db-selector/role/favorite/intellisense) and a separate
footer at the very bottom (row count + limit dropdown).
## What is the new behavior?
All controls are consolidated into a single top bar above the editor (⋮
overflow menu, database selector, role impersonation, limit, save, run).
The bar between the editor and results now holds only result-relevant
information: the Results/Explain/Chart tabs, the row-count summary, and
the Export button. The limit dropdown is now always visible as a
persistent query setting.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
- docs update
Scheduled follow-up to #47252 / DOCS-1080.
## What is the current behavior?
- Docs include a temporary note admonition on five pages: "This default
takes effect for new projects from July 9, 2026." (#47252)
- The `do-not-merge` label blocks CI until this PR is ready to merge.
## What is the new behavior?
- Removes the temporary effective-date admonition partial and all
`$Partial` includes.
- Default-behavior copy from #47199 remains unchanged.
## Additional context
**Do not merge before July 9, 2026.**
### Merge instructions (July 9)
1. Rebase this branch onto `master` after #47252 has merged (should
remain a clean removal-only diff)
2. Remove the `do-not-merge` label
3. Confirm CI is green and merge
Review screenshots live in `.github/pr-screenshots/docs-1080/` on this
branch for PR proof only.
### Test plan
- [ ] After rebase, confirm the five pages no longer show the
effective-date admonition
- [ ] Confirm default-behavior copy from #47199 remains unchanged
- [ ] Remove `do-not-merge` label and merge on July 9, 2026
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Cleaned up several security, compliance, telemetry, and PostgreSQL
logging docs by removing a repeated note about when default connection
logging behavior takes effect.
* Streamlined the affected pages so the guidance now flows more directly
without the extra embedded note.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Nik Richers <nik@validmind.ai>
Adds 21 MSW component tests covering the project creation wizard's
permutations (plan/region/compute/OrioleDB/security
options/GitHub/blocking states/errors). Closes FE-3883; surfaced a real
empty-region submit bug tracked in FE-3884.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added a comprehensive UI/request test suite for the Studio
project-creation wizard.
* Validates paid vs. free plan behavior (including compute sizing rules)
and that region selection submits the correct payload, including the
“Recommended” option.
* Covers blocking and warning states (project limits, overdue invoices
with billing CTA, and feature-flagged disabled creation), plus error
handling when regions fail to load.
* Exercises confirmation modals, database/security option flows,
client-side validation, GitHub gating/repo selection, and toast errors
on API failures.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
blog update
## What is the current behavior?
No embedded link for Server Package video
## What is the new behavior?
Embedded link for Server Package video
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added an embedded video to the “Introducing Supabase Server” blog
post.
* The video uses privacy-focused playback settings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Fixes the Lovable logo in case studies and elsewhere to be the latest
one.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the customer RSS feed’s publication metadata to reflect the
latest content date.
* Refreshed the Lovable customer entry’s publication date and removed
the outdated duplicate entry.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add a `server` entry to the reference-markdown pipeline so it emits
`public/markdown/reference/server.md`, and register the Supabase Server
Library Reference as a source in the www `llms.txt` and `llms-full.txt`
routes.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a new Supabase Server Library Reference covering server-side SDK
usage.
* Included the server reference in generated documentation and plaintext
documentation indexes.
* Made server SDK reference content available through the full
documentation feed.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What
Fixes misaligned day cells in the PITR calendar widget for the first
week of the month.
## Why
The PITR calendar draws a \`border\` on each day cell via
\`classNames.day\`. The day \`<td>\` has no explicit width, so
\`box-sizing: border-box\` doesn't apply and the 1px borders add to its
size (36px → 38px), while the weekday header cells stay pinned at
\`w-9\` (36px). Bordered day cells therefore drift right of their
headers, which is most visible in the first partial week where
unbordered leading cells sit flush next to the wider bordered ones.
## How
Pin each day cell to a fixed \`w-9 box-border\` so the border is drawn
inside the 36px box, and let the day button fill the cell (\`w-full\`).
Column pitch now matches the weekday headers regardless of border state.
Class-only change, no logic touched.
