mirror of
https://github.com/supabase/supabase.git
synced 2026-10-17 07:09:07 +03:00
4215b6ca32a3b8fa95d433c84f00a391c39efbec
3069
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Alex Gercog
|
0f618d8efb |
fix(mcp): use native HTTP for Devin MCP connections (#51646)
## Problem
The Devin Desktop preset wraps Supabase MCP URLs in `npx -y mcp-remote`,
although Devin Local and Devin CLI support Streamable HTTP natively.
Connecting therefore adds a Node/npm bridge that the client does not
need. The preset also lacks Devin-specific setup and authentication
instructions.
## Solution
Use the existing native `url` configuration for Devin:
```json
{
"mcpServers": {
"supabase": {
"url": "https://mcp.supabase.com/mcp"
}
}
}
```
The generated URL retains the selected project, read-only mode, and
features. The internal `windsurf` key is preserved.
Add shared setup instructions for the configuration panel and generated
Markdown: user-scope installation, the Windows config file location next
to the shared macOS/Linux one, a re-authentication command for hosted
connections, and loading tools in a new Devin Local or CLI session.
Local connections omit the re-authentication step.
Include Devin in the shared client URL round-trip test. The Devin-only
test files from the first revision were removed in review so that tests
stay shared across clients.
Native configuration follows the official [Devin MCP
documentation](https://docs.devin.ai/cli/extensibility/mcp/configuration)
and [Devin Local
integration](https://docs.devin.ai/desktop/devin-local).
## Validation
- **273 tests passed** across 28 `ui-patterns` test files on the current
revision; 34 of them in the MCP section.
- Package typechecking, Prettier on the four changed files, and `git
diff --check` passed.
- **Devin CLI 3000.11.3:** native HTTP initialization and tool
discovery; synthetic OAuth with S256 PKCE and authenticated tool
discovery using a saved token.
- **Devin Desktop 3.10.48 / bundled Devin Local 3000.10.48:** the server
card showed `Connected` and the fixture tool. Its `tools/list` request
came from the bundled Devin Local process.
OAuth validation used controlled local fixtures; live Supabase Hosted
authorization was not exercised. The full monorepo application build was
not run.
## Review instructions
1. Run `pnpm --filter ui-patterns exec vitest run src/McpUrlBuilder` and
`pnpm --filter ui-patterns typecheck`.
2. Select **Devin Desktop** in the MCP configuration panel. Confirm that
the JSON uses `url` and preserves the selected project, read-only mode,
and features.
3. Switch to the local connection. Confirm that Hosted login
instructions disappear. Check that generated Markdown explicitly limits
that login step to Hosted connections.
## Checklist
- [x] I have read
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
- [ ] If I wrote a new docs topic or edited an existing topic, I used
the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs
[style
guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide).
N/A: no docs topic edited; the change is in the shared MCP configuration
component and its generated instructions.
|
||
|
Wendie CheungandClaude Sonnet 5.5
|
9aea81c3b7 |
fix(www): rename Enterprise "Designated Support manager" to "Technical Account Management" (#51628)
## What kind of change does this PR introduce? Copy fix on the pricing page. ## What is the current behavior? The Enterprise tier on supabase.com/pricing lists "Designated Support manager". We can't offer a dedicated support manager for tickets, but all Enterprise customers do get access to the Technical Account Management (TAM) service. ## What is the new behavior? The Enterprise feature reads "Technical Account Management" (`packages/shared-data/plans.ts`). ## Additional context Requested by Brad Gyger in Slack. Not changed in this PR (different copy, flagging for follow-up): the "Designated support" row in `packages/shared-data/pricing.ts`, the "Designated support team, account manager and technical specialist" description in `apps/www/components/Pricing/PricingComparisonTable.tsx`, and "Designated Support" in `apps/www/data/PricingAddOnTable.json`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com> |
||
|
Anthony Lio
|
4b93c5186d |
chore: bump shiki and catalog entry (#51578)
## Problem monorepo resolved four different shiki majors _ shiki was never added to the pnpm catalog so each app kept whatever version it started with. shiki 4.5.0 stops grammar injections from being registered again on every language load (shikijs/shiki#1318) and docs worked around the same problem locally in #50501 ## Solution - adds `shiki: ^4.5.0` to the catalog and points docs, www and marketing at it - docs preload guard from #50501 stays but will be ff by moving docs to lazy language loading in another pr <!-- ## Preview links If relevant, include links to changed pages for easy review access. Copy the preview base URL from the Vercel bot comment on this PR. Use the following table as an example template. | Site | Live | Preview | Search for | | -------------- | ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | ----------------------------- | | WWW | [/blog/your-post](https://supabase.com/blog/your-post) | [/blog/your-post](https://zone-www-dot-com-git-branch-name-supabase.vercel.app/blog/your-post) | unique phrase from the change | | Docs | [/docs/guides/your-page](https://supabase.com/docs/guides/your-page) | [/docs/guides/your-page](https://docs-git-branch-name-supabase.vercel.app/docs/guides/your-page) | unique phrase from the change | | Studio | [/dashboard](https://supabase.com/dashboard) | [/dashboard](https://studio-git-branch-name-supabase.vercel.app/dashboard) | unique phrase from the change | | Design system | [/design-system](https://supabase.com/design-system) | [/design-system](https://design-system-git-branch-name-supabase.vercel.app/design-system) | unique phrase from the change | | UI library | [/library](https://supabase.com/library) | [/library](https://ui-library-git-branch-name-supabase.vercel.app/library) | unique phrase from the change | | Knowledge base | [/kb/guides/your-page](https://supabase.com/kb/guides/your-page) | [/kb/guides/your-page](https://kb-git-branch-name-supabase.vercel.app/kb/guides/your-page) | unique phrase from the change | --> <!-- ## Additional context Optionally add any other context or screenshots. --> ## Review instructions 1. open `/docs/guides/database/full-text-search` on the docs preview and on production side by side _ sql, js, dart and python blocks should have the same colors in light and dark mode 2. hover a function name in one of the js blocks on that page, the type popover should still show 3. open the www preview home page, scroll to the frameworks section and switch a few tabs _ code should be highlighted. 4. open `/go/supabase-stripe-projects` on the www preview _ code block section should be highlighted the same as production ## Checklist Check all before review: - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) - [x] If I wrote a new docs topic or edited an existing topic, I used the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs [style guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide) |
||
|
Brian-AnandDanny White
|
f1082e28c7 |
chore: migrate Framer Motion imports to Motion (#51520)
## Problem Closes #31221. The applications and shared UI packages still import the former `framer-motion` package instead of Motion's React entry point. ## Solution Replace runtime imports, type imports, and three test mocks with `motion/react` across the consuming workspaces. Replace the seven direct dependency declarations with `motion: ^11.18.2`. Preserve the existing animation engine version and all other dependency resolutions, including the asynchronous `domMax` feature loader. Historical blog examples remain as published; `framer-motion` remains a transitive implementation dependency of Motion. ## Review instructions 1. Run `pnpm install --frozen-lockfile` and check the seven dependency replacements in the lockfile. 2. Open the WWW Auth page and Docs homepage at desktop and mobile widths, with normal and reduced motion preferences. 3. Open the mobile navigation, expand Product on WWW, and close the menu using Escape and the close button. 4. Check the existing animation components, shared form validation, and Studio tests for unchanged behavior. Validation: - Studio: 731 test files, 8,334 passing tests and one expected failure, with `--maxWorkers=4`. - Shared UI, UI patterns, WWW, and UI library: 615 passing tests. - `pnpm run typecheck --concurrency=1`: all 16 repository tasks pass. - All six application source lint scripts and lint ratchets pass; generated Docs example copies are excluded from local lint. - Repository Prettier source check, lockfile formatting, and case hazard check pass. - WWW: 10 existing end-to-end checks across nine pages. - Docs: 5 existing guide link and accessibility checks across Database and Auth. - WWW and Docs mobile navigation pass at desktop/mobile sizes with normal/reduced motion; SQL-to-REST translation tabs exercise the asynchronous feature loader without browser errors. - Frozen-lockfile installation passes; all existing package and snapshot resolutions are unchanged. - Learn and UI library command palettes open, filter results, and close with Escape without browser errors. - Independent code review finds no actionable defects. - `npm run build -- --filter=www --filter=docs --filter=studio --filter=learn --filter=library --concurrency=1 --continue=always`: all five affected applications build successfully (9 tasks including prerequisites); asset uploads disabled for local validation. ## Checklist - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) - [x] If I wrote a new docs topic or edited an existing topic, I used the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs [style guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide) (no docs topics changed) --------- Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com> |
||
|
Ping-Min LinandJoshen Lim
|
700365ffba |
fix(pg-meta): generate privilege, publication, role and schema SQL that servers can statically check (#51457)
## What kind of change does this PR introduce? Bug fix. ## What is the current behavior? On a project whose database server statically checks `DO` blocks before running them (Multigres does), several Studio actions fail: - Creating a table shows "Failed to update API access privileges for new table", although the table is created. - Toggling Realtime for a table fails with `EXECUTE of a runtime-built statement inside a PL/pgSQL body is not supported`. - The same error blocks editing a role or schema (rename, owner, drop) and changing column privileges. All of these come from SQL that `@supabase/pg-meta` generates. Such a server only accepts a dynamic `EXECUTE` when it can prove the statement is fixed, and two shapes in our SQL prevent that: - parentheses around the payload: `execute(format(...))` - `%s` conversions in `format()` strings, which substitute raw text (for example `%s` fed by `<oid>::regclass`, by a `string_agg(...)` subselect, or by a variable holding a table list) ## What is the new behavior? `tablePrivileges.grant/revoke`, `columnPrivileges.grant/revoke`, `publications.update`, `roles.update/remove` and `schemas.update/remove` generate SQL with no parentheses around the payload and only `%I`/`%L` conversions: - Table and column privileges name the table with `%I.%I`, taking the schema and name from `pg_class`/`pg_namespace`. - The publication update loops over the tables to drop and to add, with the same `tables` semantics as before (`undefined` keeps the tables, `null` publishes all tables, a list replaces them, bare names resolve through the search path). - `schemas.remove` picks between `drop schema … cascade` and `… restrict` with two plain statements instead of a `%s` fed by a `CASE`. - The grant and revoke format strings are built with `literal()`, so a quote in a role name can't end the string early. The statements are equivalent on regular Postgres. ## Additional context - New tests: replacing, clearing and keeping a publication's tables, switching between a table list and all tables, and a test (no database needed) that fails if the generated SQL of any of these builders goes back to `execute(...)` or `%s`. - I ran the pg-meta tests against a local Postgres 17. A set of existing snapshot tests were recorded on Postgres 14 and fail there with and without this change (for example the new `MAINTAIN` privilege in table privileges), so CI is the real check for those. The tests covering the changed SQL pass. - Some other Studio SQL is blocked on such servers for different reasons (for example creating foreign servers, and `SET` inside a `DO` block). It isn't addressed here. --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Mert YEREKAPANandJoshen Lim
|
