## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Chore / dependency tooling update.
## What is the current behavior?
The repo is pinned to pnpm 10.24.0. Closes
https://linear.app/supabase/issue/FE-3673/migrate-the-repo-to-use-pnpm-v11.
## What is the new behavior?
The repo is pinned to pnpm 11.13.1, pnpm v11 workspace settings are
migrated to `allowBuilds`, and the Studio Dockerfile installs pnpm
11.13.1.
## Additional context
Validated with `CI=true mise exec node@22 -- pnpm install
--frozen-lockfile`, `mise exec node@22 -- pnpm run typecheck`, and `mise
exec node@22 -- pnpm run lint`; full Prettier check still fails on
existing generated docs/router files outside this migration.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated tooling requirements (pnpm **11.13.1**, Node **>=22.13**) and
aligned container build tooling accordingly.
* Adjusted package manager behavior (scoped registry override, update
notifications disabled) and workspace build/engine validation settings.
* **Maintenance**
* Updated `clean` scripts across apps/packages to remove only
build/cache artifacts (no longer delete installed dependencies).
* Reduced Turbo `clean` task output to **errors-only** for cleaner logs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
With `STUDIO_FRAMEWORK=tanstack`, `pnpm dev:studio-local` ran Studio in
platform mode against the management API instead of the local CLI stack
(`/` redirected to `/org` instead of `/project/default`). Vite selects
env files by *mode* while the Next dev server selects them via
`NODE_ENV=test`, so the tanstack dev server never loaded `.env.test` and
the developer's `.env.local` (`NEXT_PUBLIC_IS_PLATFORM="true"`) won. The
shell `NODE_ENV=test` also gets inlined into the dev client bundle by
Vite, flipping `API_URL` to the vitest-only MSW host.
`vite dev --mode test` isn't a viable fix: TanStack Start's dev-server
plugin treats mode `test` as "running under vitest" and skips installing
its SSR middleware, so every route 404s. Instead, dev keeps mode
`development` and overlays the env cascade named by `MODE` on top.
**Changed:**
- `dev:studio-local` now also sets `MODE=test` (the same knob
`build:tanstack` / `e2e:setup:selfhosted` already use)
- `vite.config.ts` dev server: loads the `MODE`-named env cascade for
the `NEXT_PUBLIC_*` client defines and seeds it into `process.env` for
SSR, without clobbering shell-provided values (matching `serve.js`
semantics, and safe against TanStack's own load-env plugin since
`loadEnv` gives existing `process.env` priority)
- `vite.config.ts` dev server: remaps a shell `NODE_ENV=test` to
`development` so it can't be baked into the client bundle (mirrors `next
dev` behavior)
Platform-mode `pnpm dev:studio` sets no `MODE`, so the overlay is a
no-op there. Build (`--mode test`), `serve.js`, and vitest (separate
`vitest.config`) paths are unchanged.
## To test
- `supabase` CLI installed, then: `STUDIO_FRAMEWORK=tanstack pnpm
dev:studio-local`
- Visit http://localhost:8082 — it should redirect to `/project/default`
(not `/org`) and the Default Project page should load with data from the
local stack (network requests go to `localhost:8082/api/platform/...`,
no `api.supabase.(com|green)` calls)
- `pnpm dev:studio` (platform mode, tanstack) still behaves as before —
redirects to `/org`
- Next path regression check: plain `pnpm dev:studio-local` (no
`STUDIO_FRAMEWORK`) still works
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved local Studio development and test-mode environment handling.
* Prevented test settings from being incorrectly embedded in the client
application.
* Ensured environment values are loaded consistently across development
and test scenarios.
* **Chores**
* Updated the local Studio development command to explicitly use test
mode.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Upgrades the monorepo to TypeScript 7.0.2, released 2026-07-08. `tsc` is
now the native Go compiler
([announcement](https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/))
— full turbo typecheck drops from ~56s to ~19s locally.
TS 7.0 ships **without a programmatic API** (it lands in 7.1), so this
uses Microsoft's recommended side-by-side setup: the `typescript` name
resolves to `@typescript/typescript6` (the 6.0 API republished) for API
consumers — typescript-eslint and Next.js build typechecking — while
`@typescript/native` (the real `typescript@7.0.2`) owns the `tsc` bin
that typecheck scripts run. Exactly one version of each is in the
lockfile; nothing imports the native package as a library. When 7.1 +
tool support lands we can collapse back to a single `typescript` dep in
the catalog.