Closes FE-3886
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Improved calendar day cell sizing and layout for more consistent
rendering.
* Ensured day buttons use full-width styling where applicable, while
preserving existing hover, border, background, and corner behavior.
* **Documentation**
* Added documentation for “Calendar with disabled days,” including a new
interactive preview.
* **New Features**
* Introduced a calendar example demonstrating disabled-day behavior with
mid-week month start and restricted date selection.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
Bring the Vercel project connect layout up to date with other connect
screens. Follows up from https://github.com/supabase/supabase/pull/47550
which is required.
| Before | After |
| --- | --- |
| <img width="2368" height="1680" alt="image"
src="https://github.com/user-attachments/assets/f5c0b8ef-8fb5-4176-b0cf-98e33958dcc8"
/> | <img width="848" height="808" alt="image"
src="https://github.com/user-attachments/assets/e64c289f-0b73-4605-ad38-4552d3d6f934"
/> |
<img width="883" height="733" alt="image"
src="https://github.com/user-attachments/assets/7ccd9b72-de6a-4c21-ac8e-abe773bb8116"
/>
## Testing
- Open the deploy preview or staging URL for
`/dashboard/integrations/vercel/acme-production/marketplace/choose-project`
with callback params from a real Vercel Marketplace install redirect
(see _Vercel_ subheading below).
### Vercel
- Run through the [install
flow](https://github.com/supabase/supabase/pull/47550) on a real project
until you get to the project connection screen, copy the url and paste
into staging preview
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* Introduced interstitial-style Vercel integration experiences for both
install and choose-project flows, with improved page titles and clearer
environment-variable guidance (including tooltip details).
* **Bug Fixes**
* Improved Vercel integration matching by configuration id and
strengthened loading/error handling with more specific “not found”
messaging.
* **Refactor**
* Enhanced the Vercel/GitHub project chooser with a dedicated
interstitial mode.
* Updated partner logo rendering to support optional styling
customization.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
Co-authored-by: Alaister Young <alaister@users.noreply.github.com>
**Stack 6/6 (final)** of the TanStack Start migration (#46424). The
middle slices (#47107 → #47118) have all merged, so this now sits
directly on master.
## What's in this PR
One file: `.github/workflows/studio-e2e-test.yml` — adds `framework:
[next, tanstack]` to the test/report matrices and sets
`STUDIO_FRAMEWORK` (consumed by `scripts/dispatch.js`). Until now CI
only built/tested Next. This flips on the dual-framework E2E matrix so
the TanStack build gets exercised end-to-end on every run.
## ⚠️ Depends on #47657 (merge that first)
The `tanstack` shard needs the Monaco loader fix in **#47657** to be on
master. Quick version: master's #47182 re-nested the Monaco assets under
`public/monaco-editor/vs/` and the TanStack root was still pointing at
the old flat path, so Monaco didn't mount anywhere in the TanStack build
and every editor-backed test timed out (RLS, cron SQL, realtime JSON, db
functions, GraphiQL). Kept that fix on its own branch rather than piling
it onto this one.
Merge order:
1. #47657 → master
2. re-merge master into here (I'll cascade it)
3. `tanstack` shard goes green → merge this
## ⚠️ Branch-protection note
This renames the E2E jobs (`E2E tests` → `E2E tests (next|tanstack,
shard)`), so master's current required status checks (`E2E tests (1, 2)`
/ `(2, 2)`) stop being reported. The required-check list in branch
protection needs updating to the new names when this merges.
## Verification
Config-only, no app code. The real validation is this matrix running
both shards green once #47657 lands — the `next` shards already pass
here; the `tanstack` shards pass once the Monaco fix is on master.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Integration overview markdown can now be loaded more reliably from a
synchronized on-disk registry (raw markdown support).
* **Bug Fixes**
* Navigation, redirects, and prefetch now preserve query strings and
hash fragments more consistently using Next-like semantics (including
repeated keys, empty clearing, and lossless encoding like newlines).
* Improved internal-link/router compatibility for Next-style `?`/`#`
targets and base-path handling.
