Commit Graph
286 Commits
Author SHA1 Message Date
Gildas Garcia 77004016f4 fix: cannot resize table editor columns on safari (#43450)
## Problem

On Safari, it's impossible to resize a column.

## Solution 

This is actually a bug in `react-data-grid` that has been fixed in more
recent versions but we can't use them.
Patch the package

## How to test

- Open the any table in the _Table editor_
- Resize a column
2026-03-06 08:01:22 +01:00
549ca3677e feat: add similar threads on contribute (#42638)
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

This adds a component showing a list of AI curated related threads to
the detail thread view.

## What is the current behavior?

This is not available.

## What is the new behavior?

A new component on the thread view.

## Additional context

Add any other context or screenshots.

---------

Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-03-05 12:06:55 -05:00
Ivan Vasilov e0a736181a chore: Bump next in studio to v16.1.6 (#43149)
This pull request upgrades the `next` framework and its related
dependencies from version 16.0.11 to 16.1.6 across the `studio` project.
2026-03-05 11:59:43 +01:00
Matt Rossman 00436076bb chore(studio): bump mcp-server-supabase to 0.7.0 and mcp-utils to 0.4.0 (#43356)
Bumps `@supabase/mcp-server-supabase` from 0.6.3 to 0.7.0 and
`@supabase/mcp-utils` from 0.3.2 to 0.4.0.

**References**
- https://github.com/supabase-community/supabase-mcp/releases/tag/v0.7.0

Closes AI-462
2026-03-04 14:50:41 -05:00
af3b8971c5 feat: update @supabase/*-js libraries to v2.98.1-canary.0 (#43378)
This PR updates @supabase/*-js libraries to version 2.98.1-canary.0.

**Source**: manual

**Changes**:
- Updated @supabase/supabase-js to 2.98.1-canary.0
- Updated @supabase/auth-js to 2.98.1-canary.0
- Updated @supabase/realtime-js to 2.98.1-canary.0
- Updated @supabase/postgest-js to 2.98.1-canary.0
- Refreshed pnpm-lock.yaml

This PR was created automatically.

Co-authored-by: mandarini <6603745+mandarini@users.noreply.github.com>
Co-authored-by: Katerina Skroumpelou <mandarini@users.noreply.github.com>
2026-03-04 16:33:48 +02:00
Ivan Vasilov de3a9eb4db chore: Bump vulnerable dependencies (#43371)
This PR bumps and fixes the following vulnerabilities in the following
deps:
- minimatch
- rollup
- ajv
- devalue
- hono

It also dedupes the @babel deps.
2026-03-04 14:48:17 +01:00
Terry Sutton fc06ffc901 Fix contribute table component (#43298)
Updates react-markdown to be compatible with  remark-gfm

Example issue: 
https://supabase.com/contribute/t/860-66969-11493-reddit_post_1rinknm

fixed: 

https://zone-www-dot-com-git-chore-fix-table-component-supabase.vercel.app/contribute/t/860-66969-11493-reddit_post_1rinknm
2026-03-02 13:21:10 -03:30
Ivan Vasilov b03866f023 chore: Bump vulnerable dependencies (#43148)
This pull request primarily updates dependencies across the project to
their latest versions, improving compatibility, security, and
performance. It also modifies configuration files to align with the
current package management setup.

Dependency upgrades (core libraries and tools):
Bumps dependencies to solve the following issues:
- https://github.com/supabase/supabase/security/dependabot/2855
- https://github.com/supabase/supabase/security/dependabot/2844
- https://github.com/supabase/supabase/security/dependabot/2860
- https://github.com/supabase/supabase/security/dependabot/2815
- https://github.com/supabase/supabase/security/dependabot/2774
- https://github.com/supabase/supabase/security/dependabot/2836
- https://github.com/supabase/supabase/security/dependabot/2816
- https://github.com/supabase/supabase/security/dependabot/2778
- https://github.com/supabase/supabase/security/dependabot/2790
- https://github.com/supabase/supabase/security/dependabot/2793

Configuration and lock file updates:

* Changed `.prettierignore` to ignore `pnpm-lock.yaml` instead of
`package-lock.json`, reflecting the switch to pnpm as the package
manager.
* Updated dependency overrides in `pnpm-lock.yaml` for `tar` and
`fast-xml-parser` to ensure consistent versions across the workspace.