e5bc7d8fa1 |
chore(studio): ship fullscreen pricing panel, remove plan presentation experiment (#51554)
## Summary The `pricingPanelPlanPresentation` experiment is concluded with `fullscreen` as the winner. This makes it the only presentation and removes the experiment code. - Plan-change panel always opens as the full-screen overlay with the pricing-page style cards. - Removed the `control`, `parity`, `gaps` and `fullscreen-gaps` presentations: the side-sheet shell, the original compact card, and the "Not included" / "Plan limits" gap rows. - Removed `plan-presentation.ts` (flag read, eligibility gate, exposure tracking, gap lists) and its tests. - Removed the `pricing_panel_plan_presentation_experiment_exposed` event from `telemetry-constants.ts`. - The panel no longer waits for PostHog flags to resolve before opening. - `useTrackExperimentExposure` stays; it's kept across experiment gaps in `knip.jsonc`. **Behavior change for previously ineligible orgs:** partner-billed, Stripe-managed, AWS Marketplace, Enterprise/Platform orgs and members without billing write were held on `control` during the test. They now also get the full-screen panel. Their partner-managed notices and disabled CTAs are unchanged. ## After merge - [ ] Archive the `pricingPanelPlanPresentation` flag and end the experiment in PostHog. ## Test plan - [x] `vitest` for `BillingSettings/Subscription`: 11 passing (partner-managed messaging, full-screen shell, pricing-page cards, no gap rows) - [x] `tsc`: no errors in touched files - [x] `knip --workspace apps/studio`: clean - [ ] Preview: open `/org/[slug]/billing?panel=subscriptionPlan` for a Free org and a partner-billed org 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
claude[bot]andClaude
|
ffef679f70 |
chore(docs): add hasResults to docs_search_v2_search_submitted (#51541)
<!-- claude-slack-attribution --> _Requested by **Pam Chia** · [Slack thread](https://supabase.slack.com/archives/C076KTY11DF/p1791767641595649?thread_ts=1791767641.595649&cid=C076KTY11DF)_ ## Problem **Before:** `docs_search_v2_search_submitted` (added in #51146) fires when a Search V2 query settles on either the `results` or the `noResults` state, but it only sends `query`. A search that found nothing looks the same as one that found results, and no other Search V2 event carries the outcome, so the no-results rate for Search V2 can't be computed. **After:** the event also sends `hasResults`. It's `true` when the endpoint returned at least one result and `false` when it returned none, so zero-result searches can be counted and their queries inspected. ## Solution - `packages/common/telemetry-constants.ts`: `DocsSearchV2SearchSubmittedEvent` gains a doc-commented `hasResults: boolean` property. - `apps/docs/features/SearchV2/SearchV2Dialog.tsx`: the existing fire site sends `hasResults: searchState.status === 'results'`. The `useDocsSearchV2` reducer only sets `results` when the response has at least one hit, and `noResults` otherwise, so the status is exactly the outcome. The change is additive: the event name and `query` are unchanged, and the `loading`, `error`, and `initial` states still don't fire the event. Linear: [GROWTH-1330](https://linear.app/supabase/issue/GROWTH-1330/docs-search-v2-add-hasresults-to-docs-search-v2-search-submitted) ## Review instructions 1. Open the docs preview with the Search V2 flag query: `?docs-search-v2=search-v2-active`. 2. Open search and type a query that returns results. In the network tab, the `/platform/telemetry/event` request for `docs_search_v2_search_submitted` has `custom_properties` `{ "query": "...", "hasResults": true }`. 3. Type a query that returns nothing (for example random characters). The event has `"hasResults": false`. ## Checklist Check all before review: - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) - [ ] If I wrote a new docs topic or edited an existing topic, I used the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs [style guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide) (not applicable: no docs content changed) 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01JaqCdU2sPkBMbaUmUPW75i --- _Generated by [Claude Code](https://claude.ai/code/session_01JaqCdU2sPkBMbaUmUPW75i)_ Co-authored-by: Claude <noreply@anthropic.com> |
||
|
kemal.earthandCharis Lam
|
b2dab2b896 |
feat(studio): update region selector in create form (#51282)
## Problem Updates the region selector in create form to we can run a small experiment. --------- Co-authored-by: Charis Lam <26616127+charislam@users.noreply.github.com> |
||
|
ChrisandDanny White
|
842e1b5e40 |
fix(ui-patterns): wrap long confirm strings in TextConfirmModal (#51503)
## Problem Long confirm strings in `TextConfirmModal` don't wrap. I noticed it when deleting a preview branch with a long name: the name runs past the edge of the dialog and gets cut off, so you can't read what you're supposed to type. ## Solution Changed `whitespace-pre` to `whitespace-pre-wrap` on the confirm string so it wraps. Did the same for the copy button in the `enableCopy` variant and let it grow in height so the wrapped text fits. https://github.com/user-attachments/assets/0a2aa346-8e61-4d58-b595-e6adee4aa1fd ## Review instructions 1. Open the Text Confirm Dialog page in the design system preview. 2. In the demo, change `bucketName` to something long and open the dialog. The name should wrap instead of being cut off. 3. Add `enableCopy` to the demo and check the copy button wraps too. 4. Short names should look the same as before. ## Checklist Check all before review: - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) - [ ] If I wrote a new docs topic or edited an existing topic, I used the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs [style guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide) --------- Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com> |
||
|
Danny White
|
325a5a0da7 |
fix(studio): polish extension installation dialogs (#51463)
## Problem The enable-extension dialog in #51440 needs clearer installation copy and a consistent disclosure for custom-schema guidance. On narrow screens, footer buttons touch and dialog content can scroll sideways. ## Solution Polish the dialog on top of #51440: - Explain fixed-schema requirements and hide custom-schema guidance when the extension requires a specific schema. - Share the disclosure interaction with the session-expired and API-hardening dialogs through `ui-patterns/DialogDisclosure`, documented with a live design-system example. - Fix narrow-screen overflow and add vertical spacing to shared dialog footers. - Refine inline-code styling and update the PostGIS instructions and E2E button locator. | After | | --- | | <img width="852" height="710" alt="CleanShot 2026-10-09 at 12 17 47@2x" src="https://github.com/user-attachments/assets/59f6f1e7-9884-4cdb-b678-62b7f88a8ec5" /> | | _Standard extension_ | | <img width="836" height="1092" alt="52254" src="https://github.com/user-attachments/assets/dbf53d3e-6583-4c3b-8f43-577e0723d9a7" /> | | _Standard extension expanded accordion_ | | <img width="836" height="604" alt="CleanShot 2026-10-09 at 12 20 04@2x" src="https://github.com/user-attachments/assets/c8e3961f-2683-440c-a2a2-48ccd53c4a17" /> | | _Extension with fixed schema_ | ## Review instructions 1. Open `/project/<ref>/database/extensions`. Turn on the toggle for a disabled `postgres_fdw` extension. Expand **Install in a different schema** and check its hover, keyboard focus and full-width click target. Repeat with `pg_cron` or `pgmq`: the intro must say **must**, and custom-schema guidance must be absent. Cancel without enabling. 2. At 320 px and 375 px, check the extension dialog's alignment, inline-code rendering, wrapped SQL and stacked **Enable** / **Cancel** spacing. Confirm the page does not scroll sideways. 3. On a platform project with the Data API enabled, open `/project/<ref>/integrations/data_api/settings`. Under **Harden Data API**, click **Harden Data API**. Expand both sections and check the same trigger behaviour. Confirm completed sections still show their check icons. Close without applying either action. 4. The session-expired dialog has no direct route. It is rendered by `apps/studio/hooks/misc/withAuth.tsx` after authentication loading exceeds 10 seconds. For repeatable local review, temporarily pass `visible={true}` to its `SessionTimeoutModal` callsite, then open `/projects`. Expand **Having trouble?** by clicking the text or chevron and using Enter / Space. Check the help text and controls. Close the dialog without signing out or clearing site data, then undo the temporary prop change. 5. In the design system, open [`/docs/components/dialog#optional-details`](https://design-system-git-dnywh-choreextension-dialog-polish-supabase.vercel.app/design-system/docs/components/dialog#optional-details). Click **Export results**, then expand **What’s included** with the mouse and keyboard. The demo imports the same `ui-patterns/DialogDisclosure` used by Studio. 6. Open another dialog and an alert dialog at a narrow width. Check the shared 8 px gap between stacked footer buttons. Review inline-code examples on `/docs/components/typography` for the shared styling change. |
||
|
Danny White
|
255a80e219 |
refactor(apps): standardise existing favicon assets and declarations (#51419)
## Problem - Favicon files and markup are duplicated across apps. ## Solution - Replace old files with one ICO, one Apple icon and two manifest icons per set. - Share icon markup and add generation notes and scripts. - Keep existing branding, including Learn's black and white icon. - Make the border radius match across all apps’ favicons. ## Review instructions - Check normal app icons and Studio staging in browser tabs. - Check icons load under `/docs` and `/kb`. - Run `node scripts/validate-favicons.mjs`. All 8 sets should pass. |
||
|
Monica KhouryandCharis Lam
|
2d5768d3c1 |
feat(studio): wire Platform Webhooks UI to real backend API (#51352)
## What
Wires the existing (mocked) Platform Webhooks UI to the real Management
API backend, per FE-3749.
- New `data/platform-webhooks/` query/mutation hooks, calling the real
`/v2/organizations/{slug}/webhooks/...` and
`/v2/projects/{ref}/webhooks/...` endpoints
- Updated `PlatformWebhooks.types.ts` to match the real API contract
(field names, shapes)
- Added a signing secret field to the create-endpoint form (API requires
a user-provided secret, not server-generated like the mock assumed)
- Removed the event-type column from the deliveries table (the real
list-deliveries endpoint doesn't return event type, only the
single-delivery endpoint does)
- Removed `PlatformWebhooks.mock.ts` / `.store.ts` and their tests
## Why
UI was built ~80% against mock data months ago; this closes the gap to a
real, working feature.
## Known open items (not blocking, tracked separately)
- `name` field has no backend storage yet — client-only for now, open
question with Ali/Paweł
- Deliveries table only fetches the backend's default single page — real
server-side pagination not yet wired (see FE-3750)
## Follow-up PR (stacked)
Tests for the new `data/platform-webhooks/` hooks (MSW-based), per the
ticket's own scope split.