* Edge Functions diff tab matching works correctly in the browser
without Node-specific path utilities.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
## Summary
Since #47293, an API failure on a signup / org-creation /
project-creation form emitted `dashboard_error_created` twice:
`useTrackFunnelError` fired the origin-tagged event and the global
`ToastErrorTracker` independently fired the legacy untagged
`source:'toast'` event for the same toast, each behind its own 10%
sampling draw. I verified the twin rate empirically at 8-11% of
origin-tagged funnel toasts, exactly the floor for two independent 10%
draws, meaning the twin co-fires for effectively every funnel error
([Hex
thread](https://app.hex.tech/supabase/thread/019f3bc1-3a5c-7200-9122-8e3439bfbe8c)).
Any consumer counting funnel errors without an `origin IS NOT NULL`
filter saw ~2x inflation.
The fix makes `ToastErrorTracker` the sole emitter of `source:'toast'`
events, so the duplicate is unrepresentable rather than suppressed.
Funnel call sites pass the id returned by `toast.error()` into
`trackFunnelError`, which registers the funnel properties against that
toast id instead of firing its own event – the tracker then emits a
single `dashboard_error_created` enriched with `origin` /
`errorCategory` / `errorReason` / `errorCode` for registered toasts, and
the plain untagged event otherwise. The `'toast'` overload of
`trackFunnelError` requires the toast id, so a missed pairing is a
compile error rather than a silent double count. Registration is
unconditional and there's only one sampling draw, so suppression can't
lose a sampling race. `'form'`-sourced funnel events are unchanged.
## Changes
- `lib/toast-errors.tsx`: toast-id → funnel-properties registry
(`registerFunnelErrorToast`); `ToastErrorTracker` emits one (optionally
enriched) event per error toast under a single 10% draw, deleting
entries once consumed
- `lib/telemetry/use-track-funnel-error.ts`: overloaded signature –
`'toast'` requires the id returned by `toast.error()` (type-enforced),
`'form'` keeps direct emission with its own sampling
- Update the 7 funnel `toast.error` call sites in `NewOrgForm`,
`SignUpForm`, and `pages/new/[slug]` to pass the toast id
- Component tests for the tracker (previously uncovered), including an
end-to-end test through `useTrackFunnelError`
- Code hygiene (also flagged by CodeRabbit): all four
`dashboard_error_created` emitters (toast, form, `AlertError`,
`ErrorMatcher`) independently encoded the 10% draw – downstream analysis
assumes a uniform sampling multiplier across sources, so one site
drifting would silently skew comparisons. The rate and the draw now live
in one place (`isDashboardErrorSampled()` in
`lib/telemetry/error-sampling.ts`). No behavior change.
- Mount `ToastErrorTracker` in the TanStack root (`routes/__root.tsx`),
mirroring `pages/_app.tsx`. The TanStack tree mounted `Toaster` but
never the tracker, so untagged toast error telemetry has never fired in
that flavour – and with the tracker now the sole emitter, the missing
mount would have silently dropped funnel toast events there too. Side
effect once the TanStack flavour ships: untagged `source:'toast'` volume
from it goes from zero to normal.
## Testing
Component-tested (`apps/studio/lib/toast-errors.test.tsx`):
- [x] Unregistered error toast fires exactly one untagged
`dashboard_error_created {source:'toast'}`
- [x] Registered funnel toast fires exactly one event, enriched with
`origin`/`errorCategory`/`errorReason`/`errorCode`
- [x] `useTrackFunnelError` with a toast id routes through the tracker
as a single enriched event
- [x] Non-error toasts ignored; the 10% sampling gate still applies
Full Studio unit suite passes (392 files / 4371 tests), plus typecheck
and lint.
Also verified end-to-end in a local browser (TanStack flavour, sample
rate temporarily forced to 1): a failed signup produced exactly one
`dashboard_error_created` with `{source:'toast', origin:'signup',
errorCategory:'api', errorReason:'email_already_registered',
errorCode:403}` and no untagged twin (two independent trials); an
unregistered error toast produced exactly one plain `{source:'toast'}`;
a client-side validation failure produced exactly one `{source:'form',
origin:'signup', errorCategory:'validation',
errorReason:'email_invalid'}`; success toasts produced nothing.
