## What kind of change does this PR introduce?
Documentation improvement for Realtime Presence.
## What is the current behavior?
The Presence documentation doesn't explain that during a `sync` event,
clients may receive `join` and `leave` events simultaneously even when
no users are actually joining or leaving. This can be confusing for
developers new to Presence.
## What is the new behavior?
Added an explanatory note clarifying that:
- During `sync`, you may receive `join` and `leave` events at the same
time
- This is normal and expected
- It reflects state reconciliation with the server, not real user
movement
This helps developers understand this behavior upfront rather than
having to discover it through debugging.
## Additional context
As mentioned in the issue, this behavior is discussed in [this community
discussion](https://github.com/orgs/supabase/discussions/26748) where
the solution had to be discovered by users.
Fixes#41175
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Clarified behavior during sync events in the Realtime Presence guide.
Added explanation that simultaneous join and leave events may occur due
to state reconciliation rather than actual user movement changes.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Related to this previous PR
[here](https://github.com/supabase/supabase/pull/42321)
Table Editor: Adding a CTA to the `HighQueryCost` UI to allow users to
proceed with fetching data despite the high query cost warning, to
prevent completely blocking the users from their workflows (realised
that certain heavy queries are required and this safeguard shouldn't be
creating dead-ends for users)
<img width="1159" height="264" alt="image"
src="https://github.com/user-attachments/assets/5fa01f7f-4442-4349-91f2-f4275e177f89"
/>
Clicking "Load more" will open a confirmation dialog, in which
proceeding to load the data will thereafter suppress this preflight
check for the table, for the rest of the browser session
<img width="450" height="305" alt="image"
src="https://github.com/user-attachments/assets/d3197a5d-a861-47a8-95da-e157972ce092"
/>
## Other changes
- Also bumped the query cost threshold from 100,000 to 200,000 - the
former might have been too aggressive 😓
- (Unrelated) Added query cost tooltip for cron jobs high query cost
warning
<img width="450" height="230" alt="image"
src="https://github.com/user-attachments/assets/d2c66972-7c4c-4f99-818c-e90a0991c2f5"
/>
## What kind of change does this PR introduce?
Documentation fix
## What is the current behavior?
In `apps/docs/content/guides/platform/billing-on-supabase.mdx`, the
"Control your costs" link has an empty URL (`[Control your costs]()`),
making it non-functional. Users clicking this link are not taken to the
cost control documentation.
## What is the new behavior?
The link now correctly points to `/docs/guides/platform/cost-control`,
which is the existing page that covers Spend Cap, Billing Alerts, and
other cost control features.
## Additional context
The other two links in the same list (`Your monthly invoice` and `Manage
your usage`) already have correct URLs. This appears to be an oversight
where the cost-control page was created but the link in the billing
overview was not updated.
## Context
In database/tables (Schema visualizer), if the schema has no tables,
clicking on "Auto layout" causes a client error as we're trying to run
the `dagre.layout` on a graph with 0 nodes and edges
Opting to hide all actions on the Schema Visualizer if there's no tables
(understandably we've been leaning towards disabled states rather than
hiding, but in this case i was thinking hiding is better since that's an
empty state - unless some actions were applicable in the empty state,
but in this case none of the actions are)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Improved reliability of the database schema interface by strengthening
empty state handling
* Ensured database actions are properly hidden when no tables exist in
the schema
* **Refactor**
* Consolidated schema state validation logic for better code
maintainability
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Related to FE-2461
More refactoring to clean up usage of `useQueryStateWithSelect`, mainly
in the database pages
- Roles
- Triggers
- Functions
- Enumerated Types
## To test
In each of those pages, verify that
- [ ] Clicking the "new" cta updates the URL params, and refreshing
should re-open the sheet
- [ ] Editing an existing item should update URL params, and refreshing
should re-open the sheet with the right item
- Verify that if the URL param has the wrong id, page should not open
the sheet, show a toast, and reset the URL param
- [ ] Deleting an existing item should update URL params, and refreshing
should re-open the sheet with the right item
- Verify that if the URL param has the wrong id, page should not open
the sheet, show a toast, and reset the URL param
---------
Co-authored-by: Ali Waseem <waseema393@gmail.com>
Database migration — adds a new table.
## What is the current behavior?
There is no table to cache AI-derived incident metadata.
## What is the new behavior?
Adds an `incident_status_cache` table for caching AI-derived incident
metadata.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Minor amount of tests for Realtime because we have zero E2E coverage
here
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added comprehensive end-to-end test coverage for the Realtime
Inspector: channel join/leave, start/stop listening, broadcast
workflows, message display, JSON validation, and cleanup to improve
reliability.