These updates collectively ensure the project stays current with its
dependencies, reduces potential vulnerabilities, and improves overall
stability and maintainability.
2026-03-02 17:07:55 +01:00
supabase-supabase-autofixer[bot]andsupabase-releaser[bot] 8dd8daeddf feat: update @supabase/*-js libraries to v2.98.0 (#43212)
This PR updates @supabase/*-js libraries to version 2.98.0.

**Source**: supabase-js-stable-release

**Changes**:
- Updated @supabase/supabase-js to 2.98.0
- Updated @supabase/auth-js to 2.98.0
- Updated @supabase/realtime-js to 2.98.0
- Updated @supabase/postgest-js to 2.98.0
- Refreshed pnpm-lock.yaml

This PR was created automatically.

Co-authored-by: supabase-releaser[bot] <223506987+supabase-releaser[bot]@users.noreply.github.com>
2026-02-27 11:59:36 +00:00
Charis 9923496486 chore: update prose linter (#43147) 2026-02-25 09:39:21 -05:00
supabase-supabase-autofixer[bot]andmandarini 5570451040 feat: update @supabase/*-js libraries to v2.97.1-canary.3 (#43139)
This PR updates @supabase/*-js libraries to version 2.97.1-canary.3.

**Source**: manual

**Changes**:
- Updated @supabase/supabase-js to 2.97.1-canary.3
- Updated @supabase/auth-js to 2.97.1-canary.3
- Updated @supabase/realtime-js to 2.97.1-canary.3
- Updated @supabase/postgest-js to 2.97.1-canary.3
- Refreshed pnpm-lock.yaml

This PR was created automatically.

Co-authored-by: mandarini <6603745+mandarini@users.noreply.github.com>
2026-02-24 16:33:58 +02:00
Charis e60b6a6a2e chore: properly add eslint-plugin-jsx-a11y package (#43108)
YES

## What kind of change does this PR introduce?

Chore / dependency fix

## What is the current behavior?

`eslint-plugin-jsx-a11y` was referenced in `eslint.config.json` but was
not listed in `package.json`, causing module resolution errors in the
IDE.

## What is the new behavior?

The package is properly added to `package.json` so it resolves correctly
in both ESLint and the IDE.
2026-02-23 20:13:05 +00:00
Ivan Vasilov 637b6fb792 chore: update react-resizable-panels to v4 to support pixel width (#42990)
This pull request standardizes the usage of props and value types for
the `ResizablePanelGroup` and `ResizablePanel` components across
multiple files in the codebase. Specifically, it replaces the deprecated
`direction` prop with `orientation`, and updates numeric prop values
(such as `defaultSize`, `minSize`, and `maxSize`) to be passed as
strings. This ensures consistency with the updated component API and
improves type safety.

**Component API Updates:**

* Replaced the `direction` prop with `orientation` for all usages of
`ResizablePanelGroup`
* Updated all `ResizablePanel` props (`defaultSize`, `minSize`,
`maxSize`) to be passed as strings instead of numbers, ensuring
compatibility with the latest API requirements.
* Removed deprecated or unnecessary props such as `order` from
`ResizablePanel` components, and ensured all size-related props are
consistently formatted as strings.
2026-02-23 19:48:19 +01:00
Alan Daniel 32330e26c0 New Campaign Pages: /go (#42920)
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES/NO

## What kind of change does this PR introduce?

Bug fix, feature, docs update, ...

## What is the current behavior?

Please link any relevant issues here.

## What is the new behavior?

Feel free to include screenshots if it includes visual changes.

## Additional context

Add any other context or screenshots.
2026-02-23 15:47:03 +00:00
Ivan VasilovandJoshen Lim 75644f8396 chore: Bump react-data-grid to fix a Sentry issue (#42934)
This pull request updates the `react-data-grid` dependency and refactors
code throughout the codebase to use the new import structure and updated
APIs. The changes improve compatibility with the latest version of
`react-data-grid`, simplify imports, and update row selection logic to
match new hook signatures. Additionally, some code is reorganized to use
absolute imports for internal components.

---------

Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
2026-02-20 14:10:13 +01:00
Matt Rossman e8ab92408f feat(assistant): enable Braintrust tracing for non-sensitive chats (#42963)
Enables Braintrust tracing for AI Assistant chats to support debugging
and future online evals.

