## Problem
Closes#31221.
The applications and shared UI packages still import the former
`framer-motion` package instead of Motion's React entry point.
## Solution
Replace runtime imports, type imports, and three test mocks with
`motion/react` across the consuming workspaces.
Replace the seven direct dependency declarations with `motion:
^11.18.2`.
Preserve the existing animation engine version and all other dependency
resolutions, including the asynchronous `domMax` feature loader.
Historical blog examples remain as published; `framer-motion` remains a
transitive implementation dependency of Motion.
## Review instructions
1. Run `pnpm install --frozen-lockfile` and check the seven dependency
replacements in the lockfile.
2. Open the WWW Auth page and Docs homepage at desktop and mobile
widths, with normal and reduced motion preferences.
3. Open the mobile navigation, expand Product on WWW, and close the menu
using Escape and the close button.
4. Check the existing animation components, shared form validation, and
Studio tests for unchanged behavior.
Validation:
- Studio: 731 test files, 8,334 passing tests and one expected failure,
with `--maxWorkers=4`.
- Shared UI, UI patterns, WWW, and UI library: 615 passing tests.
- `pnpm run typecheck --concurrency=1`: all 16 repository tasks pass.
- All six application source lint scripts and lint ratchets pass;
generated Docs example copies are excluded from local lint.
- Repository Prettier source check, lockfile formatting, and case hazard
check pass.
- WWW: 10 existing end-to-end checks across nine pages.
- Docs: 5 existing guide link and accessibility checks across Database
and Auth.
- WWW and Docs mobile navigation pass at desktop/mobile sizes with
normal/reduced motion; SQL-to-REST translation tabs exercise the
asynchronous feature loader without browser errors.
- Frozen-lockfile installation passes; all existing package and snapshot
resolutions are unchanged.
- Learn and UI library command palettes open, filter results, and close
with Escape without browser errors.
- Independent code review finds no actionable defects.
- `npm run build -- --filter=www --filter=docs --filter=studio
--filter=learn --filter=library --concurrency=1 --continue=always`: all
five affected applications build successfully (9 tasks including
prerequisites); asset uploads disabled for local validation.
## Checklist
- [x] I have read
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
- [x] If I wrote a new docs topic or edited an existing topic, I used
the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs
[style
guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide)
(no docs topics changed)
---------
Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com>
## Problem
`<FormItemLayout>` does not apply item id correctly. This can be seen on
https://supabase.com/design-system/docs/ui-patterns/forms: open the
devtool and check the form items labels. They have no `for` attribute.
This makes it harder to correctly test and is an accessibility issue.
Axe devtool actually report it
## Solution
When inside React Hook Form, `<FormItemLayout>` actually generate an
`id` (via `<FormItem>`). However, this `id` is overridden in
`<FormLayout>` and read from context by `<FormLabel>`. Ensure we use the
generated id unless one was provided.
Also updated the paths filters for the CI check so that any changes in
either `ui` or `ui-patterns` triggers the studio unit and e2e tests.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Improved form accessibility by ensuring labels consistently connect to
their corresponding input fields.
- React-based forms now correctly preserve field-specific identifiers
when associating labels with inputs.
- Added support for explicitly specifying a label’s input target,
improving compatibility with customized form layouts.
- Updated Studio forms to use consistent control identifiers and
labeling behavior.
- **Quality Improvements**
- Automated validation now also runs when shared UI components and
patterns are updated.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Currently, sessions timeouts and reuse interval inputs accepted any
values. This PR caps:
- absolute session timeout to 1 year
- inactivity timeout to 1 year
- refresh token reuse interval to 300 seconds
Since these maximums are introduced _after_ some projects have values
that exceed the new limits, we allow the users to save the form if their
values exceed the max but are unchanged. However, if they decide to
change the value, it must fit within the limits.