**Changed:**
- `pnpm-workspace.yaml`: catalog aliases for `typescript` /
`@typescript/native`
- 17 package.json files: `@typescript/native` added beside each
`typescript` dep so every package's `tsc` is the native binary
- `apps/studio/tsconfig.json`: exclude `dist/` (gitignored build output)
from typechecking
**Fixed** (real type errors TS 6 under-reported):
- `packages/ui-patterns` CodeBlock: `borderLeft: null` → `undefined`
(`CSSProperties` doesn't accept null)
- `apps/www` CodeBlock: removed a JSX `@ts-ignore` comment that tsgo
doesn't honor and fixed what it masked (untyped `.js` theme objects,
possibly-undefined highlighter children)
⚠️ **Merge timing:** the new packages are inside pnpm's 3-day
`minimumReleaseAge` window until ~July 11. Installs from the committed
lockfile are unaffected (resolution is skipped), but anything that
forces a re-resolution before then will fail — hold off merging until
the window passes.
Note for editors: the compat package has no `lib/tsserver.js`, so VS
Code's "Use Workspace Version" won't work — use the bundled TS or the
TypeScript Native Preview extension.
## To test
- `pnpm install && pnpm typecheck` — all 15 tasks green, and
`./node_modules/.bin/tsc --version` prints 7.0.2
- `pnpm lint --filter=studio` — typescript-eslint still parses (resolves
the 6.0 API)
- `pnpm build --filter=design-system` (or any Next app) — Next's
tsconfig validation and build typecheck still work
- CodeBlock rendering on www (syntax highlighting, line highlights
with/without border) — the two fixes are behavior-neutral but worth an
eyeball
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Improvements / New Features**
* Enhanced TypeScript tooling support across the workspace for smoother
development builds and checks.
* **Bug Fixes**
* Code blocks render more reliably when content is empty or missing.
* Highlighted code line styling applies more consistently.
* **Maintenance**
* Studio TypeScript builds now avoid including generated output (such as
`dist`) during compilation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
## Problem
Because some tests were taking too much time before with the studio
supabase default instance, we used to do a reset of its config on CI.
This makes local testing more cumbersome as you have to manually reset
it without forgetting to create a `functions` directory.
## Solution
- prepare the existing e2e supabase config in `e2e/studio` to ensure
functions work (create the directory)
- use the `workdir` option of the supabase CLI so that it uses the
`e2e/studio` specific config
- remove the now unnecessary reset done on CI
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved the reliability of the end-to-end setup flow by simplifying
cleanup steps and avoiding an extra reset during shutdown.
* **Chores**
* Updated workflow and script behavior to better support automated test
runs without changing the user experience.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Stack 1/6** of the TanStack Start migration (#46424), split into
reviewable, independently-mergeable PRs.
> [!IMPORTANT]
> **Next stays the default and only active framework after this PR.**
This wires up the Vite/TanStack-Start build pipeline behind the
`STUDIO_FRAMEWORK` flag, but there are no TanStack routes yet — so the
TanStack build isn't functional or tested until later PRs in the stack.
Nothing about the Next build, dev, or deploy changes behaviourally here.
## What's in this PR
- **Dispatch:** `dev`/`build`/`start` now go through
`scripts/dispatch.js`, which runs the Next variant unless
`STUDIO_FRAMEWORK=tanstack`. The original commands are preserved as
`dev:next`/`build:next`/`start:next`.
- **Build pipeline:** `vite.config.ts`, `serve.js`, `smoke-server.mjs`,
vite/tanstack deps, `turbo.jsonc`.
- **`tsconfig.json`:** `jsx: react-jsx`, `moduleResolution: Bundler`,
`target: ES2022`. Because `include` is `**/*.ts(x)`, this re-typechecks
the whole app, so the companion adaptations below land with it.
- **Shared adaptations (companions to the tsconfig change):**
`BufferSource` casts, `packages/ui` unused-`React` import removals, etc.
- **Routing/middleware plumbing:** `next.config.ts` +
`redirects.shared.ts` (redirect rules now shared with `vercel.ts`),
`proxy.ts`/`start.ts` middleware + `hosted-api-allowlist.ts`.
## Verification
Run locally off `master`: frozen install ✓, `studio` typecheck ✓, **Next
build ✓** (compiles + generates all routes), lint ratchet ✓ ("some rules
improved"), prettier ✓.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a hosted API endpoint allowlist to return 404 for non-supported
`/api/*` routes.
* Introduced a TanStack route-migration checklist and expanded TanStack
Start routing support.
* **Improvements**
* Enhanced deployment refresh/detection by tightening cookie handling
for “latest deployment” updates.
* Centralized redirect/maintenance-mode rules for consistent platform vs
self-hosted behavior.
* Improved production serving with a dedicated static + proxy server and
a post-build smoke test.
* **Dependencies**
* Updated TanStack-related packages and React Table/query tooling
versions.