**Code Changes**

- Wraps `generateAssistantResponse` in a Braintrust `traced()` span,
logging the user's latest message as input along with metadata
(`chatId`, `chatName`, `projectRef`, `userId`, `orgId`, `planId`, etc.)
- Threads JWT claims from `apiWrapper` → handler to log `userId` in
Braintrust without an extra API call (+ expanded `apiWrapper` tests)
- Threads `orgId` and `planId` from `getOrgAIDetails` to log in
Braintrust

**Infrastructure Changes**

- Created a "Vercel" service account in Braintrust
- Added `BRAINTRUST_API_KEY` and `BRAINTRUST_PROJECT_ID` env vars to the
studio-staging project in Vercel using a service token for the above
service account
- Added an "Overview" view to the Logs tab in the Braintrust Assistant
project to surface the new metadata

**Precautions**

- HIPAA sensitive projects are excluded from logging (see
https://github.com/supabase/supabase/pull/42787 for the detection logic)
- Production is temporarily excluded from logging until we're confident
in the setup

**Testing steps**

- Chat with the AI Assistant in the [studio-staging preview
build](https://github.com/supabase/supabase/pull/42963#issuecomment-3917178023)
below
- Visit the [Logs tab in the Braintrust Assistant
project](https://www.braintrust.dev/app/supabase.io/p/Assistant/logs)
and inspect the trace

<img width="4680" height="962" alt="CleanShot 2026-02-18 at 17 43 55@2x"
src="https://github.com/user-attachments/assets/c3a11b21-4e7f-4e90-bdab-a25ab8ee0d1f"
/>

<img width="2632" height="1288" alt="CleanShot 2026-02-18 at 17 45
04@2x"
src="https://github.com/user-attachments/assets/6c7b6ebc-5090-4ede-8f71-859ff7e386aa"
/>

**References**
- https://www.braintrust.dev/docs/integrations/sdk-integrations/vercel
- https://www.braintrust.dev/docs/instrument/custom-tracing

Closes AI-438
2026-02-19 11:43:47 -05:00
supabase-supabase-autofixer[bot]andmandarini 1814e88a3c feat: update @supabase/*-js libraries to v2.97.1-canary.0 (#43018)
This PR updates @supabase/*-js libraries to version 2.97.1-canary.0.

**Source**: manual

**Changes**:
- Updated @supabase/supabase-js to 2.97.1-canary.0
- Updated @supabase/auth-js to 2.97.1-canary.0
- Updated @supabase/realtime-js to 2.97.1-canary.0
- Updated @supabase/postgest-js to 2.97.1-canary.0
- Refreshed pnpm-lock.yaml

This PR was created automatically.

Co-authored-by: mandarini <6603745+mandarini@users.noreply.github.com>
2026-02-19 15:50:00 +00:00
Ivan Vasilov 682931e6c8 fix: Bump resizable package and fix minor issues (#42892)
This pull request upgrades the `react-resizable-panels` dependency from
version 2.x to 3.x. It also includes some minor improvements to
component props and key usage for React elements.

**Dependency upgrade:**

* Upgraded `react-resizable-panels` from version 2.1.4 to 3.0.0.

**Component improvements:**

* Added a `key` prop to the `ResizablePanelGroup` in `LogTable.tsx` and
to action buttons in `UnifiedLogs.tsx` to help React identify elements
more efficiently.
* Ensured unique `key` props for icons rendered in a map in
`FilterSideBar.tsx` to prevent React warnings.
2026-02-19 15:15:19 +00:00
Ivan Vasilov 8f1ad8b5ed chore: bump @radix-ui/react-tooltip to version 1.2.8 (#42929)
* Upgraded `@radix-ui/react-tooltip` from version `^1.1.6` to `^1.2.8`
in `package.json` and all relevant entries in `pnpm-lock.yaml` to use
the latest release.
2026-02-19 18:27:12 +08:00
supabase-supabase-autofixer[bot]andsupabase-releaser[bot] 36592e0a2e feat: update @supabase/*-js libraries to v2.97.0 (#42982)
This PR updates @supabase/*-js libraries to version 2.97.0.

**Source**: supabase-js-stable-release

**Changes**:
- Updated @supabase/supabase-js to 2.97.0
- Updated @supabase/auth-js to 2.97.0
- Updated @supabase/realtime-js to 2.97.0
- Updated @supabase/postgest-js to 2.97.0
- Refreshed pnpm-lock.yaml

This PR was created automatically.