## Testing
Manually tested end-to-end against local backend: created/edited/deleted
an endpoint, verified the real signature using webhook.site,
independently recomputed the HMAC and confirmed it matches the
`webhook-signature` header.
Linear: FE-3749
---------
Co-authored-by: Charis Lam <26616127+charislam@users.noreply.github.com>
|
||
|
kemal.earth
|
6119ea1eb5 |
feat(design-system): remove table head hover in design system (#51452)
## Problem All our tables had shadcn's rather annoying row hover on a non-interactive `<thead>`. ## Solution Some tailwind/css magic to stop the hover on `<thead>`. |
||
|
Danny White
|
d523603e17 |
fix(ui-patterns): hide Skip to content drop shadow when off-screen (#51460)
## Problem The shared Skip to content control parks itself with `-translate-y-full`, so its bottom edge sits on the top of the viewport. After raised Button shadows landed, the `0 1px 3px` drop shadow still peeks into the top-left of Studio, Docs, www, and design-system even when the link is hidden. ## Solution Hide the control with `-translate-y-[calc(100%+8px)]` so the shadow clears the viewport. Update the unit test to match. One shared `ui-patterns` change covers every consumer. | Before | | --- | | <img width="420" height="108" alt="CleanShot 2026-10-09 at 10 14 27@2x" src="https://github.com/user-attachments/assets/469dd260-d989-49a2-a28c-7f02fa353571" /> | | _Note the shadow poking out from the top of the viewport_ | ## Review instructions On light mode and on Safari (for clearest visibility): 1. Open any Studio, Docs, or www preview page (no need to sign in on www/docs). 2. Look at the top-left of the viewport before pressing Tab. Confirm there is no faint button shadow / dark speck. 3. Press Tab once. Confirm the Skip to content button still slides in cleanly, then Enter to jump to main content. |
||
|
Saxon FletcherandDanny White
|
692b14d47b |
fix(ui): opaque sticky table column hover (#47668)
## Problem
On tables with a sticky last column (Database Extensions, OAuth Apps,
Custom Auth Providers), hovering a row lets scrolled cell content show
through the sticky column.
Root cause: row hover uses `bg-surface-200`, which maps to `--muted`
(alpha). That works for normal cells (nothing behind them) but sticky
cells sit above horizontally scrolled content, so the tint is
see-through.
## Solution
In `ShadowScrollArea` when `stickyLastColumn` is set:
- Keep an opaque `bg-surface-100` base on sticky cells
- Composite the muted hover tint via `background-image` so hover matches
`TableRow` without becoming transparent
Also:
- Extensions: use `Table containerProps={{ stickyLastColumn: true }}`
instead of nesting a second `ShadowScrollArea` (same pattern as OAuth /
Custom Auth)
- OAuth Apps and Custom Auth Providers: drop redundant per-cell
`bg-surface-100` / `hover:bg-surface-200` so sticky hover comes only
from `ShadowScrollArea`
| Before | After |
| --- | --- |
| <img width="1042" height="98" alt="27097"
src="https://github.com/user-attachments/assets/204a7dc4-d5ac-40b7-87fb-fdb03982eaad"
/> | <img width="1084" height="101" alt="94456"
src="https://github.com/user-attachments/assets/c6db3607-6bbe-4488-a0a5-81f5a0436d66"
/> |
## Review instructions
1. Open Database Extensions. Narrow the viewport or scroll the table
horizontally so the Enabled column is sticky.
2. Hover a row while Links or description content sits under the Enabled
column. The sticky cell should stay opaque and match the row hover tint
(light and dark).
3. Optionally repeat on Auth → OAuth Apps and Auth → Custom Providers
(actions column).
Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com>
|
||
|
Danny White
|
cd00775dd7 |
feat(studio): add the pipeline creation wizard preview foundation (#51425)
## Problem The redesigned pipeline creation flow (mega branch being worked on in #49243) needs an incremental rollout while the existing creation sheet remains the default. ## Solution - Register **Pipeline creation wizard** in Feature Previews, with visibility controlled by the `pipelineCreationWizard` ConfigCat flag. - Require the flag and an explicit user opt-in (via Feature previews dialog) before enabling the preview. This adds the preview registration, copy, storage key, and gate. It does not change creation routing or ship the wizard. The complete gated flow can be tested on #49243. The ConfigCat flag is configured as follows: - **Local/staging:** true for everyone. - **Production:** false by default, true for the **Supabase Team Email** segment. The flag makes the preview visible; it does not opt anyone in. Users enable it once in Feature Previews. No dev toolbar override is needed in local/staging. ## Review instructions 1. In local or staging hosted Studio, open **Feature previews**. Find **Pipeline creation wizard**. With no saved preference, it should be off by default. 2. Toggle it on and reload. The opt-in should persist. Toggle it off and reload to confirm opt-out persists. **Add pipeline** still opens the sheet in this foundation PR. |
||
|
Sean OliverandJoshen Lim
|
a7cf044118 |
feat(telemetry): capture ChatGPT Ads oppref click id (GROWTH-1278) (#51397)
## Problem ChatGPT Ads appends an `oppref` click id to landing URLs. We don't read it, so ChatGPT ad signups show up in PostHog with no click id and the first-referrer cookie doesn't treat the visit as paid. GROWTH-1278 ## Solution - Add `oppref` to the first-touch click ids sent with PostHog events (`telemetry.tsx`) - Add `oppref` to `CLICK_ID_KEYS` in `first-referrer-cookie.ts`, so it is stored in `_sb_first_referrer` and counts as a paid signal Conversion reporting to OpenAI itself goes through GTM, so it isn't part of this PR. ## Review instructions 1. Run `pnpm exec vitest run first-referrer-cookie` in `packages/common`. The `hasPaidSignals` test now covers `oppref`. 2. On the preview, load any page with `?oppref=test` and check the first-touch event in PostHog carries `oppref`. ## Checklist Check all before review: - [ ] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) - [ ] If I wrote a new docs topic or edited an existing topic, I used the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs [style guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide) Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
|
6ef729cb5c |
feat(storage): versioning bucket modals (FE-4161) (#49205)
| # | Branch | Base | | - | ------ | ---- | | 1 | `feat/storage-versioning-private-alpha` — merged | `master` | | 2 | `feat/storage-versioning/002-bucket-form-fields` | `master` | | 3 | `feat/storage-versioning/003-bucket-modals` ◀ | 2 | | 4 | `feat/storage-versioning/004-object-versions-data` | 3 | | 5 | `feat/storage-versioning/005-file-preview-versions` | 4 | | 6 | `feat/storage-versioning/006-billing-storage-retention` | 5 | | 7 | `feat/storage-versioning/007-archived-objects-data` | 6 | | 8 | `feat/storage-versioning/008-archived-rows` | 7 | | 9 | `feat/storage-versioning/009-archived-preview-pane` | 8 | | 10 | `feat/storage-versioning/010-replace-file` | 9 | ## [3/10] Storage object versioning: wire into the bucket modals **Base:** `feat/storage-versioning/002-bucket-form-fields` (PR 2) ### This PR Mounts the object-versioning form section in the create and edit bucket modals behind the feature preview, and saves it. - create and edit bucket modals spread `bucketVersioningFormFields` into their existing form schema - lifecycle defaults to 30 days / 10 versions - edit adds a confirmation before suspending an actively versioned bucket ## Enabling object versioning on a new bucket and setting lifecycle policies https://github.com/user-attachments/assets/194f8319-4929-432e-8a50-206f180a77a8 ## Edit and suspend object-versioning https://github.com/user-attachments/assets/f31e1d34-9840-4f5a-a269-6a911214742d ## To reproduce 1. Make sure storage versioning is enabled under feature previews > Storage Versioning 2. Open Storage Bucket File explorer 3. create new bucket and enable Object Versioning 4. set lifecycle policy - Noncurrent version expiration: can be either empty or >1 - Retained noncurrent versions: can be either empty or between 1 and 100 and can't exist without "Noncurrent version expiration" 5. Open new bucket with object versioning and test changing lifecycle policies 6. Disabling object-versioning shows proper warning and updates `versioning_status` to SUSPENDED (it can never go back to DISABLED once it has been enabled on a bucket) --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com> |
||
|
Ivan VasilovandClaude Sonnet 5.5
|
075c611463 |
chore: bump vulnerable dependencies (#51381)
## Summary - Bumps vulnerable transitive dependencies flagged by `pnpm audit`, one commit per dependency (lockfile only, no permanent overrides): proxy-addr, shell-quote, @fastify/busboy, @graphql-tools/executor-legacy-ws, @modelcontextprotocol/sdk, compression, http-cache-semantics, source-map-js, smol-toml, dompurify. - Updates `scripts/fix-audit-vulnerability.ts` to be agent-friendly: accepts a dependency name argument, adds `--json` (single JSON object on stdout, logs on stderr, never prompts) and `--help`. ## Not fixed The remaining audit findings could not be resolved by this script. Some are blocked by `minimumReleaseAge` (braces, node-forge, sprintf-js); others stay vulnerable even with an override and need a parent dependency update or scoped override. ## Test plan - [ ] CI passes (typecheck, lint, prettier) - [ ] `pnpm audit` shows fewer findings than on master 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com> |
||
|
claude[bot]andClaude
|
6c6b19c6c6 |
chore(studio): report empty-body GET 200s to Sentry with a no-store probe (#51123)
<!-- ccr-slack-attribution --> _Requested by **Ivan Vasilov** · [Slack thread](https://supabase.slack.com/archives/C063LNYJJKS/p1790710416069689?thread_ts=1790710416.069689&cid=C063LNYJJKS)_ **Before:** When a Studio API GET comes back as a 200 with an empty body, openapi-fetch hands the caller `{}` and we only see the downstream crash, with no record of the response that caused it. **After:** The first time this happens for an endpoint in a page session, Studio sends one Sentry warning, `Empty response body on successful API request`. It carries the response metadata, browser state, resource timing, and the result of a single `cache: 'no-store'` refetch. What the caller receives is unchanged. ## Problem Studio crashes trace back to GET requests that return 200 with an empty body, which openapi-fetch turns into `{}`. They are heavily skewed to Firefox and Safari. The leading hypothesis is browser cache revalidation (Express weak ETags, no `Cache-Control` on api.supabase.com), but nothing confirms it yet. The `no-store` probe tells the two cases apart: if the refetch has a body, the browser cache is the likely culprit; if it is also empty, the server or the edge is sending empty bodies. This data should show whether the fix belongs on the API side or the Cloudflare side. Context: #51041 (closed) tried to guard the crashing call sites instead. ## Needs API-side change to be fully useful Cross-origin, Studio can only read CORS-safelisted response headers, and resource timing sizes read as zero. If api.supabase.com sends `Access-Control-Expose-Headers: ETag, cf-ray, cf-cache-status, x-request-id` and `Timing-Allow-Origin: <studio origin>`, this event will also carry the ETag, cf-ray, and cache status, plus the real transfer and body sizes and the negotiated protocol. Until then, those fields read as `null` or `0`. ## Solution - `data/empty-body-diagnostics.ts` (new): `reportEmptyBodyResponse({ request, response, schemaPath })`. - Runs only for `GET` and only when `IS_PLATFORM`. Empty POST/201 bodies are legitimate. - Reports at most once per templated endpoint per