* **Documentation / Chores**
* Updated formatting and tooling config; added shared build environment
parsing utilities.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated build tools and development dependencies across the project
* Upgraded Vue framework and related tooling to latest versions
* Updated TanStack React Start dependency
* Refined dependency resolution settings to improve build stability and
performance
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The Supabase CLI sometimes fails to start because the postgres port is
already used:
> failed to start docker container: Error response from daemon: failed
to set up container networking: driver failed programming external
connectivity on endpoint supabase_db_supabase
(10587f26e7287c8086fd27db12be7aac4afe1f3fc521c9d7a8dfe109993c995d):
failed to bind host port for 0.0.0.0:54322:172.18.0.2:5432/tcp: address
already in use
## Solution
None yet, debugging
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Enhanced end-to-end test workflow with added pre-start and failure
diagnostics for better observability and troubleshooting of test runs.
* Updated the e2e setup CLI script to skip certain local services by
default and clarify script formatting for maintainability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated core SDK dependencies to latest compatible versions for
improved system stability and security.
* Enhanced workspace dependency configuration management by expanding
and reorganizing package constraints to optimize compatibility across
all modules and reduce potential build conflicts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request migrates all SCSS stylesheets in the `apps/studio` and
`apps/docs` projects to CSS, updates import paths accordingly, and
consolidates PostCSS configuration to use a shared config. The migration
includes renaming files, updating import statements, converting SCSS
comments to CSS comments, and removing redundant or legacy configuration
files. The changes improve maintainability and consistency across the
codebase.
**Migration from SCSS to CSS:**
* All SCSS stylesheets in `apps/studio/styles` and `apps/docs/styles`
have been renamed to `.css`, and their contents updated by converting
SCSS comments (`// ...`) to CSS comments (`/* ... */`). All relevant
import statements in the app entry points have been updated to reference
the new `.css` files.
**PostCSS configuration consolidation:**
* The separate `postcss.config.cjs` files in `apps/design-system`,
`apps/learn`, and `apps/studio` now all import from a shared
`config/postcss.config`, ensuring consistent PostCSS setup across
projects. The legacy `postcss.config.js` in `apps/studio` has been
removed.
**Code and style consistency improvements:**
* All instances of the SCSS-specific `#{!important}` in Tailwind
`@apply` rules have been replaced with the standard CSS `!important`
syntax.
* Minor fixes and comment updates were made throughout the stylesheets
to improve readability and maintainability, such as moving or clarifying
TODOs and notes.
These changes streamline the styling approach, reduce build complexity,
and make it easier to maintain and scale the design system and
documentation styles.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Consolidated PostCSS configuration across apps
* Migrated many stylesheet imports from SCSS to CSS
* Standardized CSS comment and @apply syntax for consistency
* **Chores**
* Removed SCSS (sass) dev dependency
* Added autoprefixer and tailwindcss/nesting to PostCSS plugins
* Removed SCSS module type declarations (cleaned up typings)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request introduces improvements to the project's build and
cache management processes. The main changes focus on enhancing the
cleaning of build artifacts and optimizing Turbo's caching behavior.
**Build and cache improvements:**
* Updated the `clean` script in `package.json` to also remove the
`.turbo/cache` directory, ensuring a more thorough cleanup of build
artifacts.
* Added a `cacheMaxAge` setting of 14 days to `turbo.jsonc`, which
controls how long Turbo's cache is retained, helping to balance cache
efficiency and disk usage.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Optimized build system caching configuration with extended cache
validity period (14 days) to improve build performance through longer
retention of build artifacts and reduced unnecessary recompilation.
* Enhanced cleanup procedures for build artifacts, cached files, and
temporary data to maintain a consistent and clean build environment.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Next.js 16.2
• Up to ~60% faster rendering
• Up to ~400% faster 𝚗𝚎𝚡𝚝 𝚍𝚎𝚟 startup
• Server Function 𝚍𝚎𝚟 logging
• Redesigned error page
• Better hydration errors
• 𝙴𝚛𝚛𝚘𝚛.𝚌𝚊𝚞𝚜𝚎 display in error overlay
https://nextjs.org/blog/next-16-2
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated core build/dev tooling versions for more predictable installs
(analyzer and Turbo bumped).
* Relaxed workspace release gating by reducing minimum release age and
narrowing the list of tooling exclusions, streamlining staged upgrades.
* No runtime or public API changes; configuration and tooling-only
updates.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request refactors the Turbo build configuration by moving each
app's build settings from the root `turbo.json` file into their own
dedicated `turbo.jsonc` files within each app's directory. The root
configuration is simplified to only include generic tasks, improving
maintainability and clarity.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Turbo to v2.9.3 to improve build performance and stability.
* Reorganized and added per-app build pipeline configurations to
streamline builds and caching across the workspace.
