dima/supabase
1
0 Fork 0
mirror of https://github.com/supabase/supabase.git synced 2026-10-13 13:19:09 +03:00
Code Issues Packages Projects Releases Wiki Activity
39,045 Commits 1,798 Branches 62 Tags
7b48b298ee18e9533db71642d7d46aecda60fee2
Commit Graph
39045 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Danny White 7b48b298ee feat(apps): distinguish local development with blue blueprint favicons (#51420) 
## Problem

- Local apps are hard to distinguish from hosted apps in browser tabs.

## Solution

- Add blue blueprint icons to local development in all 8 apps and Studio
CLI.
- Keep normal branding for production, hosted staging and self-hosted
Studio.
- Builds on #51419.


| Before | After |
| --- | --- |
| <img width="1290" height="76" alt="CleanShot 2026-10-08 at 13 29
14@2x"
src="https://github.com/user-attachments/assets/72bc50d7-37e0-47d0-8dfd-50e233a443bd"
/> | <img width="1282" height="72" alt="CleanShot 2026-10-08 at 13 30
03@2x"
src="https://github.com/user-attachments/assets/afb15a70-3938-4cff-9b41-dc6c25460b7c"
/> |

## Review instructions

- Start an app locally. Its browser tab should show the blue icon.
- Check Studio CLI uses blue and hosted staging uses white.
- Check production icons are unchanged, including Learn's black and
white icon.
- Run `node scripts/validate-favicons.mjs`. All 16 sets should pass.

Asset and routing checks, formatting and Common/Studio type checks
passed. Full builds have not been run.

## Checklist

- [x] I have read
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
 2026-10-12 10:26:51 +11:00
claude[bot]andClaude f44dc42b0c Add Enterprise Terms v4.1 (effective October 9, 2026) (#51474) 
<!-- ccr-slack-attribution -->
_Requested by **Nicole Kramer** · [Slack
thread](https://supabase.slack.com/archives/C0161K73J1J/p1790784371448999)_

## Problem

Three corrections to the Enterprise SaaS Subscription Agreement
(supabase.com/enterprise-terms): a typo in the contracting-entity
sentence of Section 1.9, and conforming AWS Marketplace wording in
Sections 5.1 and 14.1.

## Solution

Adds Enterprise Terms v4.1 (effective October 9, 2026) as
`apps/www/data/legal/enterprise-terms/v4-1.mdx`, a copy of v4 with only
the changes below, and registers it as the newest version in
`apps/www/pages/enterprise-terms.tsx`. v4 stays available through the
version selector. The page remains `noindex`/`nofollow`.

### Section 1.9 (second sentence)

**Before:** For clarity, unless an Order expressly specifies otherwise,
the Supabase entity contracting with Customer hereunder will be (i)
Supabase, Inc., having its registered address at 3500 S. DuPont Highway,
Dover, Kent County, DE 19901, if Customer is purchasing via a cloud
service provider marketplace, or (ii) Supabase Pte. Ltd., a Singapore
corporate entity with a place of business located at 65 Chulia Street
#38-02/03, OCBC Centre, Singapore 049513, if Customer is not purchasing
via a cloud service provider marketplace.

**After:** For clarity, unless an Order expressly specifies otherwise,
the Supabase entity contracting with Customer hereunder will be (i)
Supabase, Inc., having its registered address at 3500 S. DuPont Highway,
Dover, Kent County, DE 19901, if Customer is purchasing via the
marketplace operated by Amazon Web Services, Inc. or its affiliates,
located at https://aws.amazon.com/marketplace, as it may be updated from
time to time ("**AWS Marketplace**"), or (ii) Supabase Pte. Ltd., a
Singapore corporate entity with a place of business located at 65 Chulia
Street #38-02/03, OCBC Centre, Singapore 049513, if Customer is not
purchasing via AWS Marketplace.

### Section 5.1 (body)

**Before:** Where paid-for services are agreed between Supabase and
Customer per the applicable Order, Customer shall pay Supabase the fees
("**Fees**") identified in the Order without offset or deduction at the
cadence identified in the Order (e.g., monthly or annually). Unless
otherwise provided in the applicable Order, (i) Customer will pay the
Fees within thirty (30) days of the issuance of an invoice, (ii) Fees
are payable by credit card or other payment method permitted by Supabase
from time to time, (iii) payment will be in USD, and (iv) Customer
authorizes Supabase to charge its provided billing method for all Fees.
Notwithstanding the foregoing, where Customer purchases via a cloud
service provider marketplace, Customer will pay the Fees through the
applicable marketplace in accordance with the applicable marketplace
terms. Customer further authorizes Supabase to use a third party to
process payments, and consents to the disclosure of Customer's payment
information to such third party. Fees paid by Customer are
non-refundable (except as set forth in Sections 10.3 or 11.1(b)). Where
Customer purchased the applicable Services via a cloud service provider
marketplace, any refund owed to Customer under this Agreement will be
paid or credited back through the applicable marketplace, and not
directly by Supabase to Customer. If Customer fails to make any payment
when due, and Customer has not notified Supabase in writing within ten
(10) days of the payment becoming due and payable that the payment is
subject to a good faith dispute, without limiting Supabase's other
rights and remedies: (a) Supabase may charge interest on the undisputed
past due amount at the rate of 1.5% per month, calculated daily and
compounded monthly or, if lower, the highest rate permitted under
applicable law; (b) Customer shall reimburse Supabase for all reasonable
costs incurred by Supabase in collecting any late payments or interest,
including attorneys' fees, court costs, and collection agency fees; and
(c) if such failure continues for ten (10) days or more, Supabase may
suspend Customer's and its Authorized Users' access to any portion or
all of the Services until such amounts are paid in full.

**After:** Where paid-for services are agreed between Supabase and
Customer per the applicable Order, Customer shall pay Supabase the fees
("**Fees**") identified in the Order without offset or deduction at the
cadence identified in the Order (e.g., monthly or annually). Unless
otherwise provided in the applicable Order, (i) Customer will pay the
Fees within thirty (30) days of the issuance of an invoice, (ii) Fees
are payable by credit card or other payment method permitted by Supabase
from time to time, (iii) payment will be in USD, and (iv) Customer
authorizes Supabase to charge its provided billing method for all Fees.
Notwithstanding the foregoing, where Customer purchases via AWS
Marketplace, Customer will pay the Fees through the AWS Marketplace in
accordance with the terms applicable to the AWS Marketplace. Customer
further authorizes Supabase to use a third party to process payments,
and consents to the disclosure of Customer's payment information to such
third party. Fees paid by Customer are non-refundable (except as set
forth in Sections 10.3 or 11.1(b)). Where Customer purchased the
applicable Services via AWS Marketplace, any refund owed to Customer
under this Agreement will be paid or credited back through the AWS
Marketplace, and not directly by Supabase to Customer. If Customer fails
to make any payment when due, and Customer has not notified Supabase in
writing within ten (10) days of the payment becoming due and payable
that the payment is subject to a good faith dispute, without limiting
Supabase's other rights and remedies: (a) Supabase may charge interest
on the undisputed past due amount at the rate of 1.5% per month,
calculated daily and compounded monthly or, if lower, the highest rate
permitted under applicable law; (b) Customer shall reimburse Supabase
for all reasonable costs incurred by Supabase in collecting any late
payments or interest, including attorneys' fees, court costs, and
collection agency fees; and (c) if such failure continues for ten (10)
days or more, Supabase may suspend Customer's and its Authorized Users'
access to any portion or all of the Services until such amounts are paid
in full.

### Section 14.1 (last sentence)

**Before:** For clarity, the terms of any cloud service provider
marketplace apply solely with respect to the payment matters described
in Section 5.1 and do not otherwise amend or supersede this Agreement.

**After:** For clarity, the terms of the AWS Marketplace apply solely
with respect to the payment matters described in Section 5.1 and do not
otherwise amend or supersede this Agreement.

## Review instructions

1. Open `/enterprise-terms` on the preview; the selector defaults to
"Version 4.1 — October 9, 2026".
2. Check Sections 1.9, 5.1, and 14.1 match the After text above.
3. Switch to "Version 4 — October 5, 2026" (or `?version=v4`) and
confirm it is unchanged.

## Checklist

- [ ] I have read
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)

🤖 Generated with [Claude Code](https://claude.ai/code)

https://claude.ai/code/session_01K2vqszbsJiMJPABAnLMgaC

---------

Co-authored-by: Claude <noreply@anthropic.com>
 2026-10-12 10:23:40 +11:00
claude[bot]andClaude 05bca9e9d1 Add Terms of Service v4.1 (effective October 9, 2026) (#51473) 
<!-- ccr-slack-attribution -->
_Requested by **Nicole Kramer** · [Slack
thread](https://supabase.slack.com/archives/C0161K73J1J/p1790784371448999)_

## Problem

This adds v4.1 (effective October 9, 2026) of the Terms of Service. It
corrects the second sentence of Section 1.j (which Supabase entity
contracts with the Customer) and conforms Sections 5(a) and 14(a) to the
new "AWS Marketplace" defined term. Nothing else in the document
changes, and v4 stays available through the version selector.

### Section 1.j, second sentence

**Before:** For clarity, unless an Order expressly specifies otherwise,
the Supabase entity contracting with Customer hereunder will be (i)
Supabase, Inc., having its registered address at 3500 S. DuPont Highway,
Dover, Kent County, DE 19901, if Customer is purchasing via a cloud
service provider marketplace, or (ii) Supabase Pte. Ltd., a Singapore
corporate entity with a place of business located at 65 Chulia Street
#38-02/03, OCBC Centre, Singapore 049513, if Customer is not purchasing
via a cloud service provider marketplace.

**After:** For clarity, unless an Order expressly specifies otherwise,
the Supabase entity contracting with Customer hereunder will be (i)
Supabase, Inc., having its registered address at 3500 S. DuPont Highway,
Dover, Kent County, DE 19901, if Customer is purchasing via the
marketplace operated by Amazon Web Services, Inc. or its affiliates,
located at
[https://aws.amazon.com/marketplace](https://aws.amazon.com/marketplace),
as it may be updated from time to time ("AWS Marketplace"), or (ii)
Supabase Pte. Ltd., a Singapore corporate entity with a place of
business located at 65 Chulia Street #38-02/03, OCBC Centre, Singapore
049513, if Customer is not purchasing via AWS Marketplace.