* Added supporting test helpers/utilities to enable deterministic
navigation, channel operations, message waiting, and modal interactions
for stable test execution.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Feature
## What is the current behavior?
The Functions counter on the Home page is only displayed in platform
environments.
In self-hosted setups, the counter is hidden due to a platform guard,
even though Functions may be available.
## What is the new behavior?
The Functions counter is now also displayed in self-hosted environments.
This is now possible thanks to the following PRs:
- #40690
- #42322
- #42349
- #42350
These PRs introduce and enable the API required for listing Functions in
Studio, making it feasible to show the Functions count outside of the
platform environment.
## Additional context
Related issues: #36285
This change removes the platform-only restriction around the Functions
card in the Home interface, allowing feature parity between platform and
self-hosted deployments where the Functions API is available.
---------
Co-authored-by: Andrey A. <56412611+aantti@users.noreply.github.com>
Co-authored-by: Charis Lam <26616127+charislam@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
The changes required for this React Doctor need more thought that I can
hammer with AI. Just need to stop this from happening in the future with
Ratchet rules
This PR:
- Adds a new Join types and join modifiers section to the
joins-and-nesting guide.
- Documents default left join semantics for embedded relations.
- Explains !inner for inner-join behavior.
- Explains : aliasing and ! join modifiers (!inner, !foreign_key).
- Adds join/filter examples with expected JSON results.
- Includes query examples across JavaScript, Dart, Swift, Kotlin,
Python, and URL.
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix. One liner.
## What is the current behavior?
The resizable product menu to the left on drag responds with a slow drag
animation.
This is inconsistent with other resizable drag animations.
## What is the new behavior?
the drag animation is consistent and snappy!
## Additional context
As far as I can tell the transition animation on the `ResizablePanel` is
for the open and closing of the menu and not for resizing. It looks like
a just overly broad transition target (`transition-all`).
The react-resizable-panels seems to use flex grow to do the animation.
The `transition-all` which is currently on the `ResizablePanel`
component is causing the flex grow to animate and this in turn is
causing some minor layout thrashing.
<img width="406" height="579" alt="Screenshot 2026-01-21 at 8 40 24 PM"
src="https://github.com/user-attachments/assets/9282731a-f1d6-411d-9092-25f0bddff29f"
/>
After this update the layout thrashing from flex-grow is fixed.
<img width="539" height="520" alt="Screenshot 2026-01-21 at 6 38 00 PM"
src="https://github.com/user-attachments/assets/dc2b2e28-8298-400e-8f19-77edaf6b9884"
/>
Related to [this](https://github.com/supabase/supabase/issues/27801)
issue.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Refined sidebar animation to animate width-related properties only,
delivering smoother and more responsive open/close transitions without
changing timing.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The [spec generation Makefile started
failing](https://github.com/supabase/supabase/actions/runs/22142393017)
with:
```text
ReferenceError: React is not defined
at Object. (/Users/.../_npx/.../node_modules/styled-components/dist/styled-components.cjs.js:1:860)
```
This occurred when `@redocly/cli@2.18.2` was released on Feb 16, 2026.
The error happens because `npx @redocly/cli` installs the package in an
isolated temporary cache without properly resolving peer dependencies
(React is a peer dependency of styled-components).
## Solution
Replace `npx @redocly/cli` with `pnpm exec redocly` to use the installed
version from `packages/generator/package.json`.
This ensures:
1. **Proper dependency resolution** - pnpm installs the full dependency
tree including peer dependencies
2. **Version control** - locked to the version in package.json instead
of always fetching latest
3. **Reproducible builds** - won't break when new versions are released
## Changes
- Replace `npx @redocly/cli` → `cd $(GENERATOR_DIR) && pnpm exec
redocly` (5 places)
- Replace `npm run` → `pnpm run` for consistency with project's package
manager (6 places)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated build configuration to execute documentation generation tasks
from a centralized generator directory with unified package management,
ensuring consistent handling of OpenAPI bundling, TypeScript
documentation, and validation workflows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This PR updates @supabase/*-js libraries to version 2.97.0.
**Source**: supabase-js-stable-release
**Changes**:
- Updated @supabase/supabase-js to 2.97.0
- Updated @supabase/auth-js to 2.97.0
- Updated @supabase/realtime-js to 2.97.0
- Updated @supabase/postgest-js to 2.97.0
- Refreshed pnpm-lock.yaml
This PR was created automatically.