Post-deploy I'll re-run the twin-rate query from the Hex thread; the
untagged-twin rate on funnel pages should decay to ~0 as stale bundles
reload over 2-3 days.
## Notes
- Origin-tagged funnel toast events now ride the tracker's single 10%
draw instead of their own independent draw – statistically identical
volume, but the event fires on the tracker's next effect rather than
synchronously at the call site (irrelevant for PostHog)
- Registration must happen in the same synchronous block as
`toast.error()` (documented on the `TrackFunnelError` type) – all
current call sites comply
- The invalid Postgres version toast in `pages/new/[slug].tsx` (~line
416) needs no special-casing: unregistered toasts keep the plain
untagged event, so its telemetry is preserved
- Heads-up for `dashboard_error_created` consumers: overall untagged
`source:'toast'` volume will dip slightly after this deploys, since
funnel-page twins disappear. A volume monitor seeing that drop is this
fix landing, not a tracking regression (same class as the intended
GROWTH-893 sampling-unification drop).
## Linear
- fixes GROWTH-965
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Enhanced error telemetry for organization creation, sign-up, payment,
and project-creation flows by associating failures with toast
identifiers and enriched funnel context.
* Standardized dashboard error sampling logic across error handling
components for consistency.
* **Tests**
* Added comprehensive test coverage for toast error tracking, including
funnel registration, deduplication, filtering, and sampling behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix (accessibility improvement)
## What is the current behavior?
Icon-only button (not visible on widescreen displays) does not have
explicit accessible name for screen readers and tooltip.
## What is the new behavior?
The icon-only button now has explicit accessible name using visually
hidden text (sr-only), ensuring proper screen reader support.
## Additional context
Tooltip text is added for visual users.
No visual changes were introduced
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **UI Improvements**
* Added a tooltip to the SQL editor’s “More actions” dropdown button,
improving discoverability.
* The tooltip now shows “More actions” when hovering over the trigger.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com>
Stacked on #47666 (base `alaister/tanstack-sentry-init`; retarget to
`master` when that merges). **Supersedes #47721** (the manual
`@sentry/node` wrapper). Client stays on #47666's `@sentry/react` setup.
Adopts the official `@sentry/tanstackstart-react` SDK **on the server
only**, after a spike (#47723) evaluating the full unified client+server
SDK. The spike found the SDK's **browser**
`tanstackRouterBrowserTracingIntegration` is a broken no-op stub at
10.59.0/10.64.0 — so the client stays on `@sentry/react` (whose
equivalent integration is a real, working implementation, already
shipped in #47666). The **server** exports, however, are a clear upgrade
and slot in cleanly.
### What this adds (server-side, TanStack build only)
- **`instrument.server.mjs`** — `Sentry.init` from
`@sentry/tanstackstart-react`, mirroring `sentry.server.config.ts` +
`release: VERCEL_GIT_COMMIT_SHA`.
- **`start.ts`** — `sentryGlobalRequestMiddleware` +
`sentryGlobalFunctionMiddleware` at the front of the existing
`createStart(...)` middleware. **This is the win**: it captures request-
and server-function errors *including the ones swallowed into 500s* —
the exact class the manual wrapper (and the Next server SDK) miss.
- **`api/server.js` / `scripts/serve.js`** — gated
(`STUDIO_FRAMEWORK==='tanstack'`) instrument init +
`wrapFetchWithSentry` on the handler.
- **`vite.config.ts`** — `sentryTanstackStart({ …,
autoInstrumentMiddleware: false })` as the last plugin: source-map
upload + release injection (skips gracefully without an auth token).
Middleware is wired explicitly rather than via the plugin's
string-rewrite.
### Guarantees
- **Client untouched** — the `@sentry/nextjs`→`@sentry/react` alias and
#47666's client init are unchanged.
- **Next untouched** — `instrumentation.ts` / `sentry.server.config.ts`
etc. stay as-is; all new code is TanStack-gated.