page session (module-level `Set`). - Endpoint: openapi-fetch's `schemaPath` (e.g. `/platform/projects/{ref}/settings`), passed through `templateEndpointPath`. That function drops the query string and hash, replaces the segment after `projects`/`organizations`/`branches` with `{ref}`/`{slug}`/`{branch}`, and replaces UUIDs, numeric IDs, and 20+ character alphanumeric IDs with `{id}`. I used `schemaPath` rather than the request URL so user-chosen names (bucket names, function slugs) never end up in tags or fingerprints. - Probe: one plain `fetch(new Request(request, { cache: 'no-store', ... }))` with a fresh `X-Request-Id` and a 10s `AbortController` timeout. `AbortSignal.timeout` isn't available in older Safari. The probe bypasses the openapi-fetch middleware, so it can't recurse. Only the body's byte length is recorded, never its contents. - Event: `level: 'warning'`, `fingerprint: ['empty-body-response', endpoint]`, `tags: { endpoint, probe_has_body, empty_body_diagnostic: 'true' }`, where `probe_has_body` is `true` / `false` / `error`. `extra` holds: - the request: method, status, `response.type`, `redirected`, and the original `X-Request-Id` (for API log lookup) - response headers: `content-type`, `cache-control`, `last-modified`, `expires`, `content-length`, `etag`, `cf-ray`, `cf-cache-status`, `x-request-id` - browser state: `visibilityState`, `navigator.onLine`, the navigation type, ms since navigation start, and whether the page was restored from bfcache - the latest `PerformanceResourceTiming` for the URL (transfer, encoded, and decoded size, `nextHopProtocol`, `responseStatus`) - the probe: status, request ID, body length, `content-length`, `content-type`, or the error name - Fire-and-forget: everything is wrapped in a `try`/`catch`, and the caller does not await it. - `data/fetchers.ts`: the `onResponse` middleware passes `{ request, schemaPath }` to `normalizeEmptyBodyResponse`, which calls the reporter in its empty-body branch and also for a 200 that carries `Content-Length: 0`. openapi-fetch short-circuits that case to `{}` the same way, so it is the same symptom. The return value is unchanged in every branch. - `packages/common/sentry.ts`: `filterSentryEvent` normally keeps only 1% of events that aren't page crashes. It now sends events tagged `empty_body_diagnostic` unsampled, with `codeSampleRate: '1'`. A once-per-session warning would barely show up at 1%. Consent and platform gating and the third-party filter still apply. www and docs also use `filterSentryEvent`, but only Studio's reporter sets this tag, so sampling for them and for every other Studio event is unchanged. Sentry config: Studio's `beforeSend` doesn't otherwise drop this message. It has no exception values, so the no-stack-trace filter doesn't apply, and it matches no `ignoreErrors` entry. ## Review instructions 1. Check `normalizeEmptyBodyResponse` in `data/fetchers.ts`: the reporter is `void`-called and its return value is untouched. 2. Check `probe()` in `data/empty-body-diagnostics.ts`: only `byteLength` is read from the body. The probe reuses the original request's headers and credentials (same auth as the original GET). 3. Check `filterSentryEvent` in `packages/common/sentry.ts`: only the `empty_body_diagnostic` tag skips sampling. 4. Tests: `data/empty-body-diagnostics.test.ts` and `packages/common/sentry.test.ts`. ## Verification - Unit tests (`data/empty-body-diagnostics.test.ts`, new): - path templating cases - `probe_has_body` `true` / `false` / `error` - the secret body content never appears in the Sentry call - one report per endpoint - non-GET and non-platform requests are skipped - no throw when `fetch` or Sentry throws - end-to-end through `client.GET`: still resolves `{}` and reports the `schemaPath`, for both a missing `Content-Length` and `Content-Length: 0` - `packages/common/sentry.test.ts`: tagged diagnostics are sent unsampled, untagged or false-tagged ones are still sampled, and they're still dropped without consent. These tests, plus the existing `normalizeEmptyBodyResponse.test.ts`, `handleError.test.ts`, and the rest of `sentry.test.ts`, pass (67 tests) under vitest 5 + jsdom. I ran them in a minimal harness, not the full `pnpm install` workspace, because the local checkout is sparse. - I ran TypeScript 7.0.2 (`--strict`) on the five touched files against the real `api-types`, with stubbed `common`/Sentry types. No errors in the touched files. - Prettier `--check` with the repo config passes, with and without `SORT_IMPORTS=false`. - Not run locally: the full studio typecheck, `lint:ratchet`, and knip. CI covers them. The change adds no `any`, no default exports, and no deps. ## Checklist - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01UefDak8XYLMi9aiEjDPXc5 --------- Co-authored-by: Claude <noreply@anthropic.com> |
||
|
Charis
|
22886fd304 |
feat(studio): add flag-gated general region selection (#51274)
## Problem
We want to be able to show free-plan organizations a simplified region
selector that only lists general regions (Americas, Europe,
Asia-Pacific), controlled per organization through ConfigCat.
## Solution
- ConfigCat flags are now evaluated with `organization_slug` and
`organization_created_at` (Unix seconds) custom attributes, so flags can
target and bucket by organization.
- `organization_created_at` is read from `GET
/platform/organizations/{slug}`, fetched only for free-plan
organizations, since the organization list response doesn't include it.
- Two flags:
- `freeTierGeneralRegionEnrollment`: the organization is enrolled
(control or test).
- `freeTierGeneralRegionSelection`: the organization sees only general
regions.
- For enrolled free organizations, the region selector stays in its
loading state until flags have been evaluated with the organization's
creation time, so specific regions aren't shown and then removed.
- In the test variant, the selector hides specific regions and shows a
footer linking to the plan upgrade panel. High Availability keeps its
own region list.
- Telemetry: new `free_tier_general_region_experiment_exposed` and
`free_tier_general_region_upgrade_clicked` events, and
`freeTierGeneralRegionExperiment` / `regionSelectionType` properties on
`project_creation_simple_version_submitted`.
- `created_at` is added to `OrganizationSlugResponse` in the generated
platform types, matching the API.
## Review instructions
1. With both flags off, open `/new/[slug]` for a free organization and
confirm the region selector is unchanged.
2. Using the dev toolbar, set `freeTierGeneralRegionEnrollment` and
`freeTierGeneralRegionSelection` to `true`. Confirm only general regions
are listed and the footer links to the billing plan panel.
3. Set `freeTierGeneralRegionSelection` to `false` and confirm the full
selector is shown.
4. Repeat with a paid organization and confirm the full selector is
always shown.
|
||
|
Danny White
|
d95ff5bda9 |
docs(design-system): rewrite sidebar page for monorepo tokens (#51165)
## Problem The design-system Sidebar page was mostly an upstream shadcn paste: first-person voice, a broken `/blocks` link, missing structure images, CLI install steps that do not match this monorepo, and a long changelog / data-fetching tutorial that do not apply here. Separately, it still taught classic shadcn **HSL channel** variables plus `hsl(var(--sidebar-*))`. In this monorepo those tokens are **full colours**. Mixing the two patterns produces invalid CSS. Related call-site cleanup: https://github.com/supabase/supabase/pull/51161 ## Solution - Rewrite the Sidebar docs as a shorter monorepo guide: import from `'ui'`, structure, theming, provider / sidebar props, menu building blocks, controlled mode, state styling. - Move Studio’s `--sidebar-*` aliases into shared `packages/ui` compat CSS so every app on the shared theme gets working `bg-sidebar` utilities. - Drop the duplicate definitions from Studio `globals.css`. Left alone on purpose: brand / destructive channel tokens and docs that correctly use `hsl(var(--brand-…))`. ## Review instructions Design-system preview: [design-system](https://design-system-git-dnywh-docssidebar-full-colour-tokens-supabase.vercel.app/) 1. [Live Sidebar docs](https://supabase.com/design-system/docs/components/sidebar) · [Preview Sidebar docs](https://design-system-git-dnywh-docssidebar-full-colour-tokens-supabase.vercel.app/design-system/docs/components/sidebar). Confirm the page is no longer the upstream essay: no broken images, no `/blocks` link, imports from `'ui'`, theming shows full-colour aliases. 2. Smoke Studio: left nav should look unchanged (same aliases, now from compat.css). 3. Optional: in DevTools, confirm `--sidebar-background` resolves to a full `oklch(...)` colour. ## Checklist - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) - [ ] If I wrote a new docs topic or edited an existing topic, I used the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs [style guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide) |
||
|
Danny White
|
b5c865521f |
feat(studio): notify users about the Terms of Service update (#51302)
## Problem Dashboard users need a notice about the Terms of Service update alongside #51106 and #51107. ## Solution Reuse the organisation landing-page notice pattern from #50397. A compact “We've updated our Terms of Service.” notice opens the explanation and agreement link through **Learn more**. Closing the notice or choosing **Got it** remembers dismissal in the browser with a new version-specific key. ```text Organisation landing page Notice → Learn more → Explanation and Terms of Service link Close / Got it → Remember dismissal ``` | After | | --- | | <img width="628" height="444" alt="CleanShot 2026-10-06 at 14 47 46@2x" src="https://github.com/user-attachments/assets/72922712-321f-4972-b20c-1a075e0745d0" /> | | _Banner_ | | <img width="1078" height="718" alt="CleanShot 2026-10-06 at 16 58 18@2x" src="https://github.com/user-attachments/assets/2109c2ab-e9b7-4855-8acb-42d5232cd002" /> | | _Dialog_ | ## Review instructions 1. Open `/organizations` or an organisation's `/org/<slug>` landing page in the hosted Studio preview. Expect the compact notice. 2. Click **Learn more**. Expect the explanation and a link to the Terms of Service. Escape closes the dialog without dismissing the notice. 3. Choose **Got it**, then reload. The notice stays dismissed. Repeat in a fresh browser profile using **Close banner**. 4. Open a project or an organisation settings page. The notice should not appear. |
||
|
Joshen Lim
|
eb20a4674d |
getTableDefinitionSql to escape SQL identifiers (#51258)
## Context Similar to domain to https://github.com/supabase/supabase/pull/51256 - `getTableDefinitionSql` doesn't escape SQL identifiers, which generates invalid SQL on the dashboard's table editor for the "Copy table schema" CTA, or the table definition tab. Also fixes the "Copy table schema" CTA which was missing the `scoped` parameter when calling `getTableDefinition` Changes here addresses this issue, can test with a table named like `test"table` |
||
|
Pamela Chia
|
20d6f2197f |
chore(studio): remove privacy policy notice (#51299)
I removed the Studio Privacy Policy update notice that #50397 added on 2026-09-16, when Privacy Policy v4 took effect. It has been up for almost three weeks, and the ToS v4 banner (#51109) goes out next. I did the same in #44380, removing the March 2026 privacy notice after 15 days. This is the exact inverse of #50397: the banner component and its test, the banner ID, the dismissal local storage key, and the org-landing path helper that only this notice used. ## To test Tested on Vercel preview: - [ ] In a fresh browser profile (no `privacy-policy-update-2026-09-16-dismissed` key), open `/organizations`: expect no Privacy Policy notice - [ ] Open `/org/<slug>`: expect no Privacy Policy notice and the project list renders normally - [ ] Open a project's Logs page: expect the logs deprecation banner behavior unchanged (only shows before its expiry) ## Linear - fixes GROWTH-1322 |