Co-authored-by: supabase-releaser[bot] <223506987+supabase-releaser[bot]@users.noreply.github.com>
2026-02-18 17:14:13 +02:00
Ivan Vasilov a41d7138a5 feat: add vitest configuration and tests for X-Robots-Tag headers (#42873)
This pull request introduces a testing setup for the Next.js app using
Vitest. The main changes include the addition of a test configuration,
test scripts, and a sample test for the Next.js config. It also adds
relevant dependencies to support Vitest and path resolution, and updates
the lock file accordingly.

Testing infrastructure:

* Added a sample test file `next.config.test.ts` using Vitest to verify
that specific headers are present in the Next.js configuration.
* Created a Vitest configuration file `vitest.config.ts` with TypeScript
path resolution support via the `vite-tsconfig-paths` plugin.

Scripts and dependencies:

* Added `test` and `test:watch` scripts to `package.json` for running
and watching tests, and included `vitest` and `vite-tsconfig-paths` as
dev dependencies.
2026-02-17 07:15:55 -07:00
Ivan VasilovandClaude Haiku 4.5 3a98d32b6e chore: upgrade next-mdx-remote to v6 in apps/docs (#42748)
## I have read the CONTRIBUTING.md file.

YES

## What kind of change does this PR introduce?

Dependency upgrade (next-mdx-remote v4 → v6)

## What is the current behavior?

The docs app uses next-mdx-remote v4.4.1 with MDX v2.

## What is the new behavior?

- Upgraded to next-mdx-remote v6.0.0 (uses MDX v3)
- Updated @mdx-js/loader and @mdx-js/react to v3
- Upgraded remark-gfm to v4 for MDX v3 compatibility
- Removed deprecated `useDynamicImport` option (now default)
- Added `blockJS: false` to preserve JS expressions in MDX content

Build compiles successfully. Testing shows the same pre-existing
prerender error on /guides/troubleshooting as on master (supabaseUrl is
required).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Upgraded MDX and markdown tooling to major releases (MDX v3,
next-mdx-remote v6, remark-gfm v4).
* Adjusted MDX serialization to disable embedded JS handling and remove
legacy dynamic-import behavior for more consistent rendering of docs,
guides, and code examples.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
2026-02-12 19:01:53 +00:00
Ivan Vasilov a5511386ce chore: Clean up unused files from a project creation experiment (#42690)
This PR removes the onboarding schema generation and visualization
feature from the project creation flow. This was part of an experiment
which has been tested and shut down.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Revert**
* Removed project creation workflow components and related UI surfaces
including the initial setup interface, project visual preview, and
schema generation assistant.
  * Removed database schema visualization and diagram components.
  * Cleaned up associated package dependencies.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-02-12 10:15:14 +01:00
Ivan Vasilov be781d49a0 chore: Remove the cms app from the repo (#42686)
This PR removes the `payload` `cms` app that was added for the marketing
blog posts. We never started using it, it just adds additional work in
keeping the dependencies updated.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Removed the CMS application and associated infrastructure, including
configuration files, build scripts, and environment management.
* Simplified project build configuration and removed CMS-related
dependencies from deployment workflows.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-02-11 12:23:24 +01:00
Ivan Vasilov 21d7ac0518 chore: Remove CMS code from the www app (#42648)
This PR removes all CMS code from the `www` app. This includes fetching
of blog posts, API routes for proxying blog posts and types.

All functionality should remain the same (and the number of blog posts
should be the same).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Removed CMS integration, APIs, preview/draft/revalidate endpoints,
related env vars and dependency; switched to static markdown-only blog
pipeline.
* **Refactor**
* Simplified image and author resolution, tightened component props to
static post shapes, and migrated imports to path aliases.
* **Documentation**
  * Deleted CMS integration docs and rich-text conversion helpers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-02-11 11:40:57 +01:00
Ivan Vasilov 69ce915a9e chore: Rename SUPABASE_PUBLISHABLE_OR_ANON_KEY to SUPABASE_PUBLISHABLE_KEY for all blocks (#42652)
This PR renames all `SUPABASE_PUBLISHABLE_OR_ANON_KEY` env vars into
`SUPABASE_PUBLISHABLE_KEY` to make the new API keys default. This is in
coordination with the rest of the docs.