- **No server SDK in the client bundle** — verified after build: no
`@sentry/node` / server middleware / `wrapFetchWithSentry` in
`dist/client/assets` (`start.ts`'s server import is tree-shaken out).
### Verified
TanStack build exit 0 (past `assertNoChunkCycles`), post-build server
boot served `/api/get-utc-time → 200`, `tsc --noEmit` clean,
prettier/eslint clean. Node smoke: no-DSN init is a clean no-op; wrapped
handler returns 200.
### To test (deploy with a server DSN)
Throw a server error from an `/api/*` route (or a `/_serverFn/*`) —
including one that gets turned into a 500 without rethrowing — and
confirm a server event in Sentry with `release` = the deploy SHA.
Compared to #47721, the swallowed-500 case should now be captured via
the middleware.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Sentry integration for the Studio app’s TanStack Start runtime,
including request and server-function instrumentation.
* Wrapped server request handling to capture errors reliably, with
tracing enabled.
* Updated build tooling to conditionally upload source maps when
credentials are present.
* **Bug Fixes**
* Improved resilience by safely falling back to a no-op Sentry setup if
instrumentation cannot be loaded.
* Ensured existing request protection remains enabled while adding
observability middleware.
* **Chores / Config**
* Added `SKIP_ASSET_UPLOAD` to the build environment list to control
cache/build behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## Context
As per PR title - also adjusts the imports for files consuming
`apiWrapper` to remove the default export for `apiWrapper`
Have tested locally by throwing an error in one of the API routes -
verified that the event shows up on Sentry
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* API errors are now captured in Sentry before returning server error
responses, improving production visibility while keeping endpoint
behavior the same.
* **Tests**
* Added coverage to confirm rejected handler executions are reported to
Sentry and return the expected HTTP 500 JSON payload.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
PR here mainly breaks up the files under `ConnectSheet` to separate the
functional logic so that we can write unit tests.
No behavior changes intended beyond the bug fixes
## Changes involved
- **Test organization:** moved all root-level `ConnectSheet` test files
into `ConnectSheet/__tests__/` for consistency with other parts of the
codebase that use this convention.
- **Bug fix:** read replica label had a stray `}` / missing `)`,
rendering as e.g. `Read Replica (us-east-1 - abc123})` instead of `Read
Replica (us-east-1 - abc123)`.
- **`ConnectSheet.tsx`:** extracted the "hydrate sheet state on open"
`useEffect` logic (mode/field/URL param resolution from URL vs.
localStorage) into a new `ConnectSheet.utils.ts`, with unit tests
- **`useConnectServerEnv.ts`:** fixed two race conditions in the secret
reveal/hide flow:
- `toggle()` and `getValue()` could each fire a separate reveal request
if triggered close together — now deduped to share one in-flight
request.
- `getValue()` could hide a secret that had just been explicitly
revealed by a concurrent `toggle()`, due to reading a stale closure
value — now reads the live state via `useLatest`.
- Also stopped swallowing the original error on reveal failure (now
attached via `cause`).
- Added tests for the above, plus the 10s auto-hide timer (previously
untested).
- **`ConnectStepsSection.tsx`:** extracted `resolveContentPath` and the
three inline "show notice" booleans (IPv4 addon, session pooler,
self-hosted MCP) into `ConnectStepsSection.utils.ts`, matching the
existing pattern for the Data API notice. Added unit tests for all of
them.
## To test
- [ ] Just a basic smoke test of the Connect sheet should do
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Improved connect setup hydration so saved preferences and URL values
are applied more consistently when opening the sheet, including
automatic URL backfilling where needed.
* Refreshed connection guidance notices (IPv4 add-on, session pooler,
and self-hosted MCP) with more consistent logic.
* **Bug Fixes**
* Fixed secret reveal behavior to keep concurrent reveal actions in
sync, handle failures more safely, and ensure auto-hide works reliably.