||
|
Danny White
|
0cb8bd95dd |
feat(studio): add spot colour control to Appearance (#50782)
## Problem The theme's primary hue can change in CSS, but Appearance had no way to try other spot colours. That makes it hard to find controls whose colour still depends on the fixed Supabase brand palette. ## Solution Add a **Spot color** control under Appearance → Theme colors (employee-only via ConfigCat `appearanceSpotColor`, targeted to Supabase Team Email). ### Spot color UX - Rainbow spectrum track with a thin outline so pale tracks stay visible - Live trifecta swatches for `--primary-solid`, `--primary`, and `--primary-bright` (darkest → lightest) next to the degree readout - Drag updates are rAF-batched so React paint and CSS preview stay to one frame ### Canvas tint coupling - `--surface-hue` is derived in CSS as `calc(var(--primary-hue) + var(--surface-hue-offset))` - Dark: offset `0` (same hue as spot) - Light: offset `180` (complementary canvas tint; brand green ≈157.5° → rose ≈337.5°) - No JS override of `--surface-hue`. Changing Spot color moves primary controls and the low-chroma canvas tint together ### Other theme sliders - Renamed **Color intensity** → **Surface tint** (it only drives the neutral ramp via `--chroma`, not spot chroma) - Meaning-shaped tracks for every knob (spectrum, grey→tint, soft→hard, dark→light, flat→lift) - Same outline treatment on those tracks | Before | After | | --- | --- | | <img width="1476" height="2174" alt="CleanShot 2026-10-05 at 15 02 21@2x" src="https://github.com/user-attachments/assets/d08b0fa8-32af-450e-adce-861f59c9d6ca" /> | <img width="1474" height="2354" alt="CleanShot 2026-10-05 at 14 56 35@2x" src="https://github.com/user-attachments/assets/9a1e6183-a4ba-4c8e-a458-bb0eea946db8" /> | | _Anyone else_ | _With staff flag, custom settings_ | ## Review instructions 1. Confirm ConfigCat flag `appearanceSpotColor` is on for your staff account (or flip it in the Dev Toolbar). 2. Open `/account/me` → **Appearance → Theme colors**. 3. Without the flag: Spot color is hidden; other theme sliders still work. 4. With the flag: drag Spot color in light and dark. Primary controls and canvas tint should move together; Supabase brand assets should stay fixed. 5. Raise Surface tint and confirm the canvas hue follows the complementary (light) or same-hue (dark) offset. 6. Refresh, switch modes, and use **Reset** to check persistence and defaults. |
||
|
Pamela Chia
|
a9078612f2 |
fix(www): stop cross-zone link prefetch (#51066)
About 95% of the 404s served on supabase.com are App Router RSC prefetches (`?_rsc=`) that www `<Link>`s fire at paths another zone serves: `/docs`, `/dashboard`, `/library`, and the footer's `humans.txt`, `lawyers.txt` and `security.txt`. Next.js can't prefetch or client-navigate across multi-zone boundaries, so each prefetch 404s even though the link itself works. I turned every www link into another zone into a plain `<a>` and added a lint rule so new ones stay that way. **Changed:** - **Cross-zone links are plain anchors**: links that always leave www (literal `/docs`, `/dashboard` and `.txt` hrefs, absolute `https://supabase.com/dashboard` URLs, the `getDashboardCtaHref` CTAs) render `<a>`. Renderers whose href comes from data (nav, footer, plan and add-on CTAs, product cards) branch on `isCrossZoneHref`, which reads the zone list from `lib/rewrites.js`. In-zone links stay `<Link>` and keep prefetching. - **New literal links can't regress**: `www/no-cross-zone-link` errors on a `next/link` `<Link>` whose literal or template href points at another zone. It evaluates `lib/rewrites.js` as production, so `/docs` counts in every environment. - **Click tracking survives the full navigation**: `sign_in_button_clicked`, `start_project_button_clicked` and `www_pricing_plan_cta_clicked` now send with `keepalive`, like `sign_in_submitted` already did, so an immediate page load can't cancel them. The mobile nav Sign in and Start your project buttons used `legacyBehavior`, which never called their `onClick`: PostHog has no `Mobile Nav` location for either event in the last 30 days. Those clicks report from this PR on. - **Typecheck no longer crashes**: the functions page's default export inferred a type through `RealtimeLogs`'s unexported `Props`, which makes the native TypeScript compiler panic during `tsc --noEmit`. I exported `Props`. **Note:** the lint rule only sees literal hrefs. A new renderer whose href comes from data needs its own `isCrossZoneHref` branch, and review is the only check on that. ## To test `/docs` is only rewritten on production and absolute `https://supabase.com/...` links are cross-origin on a preview, so the preview proves the relative non-docs cases (`/dashboard*`, `/library`, the footer .txt files). `/docs/...` prefetches still appear on the preview because it has no docs rewrite. Tested on Vercel preview: - [x] Open `/` with the network tab filtered to `_rsc` and scroll to the footer: no requests for `/dashboard*`, `/library`, `/design-system`, `/kb`, `/evals`, `/humans.txt`, `/lawyers.txt` or `/.well-known/security.txt`, while in-zone ones such as `/pricing`, `/features` and `/blog` still appear - [x] Same check on `/pricing`, `/auth`, `/database`, `/storage`, `/realtime`, `/edge-functions`, `/blog` and a blog post: no `_rsc` requests to `/dashboard*`, `/library` or the footer .txt files - [x] Open the Developers dropdown on desktop and the mobile menu at 390px: no new `_rsc` requests to `/dashboard*` or `/library` - [x] Click header Docs, footer Humans.txt, the hero Start your project button and the pricing Free plan button: each lands where it did before (`/docs`, `/humans.txt` text, `https://supabase.com/dashboard/sign-up`, `https://supabase.com/dashboard/new?plan=free`). Signed out, the Free plan button lands on the dashboard sign-in with `plan=free&returnTo=%2Fnew` - [x] Click the hero Start your project button: the `/platform/telemetry/event` POST with `start_project_button_clicked` completes with a 2xx after the page starts navigating. 201 with the navigation held; on the real navigation the event still reached staging PostHog - [x] At 390px, open the mobile menu and click Sign in: a `/platform/telemetry/event` POST with `sign_in_button_clicked` and `buttonLocation: "Mobile Nav"` fires. Start your project in the same menu also sends `start_project_button_clicked` with `buttonLocation: "Mobile Nav"` - [ ] Signed in, load `/`: no `/dashboard/projects?_rsc=` request (not run: the preview origin has no signed-in session) - [x] Open the desktop Product dropdown and the Product section of the 390px mobile menu: Compute shows its Private Alpha badge and the other products show none (checks the master merge into `MenuItem`) After deploy, `/` and `/pricing` on supabase.com show no `_rsc` requests to `/docs*`, `/dashboard*` or `/library`. After a full day, the share of supabase.com 404s carrying `_rsc=` should drop from about 95% to under 10%, and `sign_in_button_clicked` and `start_project_button_clicked` should start showing a `Mobile Nav` location in PostHog. ## Linear - fixes GROWTH-1294 |
||
|
Anthony Lio
|
dcf266c360 | feat(docs): update search v2 ui (#51175) | ||
|
Jeremias Menichelli
|
53ecbf9f2a |
chore: Add telemetry to search v2 user actions (#51146)
## Problem We need to collect data from search v2 experiment usage. ## Solution Add telemetry to search v2 modal being opened, closing, sending a query and clicking a search v2 result. <!-- ## Preview links If relevant, include links to changed pages for easy review access. Copy the preview base URL from the Vercel bot comment on this PR. Use the following table as an example template. | Site | Live | Preview | Search for | | -------------- | ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | ----------------------------- | | WWW | [/blog/your-post](https://supabase.com/blog/your-post) | [/blog/your-post](https://zone-www-dot-com-git-branch-name-supabase.vercel.app/blog/your-post) | unique phrase from the change | | Docs | [/docs/guides/your-page](https://supabase.com/docs/guides/your-page) | [/docs/guides/your-page](https://docs-git-branch-name-supabase.vercel.app/docs/guides/your-page) | unique phrase from the change | | Studio | [/dashboard](https://supabase.com/dashboard) | [/dashboard](https://studio-git-branch-name-supabase.vercel.app/dashboard) | unique phrase from the change | | Design system | [/design-system](https://supabase.com/design-system) | [/design-system](https://design-system-git-branch-name-supabase.vercel.app/design-system) | unique phrase from the change | | UI library | [/library](https://supabase.com/library) | [/library](https://ui-library-git-branch-name-supabase.vercel.app/library) | unique phrase from the change | | Knowledge base | [/kb/guides/your-page](https://supabase.com/kb/guides/your-page) | [/kb/guides/your-page](https://kb-git-branch-name-supabase.vercel.app/kb/guides/your-page) | unique phrase from the change | --> <!-- ## Additional context Optionally add any other context or screenshots. --> ## Review instructions 1. Open the preview link and add the search v2 flag query: `?docs-search-v2=search-v2-active` 2. Trigger all actions mentioned above 3. Telemetry data should be sent on the network tab ## Checklist Check all before review: - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) - [x] If I wrote a new docs topic or edited an existing topic, I used the `/write-the-docs` or `/edit-the-docs` skill, which references [WORD_LIST](https://github.com/supabase/supabase/blob/master/apps/docs/WORD_LIST.md) and the docs [CONTRIBUTING](https://github.com/supabase/supabase/blob/master/apps/docs/CONTRIBUTING.md) guide <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Documentation search activity is now recorded when the dialog opens from the keyboard shortcut or search input, and when it closes. Search submissions include the query and whether results were found; selected results include their destination and the highlighted query. This adds visibility into key search interactions without changing how search results or highlighting work. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
838fcaaa89 |
Joshenlim/fe 4509 fdw general UI consolidation and refactor (#51079)
## Context Stacks on top of https://github.com/supabase/supabase/pull/51074 PR's just mainly refactoring, no visual differences: - `CreateWrapperSheet` + `EditWrapperSheet` use the same UI components for the foreign tables section - Can be consolidated into one reusable component - `WrapperTableEditor` is still using `SidePanel` component - Can be swapped to use new `Sheet` component - Refactor `WrapperTableEditor`'s layout a little - added separators for clarity between sections <img width="400" alt="image" src="https://github.com/user-attachments/assets/b1983bf2-cff5-43eb-8b31-40a7abb65038" /> - Update `getCreateFDWSql` to just use the Foreign Data Wrapper's name from `wrapperMeta` since its now standardized <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a shared foreign-table selector for wrapper setup and editing, with options to view columns, add or edit table definitions, and remove tables. * Updated the table editor to use a sheet layout with a fixed footer. * **Bug Fixes** * Wrapper creation now uses the wrapper’s configured name when creating the server. * Foreign-table targets display the table name when other target details are unavailable. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
521881a899 |