I've also cleaned up the `blocks/vue` package from unused files.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Breaking Changes**
* Public environment variable names renamed from PUBLISHABLE_OR_ANON_KEY
→ PUBLISHABLE_KEY across all framework integrations; update your
environment configs.

* **Documentation**
* All framework guides, .env examples and registry docs updated to use
the new variable names.

* **Chores**
* Cleaned up UI registry/templates: some example Vue registry items and
autogenerated registry artifacts were removed or simplified.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-02-11 10:23:16 +01:00
Ivan Vasilov 4decdd3680 chore: Update TanStack blocks to latest TanStack libs (#42410)
This PR updates the TanStack blocks to the latest versions of their
libs. There were some minor renames in the functions. Everything should
work the same.

How to test:
1. Install the block for password-based auth and social auth
2. Follow the instructions from
https://supabase.com/ui/docs/tanstack/password-based-auth

Also fixes
https://github.com/supabase/supabase/security/dependabot/2674.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Updated @tanstack/react-router and @tanstack/react-start to v1.150.0,
bringing latest improvements and stability enhancements.
* Refactored internal server-side utilities to align with updated
library APIs, improving code maintainability without affecting user
experience.
  * Added development dependency for build tooling support.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-02-10 16:46:08 +01:00
Ivan Vasilov 3fd58546d6 chore: Remove all extra dependencies from the learn app (#42642)
This PR removes all extra deps from the `learn` app. The `learn` app was
copy-pasted from `ui-library` so it had a lot of unneeded deps.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Streamlined project dependencies by removing unused packages, reducing
the overall dependency surface for better performance and
maintainability.
* Enhanced build cleanup process to remove temporary TypeScript build
artifacts alongside existing cleanup tasks.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-02-10 09:17:51 -03:30
228ce4e369 feat: update @supabase/*-js libraries to v2.95.3 (#42556)
This PR updates @supabase/*-js libraries to version 2.95.3.

**Source**: supabase-js-stable-release

**Changes**:
- Updated @supabase/supabase-js to 2.95.3
- Updated @supabase/auth-js to 2.95.3
- Updated @supabase/realtime-js to 2.95.3
- Updated @supabase/postgest-js to 2.95.3
- Refreshed pnpm-lock.yaml

This PR was created automatically.

Co-authored-by: supabase-releaser[bot] <223506987+supabase-releaser[bot]@users.noreply.github.com>
Co-authored-by: Katerina Skroumpelou <mandarini@users.noreply.github.com>
2026-02-10 11:57:04 +02:00
Ivan Vasilov e41a3f4fb3 chore: Bump payload vulnerability (#42609)
This PR
- reverts changes made in
https://github.com/supabase/supabase/pull/42568 and
https://github.com/supabase/supabase/pull/42570 because they had some
unneeded changes (`@types/node` bumped to v25+, for example)
- bumps only the vulnerable dependency (which is in `cms` app and it's
not currently used).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
  * Adjusted CMS dependencies to earlier versions
  * Optimized documentation API code organization and type handling

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-02-09 15:26:47 +01:00
kemal.earth 8ffdcfc145 feat(studio): scoped pat ui (#38170)
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Introduces UI for Scoped PAT's.

## Additional context

WIP. Testing endpoints.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Scoped access tokens: create, view, delete, and manage granular
resource/action permissions with custom expiry options and scoped
creation flows.
* New scoped token UI: modal/sheet creation flow, resource access
selectors, permissions editor, and a scoped token list.

* **UI Improvements**
* Tabbed Classic vs Scoped tokens layout, refreshed tokens page,
improved forms, search/filtering, and table tweaks.

* **Bug Fixes / Maintenance**
  * New data hooks and utilities for scoped tokens and token handling.

* **Removed**
  * Legacy account settings layout and legacy token banner.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-02-09 11:32:55 +00:00
Ali Waseem 28443251ff fix: updated deployments with unbroken pnpm (#42570)
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Update lock file changes

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Refactor**
* Reorganized internal imports and improved type compatibility handling
for the AI documentation API to ensure robust operation across different
OpenAI client versions.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-02-06 20:59:45 +00:00
Ali Waseem 114994b723 chore: updated payload only (#42568)
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Update payload

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Updated Payload CMS dependencies to version 3.74.0, including
enhancements to the admin interface, database support, and live preview
functionality.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-02-06 13:08:07 -07:00
Sean OliverandCharis Lam 6bbe2c3297 feat(telemetry): add dev telemetry toolbar (#42259)
## Problem
We need a local-only UI to inspect client and server telemetry events
and override flags during development without touching non-local env
behavior. This work is intended to be shared across Studio, Docs, and
WWW.