### Section 5(a) (Fees)

**Before:** ... Notwithstanding the foregoing, where Customer purchases
via a cloud service provider marketplace, Customer will pay the Fees
through the applicable marketplace in accordance with the applicable
marketplace terms. Fees paid by Customer are non-refundable. Where
Customer purchased the applicable Services via a cloud service provider
marketplace, any refund owed to Customer under this Agreement will be
paid or credited back through the applicable marketplace, and not
directly by Supabase to Customer. ...

**After:** ... Notwithstanding the foregoing, where Customer purchases
via AWS Marketplace, Customer will pay the Fees through AWS Marketplace
in accordance with the terms applicable to AWS Marketplace. Fees paid by
Customer are non-refundable. Where Customer purchased the applicable
Services via AWS Marketplace, any refund owed to Customer under this
Agreement will be paid or credited back through the AWS Marketplace, and
not directly by Supabase to Customer. ...

The rest of 5(a) is unchanged.

### Section 14(a) (Entire Agreement), last sentence

**Before:** For clarity, the terms of any cloud service provider
marketplace apply solely with respect to the payment matters described
in Section 5(a) and do not otherwise amend or supersede this Agreement.

**After:** For clarity, the terms of AWS Marketplace apply solely with
respect to the payment matters described in Section 5(a) and do not
otherwise amend or supersede this Agreement.

## Solution

- Add `apps/www/data/legal/terms/v4-1.mdx`, a copy of `v4.mdx` with only
three passages changed: the second sentence of Section 1.j, the
marketplace wording in Section 5(a), and the last sentence of Section
14(a). The AWS Marketplace URL in 1.j is formatted as a markdown link,
like the other URLs in the document.
- Register `v4-1` in `apps/www/pages/terms.tsx` as the newest entry
(label "Version 4.1", effective October 9, 2026). v4 and older entries
are unchanged.

## Preview links

| Site | Live | Preview |
| ---- | ---- | ------- |
| WWW | [/terms](https://supabase.com/terms) | See the Vercel bot
comment on this PR (`/terms`) |

## Review instructions

1. Open `/terms` on the preview. The version selector should default to
"Version 4.1 — October 9, 2026".
2. Check Sections 1.j, 5(a), and 14(a) read as in the **After** text
above.
3. Switch the selector to "Version 4" and confirm they still read as in
the **Before** text.

## Checklist

- [x] I have read
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
- [ ] If I wrote a new docs topic or edited an existing topic, I used
the `/write-the-docs` or `/edit-the-docs` skill (not applicable: legal
page change)

🤖 Generated with [Claude Code](https://claude.ai/code)

https://claude.ai/code/session_01K2vqszbsJiMJPABAnLMgaC

---------

Co-authored-by: Claude <noreply@anthropic.com>
 2026-10-12 10:23:01 +11:00
Danny White a42433c9bd refactor(studio): extract destination connection fields for wizard reuse (#51471) 
## Problem

The pipeline creation wizard in #49243 needs destination connection
settings on its connection step, separately from replication settings
and table layout. These fields currently live inside the sheet’s
Advanced settings accordion.

## Solution

Extract BigQuery’s **Connection pool size** and **Maximum staleness**,
DuckLake’s **Pool size**, and Snowflake’s optional **Role** into
reusable connection-field components. Keep the existing accordion as
their first consumer. Labels, defaults, units, field order and
empty-value handling stay the same.

## Review instructions

1. Open the [preview to Database →
Pipelines](https://studio-staging-git-dnywh-refactorpipeline-conne-4a9108-supabase.vercel.app/dashboard/project/_/database/pipelines),
select a test project with Pipelines enabled and click **Add pipeline**.
Keep BigQuery selected and expand **Advanced settings**.
2. Confirm **Connection pool size** and **Maximum staleness** still
appear below **Invalidated slot behavior** and above **Table layout**,
with the same descriptions and the **connections** and **minutes**
units.
5. Select DuckLake, if available, and expand **Advanced settings**.
Confirm **Pool size** remains above **Batch wait time**, with its
existing description and 1–6 limits.
6. Select Snowflake, if available, and expand **Advanced settings**.
Confirm optional **Role** remains below **Invalidated slot behavior**,
with the `PIPELINES_ROLE` placeholder.
 2026-10-12 10:19:39 +11:00
Danny White ae69908aed refactor(studio): extract destination validation for wizard reuse (#51470) 
## Problem

The pipeline creation wizard in #49243 needs to validate its destination
connection before table selection. The sheet currently builds that
request inside its full configuration validation.

## Solution

Extract `useDestinationValidation` and use it from the sheet. It builds
and sends the existing destination request, with optional pipeline
settings. The sheet still validates destination and pipeline settings in
parallel and retains its existing loading, error and warning handling.

This foundation adds no visible changes or wizard routing.

## Review instructions

Use a test project with Pipelines enabled, a publication containing
tables, and working BigQuery credentials.

1. Open the [deploy preview at Database →
Pipelines](https://studio-staging-git-dnywh-refactorpipeline-desti-ebcb9d-supabase.vercel.app/dashboard/project/_/database/pipelines),
select your test project and click **Add pipeline**. Confirm the
existing sheet opens with BigQuery selected.
2. Enter the required fields and select a publication. Use valid
service-account JSON, but set **Dataset ID** to a dataset that does not
exist. Click **Start pipeline**. While the request runs, expect a
loading state and disabled submission. Once validation completes, expect
configuration issues in the sheet, retained field values and no pipeline
creation.
3. Correct the dataset ID and click **Start pipeline** again. Expect
validation to recover and open the **Create and start pipeline** cost
confirmation when there are no remaining issues. Click **Cancel** to
avoid creating the pipeline.
4. If your test project returns warnings, confirm they appear inline and
the action changes to **Start pipeline anyway**. Click it again:
unchanged warnings should open the warning confirmation, and continuing
should open the cost confirmation. Critical issues must still block
progression.
 2026-10-12 10:18:56 +11:00
Danny White 325a5a0da7 fix(studio): polish extension installation dialogs (#51463) 
## Problem

The enable-extension dialog in #51440 needs clearer installation copy
and a consistent disclosure for custom-schema guidance. On narrow
screens, footer buttons touch and dialog content can scroll sideways.

## Solution

Polish the dialog on top of #51440:

- Explain fixed-schema requirements and hide custom-schema guidance when
the extension requires a specific schema.
- Share the disclosure interaction with the session-expired and
API-hardening dialogs through `ui-patterns/DialogDisclosure`, documented
with a live design-system example.
- Fix narrow-screen overflow and add vertical spacing to shared dialog
footers.
- Refine inline-code styling and update the PostGIS instructions and E2E
button locator.


| After |
| --- |
| <img width="852" height="710" alt="CleanShot 2026-10-09 at 12 17
47@2x"
src="https://github.com/user-attachments/assets/59f6f1e7-9884-4cdb-b678-62b7f88a8ec5"
/> |
| _Standard extension_ |
| <img width="836" height="1092" alt="52254"
src="https://github.com/user-attachments/assets/dbf53d3e-6583-4c3b-8f43-577e0723d9a7"
/> |
| _Standard extension expanded accordion_ |
| <img width="836" height="604" alt="CleanShot 2026-10-09 at 12 20
04@2x"
src="https://github.com/user-attachments/assets/c8e3961f-2683-440c-a2a2-48ccd53c4a17"
/> |
| _Extension with fixed schema_ |

## Review instructions

1. Open `/project/<ref>/database/extensions`. Turn on the toggle for a
disabled `postgres_fdw` extension. Expand **Install in a different
schema** and check its hover, keyboard focus and full-width click
target. Repeat with `pg_cron` or `pgmq`: the intro must say **must**,
and custom-schema guidance must be absent. Cancel without enabling.
2. At 320 px and 375 px, check the extension dialog's alignment,
inline-code rendering, wrapped SQL and stacked **Enable** / **Cancel**
spacing. Confirm the page does not scroll sideways.
3. On a platform project with the Data API enabled, open
`/project/<ref>/integrations/data_api/settings`. Under **Harden Data
API**, click **Harden Data API**. Expand both sections and check the
same trigger behaviour. Confirm completed sections still show their
check icons. Close without applying either action.
4. The session-expired dialog has no direct route. It is rendered by
`apps/studio/hooks/misc/withAuth.tsx` after authentication loading
exceeds 10 seconds. For repeatable local review, temporarily pass
`visible={true}` to its `SessionTimeoutModal` callsite, then open
`/projects`. Expand **Having trouble?** by clicking the text or chevron
and using Enter / Space. Check the help text and controls. Close the
dialog without signing out or clearing site data, then undo the
temporary prop change.
5. In the design system, open
[`/docs/components/dialog#optional-details`](https://design-system-git-dnywh-choreextension-dialog-polish-supabase.vercel.app/design-system/docs/components/dialog#optional-details).
Click **Export results**, then expand **What’s included** with the mouse
and keyboard. The demo imports the same `ui-patterns/DialogDisclosure`
used by Studio.
6. Open another dialog and an alert dialog at a narrow width. Check the
shared 8 px gap between stacked footer buttons. Review inline-code
examples on `/docs/components/typography` for the shared styling change.
 2026-10-12 10:18:45 +11:00
Danny White 255a80e219 refactor(apps): standardise existing favicon assets and declarations (#51419) 
## Problem

- Favicon files and markup are duplicated across apps.

## Solution

- Replace old files with one ICO, one Apple icon and two manifest icons
per set.
- Share icon markup and add generation notes and scripts.
- Keep existing branding, including Learn's black and white icon.
- Make the border radius match across all apps’ favicons.