<img width="1195" height="402" alt="Screenshot 2026-08-20 at 15 45 49"
src="https://github.com/user-attachments/assets/192420e8-4878-4e4b-9d82-0d1cc4074728"
/>
<img width="1194" height="512" alt="Screenshot 2026-08-20 at 15 46 06"
src="https://github.com/user-attachments/assets/bb333c54-daa3-46ac-b144-96263428f4d7"
/>
<img width="1168" height="323" alt="Screenshot 2026-08-20 at 15 46 35"
src="https://github.com/user-attachments/assets/ae38fcf6-bc73-453f-a61b-2d6f2d0ecfee"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Improvements**
* Added clear maximum-value guidance for session and refresh-token
settings.
* Existing projects with previously configured values above new limits
can retain those values while making unrelated changes.
* Removed session-related settings from the protection authentication
form.
* **Bug Fixes**
* Improved validation for session timeouts, JWT expiration, and
refresh-token reuse intervals.
* Added clearer validation messages and support for reducing previously
over-limit values.
* **Tests**
* Expanded coverage for boundary values, invalid inputs, saved settings,
and submitted configuration updates.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Exposes the access token expiry (`JWT_EXP`) under `Auth -> Sessions`
settings as opposed to the Legacy JWT settings previously used.
<img width="1632" height="1199" alt="Screenshot 2026-07-23 at 10 06 33"
src="https://github.com/user-attachments/assets/85356e57-da95-404c-852a-21cf9cab2b74"
/>
<img width="1198" height="1119" alt="Screenshot 2026-07-23 at 10 06 19"
src="https://github.com/user-attachments/assets/bfa64b3b-1902-45eb-83ed-ca8bc12673af"
/>
<img width="1237" height="513" alt="Screenshot 2026-07-23 at 10 03 44"
src="https://github.com/user-attachments/assets/85779e9b-30f2-48c5-9faa-4c650d450227"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added an **Access Tokens** section to configure JWT expiration with
dedicated Save/Cancel controls and success/error toasts.
* Enforced a maximum JWT expiration value (must be **less than 604800
seconds**).
* **Bug Fixes**
* Updated the Sessions auth page text to better clarify configuration
for access tokens, refresh tokens, and user sessions.
* **Documentation**
* Updated JWT expiration guidance to point to **Auth settings → Access
Tokens** (replacing legacy JWT secret references).
* **Chores**
* Expanded automated tests covering Access Tokens saving and validation.
* **Refactor**
* Removed JWT expiration editing from the legacy JWT Secrets area,
consolidating it under Access Tokens.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
We now export components under a subpath in ui-patterns to avoid barrel
files as they slow down every tools (from IDE to linters, etc.) and may
also affect bundles our users have to download.
## Solution
- Remove the UI patterns index file
- Fix invalid impors
## Problem
Knip reports many duplicate exports (both named and default). Besides,
we're moving away from default exports and even have an eslint rule to
enforce it on new code.
## Solution
- Cleanup those exports
- Update imports when necessary
No functional changes. If it builds, it's fine
## Problem
Our `<Button>` component breaks the default `button` contract by
redefining the `type` prop to set its variant (`primary`, `default`,
etc) instead of the button type (`submit`, `button`, etc).
This is confusing and forces to write more code when using it with
shadcn components that expect/inject the standard button props.
## Solution
- rename the `type` prop to `variant`
- rename the `htmlType` prop to `type`
- propagate the changes where necessary
- format code
## How to test
As this is just prop renaming, if it builds it's ok
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
## Problem
We used to have a `_Shadcn_` suffix for all the shadcn form components
because we also had `formik` form components.
This is not needed anymore.
## Solution
- Remove the suffix
- Update all usages
## Problem
The input groups components introduced in #44282 don't have the
validation attributes when invalid. This hurts accessibility and also
break the design:
<img width="1730" height="324" alt="image"
src="https://github.com/user-attachments/assets/a3fb8d86-f3a8-46bb-aa53-d0599c11f056"
/>
## Solution
This is because the wrapper `<FormControl_Shadcn_>` passes the
validation props to its direct child.
The solution is to avoid applying them on the `<InputGroup>` and to
apply them manually on the inputs.
I also fixed a small accessibility issue by moving the addon texts after
the input so that screen readers announce them in the correct order. No
visual change for this
<img width="587" height="158" alt="image"
src="https://github.com/user-attachments/assets/1f8858ea-6659-45f9-964e-8c43a7fe14ba"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Unified numeric input layout by moving unit labels/suffixes (e.g.,
"seconds", "GB", "%", "connections", "digits", "IOPS", "MB/s", "rows")
to appear after their inputs for a consistent, predictable form
appearance.