## Changes
- Introduced a shared `dev-tools` package with the Dev Telemetry Toolbar
UI, trigger, and provider.
- Wired the toolbar into Studio, Docs, and WWW app shells (local-only
gating).
- Added a local-only `devTelemetry()` opt-in with storage gating and SSE
subscription.
- Wired client PostHog events into a local listener and re-exported
types.
- Added local flag override cookie support in the UI and CODEOWNERS for
the new package.
- Added unit tests covering local/non-local behavior and flag utilities.

## Testing
Manual (local only):
- Start each app locally: `pnpm dev:studio`, `pnpm dev:docs`, `pnpm
dev:www`
- Open the app, run `devTelemetry()` in the browser console
- Click around and confirm both client and server events appear (client
will be page views only)
- Verify feature flag overrides (PostHog + ConfigCat) persist and
restore correctly
- Confirm dismissing the toolbar clears local storage and hides the
trigger

Unblocked by https://github.com/supabase/platform/pull/29172

Resolves GROWTH-591

Demo:

[github.com/user-attachments/assets/60b376db-7440-4ada-82f5-d1bd4af4db3b](https://github.com/user-attachments/assets/60b376db-7440-4ada-82f5-d1bd4af4db3b)

Screenshots:

<img width="1368" height="972" alt="1"
src="https://github.com/user-attachments/assets/d2f20a0c-191f-4118-bb5e-15b25f5a54a9"
/>

<img width="1423" height="790" alt="2"
src="https://github.com/user-attachments/assets/115598e2-7287-49bf-9ed7-71ecc679dee3"
/>

<img width="1433" height="882" alt="3"
src="https://github.com/user-attachments/assets/51f666f2-9efc-410f-baec-378bdee9dbfe"
/>

<img width="608" height="483" alt="4"
src="https://github.com/user-attachments/assets/584d6cf5-1b2f-4cee-9e6a-d55ce2e3bae5"
/>

<img width="628" height="305" alt="5"
src="https://github.com/user-attachments/assets/991a9b39-578a-4565-b110-537a02040a53"
/>

<img width="659" height="447" alt="6"
src="https://github.com/user-attachments/assets/95ef405c-fffa-44af-bf6a-f974b780e3fc"
/>

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Developer Toolbar (local only): view client/server telemetry, inspect
events, and manage/override feature flags with persistent overrides,
filtering, and clear/reload.
* Client-side telemetry hooks: surface structured events to dev tooling
for realtime inspection.

* **Bug Fixes**
  * Fixed end-of-file newline in shared code.

* **Chores**
* Added dev-tools package, integrated provider and trigger across
Studio, Docs, and marketing sites, and added CODEOWNERS entry.

* **Tests**
  * Added comprehensive tests and test setup for the DevToolbar.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Charis Lam <26616127+charislam@users.noreply.github.com>
2026-02-06 11:46:53 -08:00
Katerina Skroumpelou 3c848ec4e8 Revert "feat: update @supabase/*-js libraries to v2.95.0" (#42522)
`esm.sh` does not work, so we will revert this version for now.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Downgraded Supabase packages (@supabase/auth-js,
@supabase/postgrest-js, @supabase/realtime-js, @supabase/supabase-js)
from version 2.95.0 to 2.94.1.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-02-05 20:15:38 +00:00
supabase-supabase-autofixer[bot]andsupabase-releaser[bot] e72e532221 feat: update @supabase/*-js libraries to v2.95.0 (#42508)
This PR updates @supabase/*-js libraries to version 2.95.0.

**Source**: supabase-js-stable-release

**Changes**:
- Updated @supabase/supabase-js to 2.95.0
- Updated @supabase/auth-js to 2.95.0
- Updated @supabase/realtime-js to 2.95.0
- Updated @supabase/postgest-js to 2.95.0
- Refreshed pnpm-lock.yaml

This PR was created automatically.