## Review instructions

- Check normal app icons and Studio staging in browser tabs.
- Check icons load under `/docs` and `/kb`.
- Run `node scripts/validate-favicons.mjs`. All 8 sets should pass.
 2026-10-12 10:18:18 +11:00
Alexis AguilarandMiranda Limonczenko 8617532ae1 fix(docs): remove orphaned cli.mdx and update stale /guides/cli link (#51495) 
Resolves
[DOCS-1252](https://linear.app/supabase/issue/DOCS-1252/resolve-e2e-broken-link-errors-for-the-cli-guide).

#48453 updated most `/cli` links to `/local-development`. This PR covers
the remaining `/cli` references.

## Changes

- **Delete `apps/docs/content/guides/cli.mdx`.** The file has had no
route since the October 2024 docs IA reorganization (#29364), which
moved the CLI guides under `local-development/`.
- In production, `/docs/guides/cli` redirects to
`/docs/guides/local-development` through `apps/www/lib/redirects.js`, so
the file's content never renders.
- On Vercel previews, which don't have `www` redirects, the URL returns
404. Docs E2E tests every changed guide file, so any edit to `cli.mdx`
fails the required check.
- Deleting it is safe for Docs E2E, which only scopes added or changed
files. The redirect still covers the old URL.
- **Update the connection-refused troubleshooting page** to link to
`/docs/guides/local-development` instead of the redirected
`/docs/guides/cli`.
- **Point the "Go to Local Dev / CLI" command palette entry at
`/guides/local-development`.** It routed to `/guides/cli`, which only
resolves through the `www` redirect and returns 404 on previews.
- **Remove the unused `cli` navigation menu** from
`NavigationMenu.constants.ts`. No `MenuId` resolves to it, so it was
never rendered, and its links pointed to pages that no longer exist.

Question for @czenko: 
#48453 left `cli.mdx` alone on purpose, describing it as needing a
routing or content decision. Deleting it seemed like the simplest fix,
but is there a reason to keep it? It looks like it's an artifact that
sometimes gets updated because it's being mistaken as a living document.
Also, I believe troubleshooting guides are being currently moved - this
ticket and change might coincide with the new
https://github.com/supabase/troubleshooting repository, but I didn't see
this file existing in there just yet - it's being currently being moved
in this PR
https://github.com/supabase/troubleshooting/pull/330/changes#diff-b5908c6861f711c3a38fba99aa133cdb796f26c27a35e77c674cb21f988a1046
(so I think I should do the link change in that PR and I can remove it
from this PR as to not create merge conflicts or drift). But it makes
questions come up about how broken links are handled in that repository
👀

---------

Co-authored-by: Miranda Limonczenko <miranda.limonczenko@supabase.io>
 2026-10-09 22:48:36 +00:00
Monica KhouryandCharis Lam 2d5768d3c1 feat(studio): wire Platform Webhooks UI to real backend API (#51352) 
## What
Wires the existing (mocked) Platform Webhooks UI to the real Management
API backend, per FE-3749.

- New `data/platform-webhooks/` query/mutation hooks, calling the real
`/v2/organizations/{slug}/webhooks/...` and
`/v2/projects/{ref}/webhooks/...` endpoints
- Updated `PlatformWebhooks.types.ts` to match the real API contract
(field names, shapes)
- Added a signing secret field to the create-endpoint form (API requires
a user-provided secret, not server-generated like the mock assumed)
- Removed the event-type column from the deliveries table (the real
list-deliveries endpoint doesn't return event type, only the
single-delivery endpoint does)
- Removed `PlatformWebhooks.mock.ts` / `.store.ts` and their tests

## Why
UI was built ~80% against mock data months ago; this closes the gap to a
real, working feature.

## Known open items (not blocking, tracked separately)
- `name` field has no backend storage yet — client-only for now, open
question with Ali/Paweł
- Deliveries table only fetches the backend's default single page — real
server-side pagination not yet wired (see FE-3750)

## Follow-up PR (stacked)
Tests for the new `data/platform-webhooks/` hooks (MSW-based), per the
ticket's own scope split.

## Testing
Manually tested end-to-end against local backend: created/edited/deleted
an endpoint, verified the real signature using webhook.site,
independently recomputed the HMAC and confirmed it matches the
`webhook-signature` header.

Linear: FE-3749

---------

Co-authored-by: Charis Lam <26616127+charislam@users.noreply.github.com>
 2026-10-09 22:41:09 +03:00
Ignacio Dobronich eeae6027d5 fix: don't warn about SMS MFA charges on branch projects (#51459) 2026-10-09 12:57:27 -03:00
Alaister Young f7b7969728 fix(studio): cancel pending banner removal timeouts on unmount (#51491) 2026-10-09 17:38:50 +02:00
Matt Rossman 0d8cd9c315 feat(studio): prompt for a higher AI opt-in level instead of "no tool access" (#51411) 
## Motivation

When an Assistant tool needs a higher opt-in level than the org has, the
user only sees the model say it has no access with (inconsistent)
written instructions how to fix, instead of Assistant proactively
facilitating the fix.

<img width="400" alt="CleanShot 2026-10-07 at 3 44 29 PM@2x"
src="https://github.com/user-attachments/assets/ba95568a-5db4-4d8c-b4ff-64855f2b87ec"
/>

The majority of recent labelled [Assistant
Issues](https://www.braintrust.dev/app/supabase.io/p/Assistant/topics)
in Braintrust are tools or query results blocked by the org opt-in
level. We've considered making Assistant disabled entirely when data
opt-in is off to eliminate the most common footgun (AI-405), but that's
an intrusive change which could break legitimate use cases.

## Changes



https://github.com/user-attachments/assets/206a2438-630e-4368-9cec-2b04b66c9cd4



A new `update_opt_in_level` tool renders an inline card which prompts
admins to review the opt-in level and highlights the proposed change
(non-admins see a message telling them to contact their admin to change
the setting). Saving approves the call and the turn resumes at the new
level. Results appear in a Braintrust tool span based on
https://github.com/supabase/supabase/pull/45654.

I added 5 evals that simulate the user answering the opt-in card to
verify that the Assistant asks when blocked, continues after the user
accepts, and doesn't invent data after a skip. Tool Usage and
Correctness are at 100% in the [sample
run](https://www.braintrust.dev/app/supabase.io/p/Dev%20(mattrossman%2FAssistant)/experiments/mattrossman%2Fai-158-prompt-users-to-update-settings-instead-of-showing-no-tool-1791483991).

<details>
<summary>📸 Screenshots</summary>

| Admin, pending | Modal, Current and Proposed |
| -- | -- |
| <img width="100%" alt="CleanShot 2026-10-07 at 3 23 37 PM@2x"
src="https://github.com/user-attachments/assets/2fc8ba11-0530-4028-a056-40ca02afd3ef"
/> | <img width="1184" height="1754" alt="CleanShot 2026-10-07 at 3 32
37 PM@2x"
src="https://github.com/user-attachments/assets/73639633-89ac-4d4c-b869-d9301735d5b9"
/> |
| **After saving, turn continues** | **Non-admin** |
| <img width="100%" alt="CleanShot 2026-10-07 at 3 27 14 PM@2x"
src="https://github.com/user-attachments/assets/a91c6760-6dfb-4f51-9ef8-4bdbe1b22495"
/> | <img width="100%" alt="CleanShot 2026-10-07 at 3 15 33 PM@2x"
src="https://github.com/user-attachments/assets/ecb9aa87-26dc-4b69-a086-cb77a28bb860"
/> |

</details>

## Verification

To test in staging, set your org's Assistant opt-in level to Disabled,
ask "What tables do I have?", and review the card. Try selecting the
proposed (or different) opt-in level and saving to continue.

[This
trace](https://www.braintrust.dev/app/supabase.io/p/Dev%20(mattrossman%2FAssistant)/experiments/mattrossman%2Fai-158-prompt-users-to-update-settings-instead-of-showing-no-tool-1791483991?r=90066cd9-4da3-4817-9650-c369d2b42cea)
is a sample from the accept eval case after saving Schema Only, note the
`update_opt_in_level` span.

## Safety considerations

I added a banner to the modal to make it more obvious that this setting
impacts the whole org, not just the current chat or project:

<img width="592" height="78" alt="CleanShot 2026-10-08 at 2 04 44 PM@2x"
src="https://github.com/user-attachments/assets/6b140ed6-65fb-4bc0-b5cc-9c82fe2a67aa"
/>


I leave the current opt-in value selected by default in the form so the
user has to consciously select the proposed value instead of mindlessly
clicking save without understanding implications.

`execute_sql` and `run_notebook` outputs are now stamped with the level
they ran under, and history is sanitized by the least permissive of the
stamped vs current opt-in levels. That way raising the level mid-chat
doesn't unexpectedly expose earlier query rows to the model.

Closes AI-158
 2026-10-09 10:39:23 -04:00
kemal.earth 6119ea1eb5 feat(design-system): remove table head hover in design system (#51452) 
## Problem

All our tables had shadcn's rather annoying row hover on a
non-interactive `<thead>`.

## Solution

Some tailwind/css magic to stop the hover on `<thead>`.
 2026-10-09 13:56:50 +01:00
Daniel Chapman 4fcd212d6a Add Daniel Chapman to humans.txt (#51467) 
## Problem

I joined the company.

## Solution

Added myself to humans.txt.
 2026-10-09 05:50:33 -04:00
Gildas GarciakemalClaude Opus 5Joshen Lim
 		4f23e91174 feat(studio): scoped oauth apps, admins can revoke an app (#50980) 
## Problem

Admins should be able to revoke an OAuth app that uses scoped tokens.

## Solution

## Solution

- Add a menu to the org settings oauth approved apps rows to revoke the
app

<img width="1164" height="342" alt="image"
src="https://github.com/user-attachments/assets/1323318a-7c68-436e-ae77-0c79d763e4cc"
/>


<img width="441" height="350" alt="image"
src="https://github.com/user-attachments/assets/dd5cf88e-184a-4edb-a240-340bd2f58727"
/>

## Review instructions

In Org Settings/OAuth apps, you should see a menu button for each app
that contains a _Revoke_ item. Clicking this item should open a dialog
to revoke the app.
Notice how the focus is back on the dropdown trigger button when the
dialog is closed (canceled or success)

---------

Co-authored-by: kemal <hello@kemal.earth>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-10-09 11:30:52 +02:00
Marcus Weinerandsupabase-vercel-tedd[bot] 8c10701cb5 feat(docs): Document TLS ciphers and upcoming CBC removal (#51390) 
## Problem

We're soon going to remove CBC-mode ciphers from the HTTP APIs for
projects hosted on the platform.