* Removed a Tailwind container-queries plugin from one app's styling
setup.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This PR fixes some prettier issues:
- Bump and unify all prettier versions to 3.7.3 across teh whole repo
- Bump the SQL prettier plugin
- When running `test:prettier`, check `mdx` files also
- Run the new prettier format on all files
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## Problem
Since the upgrade to NextJS 16.1.6, many e2e tests run fails with
timeout, probably when building or starting the studio
## Solution
- [x] Add dedicated steps for supabase setup and NextJS build to ease
debugging
- [x] Fix flakyness
## Problem
The docker build for studio fails because pnpm patches are not included
## Solution
- bump pnpm version in Dockefile to match the one used by the repo
- bump turbo version in Dockerfile to use one that handles pnpm patches
- add a script to test the build locally
- add a github action to validate the build on each PR
This PR removes the `payload` `cms` app that was added for the marketing
blog posts. We never started using it, it just adds additional work in
keeping the dependencies updated.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed the CMS application and associated infrastructure, including
configuration files, build scripts, and environment management.
* Simplified project build configuration and removed CMS-related
dependencies from deployment workflows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This PR renames all `SUPABASE_PUBLISHABLE_OR_ANON_KEY` env vars into
`SUPABASE_PUBLISHABLE_KEY` to make the new API keys default. This is in
coordination with the rest of the docs.
I've also cleaned up the `blocks/vue` package from unused files.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Breaking Changes**
* Public environment variable names renamed from PUBLISHABLE_OR_ANON_KEY
→ PUBLISHABLE_KEY across all framework integrations; update your
environment configs.
* **Documentation**
* All framework guides, .env examples and registry docs updated to use
the new variable names.
* **Chores**
* Cleaned up UI registry/templates: some example Vue registry items and
autogenerated registry artifacts were removed or simplified.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Sorted all imports in all packages, `cms`, `design-system` and
`ui-library` apps by running `pnpm format` on them.
All changes in this PR are done by the script.
This PR switches the sort imports plugin to
@ianvs/prettier-plugin-sort-imports which is more reliable and merges
imports from the same file (the old one reported them as error).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated import-sorting tooling and related configuration to improve
consistency of import ordering and formatting across the codebase,
simplifying rules and adjusting behavior for private/internal paths to
produce more predictable diffs and clearer code style in development.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
* Add prettier plugin for sorting imports.
* Migrate the prettier config to a js file. Make the sort imports conditional which will work only in code editors.
* Remove unneeded commands for running prettier.
* Fix the regex to be more specific.
* Another fix for the import regex.
* Hide favorite and share actions for self-hosted version.
* Rename the query on save only on platform.
* Simplify useCheckOpenAiKeyQuery.
* Rename with AI now depends if the OPENAI_API_KEY is set.
* Minor fixes.
* Fix the tests to use .skip for skipping tests. Remove extra port params.
* Make the test for favourites work only on platform variant.
* updated commands and expose ai key locally
* added tests for AI assistant
* added OPEN_API_KEY for e2e test suite
* updated log drain options
* updated README
* Use the "eslint" command instead of built-in next lint since it's getting obsolete.
* Bump all deps to support eslint 9+.
* Convert the rules in eslint-config-supabase to be flat-config compatible.
* Migrate all apps to use the new eslint config rules.
* Fix all errors found in the new setup.
* Fix the no default exports ignores.
* Scan all files for linting in studio.
* Fix all lint errors.
* Make the reportUnusedDisableDirectives a warning.
* Deduplicate @babel/core.
* Remove explicit dependency of import-in-the-middle (it's imported in sentry deps).
* Add an API route for api-keys/temporary.
* Refresh the token if on self-hosted.
* Readd import-in-the-middle.
* Bump supabase to 2.50.3 which contains fixes for storage upload.
* Move the overrides to pnpm-workspace.yml.
* Only allow building for supabase CLI. All other deps will ignore their postbuild scripts.
* Run approve-builds and approve only supabase CLI.
* Move typescript version definition to pnpm-workspace.
* Bump typescript to 5.9.
* Minor fixes to satisfy the compiler.
---------
Co-authored-by: Raúl Barroso <code@raulb.dev>
* Bump brace-expansion.
* Bump next to non-vuln version.
* Remove old version of @vercel/flags.
* Try to bump prismjs again.
* Bump fastify.
* Dedupe graphql.
* Bump form-data.
* feat: bump auth-js to v2.71.0-rc.7
* Use the version specified in the catalog.
* bump to rc.8
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
* Bump vite version.
* Rename and bump the vercel/flags dependency.
* Bump all versions of esbuild to one.
* Bump image-size.
* Bump fastify.
* Bump prismjs.
Ivan Vasilov