Co-authored-by: supabase-releaser[bot] <223506987+supabase-releaser[bot]@users.noreply.github.com>
2026-02-05 17:36:28 +02:00
dda0b526ac Feat/learn (#41566)
wip

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

# Release Notes

* **New Features**
* Added a new Learn application offering foundational Supabase courses
with interactive documentation
* Courses include Architecture, Authentication, Data Fundamentals,
Security, Storage, Realtime, and Edge Functions
  * Chapter tracking and progress indicators for course completions
  * Responsive sidebar navigation with search/command menu
  * Theme switching support (light, dark, classic dark modes)
  * Mobile-friendly course interface

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Alan Daniel <stylesshjs@gmail.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-02-04 21:36:24 -03:30
supabase-supabase-autofixer[bot]andsupabase-releaser[bot] 980ba1307a feat: update @supabase/*-js libraries to v2.94.1 (#42452)
This PR updates @supabase/*-js libraries to version 2.94.1.

**Source**: supabase-js-stable-release

**Changes**:
- Updated @supabase/supabase-js to 2.94.1
- Updated @supabase/auth-js to 2.94.1
- Updated @supabase/realtime-js to 2.94.1
- Updated @supabase/postgest-js to 2.94.1
- Refreshed pnpm-lock.yaml

This PR was created automatically.

Co-authored-by: supabase-releaser[bot] <223506987+supabase-releaser[bot]@users.noreply.github.com>
2026-02-04 18:03:15 +02:00
Matt Rossman bebf26ed01 chore(studio): bump @supabase/mcp-server-supabase to 0.6.3 (#42433)
Bumps `@supabase/mcp-server-supabase` from 0.6.2 to 0.6.3

Closes AI-416

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
  * Updated dependencies to maintain compatibility and stability.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-02-04 07:31:40 -05:00
Ivan Vasilov 3a391d4f6b fix: Fix the sorting of imports (#42419)
This PR switches the sort imports plugin to
@ianvs/prettier-plugin-sort-imports which is more reliable and merges
imports from the same file (the old one reported them as error).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Updated import-sorting tooling and related configuration to improve
consistency of import ordering and formatting across the codebase,
simplifying rules and adjusting behavior for private/internal paths to
produce more predictable diffs and clearer code style in development.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-02-03 19:09:16 +00:00
Ivan Vasilov 5de2564df2 chore: Revert the bump of next package (#42420)
This PR reverts the bump of `next` from `16.0.11` to `16.1.6` because it
broke the self-hosted build (it got stuck and timeouts after 45 minutes)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
  * Adjusted the Next.js runtime for the Studio app to ~16.0.0.
  * No other dependencies, scripts, or app behavior were changed.
* No public-facing API or exported declarations were added, removed, or
modified — low impact on end-user experience.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-02-03 17:11:42 +00:00
Ivan Vasilov d7626c9830 chore: Bump vulnerable dependencies (#42416)
This PR fixes:
- https://github.com/supabase/supabase/security/dependabot/2721
- https://github.com/supabase/supabase/security/dependabot/2699
- https://github.com/supabase/supabase/security/dependabot/2704
- https://github.com/supabase/supabase/security/dependabot/2701
- https://github.com/supabase/supabase/security/dependabot/2708
- https://github.com/supabase/supabase/security/dependabot/2709
- https://github.com/supabase/supabase/security/dependabot/2732
- https://github.com/supabase/supabase/security/dependabot/2733
- https://github.com/supabase/supabase/security/dependabot/2750
- https://github.com/supabase/supabase/security/dependabot/2751

It also dedupes `mermaid` and `sharp` deps.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Updated image-processing dependency to a newer patch release for
stability.
* Upgraded framework runtime to a minor release for improvements and bug
fixes.
  * Adjusted workspace dependency override for a transitive package.
* Added a development build tool dependency to the web app for improved
tooling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-02-03 15:23:30 +01:00
Jordi Enric 022b510269 fix: centralize compute disk limits data and update documentation (#41242)
https://linear.app/supabase/issue/FE-2226/fix-incorrect-baseline-and-max-iopsthroughput-values

- Centralized compute/disk limits in
packages/shared-data/compute-disk-limits.ts (MB/s, baseline+max
IOPS/throughput) and re-exported from shared-data.
- Hooked Docs compute/disk table into shared data, converted docs
text/table to MB/s baseline/max.
- Removed duplicated compute IOPS/throughput constants from Studio,
Studio now imports shared data.
- Updated Studio disk schema: compute-aware MAX IOPS/throughput
validation (MB/s), defaults computeSize to ci_micro, and gp3/io2 checks
use compute caps.
- Clarified disk update mutation to send throughput as MB/s despite
backend throughput_mbps field name.
- Added tests for compute-size mappings and IOPS helper logic.
- Added Infra ownership for shared compute/disk data in CODEOWNERS.
- Locked zod version via catalog and added zod dep to shared-data.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a reusable Compute Disk Limits table and centralized compute
disk limits dataset for dynamic display.