## Solution

These docs help customers understand what our TLS offering looks like
and helps with the change.

## Review instructions

Check the copy if it's understandable and well written

## Checklist

Check all before review:

- [x] I have read
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
- [x] If I wrote a new docs topic or edited an existing topic, I used
the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs
[style
guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide)

The `/write-the-docs` skill showed these notes:

- The error strings in the troubleshooting table are typical messages,
not taken from Supabase logs or tickets.
- The proxy workaround is my suggestion, not part of the approved comms.
- The openssl command appears on both pages. The troubleshooting
renderer (MDXRemoteBase) doesn't seem to support <$Partial>, and no
troubleshooting article uses one, so I didn't share it.
- Both pages describe a future removal. After November 10 the wording
("will remove", "until the removal date") needs a follow-up edit to
present tense.

---------

Co-authored-by: supabase-vercel-tedd[bot] <336548405+supabase-vercel-tedd[bot]@users.noreply.github.com>
 2026-10-09 15:45:08 +07:00
Joshen Lim 2b393377c6 Show connection settings if already configured despite no GH auth (#51427) 
## Context

A project could already have a GitHub integration set up by another
member, which will show up in the branch management side navigation as
such:
<img width="259" height="255" alt="image"
src="https://github.com/user-attachments/assets/8bc12ef2-5f25-4245-9c89-4563b08a42a8"
/>

However if the user hasn't authenticated with GitHub, the project
settings -> integrations page will obfuscate the integration details
with a "Connect GitHub" CTA, which is a confusing UX as it hints that
there's no integration set up + conflicts with what's on the branch
management page
<img width="768" height="318" alt="image"
src="https://github.com/user-attachments/assets/a68409c0-f2db-407d-9bac-c109a0d14214"
/>

## Changes involved

Opting to show the integration details if there's one set up
irregardless of whether the user has authenticated with GH, but we'll
require the user to complete the authentication to manage the
integration settings as such (all input fields will also be disabled
until the auth is complete):
<img width="1031" height="511" alt="image"
src="https://github.com/user-attachments/assets/6fad387b-6e76-475e-b4e6-76972d8f76b6"
/>

Note that you can still disable the integration nonetheless irregardless
of the GH connection status

Also fixes the "Remove connection" CTA from Account Preferences - we
were invalidating the GH authorization query cache but the GH
authorization requests normally fails with a 404 if there's no auth set
up, so the query cache would remain stale. Opting to clear the query
cache instead of invalidating

## To test
- [ ] Set up a GH integration for your project under project settings ->
integrations
- [ ] Head to account preferences to remove your GH connection
- [ ] Go back to the project settings -> integrations page, should still
see the GH integration details, just unable to edit
- [ ] Connect with GH, and you should be able to edit the integration
details thereafter
 2026-10-09 16:28:49 +08:00
Francesco SansalvadoreandClaude Sonnet 5 1b27761bec feat(storage): add version history to the file preview panel (FE-4163) (#49208) 
## [5/10] Storage object versioning: version history in the file preview
panel

**Base:** `feat/storage-versioning/004-object-versions-data` #49207 

### This PR

Adds all the versioning ui to the file preview panel.

- polished file preview panel (header, buttons, nits)
- added "Upload file" to the action buttons
- "Delete permanently" now defaults to "Archive" as primary action, and
"Delete permanently" via a dropdown menu as a more destructive action
- added "Versions" toggle section to the file preview panel
- with lifecycle policy "summary"
  - with additional explanation on hover
- versions can be restored or deleted permanently 

### How to test

- in a File storage bucket, open a file preview panel
- when the "Storage Versioning" feature preview flag is true, the
preview panel should show
    - a "versions" section
    - a new "upload file" button next to the "download file" button
- the "delete permanently" button should show "Archive" + a dropdown
with the "Delete permanently" option
- if the feature preview flag is toggled _off_, the preview panel should
looks as before (but with some minor polish)


https://github.com/user-attachments/assets/56f6b9aa-b3a0-45bd-b3e7-5788967d196a

With the feature preview toggled _on_:
- the ui should show the lifecycle policy "summary" that will affect
this file
- hovering the lifecycle policy summary should explain how the policy
will affect/clean up the noncurrent files
- the lifecycle policy summary hover card button should link and open
the "edit bucket modal"
- create a new version of a file by using the "Upload file" (next to
"download file")
  - the file should have a new "Current" version
  - the previous version should become a "noncurrent" version
- the noncurrent version should reflect the lifecycle policy that will
eventually affect it with some additional context on hover via a tooltip
- clicking on a noncurrent version should open a "comparison widget"
that provides a way to restore it and re-promote it to "current" or
delete it permanently
- these actions are also available via dropdown menu from the version
item
- a file should be "archiveable" (please note that showing/managing
archived files will come in the next pr in the stack)
- confirmation modals should prompt to confirm to proceed to restoring
or permanently deleting a noncurrent version


https://github.com/user-attachments/assets/803a6f15-7f32-44ae-9e24-1c201aab178a

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
 2026-10-09 09:36:41 +02:00
Danny White 0b85e0d9c8 fix(design-system): give source panel breathing room before prose (#51468) 
## Problem

After the shadcn source row started rendering, body prose sat flush
under the source stack. The first MDX paragraph has no top margin
(`not-first:mt-6`), and `SourcePanel` had no bottom margin. Pages with
no Radix used to fall through to the separator’s spacing; once shadcn
showed, that gap disappeared.

## Solution

When any source row is present, `SourcePanel` adds `mb-6` (same as the
separator above). When none are present, it returns `null` so we do not
double the separator gap.

| Before | After |
| --- | --- |
| <img width="1650" height="716" alt="CleanShot 2026-10-09 at 14 14
31@2x"
src="https://github.com/user-attachments/assets/f1c6b7bd-ad08-4540-8b20-1951a1c3e49f"
/> | <img width="1646" height="770" alt="CleanShot 2026-10-09 at 14 15
35@2x"
src="https://github.com/user-attachments/assets/bd0f2971-25a2-4468-8164-ceeb60263bf1"
/> |

## Review instructions

1. Open a component with both Radix and shadcn (e.g. Alert), one with
only shadcn (e.g. Skeleton), one with only Radix if available, and one
with neither (e.g. Collapsible).
2. Confirm consistent space between the source rows (or the separator,
when there are none) and the first body paragraph.
 2026-10-09 18:19:44 +11:00
Danny White d523603e17 fix(ui-patterns): hide Skip to content drop shadow when off-screen (#51460) 
## Problem

The shared Skip to content control parks itself with
`-translate-y-full`, so its bottom edge sits on the top of the viewport.
After raised Button shadows landed, the `0 1px 3px` drop shadow still
peeks into the top-left of Studio, Docs, www, and design-system even
when the link is hidden.

## Solution

Hide the control with `-translate-y-[calc(100%+8px)]` so the shadow
clears the viewport. Update the unit test to match. One shared
`ui-patterns` change covers every consumer.

| Before |
| --- |
| <img width="420" height="108" alt="CleanShot 2026-10-09 at 10 14
27@2x"
src="https://github.com/user-attachments/assets/469dd260-d989-49a2-a28c-7f02fa353571"
/> |
| _Note the shadow poking out from the top of the viewport_ |

## Review instructions

On light mode and on Safari (for clearest visibility):

1. Open any Studio, Docs, or www preview page (no need to sign in on
www/docs).
2. Look at the top-left of the viewport before pressing Tab. Confirm
there is no faint button shadow / dark speck.
3. Press Tab once. Confirm the Skip to content button still slides in
cleanly, then Enter to jump to main content.
 2026-10-09 18:19:33 +11:00
Danny WhiteandJoshen Lim d5341f37f9 chore(studio): use standard Badge for deprecated extensions (#51461) 
## Problem

The deprecated indicator next to extensions like `pgjwt` on Database →
Extensions was a `ButtonTooltip` styled to look like a badge
(`variant="warning"`, triangle icon, `rounded-full`). That adds another
one-off badge-like control instead of using the shared `Badge`.

## Solution

Replace it with a warning `Badge` plus the same tooltip content (when
the extension will be removed).

| Before | After |
| --- | --- |
| <img width="356" height="114" alt="CleanShot 2026-10-09 at 10 38
08@2x"
src="https://github.com/user-attachments/assets/98a2356e-203e-4946-b399-63a53ea9804f"
/> | <img width="312" height="116" alt="CleanShot 2026-10-09 at 10 43
08@2x"
src="https://github.com/user-attachments/assets/ee9ff91d-79f6-4a50-b508-ebe602497cfe"
/> |

## Review instructions

1. Open Studio → Database → Extensions.
2. Find `pgjwt` (or another deprecated extension).
3. Confirm a warning `Deprecated` badge appears next to the name (no
triangle icon / pill button).
4. Hover (or focus) the badge and confirm the removal tooltip still
shows.

---------

Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-10-09 14:23:37 +08:00
Saxon FletcherandDanny White 692b14d47b fix(ui): opaque sticky table column hover (#47668) 
## Problem

On tables with a sticky last column (Database Extensions, OAuth Apps,
Custom Auth Providers), hovering a row lets scrolled cell content show
through the sticky column.

Root cause: row hover uses `bg-surface-200`, which maps to `--muted`
(alpha). That works for normal cells (nothing behind them) but sticky
cells sit above horizontally scrolled content, so the tint is
see-through.