* **Accessibility**
* Form controls now expose IDs and ARIA attributes from form context
when available, improving screen-reader descriptions and error
association.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
* Bump the deps, refactor deprecated code.
* Migrate keepPreviousData usage.
* Migrate all uses of InfiniteQuery.
* Fix refetchInterval in queries.
* Migrate all use of isLoading to isPending in mutations.
* Fix accessing location in claim-project.
* Fix a bug in duplicate query keys.
* Migrate all queries to use isPending.
* Revert "Fix accessing location in claim-project."
This reverts commit 2a07df64b5.
* Revert the rss.xml file to master.
* init request upgrade plan modal
* Consolidate UpgradeToPro components across UI + use UpgradePlanButton, UpgradePlanButton determines whether to show request upgrade CTA
* Allow to pass icon to Admonition
* Tiny fix on upgrade plan button CTA to consider addons
* Hook up upgrade request endpoint
* Update API types
* remove hardcode
* Add request upgrade CTA in plan side panel
* Fix disk compute
* Show request upgrade button for change to large compute
* Nit
* Add UpgradePlanButton which handles redirecting either to subscription page or support page
* Update upgrade CTAs to go to support if billing:all flag is disabled
* Nit
* Nit
* Smol fix
* Temp show plan upgrade support category
* revert as instructed
* asChild
---------
Co-authored-by: Alaister Young <a@alaisteryoung.com>
* fix(ui/auth-sessions): always show refresh token reuse interval
The reuse interval input was previously hidden when rotation was disabled. This
caused confusion, since the interval still applies regardless of rotation
setting. Allow zero values for reuse interval as it is supported in auth server
and is used by some projects.
* Always render SECURITY_REFRESH_TOKEN_REUSE_INTERVAL field.
* Removed .positive() schema check to allow 0 values
* Improves alignment between dashboard UI and backend behavior
* chore: prettier
---------
Co-authored-by: Chris Stockton <chris.stockton@supabase.io>
* Update perms checking in audit logs
* Deprecate useCheckPermissions, useIsPermissionsLoaded and useCheckProjectPermissions as they're no longer used
* Rename useAsyncCheckProjectPermissions to useAsyncCheckPermissions
* Fix TS
* Part 1 of swapping useCheckPermissions with useAsyncCheckProjectPermissions
* Update apps/studio/hooks/misc/useCheckPermissions.ts
Co-authored-by: Drake Costa <drake@saeris.io>
* Address feedback
---------
Co-authored-by: Drake Costa <drake@saeris.io>
* Replace all usage of useProjectContext with useSelectedProjectQuery
* Replace all usage of useSelectedProject with useSelectedProjectQuery
* Replace all usage of useProjectByRef with useProjectByRefQuery
* Replace all usage of useSelectedOrganization with useSelectedOrganizationQuery
* Deprecate useSelectedProject, useSelectedOrganization, and useProjectByRef hooks
* Deprecate ProjecContext
* all settings moved into the right places
* clean a few things up
* update ui for auth settings
* more updating
* rearrange settings
* Update SmtpForm.tsx
* updated styling
* add old auth page to show links
* add copy
* udpate copy
* smtp links
* auth fixes
* Smol fix
* Another smol fix
* Fix tab page menu selection
* Add missing border
* Gah one last one
* Smol improvement for redirects from settings/auth to use id
* Update apps/studio/components/layouts/AuthLayout/AuthLayout.utils.ts
Co-authored-by: Kang Ming <kang.ming1996@gmail.com>
* Update apps/studio/pages/project/[ref]/auth/mfa.tsx
Co-authored-by: Kang Ming <kang.ming1996@gmail.com>
* Update apps/studio/pages/project/[ref]/auth/mfa.tsx
Co-authored-by: Kang Ming <kang.ming1996@gmail.com>
* remove recommendation
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
Co-authored-by: Kang Ming <kang.ming1996@gmail.com>