* **Documentation**
* Replaced static per-size tables with a component-driven MB/s view;
clarified baseline vs. burst behavior and updated guides and
troubleshooting.

* **Bug Fixes**
* Validation and UI guidance now honor compute-size limits for IOPS and
throughput.

* **Tests**
  * Expanded unit tests for sizing, mappings, and edge cases.

* **Chores**
* Published shared-data exports, added a validation schema, pinned a
dependency, and added ownership entries.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-02-03 10:52:42 +00:00
b04da949aa Docs/dropzone cursor vue nuxt (#41553)
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

This pull request adds documentation and support for the Dropzone (File
Upload) and Realtime Cursor components for both Vue and Nuxt.js
frameworks in the UI library. It updates the sidebar navigation,
introduces new documentation pages, and ensures these components are
referenced in the project overview and component listings.

TODO: install new dependencies and resolve conflicts in lock.json

## Additional context

Initiative by Terry :)


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added Dropzone and Realtime Cursor components for Vue and Nuxt.js
(file upload with previews/validation; collaborative cursor tracking).

* **Documentation**
* Added comprehensive Vue and Nuxt.js docs and registry entries for
Dropzone and Realtime Cursor with usage examples and API guidance.

* **Bug Fixes**
* Fixed text escaping in several authentication and UI components for
consistent rendering.

<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Terry Sutton <saltcod@gmail.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
2026-01-30 10:49:29 -03:30
supabase-supabase-autofixer[bot]andsupabase-releaser[bot] 5d85e33bc4 feat: update @supabase/*-js libraries to v2.93.2 (#42228)
This PR updates @supabase/*-js libraries to version 2.93.2.

**Source**: supabase-js-stable-release

**Changes**:
- Updated @supabase/supabase-js to 2.93.2
- Updated @supabase/auth-js to 2.93.2
- Updated @supabase/realtime-js to 2.93.2
- Updated @supabase/postgest-js to 2.93.2
- Refreshed pnpm-lock.yaml

This PR was created automatically.

Co-authored-by: supabase-releaser[bot] <223506987+supabase-releaser[bot]@users.noreply.github.com>
2026-01-29 13:11:12 +02:00
Matt Rossman d21098ada4 chore(studio): upgrade @supabase/mcp-server-supabase to v0.6.2 (#42210)
* chore(mcp): upgrade @supabase/mcp-server-supabase to v0.6.2

* fix: mocks for Node.js / Web Standard HTTP APIs
2026-01-27 13:10:17 -05:00
Ivan Vasilov 07b9702be3 chore: Add prettier plugin for sorting imports (#41608)
* Add prettier plugin for sorting imports.

* Migrate the prettier config to a js file. Make the sort imports conditional which will work only in code editors.

* Remove unneeded commands for running prettier.

* Fix the regex to be more specific.

* Another fix for the import regex.
2026-01-27 10:55:59 +01:00
Ivan Vasilov 036740b5b5 chore: Bump vulnerable deps (#42182)
* Bump @modelcontextprotocol/sdk.

* Bump qs.

* Bump preact.

* Bump react-router.

* Bump @smithy/config-resolver.

* Bump undici.

* Bump devalue.

* Bump h3.

* Bump tar.

* Bump diff.

* Bump lodash.

* Dedupe @aws-sdk/credential-providers.
2026-01-27 10:29:05 +01:00
Ivan Vasilov fb2bd2abb3 chore: Bump next versions to non-vulnerable numbers (#42198)
Bump next versions to non-vulnerable numbers.
2026-01-27 08:31:54 +00:00
supabase-supabase-autofixer[bot]andsupabase-releaser[bot] 94ec700eda feat: update @supabase/*-js libraries to v2.93.1 (#42171)
Co-authored-by: supabase-releaser[bot] <223506987+supabase-releaser[bot]@users.noreply.github.com>
2026-01-26 16:44:26 +00:00