## Solution

In `ShadowScrollArea` when `stickyLastColumn` is set:

- Keep an opaque `bg-surface-100` base on sticky cells
- Composite the muted hover tint via `background-image` so hover matches
`TableRow` without becoming transparent

Also:

- Extensions: use `Table containerProps={{ stickyLastColumn: true }}`
instead of nesting a second `ShadowScrollArea` (same pattern as OAuth /
Custom Auth)
- OAuth Apps and Custom Auth Providers: drop redundant per-cell
`bg-surface-100` / `hover:bg-surface-200` so sticky hover comes only
from `ShadowScrollArea`

| Before | After |
| --- | --- |
| <img width="1042" height="98" alt="27097"
src="https://github.com/user-attachments/assets/204a7dc4-d5ac-40b7-87fb-fdb03982eaad"
/> | <img width="1084" height="101" alt="94456"
src="https://github.com/user-attachments/assets/c6db3607-6bbe-4488-a0a5-81f5a0436d66"
/> |

## Review instructions

1. Open Database Extensions. Narrow the viewport or scroll the table
horizontally so the Enabled column is sticky.
2. Hover a row while Links or description content sits under the Enabled
column. The sticky cell should stay opaque and match the row hover tint
(light and dark).
3. Optionally repeat on Auth → OAuth Apps and Auth → Custom Providers
(actions column).

Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com>
 2026-10-09 17:12:47 +11:00
Joshen Lim a76b861b50 Remove schema selector in DB extensions enable dialog (#51440) 
## Context

We've had a number of users run into issues after installing database
extensions in schemas outside of the `extensions` schema - in particular
for the `public` schema, which issues that normally surface are either:
- Inability to enable RLS because the extensions are owned by
`supabase_admin` when created
  - Security advisor hence constantly flags this as an issue
- Inability to move the extension for the same reason
- There is a solution for but it requires a lengthy resolution as
outlined here in [our
docs](https://supabase.com/docs/guides/database/extensions/postgis#moving-postgis-to-a-different-schema)

While the option to select a schema to enable the database extension was
for convenience, this is typically more for power users which seems to
be more of a footgun for most other users.

Hence we're opting to remove the schema selection option in the enable
extension modal to also streamline the UX for enabling an extension by
removing that additional cognitive load.

## Changes involved

### Before:
<img width="430" height="248" alt="image"
src="https://github.com/user-attachments/assets/e99ce86c-b56c-4149-86ca-2457da65b179"
/>

### After:
<img width="438" height="328" alt="image"
src="https://github.com/user-attachments/assets/6be599d5-185b-4efe-9718-b50ac0ed4948"
/>

Clicking on the foot note expands a note as such with an alternative for
power users:
<img width="425" height="434" alt="image"
src="https://github.com/user-attachments/assets/7cbf0b59-0ddc-4933-8c6b-4e30a32115b5"
/>

Extensions will be installed in the `extensions` by default unless
otherwise specified by the extension itself within
`default_version_schema`
 2026-10-09 13:15:48 +08:00
Danny White cd00775dd7 feat(studio): add the pipeline creation wizard preview foundation (#51425) 
## Problem

The redesigned pipeline creation flow (mega branch being worked on in
#49243) needs an incremental rollout while the existing creation sheet
remains the default.

## Solution

- Register **Pipeline creation wizard** in Feature Previews, with
visibility controlled by the `pipelineCreationWizard` ConfigCat flag.
- Require the flag and an explicit user opt-in (via Feature previews
dialog) before enabling the preview.

This adds the preview registration, copy, storage key, and gate. It does
not change creation routing or ship the wizard. The complete gated flow
can be tested on #49243.

The ConfigCat flag is configured as follows:

- **Local/staging:** true for everyone.
- **Production:** false by default, true for the **Supabase Team Email**
segment.

The flag makes the preview visible; it does not opt anyone in. Users
enable it once in Feature Previews. No dev toolbar override is needed in
local/staging.

## Review instructions

1. In local or staging hosted Studio, open **Feature previews**. Find
**Pipeline creation wizard**. With no saved preference, it should be off
by default.
2. Toggle it on and reload. The opt-in should persist. Toggle it off and
reload to confirm opt-out persists. **Add pipeline** still opens the
sheet in this foundation PR.
 2026-10-09 14:55:38 +11:00
Danny White 600c48840f chore(studio): remove outdated Pipelines feedback button (#51424) 
## Problem

The Pipelines header links to an older feedback discussion. The
dashboard's existing Feedback control already captures the current
route.

## Solution

Remove the “Leave feedback” button and its unused URL constant.

| Before | After |
| --- | --- |
| <img width="1932" height="340" alt="32431"
src="https://github.com/user-attachments/assets/ef5f919c-503b-4fcc-9137-90ddeb6c07dd"
/> | <img width="1930" height="350" alt="CleanShot 2026-10-08 at 15 47
38@2x"
src="https://github.com/user-attachments/assets/d44df2a0-8681-4594-9679-148d639d08fd"
/> |

## Review instructions

1. Open a project's Database > Pipelines page at
`/project/<ref>/database/pipelines`.
2. Confirm the header shows the documentation button without “Leave
feedback”.
3. Confirm the diagram and the usage and enable/disable dropdown actions
are unchanged.
 2026-10-09 14:24:08 +11:00
Ping-Min Lin 1ee88e0fee feat(studio): show Realtime on High Availability projects in staging (#51372) 
## What kind of change does this PR introduce?

Feature, limited to staging and local.

## What is the current behavior?

On High Availability projects, Studio always disables Realtime: the
Realtime pages and the Publications pages show an "unavailable" message,
the table editor's "Enable Realtime" checkbox is disabled, and the
project home shows Realtime as disabled.

## What is the new behavior?

A new `useIsRealtimeUnavailable()` hook treats Realtime as unavailable
only on High Availability projects outside staging and local (via
`IS_STAGING_OR_LOCAL`). Those four places use it instead of checking
`high_availability` directly.

- **Production:** unchanged.
- **Staging and local:** Realtime behaves as on standard projects.

## Additional context

Whether a High Availability project is actually registered as a Realtime
tenant is gated separately on the platform side. Until then, the pages
render but Realtime connections for that project fail.

Tests: a new `resolveRealtimeUnavailable` test, and the
`TableRealtimeToggle` and `resolveRealtimeServiceStatus` tests updated
for the renamed parameter.
 2026-10-08 14:05:37 -07:00
Tina HaandClaude Sonnet 5.5 94f0a0ab1e fix(docs): remove outdated migrations endpoint access note from supabase-for-platforms (#51399) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Docs update

## What is the current behavior?

The "Make database changes" section of the Supabase for Platforms guide
says only select customers can access `POST
/v1/projects/{ref}/database/migrations` and points to a partnerships
form. The endpoint is no longer gated:

- https://github.com/supabase/platform/pull/31058 (merged 2026-03-27)
made the migrations endpoint GA for everyone.
- https://github.com/supabase/platform/pull/36265 (merged 2026-07-28)
removed the outdated beta/partner-only descriptions from the API
reference.

This guide page was not updated alongside them.

## What is the new behavior?

Removes the outdated access admonition. The endpoint description and
example are unchanged.

## Additional context

Confirmed with the Control Plane team that the endpoint is GA and this
page is outdated. Related support ticket: SU-491909.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
 2026-10-08 16:18:23 -04:00
Ali Waseem 4205c4103d fix(studio): make detail panel close buttons clickable (#51455) 
The close button on the Auth users detail panel (and the queue message
panel) is absolutely positioned, but `TabsList` is `position: relative`
and comes later in tree order — so it painted on top of the button and
swallowed every click. The button looked fine and did nothing.

Stacks the button above the tab list, adds an accessible name to the
users panel button, and covers it with an E2E test (Playwright does real
hit-testing, so it fails without the fix).

Fixes FE-4519
 2026-10-08 13:43:02 -06:00
Mike Donnalley f918b8ebd6 Add Mike Donnalley to humans.txt (#51451) 
## Problem

humans.txt doesn't have my name listed in it.

## Solution

Adds my name to the list of humans.


## Checklist

Check all before review:

- [x] I have read
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
- [x] If I wrote a new docs topic or edited an existing topic, I used
the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs
[style
guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide)
 2026-10-08 10:44:04 -06:00
Sean OliverandJoshen Lim a7cf044118 feat(telemetry): capture ChatGPT Ads oppref click id (GROWTH-1278) (#51397) 
## Problem

ChatGPT Ads appends an `oppref` click id to landing URLs. We don't read
it, so ChatGPT ad signups show up in PostHog with no click id and the
first-referrer cookie doesn't treat the visit as paid.

GROWTH-1278

## Solution

- Add `oppref` to the first-touch click ids sent with PostHog events
(`telemetry.tsx`)
- Add `oppref` to `CLICK_ID_KEYS` in `first-referrer-cookie.ts`, so it
is stored in `_sb_first_referrer` and counts as a paid signal

Conversion reporting to OpenAI itself goes through GTM, so it isn't part
of this PR.

## Review instructions

1. Run `pnpm exec vitest run first-referrer-cookie` in
`packages/common`. The `hasPaidSignals` test now covers `oppref`.
2. On the preview, load any page with `?oppref=test` and check the
first-touch event in PostHog carries `oppref`.

## Checklist

Check all before review:

- [ ] I have read
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
- [ ] If I wrote a new docs topic or edited an existing topic, I used
the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs
[style
guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide)

Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-10-08 08:26:17 -07:00
Jordi Enric dbfa35ddb3 fix(studio): remove unsupported log drain form variants (#51449) 
## Problem

The log drain form still includes Postgres, ClickHouse, and BigQuery
placeholder variants even though the dashboard does not offer these
destinations. Production Platform API create/update types now exclude
them, causing Studio type errors when the API declarations are
regenerated.

## Fix

Remove the unused variants from the form and submission schemas. Accept
the broader response type for incoming defaults, resolve defaults
through the selectable destination list, and use the form schema type
for the selector.

## How to test

- Run `pnpm --filter studio typecheck` with committed API types and with
types generated from production. Both should pass.
- Run Prettier and ESLint on `LogDrainDestinationSheetForm.tsx`.
- Open project or organization audit log drain settings and add a
supported destination. Available destinations remain unchanged.