* Corrected the read-replica option label formatting.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
The `ChatGPT-User` live-fetch agent's user-facing reader hard-fails
(`(400) OK`) on pages we serve it as markdown via user-agent matching,
which made supabase.com blog and product pages unreadable in that
assistant. I root-caused this with a controlled fetch diagnostic
cross-checked against our request logs: the failing fetches never reach
our origin (the failure is cached on their side), pages served as plain
HTML read fine everywhere we tested, and the same failure reproduces on
other major sites that serve UA-matched markdown, so the reader bug is
upstream.
This PR removes user-agent-based markdown serving entirely rather than
special-casing one agent: UA sniffing is a guess about contractless
clients whose fetchers change without notice, and this incident showed
the failure mode is silent (we keep serving 200s while the user-facing
agent breaks). Markdown remains available on every explicit signal —
`Accept: text/markdown` q-value negotiation, explicit `.md` URLs, and
llms.txt — which is the same contract-driven model the Claude fetcher
already uses successfully (it sends `Accept: text/markdown, text/html,
*/*` and keeps receiving markdown after this change).
## Changes
- Remove the `LLM_USER_AGENT` regex and the `userAgent` parameter from
`negotiateMarkdown` in `packages/common/markdown-negotiation.ts`;
decisions now depend only on `Accept`, the `.md` suffix, and the
markdown-variant manifest
- Update both consuming middlewares (`apps/www`, `apps/docs`) to the new
signature; no behavior change for Accept-negotiated or `.md` requests
- Add the missing `Vary: Accept` header to docs guides-md 200 responses
(the www `api-v2/md` route already declares it)
- Fix a pre-existing www bug surfaced in review: explicit changelog
`.md` URLs rewrote to a doubled `.md.md` path (404) under a
markdown-preferring `Accept`, and 406'd on a non-matching `Accept`. The
www middleware now strips the `.md` suffix before slug lookup and passes
`isMarkdownSuffix` into `negotiateMarkdown`, folding the separate
`MD_PAGES` `.md` block into the single negotiation path (same shape as
the docs middleware)
- Rework tests: UA-independence suites replace the per-agent rewrite
tests; a probe Accept header now 406s regardless of user agent
(previously agent UAs were exempt); new changelog `.md` negotiation
coverage
## Testing
Tested locally:
- [x] www middleware suite 36/36, docs middleware suite 17/17
- [x] typecheck green for common, www, docs
Verified on the Vercel previews (www + docs) with curl:
- [x] `ChatGPT-User` and `Claude-User` UA GETs on blog/pricing/guide
pages return `text/html` with a default Accept
- [x] Claude's real Accept (`text/markdown, text/html, */*`) still
returns `text/markdown`; `Accept: text/markdown` and `.md` URLs return
`text/markdown`; probe Accept returns 406
- [x] `/changelog/<slug>.md` with `Accept: text/markdown` returns the
entry markdown as a direct 200 (production today detours through a 308
to the bare URL); changelog index `.md` and bare-entry Accept
negotiation also verified
- [x] docs guides markdown 200s carry `Vary: Accept`
The intermediate commit (ChatGPT-User-only exclusion) was already
verified on the preview: `ChatGPT-User` got HTML while
`Accept`/`.md`/other-UA markdown was unaffected.
Expected effects post-merge: UA-driven markdown volume in the request
logs (~92% of md traffic) collapses to the Accept + `.md` baseline;
named-agent page requests return to prerendered/static serving,
reversing the extra Vercel function invocations the UA rewrite
introduced; user-facing readability in the affected assistant recovers
within ~24h as its fetch cache revalidates. The md-share dashboard gets
a dated annotation; the ratio is not comparable across this change.
## Linear
- fixes GROWTH-973
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Markdown and HTML routing now depends on the request’s `Accept` header
and `.md` links, making content negotiation more predictable.
* Requests that don’t accept available content now consistently return
`406 Not Acceptable`, even for bot-like user agents.
* Guide markdown responses now include an `Accept`-based cache variation
header to improve correct caching behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Before**
<img width="340" height="104" alt="image"
src="https://github.com/user-attachments/assets/48a434de-21c2-4e3f-8cad-3c6408f7348d"
/>
**After**
<img width="508" height="317" alt="image"
src="https://github.com/user-attachments/assets/e52c6ba6-c173-4bb8-a466-1697585286c7"
/>
Fixes
- Rendering issue of the menu toggle on mobile when menu is open
- You can now switch between panels when open (e.g. from help to
advisor). There was previously a bug that would just close the drawer
rather than switch.