Joshenlim/fe 4480 fdw create wrapper to only init fdw once users to name the (#51074)
## Context PR here refactors the way we manage Foreign Data Wrappers in the dashboard (Under Project -> Integrations), as there's some DX problems with the current behaviour. Currently whenever a user creates a new wrapper, the dashboard is creating both the Foreign Data Wrapper (`create foreign data wrapper...`) + server (`create server ...`). The former is **_redundant_** to create multiples of given that it just handles the `handler` and `validator`, whereas what matters more is the server which holds the connection credentials. Hence standard practice is usually one Foreign Data Wrapper with multiple servers. (The former just needs to be created once if not done yet) This also led to some problems as well when users created their own wrappers via SQL and tried to manage them through the dashboard GUI, leading to us having to add some guard rails to prevent managing wrappers sharing the same Foreign Data Wrapper ([ref](https://github.com/supabase/supabase/pull/50785)) ## Changes involved - When creating a wrapper, if the Foreign Data Wrapper has yet to be set up for the wrapper type, the dashboard will initialize one and subsequently use that same Foreign Data Wrapper for any new wrappers - When creating / editing a wrapper, users will name the **server** instead of the **wrapper** <img width="500" alt="image" src="https://github.com/user-attachments/assets/b3e61204-0e16-4599-84ac-af2aab5b93c2" /> - When deleting a wrapper, the clean up for vault secrets are now deterministic by referencing the wrapper's server options - RE backwards compatibility: Existing wrappers will _not_ be affected by the changes here - they can be edited / deleted as per normal ## Unrelated fixes + UI refactors added - Fix Iceberg Wrapper not showing the right form when adding new wrapper - Adjust form layouts in side panel to be horizontal instead of vertical (Follows Database -> Pipelines) - Clean up to use newer UI components like `ButtonTooltip` - Opt to hide Docs + Create CTA under `WrappersTab` if marketplace feature preview is enabled (Since these actions are already in the header, will be duplicates) - Consolidate foreign tables configuration for create + edit wrapper sheet into one component `ForeignTablesSelector` ## To test - [ ] Verify that existing wrappers with their own Foreign Data Wrapper can be edited correctly - [ ] Verify that existing wrappers with their own Foreign Data Wrapper can be deleted - [ ] Verify that existing wrappers with shared Foreign Data Wrapper can be edited correctly - [ ] Verify that existing wrappers with shared Foreign Data Wrapper can be deleted - [ ] Verify that new wrappers can be created - [ ] Verify that newly created wrappers can be edited correctly - [ ] Verify that newly created wrappers can be deleted |
||
|
Danny White
|
ba82106697 |
chore(www + studio): remove expired Select 2026 promo banners (#51245)
## Problem Supabase Select 2026 has finished. The promo banners already hide via the scheduled expiry from #51006, but the campaign code, assets, and wiring are still in the tree. ## Solution Remove the Select 2026 sitewide promotion across www and Studio: - Delete shared `Select26*` banner code, font, and tests from `ui-patterns` - Delete Studio `BannerSelect2026*` and its Banner Stack registration - Unmount the www announcement banner and revert the State of Startups spacing that only existed for it - Drop the Select-only session-replay `data-band` allowlist entry and lint ratchet baseline Event go pages, blog posts, and other Select content are left alone. The `Announcement` shell stays for the next campaign. ## Review instructions 1. Open the www homepage on the deploy preview. Confirm there is no Select announcement bar above the nav. 2. Open `/state-of-startups` on the deploy preview. Confirm the hero still looks correct with no extra top gap from the removed banner. 3. Open a hosted Studio dashboard page on the deploy preview. Confirm the Banner Stack no longer shows a Select card. ## Checklist - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) - [ ] If I wrote a new docs topic or edited an existing topic, I used the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs [style guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide) |
||
|
Joshen Lim
|
94b8b06eb2 |
Clean up auto region selection experiment (#51121)
## Context Just cleans up the experiment that was introduced [here](https://github.com/supabase/supabase/issues/50851) - can clean up feature flag in ConfigCat thereafter too <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Project Creation** * Removed the “Best available” region option. Choose a specific region or smart group when creating a project; the selected region name appears in the selector. * Recommended badges remain visible on recommended regions. * **Telemetry** * Project creation events no longer include details about the removed region option or the initial region recommendation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Francesco Sansalvadore
|
edb8a2dc31 |
fix(www): hover bug on www menu (#51194)
## Problem The website "freezes" after hovering the menu. ## Solution No more freeze. |
||
|
Francesco Sansalvadore
|
4617b6f4cb |
feat: compute landing page (#50899)
Compute landing page. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a Compute product page introducing ephemeral sandboxes and always-on HTTP services, with information on workloads, security, deployment, and common questions. * Added a private-alpha waitlist form with submission confirmation and error feedback. * Added Compute links and a “Private Alpha” badge in product navigation and the footer. * Added an animated diagram illustrating Compute workloads and their lifecycle. * **Documentation** * Added a Compute overview covering runtimes, scaling, security, deployment, and availability. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Anthony Lio
|
b13d6c2878 |
feat(chore): add a lint ratchet for shadcn rules (#51014)
## Problem shadcn lint rules has been soft landed in #50676 and are now on as warnings in every app, but nothing stops a PR from adding new violations linear: FE-4473 ## Solution - moved the ratchet script and its tests from `apps/studio/scripts` to `packages/eslint-config-supabase` so every app runs one copy - added a shared rule list, `packages/eslint-config-supabase/ratchet-rules.json` with the shadcn rules - www, docs, design-system, ui-library and learn get `lint-ratchet.yml` with one job per changed app (triggered by the app, `packages/**` or the lockfile) + a weekly `lint-ratchet-decrease.yml` (as for studio ratchet) - package tests run in `eslint-config-supabase-tests.yml` <!-- ## Preview links If relevant, include links to changed pages for easy review access. Copy the preview base URL from the Vercel bot comment on this PR. Use the following table as an example template. | Site | Live | Preview | Search for | | -------------- | ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | ----------------------------- | | WWW | [/blog/your-post](https://supabase.com/blog/your-post) | [/blog/your-post](https://zone-www-dot-com-git-branch-name-supabase.vercel.app/blog/your-post) | unique phrase from the change | | Docs | [/docs/guides/your-page](https://supabase.com/docs/guides/your-page) | [/docs/guides/your-page](https://docs-git-branch-name-supabase.vercel.app/docs/guides/your-page) | unique phrase from the change | | Studio | [/dashboard](https://supabase.com/dashboard) | [/dashboard](https://studio-git-branch-name-supabase.vercel.app/dashboard) | unique phrase from the change | | Design system | [/design-system](https://supabase.com/design-system) | [/design-system](https://design-system-git-branch-name-supabase.vercel.app/design-system) | unique phrase from the change | | UI library | [/library](https://supabase.com/library) | [/library](https://ui-library-git-branch-name-supabase.vercel.app/library) | unique phrase from the change | | Knowledge base | [/kb/guides/your-page](https://supabase.com/kb/guides/your-page) | [/kb/guides/your-page](https://kb-git-branch-name-supabase.vercel.app/kb/guides/your-page) | unique phrase from the change | --> <!-- ## Additional context Optionally add any other context or screenshots. --> ## Review instructions 1. run `pnpm --filter ./apps/www run lint:ratchet` 2. add `p-[13px]` to a `className` in any www component and run it again. it fails with `shadcn/no-arbitrary-values` and the file name with `(+1)` 3. revert change 4. run `pnpm --filter eslint-config-supabase test` and see 6 tests pass 5. in ci, check `Ratchet studio lint checks` and the `ratchet (<app>)` jobs for the apps this pr touches ## Checklist Check all before review: - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) - [x] If I wrote a new docs topic or edited an existing topic, I used the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs [style guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Developer Improvements** * Expanded automated lint checks to cover additional apps and shared package changes. * Added checks for arbitrary Tailwind values, unknown classes, and raw colors across supported apps. * Added automated baseline updates that can open or update a pull request when lint counts change. * Added tests for the lint configuration and support for combining multiple rule files. * Updated Studio lint notifications to exclude Shadcn rules with zero-baseline counts. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
531431cd77 |
docs: document MCP cost confirmation via elicitations (#50017)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update for the MCP cost confirmation launch ([AI-1161](https://linear.app/supabase/issue/AI-1161/write-the-docs)). ## What is the current behavior? The MCP server guide lists `get_cost` / `confirm_cost` but doesn't describe the elicitation-based cost confirmation flow that `@supabase/mcp-server-supabase` 0.12.0 introduces for `create_project` and `create_branch` on form-capable clients. ## What is the new behavior? - New **Cost confirmation** section in the MCP server guide: how the elicitation flow works (accept / decline / expiry / rate-change outcomes, all side-effect-free except accept), the zero-cost skip, client support, and how to tell which cost flow a connection uses. - New troubleshooting entry: "Cost confirmations do not appear in your MCP client". - Three `supa-mdx-lint` dictionary additions the new prose needs (`elicitation(s)`, `dialogs`, `pauses`). ## Additional context **Draft — hold until launch.** Merge gates before publishing: 1. The feature is enabled for hosted connections. 2. The client support table is re-verified against launch verification results (there's a matching `{/* ... */}` reviewer note above the table). Client support moves quickly; the table reflects verification as of 2026-09-04. Needs review: - **Rate-change behavior follows the shipped code, not the spec docs**: on any change to the computed cost between confirmation and creation (including a decrease), the server reissues a fresh confirmation rather than proceeding (`account-tools.ts` redemption path in supabase/mcp). Flagging in case the intent was lower-or-equal proceeds. - No exact confirmation expiry is stated because the TTL is deployment-configured (`ttlSeconds`). - Wording deliberately says "client-mediated" style confirmation and avoids claiming a person approved each action, since clients can answer elicitations via hooks. Test plan: `supa-mdx-lint` clean on both files; Prettier (repo config) clean. No runnable snippets, so no sandbox verification needed. Vercel preview link will appear below. 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added advanced options to hosted MCP connections for skipping selected cost or destructive-SQL confirmations when supported. Available options depend on connection scope, enabled features, and read-only settings. * The configuration panel explains when skip selections are unavailable or ignored by certain client configurations. * **Documentation** * Added guidance on cost and SQL confirmation prompts, Edge Function secret entry, and troubleshooting missing prompts or unavailable secret collection. This includes client requirements, fallback behavior, and relevant security considerations. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Barry Roodt <barry.roodt@supabase.io> |