Validation: Studio typecheck passes with both committed API types and
freshly generated production API types. Prettier passes; ESLint reports
only existing warnings. Generated declarations are not included in this
PR.
 2026-10-08 15:25:44 +00:00
claude[bot]andClaude 514938f2a6 Revert "chore(www): update Subprocessor List to October 8, 2026 (#51445)" (#51448) 
<!-- claude-slack-attribution -->
_Requested by **Ali Waseem, Nicole Kramer** · [Slack
thread](https://supabase.slack.com/archives/C0161K73J1J/p1791467710430139)_

## Problem

Before: the Subprocessor List page
(`/legal/customer-resources/subprocessor-list`) links to the "Updated
October 8, 2026" PDF, added in #51445.

## Solution

After: the page links to the "Updated June 1, 2026" PDF again, until a
page listing all historical lists is built.

How: reverts #51445. Removes `October-8-2026.pdf` from
`apps/www/public/legal/subprocessor-list/` and restores the
`CURRENT_PDF` constant in
`apps/www/pages/legal/customer-resources/subprocessor-list.tsx` to
`June-1-2026.pdf` / `June 1, 2026`. `June-1-2026.pdf` was never removed,
so it is still in place. This is reverted pending a different page
structure.

## Review instructions

1. Open the preview of `/legal/customer-resources/subprocessor-list`.
2. Confirm the button reads "Subprocessor List - Updated June 1, 2026"
and downloads the June 1, 2026 PDF.

## Checklist

- [x] I have read
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
- [ ] If I wrote a new docs topic or edited an existing topic, I used
the `/write-the-docs` or `/edit-the-docs` skill (not applicable)

🤖 Generated with [Claude Code](https://claude.ai/code)

https://claude.ai/code/session_01HVnxEAvXusb7JCGthHfMW7


---
_Generated by [Claude
Code](https://claude.ai/code/session_01HVnxEAvXusb7JCGthHfMW7)_

Co-authored-by: Claude <noreply@anthropic.com>
 2026-10-08 15:03:44 +00:00
claude[bot]andClaude a259302f36 chore(www): update Subprocessor List to October 8, 2026 (#51445) 
<!-- claude-slack-attribution -->
_Requested by **Sofia Calado** · [Slack
thread](https://supabase.slack.com/archives/C0161K73J1J/p1791467710430139)_

## Problem

Before: the Subprocessor List page
(`/legal/customer-resources/subprocessor-list`) links to the "Updated
June 1, 2026" PDF.

## Solution

After: the page links to the new "Updated October 8, 2026" PDF.

How: added `October-8-2026.pdf` to
`apps/www/public/legal/subprocessor-list/` and updated the single
`CURRENT_PDF` constant (`file` and `displayDate`) in
`apps/www/pages/legal/customer-resources/subprocessor-list.tsx`.

Old PDF: `June-1-2026.pdf` is kept in place so any existing links to it
keep working. The directory had no history of removing old files, so I
left it alone; it can be deleted in a follow-up if preferred.

## Review instructions

1. Open the preview of `/legal/customer-resources/subprocessor-list`.
2. Confirm the button reads "Subprocessor List - Updated October 8,
2026" and downloads the new PDF (header "As of October 8, 2026").

## Checklist

- [x] I have read
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
- [ ] If I wrote a new docs topic or edited an existing topic, I used
the `/write-the-docs` or `/edit-the-docs` skill (not applicable, no docs
change)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01HVnxEAvXusb7JCGthHfMW7


---
_Generated by [Claude
Code](https://claude.ai/code/session_01HVnxEAvXusb7JCGthHfMW7)_

Co-authored-by: Claude <noreply@anthropic.com>
 2026-10-08 08:41:11 -06:00
Gildas GarciakemalClaude Opus 5
 		690ef5e7f7 feat(studio): scoped oauth apps, admins can see an app grants (#50979) 
## Problem

Admins need to see the grants associated to an approved OAuth
application that uses scoped tokens.

## Solution

- Add a menu to the org settings oauth approved apps rows to see the
grant list
- Update the react query hook to use infinite query for the grant list

<img width="1149" height="356" alt="image"
src="https://github.com/user-attachments/assets/2e6cfc76-5584-4447-aa19-a0bf103e2218"
/>

<img width="429" height="395" alt="image"
src="https://github.com/user-attachments/assets/dd811d33-2c0a-46df-b9e9-3cbf8ad2fa7f"
/>

<img width="434" height="267" alt="image"
src="https://github.com/user-attachments/assets/108905ba-4dcb-4dca-abe2-1a4e1fc3dbd2"
/>

## Review instructions

In Org Settings/OAuth apps, you should see a menu button for each app
that contains a _View grants_ item. Clicking this item should open a
dialog with the grants

---------

Co-authored-by: kemal <hello@kemal.earth>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-10-08 15:48:51 +02:00
Kody Jackson ff98ac6452 chore(www) - fix redirects with 404 target destinations (#51413) 
## Problem

A subset of redirects were sending folks over to 404's via incorrect /
outdated destinations.

## Solution

Updates redirect targets to be accurate.

## Preview links

TBD (though only the ones attached to the www app itself will be
testable here).
 2026-10-08 08:04:45 -05:00
Joshen Lim 18080d88f7 Joshenlim/fe 4512 make GitHub connection setup obvious on empty branching page (#51393) 
## Context

Adds an empty state for the branch management page, if no preview
branches have yet to be created (overview wont be shown) - mainly visual
changes here. The main intention here is to surface the GH connection
setup a bit more (otherwise the only CTA for that is in the side nav
which is easily missed + its not clear up front what the benefit of the
GH connection is in the context of branching)

This is how it looked like before for reference:
<img width="1346" height="956" alt="image"
src="https://github.com/user-attachments/assets/776ce3f4-e12b-42e4-8e90-0d5ca15dc58f"
/>

And this is what I'm thinking for the empty state:
<img width="1037" height="431" alt="image"
src="https://github.com/user-attachments/assets/d3a8871e-74d2-499a-b317-f739ed925668"
/>

GH connection will flip its badge and hide the CTA if there already is a
GH connection
<img width="1038" height="443" alt="image"
src="https://github.com/user-attachments/assets/4bf2d34d-6c74-4206-b83c-38ba84b99fb3"
/>
 2026-10-08 19:54:41 +08:00
Bobbie Soedirgo 536fbd5470 fix: make auto rls SQL Multigres-compatible (#51428) 
Part of resolving
[INC-868](https://supabase.slack.com/archives/C0C8EBVUX2L/p1791443825740829?thread_ts=1791411302.921479&cid=C0C8EBVUX2L)

Auto RLS SQL isn't Multigres-compatible since it uses `EXECUTE` with a
freeform `%s` parameter

Tested locally
 2026-10-08 11:59:35 +02:00
kemal.earthClaude Opus 5Gildas Garcia
 		12ab771e86 feat(studio): authorized apps table in org settings (#50529) 
<img width="1150" height="669" alt="image"
src="https://github.com/user-attachments/assets/0b324577-bed5-4272-a7e0-f4444a0c1230"
/>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com>
 2026-10-08 11:25:07 +02:00
Julian Domke af3e397e7f feat(credit-codes): show that credit codes were reduced by partner deals (#51173) 2026-10-08 07:38:53 +00:00
Danny WhiteandJoshen Lim 78dc739901 fix(studio): show support inline and honour AlertError layouts (#51377) 
## Problem

AlertError forces a vertical layout whenever additional actions are
supplied, even when the caller explicitly requests horizontal or
responsive layout. Stripe Sync Engine's uninstall error is one affected
call site, the other was Pipelines as demoed in #51311.

## Solution

Honour an explicit layout. Preserve the existing defaults: vertical with
additional actions, responsive otherwise.

Replace the standalone Contact support action with an InlineLink in the
contact support prose, preserving support form context and breadcrumb
capture. Keep custom actions such as Retry. If instructions are hidden
or custom prose omits contact support, retain a separate inline support
link. With `hideContactSupport`, show no support link and shorten the
default instructions to “Try refreshing your browser.” Custom
descriptions remain unchanged. The local Pipelines configuration error
explicitly hides support. Add the explicit responsive layout at the
Pipelines call site.

| Before | After |
| --- | --- |
| <img width="914" height="426" alt="CleanShot 2026-10-07 at 17 51
20@2x"
src="https://github.com/user-attachments/assets/6cbddfee-97f5-4a7a-bafa-7b5dfd6ab8bf"
/> | <img width="916" height="422" alt="CleanShot 2026-10-07 at 18 26
06@2x"
src="https://github.com/user-attachments/assets/a21952a6-1c1a-437c-af73-c5736f33fd98"
/> |
| <img width="1566" height="384" alt="CleanShot 2026-10-07 at 18 28
07@2x"
src="https://github.com/user-attachments/assets/bdc2a043-421f-4c22-9bd3-37859c6e85c7"
/> | <img width="1568" height="308" alt="CleanShot 2026-10-07 at 18 26
58@2x"
src="https://github.com/user-attachments/assets/da0f2c6a-6254-4196-944b-5665e87b3c3c"
/> |

## Review instructions

1. In a fresh local test project with no existing `stripe` schema, run
this in SQL Editor:

```sql
begin;
create schema stripe;
comment on schema stripe is
  '{"status":"uninstall error","errorMessage":"Local layout test: uninstallation failed"}';
commit;
```

2. Open **Integrations → Stripe Sync Engine → Overview** and reload.
Check **Failed to uninstall Stripe Sync Engine** at wide and narrow
widths, including **Retry uninstallation** and the inline **contact
support** link. Do not click Retry: it invokes the real uninstall
operation.
3. Remove the empty fixture with `drop schema stripe restrict;`.
4. Block the Pipelines source-status request and resize the page: Retry
uses the responsive layout.
5. AlertError callers without an explicit layout should retain their
existing presentation. Confirm default and custom contact support prose
use an inline link, with no standalone support action. Hidden
instructions and custom prose without contact support retain an inline
fallback. With `hideContactSupport`, the default prose is “Try
refreshing your browser.” and no support link appears; custom
descriptions remain unchanged.
6. Automated regression coverage checks that an explicit responsive
layout survives additional actions, and that hiding support removes the
default support wording while preserving custom descriptions.