Co-authored-by: supabase-releaser[bot] <223506987+supabase-releaser[bot]@users.noreply.github.com>
Add myself into `humans.txt`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated team information in public metadata.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Documentation / text fix (grammar)
## What is the current behavior?
Several places in the codebase use "a" before acronyms that start with
vowel sounds, which is grammatically incorrect:
- "enter a MFA code" (MFA is pronounced "em-eff-ay", starting with a
vowel sound)
- "a SMS with a OTP" (SMS = "ess-em-ess", OTP = "oh-tee-pee")
## What is the new behavior?
Corrected to use "an" before acronyms with vowel sounds:
- "enter an MFA code"
- "an SMS with an OTP"
## Files changed
- `apps/studio/data/profile/mfa-challenge-and-verify-mutation.ts` -
comment fix
- `apps/docs/content/guides/platform/multi-factor-authentication.mdx` -
user-facing docs
- `apps/docs/docs/ref/javascript/v1/upgrade-guide.mdx` - code comment in
example
- `apps/docs/docs/ref/dart/v0/upgrade-guide.mdx` - code comment in
example
## Additional context
The rule: use "an" before acronyms pronounced with an initial vowel
sound, regardless of the first letter. "MFA" starts with "em" (vowel
sound), "SMS" starts with "ess" (vowel sound), "OTP" starts with "oh"
(vowel sound).
This pull request introduces improvements to the handling of storage
endpoints in the Studio app, ensuring that storage operations utilize
the correct endpoint and enhancing maintainability through import path
updates and code clarity. The most significant changes are grouped
below:
**Storage Endpoint Handling:**
* The `useProjectEndpointQuery` hook now returns both `clientEndpoint`
and `storageEndpoint`, allowing storage operations to use a dedicated
endpoint when available.
* In the `StorageExplorerStateContextProvider`, the logic for
constructing the resumable upload URL now prefers `storageEndpoint` if
present, falling back to `clientEndpoint` otherwise. This ensures
uploads use the most appropriate endpoint.
* The context provider now sets `clientEndpoint` to `storageEndpoint`
when available, further aligning storage requests with the correct
endpoint.
* The dependency array for the provider effect now includes
`storageEndpoint`, ensuring state updates when the storage endpoint
changes.
**Code Quality and Maintainability:**
* Import paths in `storage-explorer.tsx` have been updated to use alias
(`@/`) references, improving clarity and maintainability. Type-only
imports are also used where appropriate, reducing bundle size and
potential circular dependencies.
**Code Clarity:**
* Added comments to chunk size calculations in the upload logic,
clarifying the rationale behind chunk sizing for different file sizes.
## What kind of change does this PR introduce?
Documentation fix
## What is the current behavior?
1. In `apps/docs/content/troubleshooting/enabling-ipv4-addon.mdx`, the
heading reads "Will the project instance **will** be restarted?" with a
doubled "will"
2. In `apps/docs/content/guides/auth/auth-email-templates.mdx`, the `{{
.Email }}` description reads "Empty **when when** trying to link an
email address..." with a doubled "when"
## What is the new behavior?
1. Heading now reads "Will the project instance be restarted?"
2. Description now reads "Empty when trying to link an email address..."
## Additional context
Minor grammar fixes for documentation clarity.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added OpenTelemetry Protocol (OTLP) as a log drain destination with
configurable endpoint, protocol (HTTP/Protobuf), gzip compression, and
custom headers.
* OTLP appears as a selectable destination in the Log Drains UI with its
own icon and form fields.
* **Documentation**
* Added a full OTLP guide including HTTP/Protobuf details, Collector
example, and authentication examples.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
## Description
Adds a troubleshooting article for the `UNUSED_EXTERNAL_IMPORT` build
warnings
that Vite/Rollup/Nuxt users see when bundling apps that use
`@supabase/supabase-js`.
**File:**
`apps/docs/content/troubleshooting/unused-external-import-warning-vite-rollup.mdx`
## What the article covers
- What the warning looks like
- Why it's a false positive (re-exported external imports not recognised
as "used"
by Rollup's code-body check)
- `onwarn` suppression snippet for Vite/Rollup
- `onwarn` suppression snippet for Nuxt
## Related
- https://github.com/supabase/supabase-js/issues/2010
- https://github.com/supabase/supabase-js/pull/2122
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
E2E suite for webhook integrations since we've broken it before, ideally
stop this from happening again
This PR adds a new rule `no-restricted-imports` for deprecating old
packages. For now, only `react-data-grid` and `react-contexify` have
been added.
The ratchet baselines has been rerun with the new rules.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix
## What is the current behavior?
Manual replacement of quotes
## What is the new behavior?
Uses defined SQL literal function
## Additional context
No security risk, but builds better sql strings following best practice
and avoids potential issues with frontend mis-escaping something
Detects HIPAA customers server-side in the assistant code path. Threads
`isHipaaEnabled` boolean through `getOrgAIDetails` → `generate-v4` →
`generateAssistantResponse`. The motivation is to support online evals
down the road, where we'll want to exclude HIPAA projects from Assistant
tracing.