**To test**
- Reduce screen size in a project view
- Click top right menu item
- Notice menu item is active in light mode
- Click "Assistant" and notice it switches vs closes the drawer
- Click close or outside the toolbar to close the drawer
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved the mobile menu button’s visual state by updating the menu
icon color when the menu is open.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
There's a chance users may run into tax ID issues when upgrading a plan
as such:
<img width="412" height="120" alt="image"
src="https://github.com/user-attachments/assets/4c559ae0-d942-4c10-b83a-c5944a2a49ee"
/>
Adding a CTA here to guide users and mitigate confusion on how to
proceed to remediate
<img width="399" height="147" alt="image"
src="https://github.com/user-attachments/assets/3bcaca14-bd77-4168-b9ab-cd6b75f79e24"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved billing-profile validation feedback by standardizing error
messaging for tax ID vs. billing address country mismatches.
* Added an in-toast “Update tax ID” action to guide users directly to
the fix.
* Updated the billing dialog’s close behavior so it returns users to the
relevant address section (including scrolling to it automatically).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Add UTM params to CipherStash blog post links
Follow-up to #47751. The [Notion
doc](https://app.notion.com/p/supabase/Blog-Post-CipherStash-partner-drop-3455004b775f81c68712f6a115ee43f8)
now has UTM-tagged outbound links for launch tracking. This applies them
to the three links in the published post.
All three use
`?utm_source=supabase_announcement_post&utm_medium=blog&utm_campaign=launch`:
- Intro: CipherStash integration link
- Intro: cipherstash.com link
- Get started: Add CipherStash to your Supabase project
No content or copy changes.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated CipherStash and Supabase links in the blog post with campaign
tracking parameters.
* Applied tracking to introductory links and the “Get started”
call-to-action.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Adds 8 new investor logos: Accel, Craft, Figma, Georgian, GIC, Peak
XV, Salesforce Ventures, Stripe
- Reorders lead investor grid to match design mockup (3 rows of 4)
- Adds per-logo `scale` field to control logo size within each cell
- Adds `grayscaleOnly` field for Salesforce Ventures to preserve tonal
contrast (prevents wordmark from being hidden by `contrast-0` filter)
## Test plan
- [ ] Visit /company and verify all 12 investor logos render correctly
across 3 rows
- [ ] Check logo sizing and order matches the mockup
- [ ] Verify Salesforce Ventures wordmark is visible inside the cloud
shape
- [ ] Check dark mode
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Expanded and reordered the “Our investors” lead cards with additional
entries (including Stripe, Salesforce Ventures, and others).
* Enhanced logo presentation options for lead cards with per-investor
sizing/positioning controls.
* **Bug Fixes**
* Improved lead investor card image rendering by removing internal
scrolling and using an overflow-hidden container with scale-based
sizing.
* Preserved the existing logo filter behavior (opacity-only when
configured, grayscale-only when selected, otherwise the default contrast
treatment).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com>
## Problem
The new project form has accessibility issues:
- labels are not linked to inputs
- description are not linked to inputs
## How to test
Navigate through the form inputs with voice over and make sure every
input makes sense
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved form field identification consistency across project creation
screens (compute size, database password, project name, PostgreSQL
version, region, and organization).
* Enhanced selector/input accessibility by adding explicit element
identifiers to key controls.
* Updated region and repository UI structure to improve reliable
rendering without changing setup behavior.
* Preserved existing password, version, and routing logic while making
dropdowns and fields easier to locate and interact with.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
FUP to https://github.com/supabase/supabase/pull/47709
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the Next.js Sentry setup guide with clearer wording and a
step-by-step configuration flow.
* Added explicit instructions for instrumenting Supabase clients in
server, browser, and middleware contexts.
* Included guidance for enabling query and mutation data capture so
Supabase activity appears in monitoring as database spans.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Gildas Garcia