---------

Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-10-08 16:04:32 +11:00
Joshen Lim 26c838a433 Joshenlim/fe 4590 studio sql export can silently swap values for numeric (#51382) 
## Context

Resolves https://github.com/supabase/supabase/issues/51330

Odd bug on the Table Editor where "Copy as SQL" CTA would misalign
column names to values if the columns had numerical like names such as
`2024` for example.

Also added an unrelated fix for "Copy as JSON":
- Was adding an `idx` column to the output even if the table didn't have
(was a react data grid internal detail)
- Column name ordering didn't match the table

## To reproduce:

1. Create and populate a table:
```
create table public.yearly_totals (id bigint, "2024" bigint, "2023" bigint);
insert into public.yearly_totals values (7, 99, 42);
```

2. Select the row in the Table Editor, then "Copy as SQL" -> The output
will turn out to be
```INSERT INTO public.yearly_totals (id, "2024", "2023") VALUES (42, 99, 7);```
instead of 
```INSERT INTO public.yearly_totals (id, "2024", "2023") VALUES (7,
99,42);```

## To test
- [ ] Verify that the Copy to SQL output matches the intended as per the
set up above
 2026-10-08 11:41:16 +08:00
Brad Deam 33c5f91e6f chore(docs): Add Brad Deam to humans.txt (#51418) 2026-10-08 11:30:04 +10:30
Danny White 6c829b32da fix(studio): enable Pipelines before opening creation (#51311) 
## Problem

Add pipeline opens the creation sheet before users enable Pipelines. A
pending or failed source lookup also lets creation open with an unknown
enablement state.

## Solution

Show the existing enablement dialog first when required, then open
creation after successful enablement. Cancellation and failed enablement
keep creation closed; enabling through the page menu does not open
creation.

Disable both Add pipeline buttons and their keyboard shortcut until the
source lookup succeeds. Failed lookups show an error with Retry,
including the local replication configuration message. Analytics Bucket
keeps its existing creation path.

| Before | After |
| --- | --- |
| <img width="1275" height="919" alt="Pipelines Database Shears Toolshed
Supabase"
src="https://github.com/user-attachments/assets/cf328732-4342-4758-bde2-98b393341d6a"
/> | _No longer in sheet; dialog is shown conditionally before sheet._ |
| <img width="1275" height="919" alt="Pipelines Database Shears Toolshed
Supabase"
src="https://github.com/user-attachments/assets/f593e271-d29c-4955-8849-0bb64946d4cc"
/> | <img width="1275" height="919" alt="Pipelines Database Shears
Toolshed Supabase"
src="https://github.com/user-attachments/assets/3257d391-b892-44df-85d1-5a2108072312"
/>|
| _“Enable Pipelines”_ | _“Enable”_ |

| After |
| --- |
| <img width="1275" height="919" alt="Pipelines Database Shears Toolshed
Supabase"
src="https://github.com/user-attachments/assets/b11770a1-4785-49ee-950d-d821892b3245"
/> |
| _Loading_ |
| <img width="1275" height="919" alt="Pipelines Database Shears Toolshed
Supabase"
src="https://github.com/user-attachments/assets/710f82be-ca6f-4337-a5ce-b65f9d7f6a32"
/> |
| _Lookup failed_ |
| <img width="1275" height="919" alt="Pipelines Database Shears Toolshed
Supabase"
src="https://github.com/user-attachments/assets/68486ca8-37e8-4b27-89ae-8004f159c38a"
/> |
| _Plan-access loading, throttled_ |

## Review instructions

Use a project with Pipelines access and a working replication API (which
should work on [deploy
preview](https://studio-staging-git-dnywh-fixpipeline-enable-create-supabase.vercel.app/)).
Test the PR preview or locally
([instructions](https://app.notion.com/p/supabase/Danny-s-Local-ETL-Pipelines-Setup-3b25004b775f8058a108f8f67fc813e9?source=copy_link)).
In DevTools Network, enable **Disable cache** before each reload.
Analytics Bucket intentionally bypasses the source-status guard.

1. **Loading:** select **Slow 3G**, reload, and watch the request ending
in `/replication/<ref>/sources`. While it is pending, both **Add
pipeline** buttons must be disabled and **Shift+N** must open nothing.
Both buttons replace the plus with a loading spinner and have no loading
tooltip. Restore **No throttling** afterwards.
2. **Lookup failed:** right-click that source request and choose **Block
request URL**, then reload. After retries finish, expect **Failed to
retrieve pipeline enablement status** with **Retry**, disabled Add
buttons whose tooltip matches the error title, and no sheet/dialog from
**Shift+N**. An unconfigured local replication API instead shows
**Replication unavailable locally**. Unblock the request before clicking
**Retry**.
3. **Lookup succeeded:** on a disposable project with Pipelines
disabled, successful Retry restores Add pipeline. Clicking it opens
**Enable Pipelines**. Cancel stays on the list; **Enable** opens the
sheet after successful enablement. On an already enabled project, Add
pipeline opens the sheet directly. Enabling through the page's three-dot
menu stays on the list. Analytics Bucket opens its sheet without ETL
enablement.
4. **Plan-access loading is separate:** in Chrome 145 or newer, find
`/organizations/<slug>/entitlements` in Network, right-click it and
choose **Throttle request**. In the **Request conditions** drawer,
select Slow 3G for that request only, leaving global throttling off.
Reload on a Pro organisation with Pipelines disabled and open Add
pipeline after the source lookup succeeds. While entitlements remain
pending, expect body shimmers, the accessible “Checking Pipelines
access…” status, a disabled loading **Enable** button, and no upgrade
prompt. Remove the request condition afterwards. If your DevTools lacks
per-request throttling, use the component tests for deterministic
coverage.
 2026-10-08 10:42:39 +11:00
shaziya 5056af35e7 chore(www): add on-demand webinar with AWS on securing and scaling vibe-coded apps (#51416) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Content: new on-demand webinar event page.

## What is the current behavior?

There is no event page for the AWS AI-Native Dev Stack webinar.

## What is the new behavior?

Adds an on-demand event, "Secure and scale vibe-coded applications with
Supabase and AWS", in the same format as the Datadog on-demand webinar:

- `main_cta` ("Watch the recording") links to the recording hosted by
The Register
- Speakers: Nick Littman (Supabase) and Mrinali Umashankar (AWS)
- Adds Mrinali Umashankar and her avatar to `authors.json` and
`public/images/blog/avatars`
- Listed under the On-demand filter on `/events`

## Additional context

Event date is set to Sept 9, 2026.

Pre-flight checks (per CONTRIBUTING.md): Prettier passes on the changed
files, and `pnpm build --filter=www` completes successfully locally.
 2026-10-07 16:12:38 -07:00
claude[bot]andClaude 7776b1f7ee docs(www): add Data Residency and Transfers FAQ legal page and Privacy Resources hub section (#51318) 
<!-- ccr-slack-attribution -->
_Requested by **Sofia Calado** · [Slack
thread](https://supabase.slack.com/archives/C0161K73J1J/p1791273150504749?thread_ts=1791273150.504749&cid=C0161K73J1J)_

**Before:** The Data Residency and Transfers FAQ only existed as a PDF.
The Legal Hub (`/legal`) listed the Data Processing Addendum and the
Subprocessor List under "Customer Legal Resources", with no
privacy-specific grouping.

**After:** The FAQ is a native, indexable page at
`/legal/privacy-resources/data-residency-and-transfers-faq`. The Legal
Hub has a new "Privacy Resources" section with the Data Processing
Addendum, the Subprocessor List and the FAQ. The DPA and Subprocessor
List URLs are unchanged.

This publishes the FAQ as a web page and groups it with the other
privacy documents in the Legal Hub.

## Problem

The FAQ needs to be discoverable on supabase.com (including search) and
linked from the Legal Hub next to the DPA and Subprocessor List.

## Solution

How: the page mirrors the DPA shell (`DefaultLayout` > `NextSeo` >
`PageHeader` with `PageBreadcrumb` > `MDXProvider` > `LegalDocVersions`)
with a single `v1` entry. The body is
`data/legal/privacy-resources/data-residency-and-transfers-faq/v1.mdx`,
transcribed verbatim from the source PDF (17 questions in 9 sections),
with one correction confirmed by the requester: the marketplace Note
names "Supabase, Inc.", and the "plan documentation" link points to
`/docs/guides/platform/backups`. The Transfer Impact Assessment has no
direct link, so it and the Trust Center link go to
`https://trust.supabase.io`, as confirmed by the requester. The version
date reads "October 6, 2026", per the requester (the source PDF gave
only the month), and the closing "Last updated / Owner" line from the
PDF is dropped. Further edits made at the requester's direction: the
Usage Information bullet in the retention answer no longer states a log
purge period, and the Usage Information category in the data-location
answer now says "processors". PDF hyperlinks are mapped to real routes.
The hub gets a `privacy-resources` section, and the DPA and Subprocessor
List breadcrumbs now point to it (text and anchor only). The sitemap is
generated from `pages/**/*.tsx`, so the new route is included without
changes.

## Review instructions

1. Open `/legal` and check the "Privacy Resources" section lists the
three documents, and "Customer Legal Resources" still lists Terms of
Service, Support Policy and Service Level Agreement.
2. Open `/legal/privacy-resources/data-residency-and-transfers-faq` and
compare the text with the source PDF.
3. Click through the links in the page, and the breadcrumbs on the DPA
and Subprocessor List pages.

## Open questions for Legal

None remaining. The requester's edits are applied: the closing "Last
updated" line is removed, the ISO 27001 / SOC 2 link goes to
`/security`, the "Legal Hub" link in the subprocessor question goes to
`/legal`, and the meta description wording is confirmed.