This PR follows existing patterns for checking if HIPAA is enabled for a
project (org has HIPAA addon + project is sensitive). Example
[[1]](https://github.com/supabase/supabase/blob/a5dd0a96716561443778f38a518b61d6cac95c19/apps/studio/components/interfaces/Settings/Addons/Addons.tsx#L75),
[[2]](https://github.com/supabase/supabase/blob/6858d4e18d9359d573fe3dff73bc4e5fa1cfe219/apps/studio/hooks/misc/useOrgOptedIntoAi.ts#L69).
```ts
const hasHipaaAddon = subscriptionHasHipaaAddon(subscription) && settings?.is_sensitive
```
(I call it `isHipaaEnabled` in this PR to avoid it being misunderstood
as just the org-level addon, rather it's a combo of that addon being
present AND high compliance being enabled on the project).
### Verification steps
<details><summary>Click to view the steps I followed to sanity check it
works with the local stack</summary>
Tested locally with `mise fullstack`:
1. Found my org's subscription ID:
```sh
docker exec platform-db-1 psql -U postgres -c "SELECT id, customer_id,
status FROM orb.subscriptions;"
```
2. Added HIPAA addon to it:
```sh
docker exec platform-db-1 psql -U postgres -c "
UPDATE orb.subscriptions
SET price_intervals = price_intervals || '[{\"price\": {\"unit_config\":
{\"unit_amount\": \"350.00\"}, \"external_price_id\":
\"addon_security_hipaa\", \"item\": {\"name\": \"HIPAA\"}}}]'::jsonb
WHERE id = '<subscription_id>';"
```
2. Toggled on High Compliance (Project Settings → General)
3. Added a temporary log after `getOrgAIDetails` in `generate-v4.ts`:
```ts
console.log('[HIPAA]', { isHipaaEnabled })
```
4. Sent a message in the AI Assistant → `isHipaaEnabled: true`
5. Toggled off High Compliance → resent → `isHipaaEnabled: false`
6. Removed addon from subscription, left project toggle on →
`isHipaaEnabled: false`
```sql
-- Find addon index:
SELECT ordinality - 1 as idx FROM orb.subscriptions,
jsonb_array_elements(price_intervals) WITH ORDINALITY AS elem(val,
ordinality)
WHERE id = '<subscription_id>'
AND val->'price'->>'external_price_id' = 'addon_security_hipaa';
-- Remove by index:
UPDATE orb.subscriptions SET price_intervals = price_intervals - <idx>
WHERE id = '<subscription_id>';
```
All three cases confirm `isHipaaEnabled` requires both the org addon and
the project-level toggle.
</details>
Closes AI-434
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added HIPAA mode detection and exposed it in AI workflows.
* API request functions now accept optional custom authorization headers
for downstream calls.
* **Tests**
* Added tests covering HIPAA scenarios and verifying authorization
header propagation in related flows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request introduces a testing setup for the Next.js app using
Vitest. The main changes include the addition of a test configuration,
test scripts, and a sample test for the Next.js config. It also adds
relevant dependencies to support Vitest and path resolution, and updates
the lock file accordingly.
Testing infrastructure:
* Added a sample test file `next.config.test.ts` using Vitest to verify
that specific headers are present in the Next.js configuration.
* Created a Vitest configuration file `vitest.config.ts` with TypeScript
path resolution support via the `vite-tsconfig-paths` plugin.
Scripts and dependencies:
* Added `test` and `test:watch` scripts to `package.json` for running
and watching tests, and included `vitest` and `vite-tsconfig-paths` as
dev dependencies.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Adding me to humans.txt
## What is the current behavior?
Please link any relevant issues here.
## What is the new behavior?
Feel free to include screenshots if it includes visual changes.
## Additional context
Add any other context or screenshots.
fixing doc inconsistencies: privatelink is in beta not alpha, and read
replicas can be requested by contacting account rep.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs Update.
## What is the current behavior?
Inconsistent docs.
---------
Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
- Move the "Create..." command menu item at the top of the Actions group
based on feedback.
- Remove "Pro" badge and replace with "New" on Analytics and Vector
buckets
- Hide "Create Data API" and "Create GraphQL" as "create" doesn't apply
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
docs update
## What is the current behavior?
Superuser settings list is out of date
## What is the new behavior?
Update superuser settings with [new
configs](https://github.com/supabase/postgres/blob/21338c84583acc6f0d65fc99f014c83206aaa32d/ansible/files/postgresql_config/supautils.conf.j2#L13)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated PostgreSQL custom configuration guide with new superuser-level
settings options including deadlock timeout, parameter logging, network
connectivity, safe update enforcement, and function tracking
capabilities.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Jonathan Fulton