||
|
Jeremias Menichelli
|
99103b3571 | feat: Add edge function and hooks for search V2 (#51103) | ||
|
Artur Zakirov
|
bd9a0ff4e6 |
feat(orioledb): rename orioledb from Public Alpha to Public Beta in dashboard (#50975)
## Problem We need to rename orioledb in Dashboard. ## Solution - Update Studio copy/badges referencing OrioleDB from "Public Alpha" to "Public Beta" (project creation advanced config, restore-to-new-project, PITR empty state) - Remove the scheduled-backups block that hid backups for OrioleDB projects — OrioleDB now has WAL-G scheduled backups in beta, so that page should behave normally. PITR keeps its existing guard since PITR is not yet supported for OrioleDB. - Update the `useOrioleDb` telemetry property doc-comment to reflect the beta status - Update project-creation wizard test expectations/fixtures accordingly (`release_channel: 'beta'`) Marketing (`apps/www`) and docs (`apps/docs`) references to OrioleDB alpha status are being updated separately. <!-- ## Preview links If relevant, include links to changed pages for easy review access. Copy the preview base URL from the Vercel bot comment on this PR. Use the following table as an example template. | Site | Live | Preview | Search for | | -------------- | ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | ----------------------------- | | WWW | [/blog/your-post](https://supabase.com/blog/your-post) | [/blog/your-post](https://zone-www-dot-com-git-branch-name-supabase.vercel.app/blog/your-post) | unique phrase from the change | | Docs | [/docs/guides/your-page](https://supabase.com/docs/guides/your-page) | [/docs/guides/your-page](https://docs-git-branch-name-supabase.vercel.app/docs/guides/your-page) | unique phrase from the change | | Studio | [/dashboard](https://supabase.com/dashboard) | [/dashboard](https://studio-git-branch-name-supabase.vercel.app/dashboard) | unique phrase from the change | | Design system | [/design-system](https://supabase.com/design-system) | [/design-system](https://design-system-git-branch-name-supabase.vercel.app/design-system) | unique phrase from the change | | UI library | [/library](https://supabase.com/library) | [/library](https://ui-library-git-branch-name-supabase.vercel.app/library) | unique phrase from the change | | Knowledge base | [/kb/guides/your-page](https://supabase.com/kb/guides/your-page) | [/kb/guides/your-page](https://kb-git-branch-name-supabase.vercel.app/kb/guides/your-page) | unique phrase from the change | --> <!-- ## Additional context Optionally add any other context or screenshots. --> ## Review instructions ## Checklist Check all before review: - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) - [x] If I wrote a new docs topic or edited an existing topic, I used the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs [style guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Updates** * OrioleDB is now labeled as being in public beta rather than public alpha, and project creation selects the beta release channel. * Restore-to-new-project and Point-in-Time Recovery notices clarify that these features are unavailable for OrioleDB projects. * OrioleDB projects now follow the standard eligibility checks and page flow for scheduled backups. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Pamela Chia
|
9690efeb42 |
fix(vault): link to current dashboard route (#51058)
I updated first-party Vault links to open the current secrets route directly. Wrapper credentials, extension metadata, and blog posts still linked to the retired path and relied on a redirect. ## To test On the preview: - [x] Inspect a Wrapper credential's Vault link. Expect `/integrations/vault/secrets` with a `search` query for that credential. - [x] Open the inspected target URL. Expect Vault to show the matching secret. - [ ] Click a Wrapper credential's Vault link. Expect the filtered Vault view. - [ ] Open the pgsodium extension's Vault link and a Vault blog link. Expect `/integrations/vault/secrets` without the retired route in the address bar. ## Linear - fixes GROWTH-1312 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Updates** * Vault secrets links now direct you to the project’s Integrations page, including links from wrapper metadata, blog articles, and the `pgsodium` extension listing. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Danny White
|
ed692f6905 |
feat(select): schedule livestream banners (#51006)
## Problem The Select banners on www and Studio still promote attendance. They need to keep serving the waitlist until the event, promote the livestream during the requested window, and disappear after the event. ## Solution Use a shared three-phase clock: existing promotion before 8:00am PT on 2 October, livestream promotion from 8:00am to 5:30pm PT, and no banner afterwards. Both livestream CTAs lead to `select.supabase.com`, where viewers can choose a stage. Separate dismissal keys let someone who dismissed the earlier promotion see the livestream. Open pages set a timer for the next boundary and recheck on visibility, focus, or page restore. | `www` | | --- | | <img width="736" height="136" alt="CleanShot 2026-09-29 at 16 27 38@2x" src="https://github.com/user-attachments/assets/1281bcf0-ece4-41fc-99d2-1f9ab6e1b3f5" /> | | _Until Friday 8am PT_ | | <img width="734" height="138" alt="CleanShot 2026-09-29 at 16 28 06@2x" src="https://github.com/user-attachments/assets/05b8779a-9961-4886-ad7d-96ba31c8b4f7" /> | | _Friday 8am to 5:30pm PT_ | | `studio` | | --- | | <img width="612" height="454" alt="CleanShot 2026-09-29 at 16 26 51@2x" src="https://github.com/user-attachments/assets/0d9a8bbb-c636-41dc-aa76-381196c149c2" /> | | _Until Friday 8am PT_ | | <img width="616" height="440" alt="CleanShot 2026-09-29 at 16 27 09@2x" src="https://github.com/user-attachments/assets/458afdb9-6576-4699-9419-947ca5312bcd" /> | | _Friday 8am to 5:30pm PT_ | ## Review instructions 1. Open the [www homepage](https://zone-www-dot-com-git-dnywh-select-2026-livestre-93dab1-supabase.vercel.app/) and a [hosted Studio dashboard](https://studio-staging-git-dnywh-select-2026-livestream-05b822-supabase.vercel.app/) in separate tabs. If the Privacy Policy update card is in front in Studio, close it (only) to reveal the Select banner. 2. In each tab's DevTools console, paste this helper: ```js window.selectRealNow = Date.now window.showSelectAt = (iso) => { Date.now = () => new Date(iso).getTime() window.dispatchEvent(new Event('focus')) } ``` 3. Run `showSelectAt('2026-10-02T07:59:00-07:00')`: both banners keep the existing “Apply to attend” CTA. 4. Run `showSelectAt('2026-10-02T08:00:00-07:00')`: www shows “Supabase Select 2026” and “Watch the livestream”; Studio shows the same title, the description “Keynote, main stage, and build stage, streamed all day.” and “Watch livestream”. Both CTAs link to `https://select.supabase.com/`. 5. Run `showSelectAt('2026-10-02T17:30:00-07:00')`: neither banner is visible. Restore the clock with `Date.now = window.selectRealNow; window.dispatchEvent(new Event('focus'))`. The console clock override affects only the current tab and is lost on reload. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - The Select 2026 banner switches from waitlist messaging to livestream details and a “Watch livestream” link during the livestream period. - Livestream banner dismissals are tracked separately from waitlist banner dismissals. - Promotion banners end at 5:30 p.m. Pacific on October 2, 2026, and update when the promotion changes phase, including after returning to an open tab. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
0daafca2ca |
feat(studio): status page banner (incident / maintenance / upcoming) (#51044)
## Summary * Adds a new global status banner (`StatusBanner`) driven by the [incident.io](<http://incident.io>) status page data, showing at most one of: an active incident, in-progress maintenance, or upcoming maintenance, in that priority order. * All three types are independently dismissible (persisted to a new localStorage key, `status-banner-dismissed-keys`); dismissal hides the banner for items still active, and a new incident reappears even if a related item was previously dismissed. * Only shows to users who are actually affected (based on their projects' regions) or when region data is incomplete (fails open), and is bypassed entirely by the existing emergency incident override. * Behind the existing `incidentIoStatusPage` ConfigCat flag — `AppBannerWrapper` renders this new banner instead of the legacy `StatusPageBanner` only when the flag is on; default behavior is unchanged. * This is PR 5b in a stacked series for Linear [FE-4057](https://linear.app/supabase/issue/FE-4057) — see that issue for full design context. ## Test plan * New unit tests (`StatusBanner.utils.test.ts`) covering banner-selection priority, dismissal-key handling, and copy generation * New MSW component test (`StatusBanner.test.tsx`) covering loading state, dismiss-and-persist, and the emergency-override path * `pnpm --filter studio run typecheck`, `lint:ratchet`, `pnpm knip --workspace apps/studio`, `pnpm test:prettier`, and relevant vitest suites all pass 🤖 Generated with [Claude Code](<https://claude.com/claude-code>) Co-Authored-By: Claude [noreply@anthropic.com](<mailto:noreply@anthropic.com>) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added status banners for relevant incidents and scheduled maintenance, including incident details, maintenance timing, and links to the status page. * Banners can be dismissed, and dismissed items stay hidden while new incidents or maintenance updates can still appear. * Upcoming maintenance banners appear within the relevant lead time, and maintenance timing is shown when available. * Emergency overrides display a warning banner without a dismiss option. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Pamela ChiaandJoshen Lim
|
4a941518e3 |
feat(studio): track Explorer runs and saves (#51004)
I added outcome events for Explorer query runs and successful manual notebook saves. Existing page visits and preview toggles do not show whether users complete queries or persist notebooks. **Changed:** - **Query usage:** Accepted runs from query tabs and notebook cells emit submitted and terminal outcome events with a shared run ID. Canceled confirmations emit no run events. - **Notebook adoption:** Successful manual saves emit created or updated events. Recreated notebooks count as creations. Unsaved drafts and failed saves emit neither. - **Event metadata:** Explorer action events use `Explorer` as their page title. **Note:** Assistant-generated saves are outside this PR. Custom properties omit SQL and notebook content. Page visits still carry the browser title, which can include a notebook name. ## To test Tested on the staging preview: - [x] Run valid and invalid SQL from an Explorer query tab. Each run emits one submitted event and one matching completed or failed event with the same run ID. - [x] Run database and Logs notebook query cells, then add a markdown cell. The query cells emit matching event pairs; the markdown cell emits no query event. - [x] Save a new notebook, then edit and save it again. The successful saves emit created and updated events. - [x] Cancel a guarded query. It emits no query run event. - [ ] Recreate a notebook deleted on the server after local edits. A successful save emits created, not updated. - [x] Inspect an Explorer action event request. Its page title is `Explorer`; page visits still use the browser title. - [ ] Force a notebook save failure. It should emit no save event. This case was not tested manually. ## Linear - fixes GROWTH-1298 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Analytics** * Explorer query runs are tracked for database and log queries, including whether they complete or fail. * Query activity is associated with its location in Explorer, such as a query tab or notebook cell. * Successful notebook saves are tracked as creations or updates. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Anthony Lio