## Checks

- `pnpm install --filter www...` worked. Prettier check passes on the
touched files, MDX compiles, and `next dev` renders both `/legal` and
the new page (200, indexable, canonical set).
- Full `tsc`/lint/`next build` were not run as CI-equivalent.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_012JHSu7iLpQ3XPfmfQzFraw

---------

Co-authored-by: Claude <noreply@anthropic.com>
 2026-10-08 10:01:57 +11:00
supabase-vercel-tedd[bot]andAli Waseem d72211556b feat(studio): link overview Machine size card to Infrastructure settings (#51402) 
## Problem

The project overview shows the project's compute size in a card labeled
"Compute", but the card is not clickable. Compute changes are managed on
Infrastructure settings, so users have to find that page on their own.
The adjacent cards (GitHub, Recent branch, Last migration, Last backup)
already link to where you manage them.

## Solution

- Rename the card label from "Compute" to "Machine size" and pass
`href={getInfrastructurePath(ref)}` to `SingleStat`. That renders the
same `Link` wrapper as the adjacent cards, so it gets the same link
semantics, keyboard focus and hover style. The value (compute badge or
"Unknown", plus the High Availability badge) is unchanged.
- Add `onClick={(e) => e.stopPropagation()}` to the
`HighAvailabilityBadge` hover card content. This is the same pattern
`ComputeBadgeWrapper` already uses. The hover card is portaled, but
React still bubbles its clicks to the new card link. Without this, the
link's `onClick` would intercept clicks inside the HA hover card.
Clicking "Read more" would then go to Infrastructure instead of opening
the docs in a new tab.

Out of scope: "Compute" labels elsewhere, the Infrastructure page and
compute provisioning behavior.

Notes:
- The compute badge's hover card trigger already calls `stopPropagation`
on click, because it also sits inside clickable project cards and table
rows. When you click the badge itself, the browser still follows the
native anchor to Infrastructure settings, but it does a full page load
instead of a client-side navigation. This PR leaves that shared
component unchanged.
- While the project is resizing, the overview is replaced by the
resizing state, so the card is not shown then. Settings routes stay
reachable while a project is building, so the link doesn't bounce users
back home.
- No new component test: rendering `ActivityStats` needs mocks for about
eight queries, including `ServiceStatus`. The change only sets an `href`
on an existing component, so a browser check is a better fit.

## Review instructions

1. Open a platform project's overview (`/project/<ref>`).
2. The card next to Status reads "Machine size" and still shows the
compute badge (and the HA badge on HA projects).
3. Click the card, or Tab to it and press Enter. You land on
`/project/<ref>/settings/infrastructure`.
4. Hover the compute badge: its hover card still opens, and "Upgrade
compute" still goes to Infrastructure.
5. On an HA project, hover the High Availability badge and click "Read
more". The docs open in a new tab and the page does not navigate.
6. GitHub, Recent branch, Last migration and Last backup keep their
labels and destinations.

Checks: `tsc --noEmit` for Studio (no new errors; one unrelated error in
`packages/ui-patterns/.../InstructionBlocks.tsx` was already there),
`eslint` on the touched files (no new warnings), Prettier check, `vitest
components/interfaces/ProjectHome` (34 passed).

## Checklist

- [x] I have read
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
- [ ] If I wrote a new docs topic or edited an existing topic, I used
the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs
[style
guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide)

---------

Co-authored-by: supabase-vercel-tedd[bot] <336548405+supabase-vercel-tedd[bot]@users.noreply.github.com>
Co-authored-by: Ali Waseem <waseema393@gmail.com>
 2026-10-07 14:37:52 -06:00
Francesco SansalvadoreandClaude Sonnet 5 2d0bd7af69 feat(storage): add object versions data layer (#49207) 
| # | Branch | Base |
| - | ------ | ---- |
| 1 | `feat/storage-versioning-private-alpha` — merged | `master` |
| 2 | `feat/storage-versioning/002-bucket-form-fields` | `master` |
| 3 | `feat/storage-versioning/003-bucket-modals` | 2 |
| 4 | `feat/storage-versioning/004-object-versions-data` ◀ | 3 |
| 5 | `feat/storage-versioning/005-file-preview-versions` | 4 |
| 6 | `feat/storage-versioning/006-billing-storage-retention` | 5 |
| 7 | `feat/storage-versioning/007-archived-objects-data` | 6 |
| 8 | `feat/storage-versioning/008-archived-rows` | 7 |
| 9 | `feat/storage-versioning/009-archived-preview-pane` | 8 |
| 10 | `feat/storage-versioning/010-replace-file` | 9 |

## [4/10] Storage object versioning: object versions data layer

**Base:** `feat/storage-versioning/003-bucket-modals` (PR 3)

### This PR

The query and mutation hooks for the version history UI, written to
`queryOptions` using the real Storage endpoints.

- `object-versions-query.ts` — the version list, plus `ObjectVersion`
and `LifecyclePolicy`
- `object-version-restore-mutation.ts` — promote a noncurrent version to
current
- `object-version-delete-mutation.ts` — remove one specific version
- `object-purge-mutation.ts` — delete an object and every version,
bypassing versioning
- `VersionHistory.utils.ts` — `computeVersionFate`, the pure rule
deciding what removal outlook each version row shows
- `BroomSparklesIcon.tsx` — inline SVG for a glyph absent from
lucide-react 0.436

Easier to test directly from next PR in the stack #49208 which wires the
queries to the real file preview panel ui.

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
 2026-10-07 22:12:19 +02:00
Miranda Limonczenko 5c68e24faf fix(docs): keep collapsed sidebar group links in the server HTML (#51373) 
Part of
[DOCS-1432](https://linear.app/supabase/issue/DOCS-1432/discovery-gather-information-and-data)

## Problem

While doing Discovery for Information Architecture, I found that my
agents were taking 10+ clicks to find a page. This was _really_ bad. But
it turns out it's an accessibility issue; the agent can't _see_ any
nested subnav item.

Allowing the dom to access the subnav without toggling an accordion
allows an agent to freely navigate, completely resolving some of my
failing evals.


## Solution

- **Render a hidden list of each group's links.** A `<ul hidden>` next
to each group holds its links, nested groups included, so they are in
the HTML. The accordion is unchanged, so the sidebar looks and animates
the same as production.
- Checked for accessibility.




## Manual testing

1. Open the [Platform hub on the deploy
preview](https://docs-git-docs-nav-render-collapsed-links-supabase.vercel.app/docs/guides/platform).
In the sidebar, **Single Sign-On** and **Multi-factor Authentication**
are collapsed.
2. Run `curl -s
https://docs-git-docs-nav-render-collapsed-links-supabase.vercel.app/docs/guides/platform
| grep -o 'href="/docs/guides/platform/sso"'`. It prints the link. The
same command against supabase.com prints nothing.
3. Click **Single Sign-On**. It opens and shows its guides, including
SSO with Google Workspace.
4. Click **Single Sign-On** again. It closes. Notice animation is
intact.
 2026-10-07 11:57:03 -07:00
kemal.earth 329b0a0156 fix(studio): animation gradient on log drains empty state (#51403) 
## Problem

Animation had values that became deprecated after colour migration.

## Solution

Updated to use the same background colour as everywhere else. To test,
on a free organization navigate to Settings > Log Drains.

| Before | After |
|--------|--------|
| <img width="764" height="356" alt="Screenshot 2026-10-07 at 18 20 21"
src="https://github.com/user-attachments/assets/eb07c4fa-e089-4558-83fe-01ff189eeae4"
/> | <img width="760" height="342" alt="Screenshot 2026-10-07 at 18 24
06"
src="https://github.com/user-attachments/assets/dc7b3998-df1c-4df0-ae15-e23286787cf4"
/> |
 2026-10-07 18:42:05 +01:00
Alaister YoungandAlaister Young a8b2f23091 fix(studio): restore deployment update metadata (#51048) 
Deployment update checks now receive a timestamp from GitHub’s
documented commit API instead of silently falling back to `unknown` when
its website response changes. Valid deployment metadata is cached for
ten minutes; development and failed lookups are uncached so they can
recover.

**Changed:**

- Validate and normalize the committer date in the shared Next/TanStack
handler, preserving the existing response shape and `unknown` fallback.
- Exclude only the exact deployment-metadata endpoint from TanStack’s
private API cache default; authenticated APIs and server functions
retain it.
- Keep the client update query unpinned and its existing toast threshold
unchanged.

**Added:**

- Shared-handler tests through both Next and the TanStack adapter for
dates, malformed payloads, upstream failures, and recovery.
- Tests using the installed Vercel route compiler for root and
`/dashboard` cache rules, security headers, and empty Next
configuration.

## To test

- On the TanStack preview, request
`/dashboard/api/get-deployment-commit`; compare its SHA and UTC
timestamp with the deployed commit’s GitHub committer date.
- Repeat the request to check CDN caching. Vercel consumes `s-maxage`,
so use cache-hit/age evidence as well as client-visible headers.
- Confirm another API route and a server-function path retain `private,
no-store`.
- Open an existing project, reload it while clean, and inspect the
untouched support form for metadata-related errors.

Validation: 60 focused tests, Studio typecheck, scoped ESLint,
formatting, knip, and both framework production builds passed. Live
unauthenticated GitHub lookup with the configured API version returned
the expected committer date. Full source lint ratchet also passed,
excluding only generated build directories. Local TanStack browser
checks passed for clean project/reload, general settings, untouched
support form, and naturally emitted development metadata formatting; no
errors or unexpected update toast appeared. The positive two-deployment
toast and submitted support-version formatting were not exercised.
Deployed native Next previews returned the exact commit SHA and expected
UTC timestamp; repeated metadata requests produced CDN HIT responses
(ages 26 and 100 seconds). Build logs establish that the staging preview
also ran Next, so it does not validate TanStack edge header behavior. A
separate preview-only redeployment with a deployment-scoped TanStack
override was confirmed to run Vite. It returned the same correct
SHA/timestamp, a repeat CDN cache HIT, and private, no-store on the
neighboring UTC API. No project settings or production aliases were
changed. Installed Vercel compiler tests cover the remaining
root/base-path and server-function rules. No new environment variable,
token, or dependency is required.

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
 2026-10-07 19:31:02 +02:00