|
8ebbfe3272 |
feat(chore): bump cn (#51016)
## Problem currently using `cn` 0.2.5 makes `@shadcn/lint` lint run printed a notice as it needs 0.3.2 or later ## Solution - added `cn: ^0.4.0` to the pnpm catalog. `packages/ui` and `blocks/vue` now use `catalog:` so they stay on the same version - added `cn` to the root `devDependencies` - runtime changes from 0.2.5 to 0.4.0 <!-- ## Preview links If relevant, include links to changed pages for easy review access. Copy the preview base URL from the Vercel bot comment on this PR. Use the following table as an example template. | Site | Live | Preview | Search for | | -------------- | ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | ----------------------------- | | WWW | [/blog/your-post](https://supabase.com/blog/your-post) | [/blog/your-post](https://zone-www-dot-com-git-branch-name-supabase.vercel.app/blog/your-post) | unique phrase from the change | | Docs | [/docs/guides/your-page](https://supabase.com/docs/guides/your-page) | [/docs/guides/your-page](https://docs-git-branch-name-supabase.vercel.app/docs/guides/your-page) | unique phrase from the change | | Studio | [/dashboard](https://supabase.com/dashboard) | [/dashboard](https://studio-git-branch-name-supabase.vercel.app/dashboard) | unique phrase from the change | | Design system | [/design-system](https://supabase.com/design-system) | [/design-system](https://design-system-git-branch-name-supabase.vercel.app/design-system) | unique phrase from the change | | UI library | [/library](https://supabase.com/library) | [/library](https://ui-library-git-branch-name-supabase.vercel.app/library) | unique phrase from the change | | Knowledge base | [/kb/guides/your-page](https://supabase.com/kb/guides/your-page) | [/kb/guides/your-page](https://kb-git-branch-name-supabase.vercel.app/kb/guides/your-page) | unique phrase from the change | --> <!-- ## Additional context Optionally add any other context or screenshots. --> ## Review instructions 1. run `pnpm install` 2. run `pnpm --filter ui exec vitest run` and `pnpm --filter ui-patterns exec vitest run` and see them pass 3. run `pnpm --filter @supabase/vue-blocks run typecheck` and see it pass ## Checklist Check all before review: - [x] I have read [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) - [x] If I wrote a new docs topic or edited an existing topic, I used the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs [style guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated package version management across the project to keep related packages aligned. This maintenance change does not alter the app’s features or behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Anthony Lio
|
e7f0d3c04f |
fix(ui): popover component (#50657)
## What kind of change does this PR introduce? fixture on the popover + command components ## What is the current behavior? currently there is a misalignment in the command component <> searchbar icon and items + the popover menu animation in is slightly scattered ## What is the new behavior? - fixes icon alignment in command component - updates popover animation in `command` | state | preview | | -------|------| | before | <img width="881" height="542" alt="image" src="https://github.com/user-attachments/assets/e38aa22f-5eea-4b08-8a24-254e26bf90fe" /> | | after | <img width="881" height="542" alt="image" src="https://github.com/user-attachments/assets/85608e11-8415-4d47-945f-cc13772e4ad1" /> | `popover` | state | preview | | -------|------| | before | <video src="https://github.com/user-attachments/assets/cbb2da1a-6f73-4a8d-87d6-21e8b636c110" /> | | after | <video src="https://github.com/user-attachments/assets/1b0832f5-e6ac-4e93-ae78-9e0aee31205c" /> | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Style** - Adjusted command input spacing for improved visual alignment. - Updated popover transitions with state-based fade and zoom animations, and refined their visual origin. - Set a consistent size for the AI docs command icon. - **New Features** - Added an option to customize the command menu input wrapper’s styling. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Manan Gupta
|
951a22183a |
feat: regenerate api types from production (#51019)
## Summary
- Regenerates `packages/api-types/types/{api-v2,platform}.d.ts` from the
live production OpenAPI specs (via the new `pnpm --filter=api-types run
codegen:prod`), picking up everything that's shipped to production since
the committed types were last regenerated.
- Notably includes `high_availability` on the `available-regions` and
`available-versions` project-creation pre-flight endpoints, which
unblocks the Studio-side wiring in #50902.
- Fixes one collateral typecheck break the regen surfaces: the invoice
schema's `prepaid_credits_applied_cents` field became required, and
`InvoicesSettings.test.tsx`'s mock invoice builder didn't set it.
## Description
`api-v1.d.ts` needed no changes — it was already in sync with
production. `api-v2.d.ts` and `platform.d.ts` pick up unrelated drift
that has landed on production independently of this change (a few new
fields/endpoints), verified against `pnpm api:verify-types` passing
clean and `pnpm typecheck` passing across the whole monorepo.
This PR is intentionally separate from #50902 (the Studio-side High
Availability pre-flight fix) so that PR's diff stays focused on the
actual feature work. #50902 will be rebased once this merges.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Updated the invoice test fixture to default prepaid credits applied to
zero.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Signed-off-by: GuptaManan100 <guptamanan100@gmail.com>
|
||
|
Joshen Lim
|
9aae037dff |
Joshenlim/fe 4475 fdw update sql to run proper alter statements instead of (#50988)
## Context Currently for FDWs under integrations, editing an FDW involves tearing it down then re-creating it - which while conveniently works has a lot of problems like: - Blast radius is way bigger than the edit - Everything is recreated, including vault secrets - Silent drops grants/comments/ownership - Cascades on dependent objects - Views or functions built on top of foreign tables would get dropped along with it Changes in this PR hence updates `getUpdateFDWSql` to diff the current wrapper state against the form state and generate targeted `ALTER` statements for only what actually changed ## To test - [ ] Verify that updating an existing wrapper still works as expected <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Wrapper changes can be saved in place, including server options, encrypted values, foreign tables, and column definitions. * Input fields can display placeholder text, and missing server-option values display their defaults. * **Improvements** * Saving is unavailable until encrypted values are ready; a waiting message appears while they load. * The edit panel closes after a successful save. Confirmation text explains that table or column changes may affect dependent functionality. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
kemal.earth
|
864cca6cda |
fix(design-system): update border radius for menu items (#50973)
## Problem Border radiuses for inner items of dropdowns, menus etc. didn't keep up with recent changes. ## Solution Adds a token/variable to help keep this consistent across our apps and components. One caveat is this modifies shadcn components, so I'm open to alternative ways of doing this. | Before | After | |--------|--------| | <img width="293" height="206" alt="Screenshot 2026-09-28 at 12 00 27" src="https://github.com/user-attachments/assets/cd5e0708-0223-43ac-9893-a33ce5acd1ca" /> | <img width="335" height="231" alt="Screenshot 2026-09-28 at 12 00 41" src="https://github.com/user-attachments/assets/dc993b09-1410-4596-ae8f-4e78e6739fa6" /> | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Standardized corner rounding across command items, context menus, dropdown menus, menubars, select options, and multi-select options. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
93a262d185 |
Check region selection for project creation (#51012)
## Context Previously added telemetry for `selectedRegionOption` and `selectedRegionOptionType` [here](https://github.com/supabase/supabase/issues/50851) if the best available region option is available for users Opting to extend this telemetry (still just for Free plan orgs) irregardless if best available region was selected and include `initialRecommendedRegion` Main thing to understand is what regions users are spinning projects up in outside of the recommended option ## To test - [ ] Verify the telemetry network request after creating projects - [ ] Non-free plan: Telemetry request doesn't have `initialRecommendedRegion` in the payload - [ ] Free plan: Telemetry request has `initialRecommendedRegion` in the payload - Sends correctly if best available region option is available (default behaviour for staging) - Sends correctly if best available region option is NOT available (override with dev tools the configcat flag) |
||
|
Dongha
|
2c5b0a5ca0 |
fix(ui): fall back to writeText when clipboard.write fails (#50777)
## Problem Safari can expose `navigator.clipboard.write()` while rejecting it with `NotAllowedError`. Studio's shared clipboard helper treated that rejection as a terminal failure, so Copy buttons showed "Unable to copy to clipboard" even though `writeText()` worked. Fixes #50769 ## Solution - Fall back to `navigator.clipboard.writeText()` when the rich clipboard write fails. - Preserve the existing success callback and error behavior. - Add regression coverage for fallback success, total failure, and callback exceptions. ## Verification - `pnpm exec vitest run lib/helpers.test.ts --pool=threads` - `pnpm test:prettier` - `pnpm --filter ui run typecheck` - `pnpm --filter studio run typecheck` - `pnpm --filter studio run lint` - `npm run build -- --filter=studio` - Rendered browser verification with `clipboard.write()` forced to reject; `writeText()` received the expected payload and the Copy button showed success. ## Review instructions 1. Review the fallback logic in `packages/ui/src/lib/utils/clipboard.ts`. 2. Review the regression tests in `apps/studio/lib/helpers.test.ts`. 3. Confirm no generated or vendored files are changed. - [x] I have read CONTRIBUTING.md - [x] This PR does not change documentation content. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Copying now falls back to standard clipboard copying when rich clipboard access is unavailable or denied. * An error message is shown only when both clipboard methods fail. Successful rich clipboard writes do not trigger a fallback if a follow-up action fails. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |