mirror of
https://github.com/supabase/supabase.git
synced 2026-10-05 17:35:10 +03:00
7b4e3aba01bc8ac94ef2d07a9160deca8564b12a
8158
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Anthony LioandAli Waseem
|
7fb2e8cd42 |
fix(docs): repeated shiki grammar registration (#50501)
## What kind of change does this PR introduce? bug fix alternative to #50492 ## What is the current behavior? [#50239](https://github.com/supabase/supabase/pull/50239) introduced repeated shiki grammar registration. duplicate injection rules accumulate between code blocks, slowing later tutorials enough to hit the 60-second build timeout ## What is the new behavior? - reuses one highlighter with all languages loaded once - restores previous highlighting approach + startup cost while keeping the page-size savings replay | before #50239 | after #50239 | this pr -- | -- | -- | -- cold, including initialization | 2.99 s | 6.96 s | 2.94 s warm | 0.37 s | 5.90 s | 0.36 s <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Enhancements * Code blocks now preload syntax highlighting for all supported bundled languages, including SQL, Markdown, and TypeScript. * Highlighting uses a shared configuration and theme for consistent rendering across code blocks. * Concurrent code block renders share a single highlighter initialization. * Language handling and syntax-highlighted output are more consistent across supported, unsupported, aliased, and plain-text code blocks. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Ali Waseem <waseema393@gmail.com> |
||
|
Maksym Ionutsaandcoderabbitai[bot]
|
b5f174a6f9 |
docs: warn against installing PostGIS in the public schema (#50509)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? docs update ## What is the current behavior? Gap in the docs that agents misinterpret ## What is the new behavior? <img width="1566" height="718" alt="CleanShot 2026-09-17 at 12 13 59@2x" src="https://github.com/user-attachments/assets/d50b4228-b0ec-4cca-94d3-ec083720a04a" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Added guidance to install PostGIS in a dedicated schema rather than `public`. - Clarified that installing PostGIS in `public` exposes the `spatial_ref_sys` table through the Data API. - Explained that related security advisor warnings are expected and do not indicate user data exposure. - Added steps for moving PostGIS to another schema, including backup precautions and an option to contact Support. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> |
||
|
Maksym Ionutsa
|
fe0afd66b8 |
docs(cron): document how to clean up cron.job_run_details (#50211)
cron.job_run_details grows unbounded and is never pruned automatically, even after a job is unscheduled. Add an example that schedules a daily cleanup job, and link it from the existing disk-usage caution. ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? docs update ## What is the current behavior? No mention of the _necessary_ regular cleanups ## What is the new behavior? This is now explicitly called out with a weekly clean-up example <img width="1620" height="654" alt="CleanShot 2026-09-10 at 11 41 25@2x" src="https://github.com/user-attachments/assets/2f78a051-5994-4f8a-95c2-c96c64679bed" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Updated the cron quickstart guide with guidance on cleaning up job run history. - Added an example showing how to schedule a daily cleanup job that removes records older than seven days. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ivan Vasilov
|
68d7387e94 |
chore: Update tanstack icons (#50504)
Update the icons for Tanstack in studio and docs. See: - https://docs-git-chore-update-tanstack-icons-supabase.vercel.app/docs - https://studio-staging-git-chore-update-tanstack-icons-supabase.vercel.app/dashboard/project/_?showConnect=true&framework=tanstack |
||
|
Lukas BernertandClaude Fable 5
|
459436e87f |
docs: update compute size descriptions (CPU column, pg_restore guidance) (#49996)
## What kind of change does this PR introduce? Docs update: aligns compute descriptions with the current compute options. Fixes PROD-655 ## What is the new behavior? - compute-and-disk: CPU column now shows "Shared" (Nano–Medium) and "Dedicated · N vCPUs" (Large and above), matching the pricing page - migrating-to-supabase/postgres: pg_restore -j guidance keyed to the vCPU count per compute size - which-version-of-postgres: uses show server_version;, which gives simpler, architecture-agnostic output - High-CPU troubleshooting guide: recommends upgrading compute size instead of naming specific instance types billing-on-supabase: "64 cores" → "64 vCPUs" - Section anchors unchanged (deep-linked from other pages) ## Self-review Content-only MDX change: - pnpm lint:mdx: no findings in the changed files (all reported errors/warnings are pre-existing in unrelated files) - pnpm build:guides-markdown: builds clean; generated .md exports for the changed pages verified - All pages verified rendering in the local dev app on current master - Swept apps/docs for remaining core-count / instance-type mentions in compute descriptions <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated PostgreSQL version-checking instructions to use `show server_version;` with simplified output. * Clarified compute sizing terminology using shared and dedicated CPU allocations and vCPU-based descriptions. * Updated billing guidance to describe scaling up to 64 vCPUs. * Revised database restore guidance with current compute tiers and recommended parallelization settings. * Simplified high-CPU troubleshooting guidance to recommend temporarily scaling CPU capacity. * Added writing guidance to consistently use “vCPU” and “vCPUs” for Supabase compute resources. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> |
||
|
Lukas Bernert
|
055cc7b956 |
docs: state disk limits as per-size minimums, align burst copy (#50016)
## What kind of change does this PR introduce? Docs update: states disk limits as per-size minimums and aligns burst copy across pages. Follow-up to #49996 (compute descriptions). Fixes PROD-658 ## What is the current behavior? - The disk limits table and surrounding prose describe a narrower set of configurations than a compute size can run on - Burst thresholds are inconsistent across pages (three different variants), and one section contradicts itself - Burst is described as CPU behavior, when the burst users observe is disk IO ## What is the new behavior? - `shared-data/compute-disk-limits.ts`: Medium baseline throughput adjusted to 39 MB/s: the lowest value across configurations - `compute-and-disk`: disk limits presented as minimums ("at least"); burst described as disk IO drawing on a disk IO budget; consistent thresholds: burst available up to 2XL, baseline equals maximum from 8XL - Troubleshooting guides (`exhaust-disk-io`, `failed-to-retrieve-tables`, `interpreting-supabase-grafana-io-charts`) aligned to the same threshold; `failed-to-retrieve-tables` keeps the ~30-minutes-per-day burst window with the corrected size range - Section anchors unchanged ## Self-review - Values verified against the AWS EBS-optimized performance data (`describe-instance-types`) for every configuration per size; content cross-checked with the internal runbooks (linked in PROD-658) - `supa-mdx-lint`: no findings in changed files - `pnpm build:guides-markdown` clean; generated `.md` exports show the new values and prose - All changed pages verified rendering in the local dev app - `pnpm typecheck` passes (shared-data + docs) - Note: `compute-disk-limits.ts` also feeds Studio (disk validation, IO budget tooltips). The only value change (Medium 43 → 39 MB/s) surfaces there as one chart tooltip label; conservative direction. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Clarified the differences between shared and dedicated CPU resources. - Updated disk I/O guidance to explain baseline and burst limits as minimums. - Documented disk I/O bursting for compute sizes up to 2XL, including expected duration and limitations. - Clarified that 8XL and larger compute sizes have consistent performance without burst capacity. - Updated the documented baseline throughput for medium compute resources. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Wen Bo Xie
|
20d09b4a72 |
docs(auth): clarify OAuth 2.1 server pricing is included in Auth MAUs (#49753)
OAuth 2.1 server had a single pricing statement anywhere, and it said the feature is free during beta. This states the actual model everywhere the feature is documented or sold: there is no separate charge, and users who sign in through the OAuth server count toward Auth MAUs. - docs getting started: replace the "free during beta" sentence with the MAU-based pricing statement - docs overview: add a Pricing section linking to the MAU usage guide and the pricing page - docs MCP authentication: note that agents authenticate as existing users, and MAUs count per distinct user, so multiple agents for one user count once - www pricing comparison table: add an "OAuth 2.1 Server" row (included on all plans) with a tooltip, and extend the MAU tooltip to cover OAuth server sign-ins <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Clarified that OAuth 2.1 Server is available on all plans without a separate charge. * Explained that OAuth sign-ins count toward Monthly Active Users (MAUs), with multiple agents for one user counted once. * Added links to MAU and pricing guidance. * **Pricing** * Added OAuth 2.1 Server as a plan feature and updated billing descriptions for greater clarity. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Saxon FletcherandClaude Opus 5
|
91e23a0f2d |
docs: define detection checks and specialist monitoring prompts (#50075)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. Yes. ## What kind of change does this PR introduce? Documentation update. ## What is the current behavior? Specialist monitoring prompts leave some comparison windows, baselines, thresholds, and missing-data behavior undefined. This can produce reports or forecasts without sufficient evidence. ## What is the new behavior? Detection checks define inputs, comparison windows, thresholds, units, missing-data behavior, and next investigation steps. Query regressions require comparable snapshots and reset history; capacity forecasts require saved measurements and a matching confirmed limit. Health, Security, Performance, and Capacity prompts fetch and follow the shared detection checks automatically. They record finding, clear, or unable to assess, preserve alert state, and suppress unchanged repeats. Missing history or failed access cannot become a healthy result. Specialist pages retain their diagrams and the sections What it watches, When it watches, What it will output, and Set up the agent. Setup explains the necessary documentation access and saved state; optional links explain report triggers. Prompt and provider setup tabs remain available in HTML and Markdown. The Hire an agent overview and Generalist page and prompt remain unchanged. Prompt Markdown exports use the Markdown serializer to safely contain nested code fences, preserving the full Generalist prompt and its SQL examples. Both prompt exporters have parser-based round-trip coverage. ## Additional context Full docs suite: 215 passed, 2 skipped against a freshly reset disposable Supabase stack. Typecheck, targeted ESLint, formatting, and guides Markdown generation also pass after the export fix. Earlier validation: production docs build, docs typecheck, targeted ESLint, formatting, and guides Markdown generation pass. All four specialist exports contain their diagrams, setup sections, enhanced prompts, and provider instructions. The Health page diagram and setup tab were checked in the browser. Changed pages have no MDX lint violations; existing repository-wide violations remain. The unchanged detection SQL was previously smoke-tested in a disposable sandbox. Hosted MCP runs, scheduler persistence, notifications, and agent evals are outside this validation. Evals remain outside this change. Stage 3 of 3; depends on stage 2. Stack: #50073 → #50074 → #50075. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Reworked observability guidance around hourly, read-only monitoring checks. - Updated health, security, performance, and usage monitors to identify new findings, data gaps, regressions, and resource growth. - Added clearer setup instructions for linked documentation, saved measurements, and alert state. - Replaced the issue-detection guide with standardized outcomes: finding, clear, or unable to assess. - Added explicit thresholds, evidence details, investigation links, and verification steps for turning detections into diagnoses. - **Improvements** - Standardized monitoring prompts and presentation across supported agent types. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> |
||
|
Miranda Limonczenko
|
e8547352c5 |
docs(auth): answer the four most repeated SSR auth questions (#50289)
Closes DOCS-1313 Closes FDBKIN-4573 Closes FDBKIN-15214 Closes FDBKIN-10628 ## Problem Four asks come up repeatedly in feedback intake. The Eval is green and this feedback cannot be included in the Eval. Using the Evals work as an excuse to action on the feedback. 😄 Readers can't tell which auth call verifies a token and which only reads stored state. They don't know that the response the cookies were written to is the response they have to return, because that only ever existed as a code comment. Nobody is warned that refreshing in two places burns a single-use refresh token, which surfaces as users being signed out at random. And nothing in `apps/docs` says `proxy.ts` is Next.js 16 and later, so a reader on 15 writes a file the framework never calls. ## Solution - Add the fact that `getClaims()` refreshes a session close to expiring before it verifies. It was only in the typedoc remarks, and it is what makes the double refresh warning make sense. - Say that `setAll` rebuilds `supabaseResponse` on every write, so a response built earlier is stale, and show how to copy the cookies onto a different one. - Warn that a second refresh outside the reuse window revokes the session, linking refresh token reuse detection. - Note that `proxy.ts` is Next.js 16 and later, and that the file is `middleware.ts` before that. - Name the file in the proxy fence in `examples/prompts/nextjs-supabase-auth.md`, which gave agents the export name and no path. The auth methods partial is shared by five other pages, so that first change surfaces there too. ## Manual testing 1. Open the [SSR client guide](https://docs-git-docs-ssr-client-feedback-supabase.vercel.app/docs/guides/auth/server-side/creating-a-client) on the deploy preview. The Next.js panel carries the version note, the refresh warning, and the response guidance. 2. Select the refresh token reuse detection link. It resolves to the sessions guide. 3. Open the [Next.js Auth prompt](https://docs-git-docs-ssr-client-feedback-supabase.vercel.app/docs/guides/ai-tools/ai-prompts/nextjs-supabase-auth). The proxy section names the file and says it is `proxy.ts` on Next.js 16 and later. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Documentation - Clarified that `getClaims` refreshes sessions when access tokens are near expiration, helping server-rendered sessions remain active. - Expanded Next.js SSR guidance for session-refresh setup, including file placement and version-specific naming. - Added warnings about refresh-token reuse and session revocation after repeated refreshes outside the reuse window. - Added guidance for preserving authentication cookies and cache-related headers when returning updated responses. - Clarified that refreshed tokens should be passed to Server Components to keep sessions active. - Clarified the required session-refresh handler export and example filename. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Miranda Limonczenko
|
a4106b01f5 |
docs(auth): correct what getClaims verifies, and fix the Express env setup (#50288)
## Problem These findings came from a technical audit and verification of the claims in the doc. I found two accuracy problems: - **The guide said `getClaims()` is safe to trust** because it "validates the JWT signature against the project's published public keys every time". That only describes projects on asymmetric signing keys. With a symmetric secret it calls the Auth server instead, which the page's own partial already said. The advanced guide then read as a flat contradiction: `getUser()` was "the only way" to know a session is valid. The real distinction is revocation, not verification. - **Running the Express sample verbatim doesn't work.** In the docs sandbox, it printed `SUPABASE_URL = undefined`, so `createServerClient` received undefined for both the URL and the key. The env var tab installed dotenv twice, once inline and once through the package manager tabs, and its "And initialize it" lead-in was followed by the second install rather than any initialization. The route sample then required dotenv without calling `config()`. ## Solution - Say what `getClaims()` verifies against in each signing key mode. - Reframe the advanced guide's `getUser()` answer around session revocation, so the two pages stop contradicting each other. - Switch the advanced guide's two middleware snippets from `getUser()` to `getClaims()`, matching the guide. - Rename its `Next.js middleware` heading and CloudFront bullet, which the proxy rename missed. - Load dotenv on the first line of the Express entry point, and drop the duplicate install. - Tag both Express fences `js`. They are CommonJS, not TypeScript. - Update the stale "middleware refreshing user sessions" comment in the rendered Next.js `server.ts` sample. ## Manual testing 1. Open the [SSR client guide](https://docs-git-docs-ssr-client-accuracy-supabase.vercel.app/docs/guides/auth/server-side/creating-a-client) on the deploy preview, then the Express tab. dotenv is installed once, followed by `require('dotenv').config()`. 2. Open the [advanced guide](https://docs-git-docs-ssr-client-accuracy-supabase.vercel.app/docs/guides/auth/server-side/advanced-guide). The Next.js heading reads `Next.js proxy` and both snippets call `getClaims()`. Part of DOCS-1313. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Clarified the difference between token validation and detecting revoked server-side sessions. - Updated Next.js guidance and examples to use “proxy” terminology. - Refined CloudFront caching guidance for authenticated routes. - Improved Express setup instructions, including dotenv loading and JavaScript examples. - Expanded explanations of signing-key verification. - Updated Astro and Nuxt examples to forward cache headers correctly. - Updated session-refresh guidance in the Next.js example to reference the proxy. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Miranda Limonczenko
|
7bec687917 |
docs(auth): regroup the SSR client guide and cut repetition (#50287)
## Problem `_partials/auth_methods.mdx` was included six times in this one page. Radix unmounts inactive tab panels, so a browser reader sees it three times on the default Next.js view, and the generated markdown that agents read contained all six. That was about 25% of the 33.5 KB export, and it put the same `Summary of the methods` heading in the table of contents three times over. The page is also 900+ lines with no intro outline, the per-framework recaps were `h2` inside an `h2` section, and six of the nine panels had no step headings at all. ## Solution - Include the auth methods partial once, under a new `Choosing an auth method` section grouped with `Caching considerations`, and point to it from the procedure. This follows the mixed information types rule in `apps/docs/CONTRIBUTING.md`. - Add an intro outline linking the section groups and saying when to read the two reference sections. - Demote the eight in-tab `Congratulations` headings to `h3` so they nest under `Create a client`. - Add a `Create the Supabase clients` heading to Astro, Remix, Nuxt, React Router, Express, and Hono, and the recap Hono was missing. No claims changed here, only placement. ## Manual testing 1. Open the [SSR client guide](https://docs-git-docs-ssr-client-structure-supabase.vercel.app/docs/guides/auth/server-side/creating-a-client) on the deploy preview. The table of contents lists `Summary of the methods` once. 2. Select each of the five links in the intro paragraph. Each one scrolls to its section. 3. Select each framework tab. Every panel has a step heading and a recap. Part of DOCS-1313. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Added an introductory setup overview covering installation, environment variables, client creation, authentication methods, and caching. - Added dedicated guidance for choosing an authentication method. - Added Astro SSR and client sections, along with a complete Hono recap. - Reorganized framework headings for clearer navigation. - Consolidated authentication guidance by removing duplicate content from individual framework sections. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Miranda Limonczenko
|
cf5bf65361 |
docs(auth): tighten the voice in the SSR client guide (#50286)
## Problem
The SSR client guide, like all guides, have drifted from our style rules
and writing best practices.
This PR is to do an inline edit without re-arranging any sections.
## Solution
- Open with what the guide does, then the SSR context.
- Delete the `{/* TODO: Can this be consolidated? */}` comment.
- Remove the three em dashes and the parenthetical asides in prose.
- Rewrite the Next.js danger callout to lead with the consequence:
anyone can forge the session cookie.
- Give Astro, Remix, Nuxt, React Router, and Express the same bulleted
recap Next.js, SvelteKit, and TanStack already had.
## Manual testing
1. Open the [SSR client
guide](https://docs-git-docs-ssr-client-style-supabase.vercel.app/docs/guides/auth/server-side/creating-a-client)
on the deploy preview. The first sentence says what the guide does.
2. Select each framework tab. Every panel ends with a bulleted recap.
Part of DOCS-1313.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Documentation**
- Updated server-side authentication guidance across supported
frameworks.
- Clarified cookie-based session storage, SSR package usage, and
cache-header handling.
- Added guidance on protecting against forged cookies and verifying
sessions with `getClaims()`.
- Expanded framework setup and authentication flow summaries for Astro,
Remix, Nuxt, React Router, Express, and TanStack Start.
- Clarified TanStack route protection, redirects, and server-side
authorization requirements.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
|
||
|
Miranda Limonczenko
|
3e6b40b238 |
chore(docs): revise CONTRIBUTING for common pitfalls with Information types (#50357)
## Problem Our CONTRIBUTING and WORD_LIST is doing a pretty good job at improving contributor documentation, but I consistently see some issues: - **Uses "This guide":** "This guide..." is no longer recommended based on discussions with Nik. Instead, recommendation is to omit those words while still including a value statement. I still do not recommend including a definition of the title term as an opening sentence. - **Mixed information types:** I still often see mixed information types or wordy, chunky paragraphs. Without a definition in place, my agent mistakenly thought there was just "Procedure, Context, and Reference." ## Solution - **A new Information types section** that clearly outlines definitions and usage with cross-references so that this guidance is not easily missed. - **Removed "This guide"** recommendation in favor of a value statement. Additionally added a clear rule about how to spell numbers consistently and gave more guidance about how to structure a large topic. ## Manual testing 1. Open [apps/docs/CONTRIBUTING.md](https://github.com/supabase/supabase/blob/docs/value-statements-and-counts/apps/docs/CONTRIBUTING.md) on this branch. The Information types section renders its table, the Recommendations list, and both fenced examples. 2. Click the two `Information types` links, one in General principles and one under Guides. Both jump to the section. 3. Open [apps/docs/WORD_LIST.md](https://github.com/supabase/supabase/blob/docs/value-statements-and-counts/apps/docs/WORD_LIST.md). The `numbers` entry sits under N, ahead of `numbers in product versions`. 4. Run `npx prettier --check apps/docs/CONTRIBUTING.md apps/docs/WORD_LIST.md` from the repo root. It reports no formatting changes. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Expanded the contribution guide with Information Mapping guidance for procedures, processes, principles, concepts, structures, and facts. - Clarified paragraph and section grouping, page-level classification, recommended ordering, navigation, transitions, outcomes, and connective prose. - Added guidance to use value-focused introductions and bold “Recommended” and “Not recommended” labels. - Added number-formatting guidance, including numeral usage, ranges, fractions, and when to omit step or item counts. - Updated related entries in the documentation word list. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Inder Singh
|
8dc9206f56 | docs(self-hosted): add custom oauth providers guide (#49971) | ||
|
Jeremias Menichelli
|
9bf43188f1 | feat: Create first scaffolding around search v2 and feature flag addition (#50236) | ||
|
Maksym Ionutsaandgithub-actions[bot]
|
795b67b611 |
Docs/clone project r2np clarifications (#50471)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? r2np docs clarifications to https://supabase.com/docs/guides/platform/clone-project ## What is the new behavior? <img width="910" height="692" alt="image" src="https://github.com/user-attachments/assets/41026106-48c6-48bf-aca3-d2ff982c938d" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated project restore guidance to clarify that binary restores copy the entire database and may immediately run extensions, scheduled jobs, webhooks, and wrappers. * Added guidance for using logical restores when definitions need inspection or removal beforehand. * Documented that manual dead-tuple recovery is unsupported due to potential constraint violations and data corruption. * Added recommended recovery paths for deleted rows using physical backups or point-in-time recovery. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
supabase-supabase-autofixer[bot]andivasilov
|
127e21b926 |
Changes by create-pull-request action (#44860)
Automated changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action Co-authored-by: ivasilov <568291+ivasilov@users.noreply.github.com> |
||
|
Katerina Skroumpelou
|
dca96ae929 |
docs: add the Deno optional peer note to the server installing page (#50412)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs, one new section on the `@supabase/server` Installing page. ## What is the current behavior? The Deno install instructions stop at `deno add jsr:@supabase/server`. A user who then imports `@supabase/server/middleware/postgres` on Deno or Edge Functions passes `deno check` and fails at startup with `Could not find package 'pg'`, because Deno resolves an optional peer only when the user's own code imports it. Nothing on the page says so. ## What is the new behavior? A new "Optional peer dependencies on Deno" row under the JSR section explains why, shows the bare `import 'pg'` at the top of the entry module, gives the `deno info` check, and notes the `--minimum-dependency-age 0` flag for same-day releases. Both hand-maintained copies of the partial are updated and stay identical: the spec partial for the reference site and the `docs/ref` copy for the markdown build. ## Additional context `pg` is the only optional peer a user can hit today. The MCP entry will add another once it ships and gets documented then. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added Deno installation guidance for Postgres middleware that requires the optional `pg` dependency. * Clarified that importing `pg` directly is necessary for Deno to resolve it at runtime. * Added commands for verifying package resolution and handling Deno’s minimum dependency age checks. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Saxon FletcherandClaude Opus 5
|
32341830b3 |
docs: organize observability by task and move SQL logs to Explorer (#50074)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. Yes. ## What kind of change does this PR introduce? Documentation update. ## What is the current behavior? The observability overview and access page overlap; configuration interrupts querying; related guides send log queries to the old editor. ## What is the new behavior? The observability overview and navigation follow the same four sections: Read project data, Detect and diagnose, Hire an agent, and Configure and export. The overview absorbs the redundant access page, with permanent redirects for both HTML and Markdown URLs. “Query logs with SQL” owns ClickHouse querying through MCP, the Management API, and Explorer with query source Logs. Logging configuration moves to its own guide; sources, captured headers, and limits live in the field reference. Inspection links to canonical diagnostic SQL. Related Storage and database guides use the replacement Explorer workflow and retain existing anchors where headings move. ## Additional context Validation: Markdown generation, docs typecheck, targeted ESLint, formatting, and content-listing tests. Browser overview/navigation checked; old HTML and Markdown URLs return 308, and the new configuration page returns 200 in both formats. Three ClickHouse examples and the Postgres configuration query ran in a disposable container sandbox. Changed pages have no MDX lint violations; repository-wide existing failures remain. Self-review: the Management API request was verified against its published schema but not sent to a hosted project. Realtime ingestion and hosted logging configuration still need a hosted smoke check. No compatibility path for the deprecated logs engine is documented. Stage 2 of 3; depends on stage 1. Stack: #50073 → #50074 → #50075. Production docs build also passes at the stack tip after standard reference generation. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Reorganized observability guidance around reading data, detecting issues, diagnosing problems, agent setup, and exporting data. - Added a guide for configuring Postgres and Realtime logging. - Updated log investigation instructions to use Explorer, SQL queries, and clearer filters. - Added log source, field, and captured-header references. - Improved advisor guidance and database performance troubleshooting. - Added redirects for moved observability content. - **Accessibility** - Improved screen-reader labels for copy and feature-selection controls. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> |
||
|
|
232ce7e68c |
docs: focus Logs on the unified view and export queryable fields (#50073)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. Yes. ## What kind of change does this PR introduce? Documentation update and a small Studio copy correction. ## What is the current behavior? The Logs guide mixes unified filtering with retired SQL Explorer instructions, and the Markdown field reference loses query semantics. ## What is the new behavior? The Logs guide mixed filtering and event inspection with the retired SQL Logs Explorer workflow. It now documents the unified Logs view: default sources, filter semantics, event details, Live, sharing, bounded exports, and missing results. The log field reference uses one mapping for HTML and Markdown, preserving source IDs, query expressions, and source/query types. The Studio User-filter empty state and comments now match its Auth and API Gateway scope. ## Additional context Validation: shared-field mapping tests, guides Markdown generation, docs typecheck, targeted docs/Studio ESLint, formatting, and browser inspection of the field table. Exported Markdown includes the source IDs and usable ClickHouse expressions. Repository-wide MDX lint has existing failures; changed pages have no reported violations. Self-review: hosted Studio filtering and log ingestion were checked against the implementation, not exercised against a hosted project. The documentation assumes the unified Logs experience is the default. Stage 1 of 3. Review and merge from the bottom of the stack. Stack: #50073 → #50074 → #50075. Production docs build also passes at the stack tip after standard reference generation. Initial CI note: the spelling action failed while building its container because Debian package downloads returned 404, before checking content. The stack has no merge conflicts. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Expanded the log field reference with ClickHouse fields, nested-field query examples, types, schema references, and capture limits. * Reworked the Logs guide with clearer instructions for filtering, event inspection, live mode, sharing, exports, retention, and missing results. * Clarified service and Postgres log behavior and updated navigation and metadata. * **Bug Fixes** * Corrected user-filtering guidance and empty-state messaging to identify Auth and API Gateway logs as supported sources. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Steven Eubank <eubank.steven88@gmail.com> Co-authored-by: Steven Eubank <47563310+smeubank@users.noreply.github.com> |
||
|
Anthony LioandDanny White
|
38f448b01c |
fix(ui): tab component (#50183)
## What kind of change does this PR introduce? bug fix on tab component + a small refactor ## What is the current behavior? the active tab in an underline list gets border-b-2 while its siblings get nothing, so it's 2px taller and its label sits higher than the rest causing a smol layout shift within docs ## What is the new behavior? - adds one absolute positioned bar that slides between tabs so nothing moves - favors track under an underline as an inset shadow vs a border | state | preview | | -------|------| | before | <video src="https://github.com/user-attachments/assets/b73820a6-2994-46d1-aa98-452681f0fef2" /> | | after | <video src="https://github.com/user-attachments/assets/054cd67d-a50c-4aef-9340-a1e1d515047b" /> | ## Test 1. visit [api reference](https://docs-git-antlio-ui-components-tabs-supabase.vercel.app/docs/reference/javascript/installing?platform=npm&queryGroups=platform) 2. visit a [guide ](https://docs-git-antlio-ui-components-tabs-supabase.vercel.app/docs/guides/database/prisma) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added an animated tab indicator that follows the active tab and adapts to layout changes. - Added support for customizing tab indicator styling. - Respects reduced-motion preferences by disabling indicator transitions when appropriate. - **Style** - Streamlined tab borders, spacing, and underlined-tab styling. - Improved tab panel spacing and standardized tab behavior in documentation examples. - Centralized easing behavior for smoother overlays, dropdowns, slides, and panels. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com> |
||
|
Anthony Lio
|
6d08a747f1 |
fix(docs): guide reference perf enhancements (#50239)
## What kind of change does this PR introduce? follow-up to #50235 to reduce reference page payloads and cold rendering overhead ## What is the current behavior? reference pages ship a large rsc payload inside the html _ most of it is duplication rather than content along with shiki that writes ~30 character css variable name for every syntax token making the page heavy in some cases ## What is the new behavior? - moves repeated styles into shared css and uses compact, namespaced token classes - renders details icons inside the client trigger - follows shiki’s guidance to [reuse one highlighter](https://shiki.style/guide/best-performance#cache-the-highlighter-instance) and [load languages on demand](https://shiki.style/guide/best-performance#use-shorthands) `page size` page | before | after | change -- | -- | -- | -- javascript | 10.61 mb | 8.28 mb | -21.9% dart | 4.59 mb | 4.13 mb | -10.1% python | 4.38 mb | 3.73 mb | -14.9% swift | 2.87 mb | 2.56 mb | -10.9% server | 1.59 mb | 1.35 mb | -15.2% kotlin | 3.42 mb | 3.17 mb | -7.2% `cold initialization` language | before | after | reduction -- | -- | -- | -- bash | 2,180 ms | 23 ms | 98.95% javascript | 2,245 ms | 38 ms | 98.29% ## Additional context measured on a local production build which uses the checked in generated content _ production has larger sdk data, so absolute sizes there will be higher <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added reusable expand/collapse controls for API reference details, with updated icons, labels, and styling. * Improved code block rendering with class-based syntax highlighting, wrapped-code support, responsive layouts, and lazy language loading. * **Style** * Added theme-aware syntax-token colors, line-number styling, and configurable code-block shadows. * Consolidated expandable reference panel and item styling. * **Tests** * Added coverage for syntax highlighting, code block rendering, language support, token stability, and reference details. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ali Waseem
|
5b099ee03f |
chore: share Sentry browser-noise filters between studio and docs FE-4392 (#50407)
Studio and docs each kept their own Sentry `ignoreErrors` list, so browser-extension and DOM-mutation noise that Studio already filtered still reached Sentry from docs. Moved the app-agnostic filters (network, extension DOM mutation, non-Error throws, cross-origin script errors) into `packages/common/sentry.ts` and spread them into both client configs, leaving app-specific entries local. Docs will stop reporting extension-driven `insertBefore`/`removeChild` crashes, matching Studio's existing behavior — `ignoreErrors` drops events before `beforeSend` runs, so the error-boundary exemption no longer applies to them. Fixes FE-4392 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Reduced non-actionable browser noise in error monitoring by filtering known network, browser extension, DOM-manipulation, cross-origin, and non-error failures. - Applied consistent filtering across the documentation site and studio error tracking. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Katerina Skroumpelou
|
68acece226 |
docs: drop the retired withSupabase middleware option from the intro (#50409)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs fix, one sentence removed from the `@supabase/middleware` reference intro. ## What is the current behavior? The alpha admonition says the `middleware` option on `withSupabase` in `@supabase/server` is also alpha. That option was removed in `@supabase/server` 1.6.0, where `withSupabase` became a `pipeline` entry, so the sentence describes something that no longer exists. ## What is the new behavior? The admonition keeps the `@supabase/middleware` alpha wording and drops the sentence about the removed option. Both hand-maintained copies of the intro are updated and stay identical: the spec partial that renders the reference site, and the `docs/ref` copy that feeds the markdown build. ## Additional context Same two-file pattern the `@supabase/server` reference uses for its intro and installing partials. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Updated middleware documentation to clarify that only the `@supabase/middleware` package is in alpha. - Removed the alpha-status notice for the `withSupabase` middleware option in `@supabase/server`. - Clarified that `@supabase/middleware` APIs may change between 0.x releases. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
86f38f97c8 |
docs: add troubleshooting entry for the Edge Function secrets limit (#50366)
## Summary - No public doc previously covered what to do when a project hits the 100-secret cap for Edge Functions. Adds a troubleshooting entry documenting the JSON-bundling workaround. - Cross-links the new entry from the Secrets section of `functions/limits.mdx`. ## Sourcing / context - Internal Slack (Jul 2): https://supabase.slack.com/archives/C02KMRX22NR/p1783003062600709?thread_ts=1783002978.740289&cid=C02KMRX22NR — workaround first suggested (Kalleby). - Internal Slack (Aug 19): https://supabase.slack.com/archives/C0BMQHEU6N6/p1787139772204509?thread_ts=1787098919.509189&cid=C0BMQHEU6N6 — functions team reconfirms no override path exists; workaround independently recommended again. - The JSON-bundling pattern mirrors how Supabase's own default secrets already work (`SUPABASE_PUBLISHABLE_KEYS` / `SUPABASE_SECRET_KEYS` in `functions/secrets.mdx`), so this isn't a novel pattern for the platform. - Prompted by support ticket SU-473846. ## Test plan - [x] `pnpm --filter docs lint:mdx` passes with no warnings on either changed file - [ ] New page renders correctly under `/docs/guides/troubleshooting` - [ ] Link from `functions/limits.mdx` resolves <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Added guidance for working around the 100-secret Edge Functions limit by bundling related credentials into a single JSON secret. - Documented JSON secret setup, parsing, replacement behavior, shell quoting, environment files, and the 48 KiB per-secret size limit. - Clarified that JSON bundling does not bypass the per-secret size limit. - Explained when to use Supabase Vault for row- or user-specific secrets, including database round trips and potential latency. - Linked the workaround guide from the Edge Functions limits documentation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> Co-authored-by: Miranda Limonczenko <miranda.limonczenko@supabase.io> |
||
|
Artur Zakirov
|
b86b5feabd |
docs(orioledb): Add Configuration section (#50329)
- Add "Configuration" section into the OrioleDB docs - Update the information about supported indexes: OrioleDB now supports non-btree indexes via index bridging |
||
|
Jake Ng
|
608c3a0813 |
chore(docs): add Jake Ng to humans.txt (#50378)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Add Jake Ng to humans.txt ## What is the current behavior? Jake Ng is not in humans.txt ## What is the new behavior? Jake Ng has joined Supabase ## Additional context Done as part of the onboarding tasks. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added Jake Ng to the team member list in the public contributor information. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Raúl Barroso
|
cad51d85fd |
docs: give your app an MCP server (BYO-MCP guide rewrite) (#50218)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Fixes AI-1009 Updates the BYO-MCP guide so it includes information about the new middleware that will let users authenticate much more easily when building their own MCP server. This one includes a couple of clarifications which are important to document (use of environment variables, etc.) ## What is the new behavior? - Updated the existing guide (and example) for deploying an MCP server to use `@modelcontextprotocol/server` v2 with `createMcpHandler`. - Added new bits related to the new middleware which helps with authentication specifying the required versions of supabase/server and supabase/middleware, and also the auth prerequisites - Includes a table of where each MCP client takes the URL. - Added a new example to `examples/edge-functions/supabase/functions/mcp/` to illustrate the authentication example `authenticated-mcp-server`. ## Publish order > [!IMPORTANT] > There will be a companion PR to include the library components so this PR is blocked until https://github.com/supabase/supabase/pull/49579 ships. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added comprehensive guidance for deploying authenticated MCP servers with OAuth 2.1, Supabase Auth, and user-scoped data access. * Added an authenticated MCP server example with `list_todos` and `create_todo` tools, protected by row-level security. * Added setup instructions for OAuth configuration, consent screens, local testing, and deployment. * **Documentation** * Updated authentication guidance and MCP security warnings across related guides. * Added links to MCP server and OAuth consent resources. * **Refactor** * Simplified the unauthenticated MCP server example and updated its tooling configuration. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Miranda Limonczenko
|
4d57edd622 |
docs(database): add data type guidance to the tables guide (#50025)
Refs FDBKIN-4668 Part 5 of a 5-PR stack on `apps/docs/content/guides/database/tables.mdx`. Builds on #50024. ## Problem Reader feedback in FDBKIN-4668 reports developers mixing `timestamptz` and `timestamp` across production schemas for lack of guidance. This PR adds the guidance half of that ask. The issue also asks for linting in the schema designer, which is a Frontend change and stays open. The page listed 44 data types and recommended neither side of any pair a reader actually has to choose between: `timestamp` or `timestamptz`, `varchar` or `text`, `numeric` or `float`, `integer` or `bigint`. No example on the page had a timestamp column at all, and `timestamptz` appeared only inside the reference table. ## Solution Adds a short "Choosing a type" section to the Reference group, stating a safe default for each pair and why. Also changes `salary bigint` to `salary numeric` in the private schema example. That line was checked against the wrong-outcome test in #50023 and deliberately left there, because a reader storing cents in a `bigint` gets a working table. It changes here because **this branch is what makes it wrong**: once the page recommends `numeric` for money, an example doing the opposite two screens away teaches the reader the opposite of what the page just said. ## Manual testing Preview: https://docs-git-docs-tables-datatypes-supabase.vercel.app/docs/guides/database/tables#choosing-a-type 1. Open the preview at that anchor. "Choosing a type" renders above the data type table. 2. Open `#data-types` on the same preview. It still lands on the reference table, which Studio deep-links to from three components. 3. In a local database, insert `1234.56` into `private.salaries.salary` and select `salary * 3`. Returns `3703.68` exactly. ## Verification (`test-the-docs`) Run in the Compose sandbox against a local stack. | Check | Result | | --- | --- | | `create table private.salaries` with `salary numeric` | pass | | `insert ... values (1234.56, ...)` then `select salary, salary * 3` | pass — returns `1234.56` and `3703.68`, exact | The same example failed to run at all before this stack, because `public.actors` didn't exist on the page's path. #50023 fixes that. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Updated the Postgres tables guide with practical guidance for choosing column types. - Added recommendations for timestamps, text, monetary and decimal values, and identifiers. - Updated the example salary column to use the `numeric` type instead of `bigint`. - Expanded the column type reference section to help readers select appropriate types for common data. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Miranda Limonczenko
|
ef3cfad9ed |
docs(database): add access control to the tables guide (#50024)
Closes DOCS-1314 Brings the Eval to green. Part 4 of a 5-PR stack on `apps/docs/content/guides/database/tables.mdx`. Builds on #50023. ## Problem The page taught table creation and never said to protect a table. Across the original 573 lines, "row level security" appeared once, and that mention was about `security_invoker` on views. There was no `enable row level security`, no policy, and no `auth.uid()` anywhere. The gap was uneven between the two paths the page offers. The Table Editor enables row level security by default and warns that a table without it is publicly writable and readable. The SQL path on the same page produced an unprotected table and said nothing about it. Two further gaps followed from that one: - **Every example was a single access class.** `movies`, `categories`, `actors`, `performances`, and `private.salaries` are all the same shape. The page had no pattern for what most applications actually look like: a shared table everyone reads sitting beside a per-person table only its owner reads. The shared one is the one that gets skipped. - **Nothing told the reader to check the result.** No verify, no confirm, and no expected output anywhere on the page. ## Solution Adds a "Securing your tables" section between creating a table and loading data: - Enabling row level security and writing a first policy, with the consequence stated: a table with row level security and no policy returns no rows to anyone. - A worked example with two access classes, `movies` and `watchlists`. - A verification step. Two queries against `pg_tables` and `pg_policies` confirm that every table exists, has row level security enabled, and has at least one policy. Policy examples follow the idioms in the Row Level Security guide, including the wrapped `(select auth.uid())` form. The guide is cross-referenced rather than restated. ## Verification (`test-the-docs`) All 22 SQL fences on the page were run in document order against a local stack, the way a reader pasting top to bottom would. | Snippet / step | Class | Result | Notes | | --- | --- | --- | --- | | `create table movies` (Creating tables) | runnable-local | pass | | | `create table movies` ×2 (Primary keys) | illustrative-only | skipped | Re-shows the same table to explain `identity`; not a continuation | | `alter table movies enable row level security` | runnable-local | pass | | | `create policy "Anyone can read movies"` | runnable-local | pass | | | `create table watchlists` + 2 policies | runnable-local | pass | | | Verification query, `pg_tables` | runnable-local | pass | Lists both tables with `rowsecurity` true | | Verification query, `pg_policies` | runnable-local | pass | Lists all three policies | | `insert into movies` (Basic data loading) | runnable-local | pass | | | `create table categories` + foreign key | runnable-local | pass | | | `create table actors` / `performances` | runnable-local | pass | Failed before this stack; see below | | `create schema private` | runnable-local | pass | | | `create table private.salaries` | runnable-local | pass | Failed before this stack; see below | | Views section, 9 fences | illustrative-only | skipped | Depend on `students`, `courses`, and `grades`, which the page shows as rendered tables and never creates | **Tier A path:** `movies` → enable RLS → policy → `watchlists` + policies → both verification queries → `insert into movies` → `categories` + FK → `actors`/`performances` → `private` schema → `private.salaries`. Runs clean end to end. **Tier B, RLS behavior.** Every access claim in "Securing your tables" was exercised with two real users: | Check | Expected | Observed | | --- | --- | --- | | User A inserts into their own watchlist | succeeds | succeeds, A sees 1 row | | User B reads A's rows | 0 rows | 0 rows | | `anon` reads `movies` | rows returned | 2 rows | | `anon` reads `watchlists` | 0 rows | 0 rows | | User B inserts a row owned by A | rejected | `new row violates row-level security policy for table "watchlists"` | **Environment:** Compose sandbox (`sandbox/run.sh up-stack`), DinD + `supabase start`, Postgres 17. Fences ran in-container only, never on the host. **Note on the sandbox.** `supabase start` inside the nested daemon hit repeated `toomanyrequests: Rate exceeded` from ECR Public. The CLI retries and the stack does come up, but expect a slow first run. ## What this PR leaves to the one above it Data type guidance is #50025. ## Manual testing Preview: https://docs-git-docs-tables-rls-supabase.vercel.app/docs/guides/database/tables#securing-your-tables 1. Open the preview at that anchor. The three subsections render, and the numbered steps show their embedded SQL blocks. 2. In a local project, run the `movies` and `watchlists` snippets, then the two verification queries. Both tables appear with `rowsecurity` true and at least one policy each. 3. As a signed-out client, select from `movies` and from `watchlists`. `movies` returns rows; `watchlists` returns none. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Expanded the database tables guide with instructions to secure tables before adding rows. - Added guidance on enabling row-level security and creating policies for shared and per-person tables. - Clarified that policies control row access, while revoked table grants can cause permission errors. - Documented owner-scoped access using authenticated user IDs and ways to verify table protection. - Explained that read-only policies reject inserts through the Data API and provided alternatives. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Miranda Limonczenko
|
31a0f450cf |
docs(database): correct the Dashboard table creation steps (#50023)
Part 3 of a 5-PR stack on `apps/docs/content/guides/database/tables.mdx`. Builds on #50022. ## Problem Three claims fail the test that a reader following the page would hit a wrong outcome. **The Dashboard steps don't match the product.** They said to click **New Table**, save, then click **New Column**. Columns are defined inside the table creation panel, so a reader who follows the steps saves a table with no columns and then hunts for a button that isn't part of that flow. The labels are also sentence case in the product: **New table** and **New column**. **The Dashboard example diverges from the rest of the page.** The steps created a table named `todos` with a `task` column, while the SQL tab beside them and every later example use `movies`. A reader who took the Dashboard path and then ran the first Loading data snippet got `relation "movies" does not exist`. **The page's SQL doesn't compose.** Running every fence in document order showed that the many-to-many example under "Joining tables with foreign keys" opened by creating `movies` again. A reader who already created it got `relation "movies" already exists`, the block stopped, so `actors` was never created, and the `private.salaries` example two sections later then failed with `relation "public.actors" does not exist`. **One redundant statement broke two sections.** **The bulk loading example couldn't work.** `COPY` accepts text, CSV, and binary input, and the page listed JSON. `\COPY movies FROM './movies.csv'` expects a value for every column, and `movies` has three while the sample file has two. The options example passed `CSV HEADER` against a file with no header row, which silently dropped the first record. Found by CodeRabbit. ## Solution Rewrites the five Dashboard steps to match the panel and to produce `movies`, so both tabs leave the reader in the same place. Drops the redundant `create table movies` from the many-to-many block; the prose above it already says "You have a list of `movies`". Names the columns in both `COPY` commands, corrects the format list, points the `HEADER` example at a file that has one, and removes the space before each quoted CSV field. Dashboard changes verified against `TableEditor.tsx`, which renders `ColumnManagement` inside the creation panel; `TableEditorMenu.tsx` and `ColumnList.tsx` for the labels; and `DEFAULT_COLUMNS` in `TableEditor.constants.ts` for the `id` and `created_at` columns the editor adds. ## Checked and deliberately left - `grant all on table transcripts to authenticated`. Broader than the example needs, but a reader gets the working result the page promises, so it doesn't meet the bar for this branch. - "By default, views are accessed with their creator's permission." Accurate. `security_invoker` is opt-in. - `salary bigint` in the private schema example. Left here; it changes in #50025, where the page starts recommending `numeric` for money and the example becomes inconsistent with it. ## Flagged, not changed - The `api-create-table-sm.mp4` video in the Dashboard tab may show the older flow. Its contents weren't verified. - **Nothing in the Views section is runnable.** All nine of its fences depend on `students`, `courses`, and `grades`, which the page shows as rendered tables and never creates. Supplying that DDL is new content, so it isn't this branch's job, but it's worth a ticket. ## Manual testing Preview: https://docs-git-docs-tables-technical-supabase.vercel.app/docs/guides/database/tables 1. Open the preview and read the Dashboard tab under "Creating tables". It says **New table**, creates `movies`, and defines both columns in the same panel. 2. Open the Table Editor in a project and click **New table**. The panel has a **Name** field and a **Columns** section, and there is no separate **New Column** step. 3. In a fresh local database, run the SQL fences from "Creating tables" through `private.salaries` in page order. Each one succeeds. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Updated the “Creating tables” guide to use a `movies` table with `name` and `description` columns. - Reworded and consolidated the table-creation steps, including the `created_at` column in the SQL example. - Updated bulk data loading instructions for CSV imports, connection setup, named columns, and header-delimited files; removed JSON from the listed formats. - Simplified the many-to-many example by removing the redundant `movies` table definition. - Clarified schema selection based on the current `search_path`. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
74c116de74 |
docs: add Multigres Public Alpha documentation — MERGE ON SEP 14, 2026 (#49020)
## I have read the CONTRIBUTING.md file. YES ## What kind of change does this PR introduce? This PR adds Public Alpha documentation for Multigres, Supabase's multi-node Postgres high-availability integration. It introduces an overview guide, a compatibility stub, Database sidebar navigation, a Features table row, and a "What you get" card grid. ContentListings items can now omit `href` so those cards are not forced to be links. Linear: MUL-452. ~~🚨 **DO NOT MERGE UNTIL THE PUBLIC ALPHA GOES LIVE** 🚨~~ [@jhydra12 OK'ed merging, FYI] ## What is the current behavior? - Linear item: Documentation for Multigres - Production has no Multigres guides. `https://supabase.com/docs/guides/database/multigres` and `https://supabase.com/docs/guides/database/multigres/compatibility` return 404 - The Database sidebar has no Multigres section - The Features status table does not list Multigres - ContentListings items required a link (`href` was mandatory) ## What is the new behavior? - Overview guide at `/docs/guides/database/multigres` covering alpha status, eligibility, enablement, and what is not included - Compatibility stub at `/docs/guides/database/multigres/compatibility` - Database sidebar: Multigres → Overview, Compatibility (after OrioleDB) - Features table: Database / Multigres / `public alpha` - "What you get" renders as three non-link ContentListings cards - `href` is optional on ContentListings items; markdown export renders unlinked entries when it is omitted ## Additional context - Worktree: ~/GitHub/supabase/supabase-worktrees/nikrichers/mul-452-documentation-for-multigres-ready - Branch commits: Initial Multigres docs draft; Edits (cards, copy, MDX comments); merge master; spelling allow-list for Multigres, Vitess, and sharding - Verification: | Check | Result | | --------------------------------------- | --------------- | | Preview overview | 200 | | Preview compatibility | 200 | | Production overview | 404 (expected) | | Production compatibility | 404 (expected) | | `supa-mdx-lint` on changed MDX | pass | | `vitest` `lib/content-listings.test.ts` | pass (21 tests) | ### Proof: Multigres docs pages render, including non-link What you get cards **Verified:** production 404 · Vercel docs preview 200 #### Overview [(PR preview)](https://docs-git-nikrichers-mul-452-documentation-for-m-6f8a59-supabase.vercel.app/docs/guides/database/multigres) <img width="1388" height="2272" alt="image" src="https://github.com/user-attachments/assets/2780f728-07c0-4320-9826-8f6e68df21e6" /> #### Compatibility [(PR preview)](https://docs-git-nikrichers-mul-452-documentation-for-m-6f8a59-supabase.vercel.app/docs/guides/database/multigres/compatibility) <img width="1388" height="852" alt="image" src="https://github.com/user-attachments/assets/1f8f7181-5b7d-4d01-b376-a2eac923626b" /> ### Test plan - [ ] [Production overview](https://supabase.com/docs/guides/database/multigres) (404) vs [preview overview](https://docs-git-nikrichers-mul-452-documentation-for-m-6f8a59-supabase.vercel.app/docs/guides/database/multigres) - [ ] [Production compatibility](https://supabase.com/docs/guides/database/multigres/compatibility) (404) vs [preview compatibility](https://docs-git-nikrichers-mul-452-documentation-for-m-6f8a59-supabase.vercel.app/docs/guides/database/multigres/compatibility) - [ ] Database sidebar shows Multigres → Overview and Compatibility after OrioleDB - [ ] Overview shows Public Alpha caution, three What you get cards (not links), eligibility, and one-way-migration caution - [ ] Compatibility page is a placeholder that links back to the overview - [ ] Features table lists Database / Multigres / `public alpha` - [ ] `supa-mdx-lint` on `apps/docs/content/guides/database/multigres.mdx`, `apps/docs/content/guides/database/multigres/compatibility.mdx`, and `apps/docs/content/guides/getting-started/features.mdx` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Multigres documentation covering availability, setup, compatibility, limitations, migration behavior, and external resources. * Added Multigres to database navigation and feature-status listings. * Added an overview of Multigres benefits, including automatic failover, unchanged connection strings, and consensus-backed write durability. * **Improvements** * Content listings now support informational items without links across layouts. * Improved listing rendering and click tracking for linked and non-linked items. * **Documentation** * Added spelling support for Multigres, Vitess, and sharding terminology. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Nik Richers <nik@validmind.ai> Co-authored-by: Cursor Agent <cursoragent@cursor.com> |
||
|
Miranda Limonczenko
|
5979218c97 |
docs(database): split out views and group the tables guide by information type (#50022)
Part 2 of a 5-PR stack on `apps/docs/content/guides/database/tables.mdx`. Builds on #50021. ## Problem Four structural problems, all covered by the Guides section of CONTRIBUTING. **Views was a second topic living inside a guide about tables.** Roughly 180 lines, its own subsections four levels deep, sharing nothing with the tables above it beyond the word "table". **The page didn't say what it was for.** It opened with three paragraphs and a sample table before a reader could tell whether the page matched their goal. CONTRIBUTING asks a guide to begin with a sentence declaring its intent. **The top level mixed information types.** It was a flat list of every task, so "Schemas" and "Primary keys" sat beside "Creating tables" and background interrupted the action path. **Reference material interrupted the procedure.** A 44-row data type table sat between "Creating tables" and "Loading data", so a reader following the action path walked through it. Plus a duplicate video: the Dashboard tab under "Joining tables with foreign keys" embedded the same YouTube ID that frontmatter already serves as the table of contents video. ## Solution Moves and regrouping. - **Views moves to its own page**, `guides/database/views`, with its headings promoted one level and the two view-related links from Resources moved with it. - The page opens with an intent sentence, then a section outline, then a "What is a table?" section holding the definition and the spreadsheet comparison. - The remaining sections split into three groups by information type, ordered procedures, context, reference: **Creating and managing tables** holds creating, loading, and joining; **How tables are organized** holds primary keys, relationships, and schemas; **Reference** holds the data type table. - "Joining tables with foreign keys" held both classes, so it splits. The steps keep the heading and stay in the procedures group. The concept, what relational means and the diagram showing it, becomes **Relationships between tables** in the context group. The two cross-reference each other. - The duplicate video goes, and with the Dashboard tab empty the surrounding `Tabs` wrapper goes too. ## Anchors **Every heading keeps its text, so every anchor keeps its slug.** Demoting a heading changes its level, not its anchor. That matters because the inbound links are mostly outside `apps/docs`: Studio deep-links to `#data-types` from three components and `#primary-keys` from two, and `apps/www` links to `#creating-tables` and `#joining-tables-with-foreign-keys`. `#views` is the one exception, since that content left the page. Its single inbound link, in `guides/ai/engineering-for-scale.mdx`, now points at the new page, and both `NavigationMenu.constants.ts` entries are updated: the existing item becomes "Managing tables and data" and a "Views" item sits beside it. ## One deletion that isn't a move The "Columns" heading and its one sentence, "You must define the data type when you create a column." The heading held only the two subsections that moved out, and the sentence repeats a line 50 lines above it. ## Deferred Reordering "View security" behind an access-control foundation. That move only reads correctly once the foundation exists, so it travels with that content in #50024. ## Manual testing Preview: https://docs-git-docs-tables-structure-supabase.vercel.app/docs/guides/database/tables 1. Open the preview. The page opens with its intent, then a four-entry outline, then "What is a table?". Each outline link resolves, and the three groups below read as procedures, then context, then reference. 2. Open `#data-types`, `#primary-keys`, `#creating-tables`, and `#joining-tables-with-foreign-keys` on the preview. All four still land on their sections. 3. Open https://docs-git-docs-tables-structure-supabase.vercel.app/docs/guides/database/views. The new page renders, and "Views" appears in the sidebar beside "Managing tables and data". 4. Run `pnpm build:guides-markdown` from `apps/docs`. It generates 782 files, one more than before. Discard the change to `public/markdown/manifest.json`, which the repo commits as `[]`. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Added a dedicated guide covering Postgres views, including creation, querying, security options, and materialized views. - Reorganized the Tables and data guide with clearer sections, navigation links, table organization details, and reference information. - Updated the many-to-many example to display SQL directly. - Split database navigation into separate “Managing tables and data” and “Views” entries. - Added a PostgreSQL log configuration entry and a C# client reference link. - Updated documentation links to point to the new Views guide. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Miranda Limonczenko
|
e022145be9 |
docs(database): apply house style to the tables guide (#50021)
Part 1 of a 5-PR stack on `apps/docs/content/guides/database/tables.mdx`, one change type per PR. ## Problem The page addressed the reader as "we" in about 18 places. CONTRIBUTING reserves `we` for the Supabase team and asks that the reader be `you`. None of it was caught by the linter, because `Rule004ExcludeWords/first_person` only bans singular first person. Alongside that: scare quotes on established terms, parenthetical asides that CONTRIBUTING disallows, future tense where present tense reads better, an ordered list that repeated `1.` four times, and three relative links where `/docs/...` paths belong. **The three diagrams had alt text that named a topic instead of describing the picture.** "Schemas and tables" tells a screen reader nothing about a diagram showing two schema boxes, one labeled `public` holding six tables and one labeled `api` holding three. ## Solution Inline rewrites and cuts. **Nothing in this PR moves a line from one place to another.** Each alt now describes its diagram: the column types in the table diagram, the arrow between matching columns in the foreign key diagram, and the two labeled schemas with their table counts. Two deletions worth calling out: - The `<br />` spacer after the data type table. - The four-item benefits list under "When to use views". The four headings immediately below restate it verbatim. Also fixes "Every column is a predefined type", which states the relationship backwards. A column has a type; it isn't one. ## One dead link, surfaced by the conversion The Loading data intro pointed at `guides/database/api`, which isn't a page. It exists only as a redirect in `apps/www/lib/redirects.js`, and that redirect doesn't serve the docs deployment, so the link 404s there. As a relative link it was invisible to the link checker; converting it to a `/docs/...` path is what made the Docs E2E suite catch it. It now points at `/docs/guides/api`, the live page that 13 other guides already link to. ## What this PR leaves to the ones above it Section moves and the Views page split are #50022. Corrections to claims are #50023. New content is #50024 and #50025. ## Manual testing Preview: https://docs-git-docs-tables-style-supabase.vercel.app/docs/guides/database/tables 1. Open the preview. The intro reads "Excel spreadsheets" and "relational databases", and the only remaining "we" is "We provide a SQL editor within the Dashboard", which refers to Supabase rather than the reader. 2. Inspect the three images on the preview. Each `alt` describes the diagram rather than naming its topic. 3. Follow the **Data API** link under "Loading data". It resolves instead of returning 404. 4. Run `npx prettier --check apps/docs/content/guides/database/tables.mdx` and `pnpm lint:mdx` from `apps/docs`. Both pass. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Clarified guidance on table creation, data types, primary keys, bulk loading, relationships, schemas, views, and materialized views. - Improved wording, capitalization, terminology, and internal navigation throughout the tables guide. - Updated diagram alt text with more descriptive captions. - Updated the loading data section to link to the Data API guide. - Revised the bulk-loading example with an explicit column list, CSV options, and a simplified database connection command. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Miranda Limonczenko
|
bc917370d1 |
docs: recommend a local CLI install on the front page (#50356)
Closes DOCS-1391 ## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update. ## What is the current behavior? The docs front page is the only place that still recommends a global CLI install. It shows `npm install -g supabase` in both the CLI tab and the AI prompt, and tells the agent to run `supabase init`. Everywhere else in the docs installs the CLI as a project dev dependency, so the version is pinned in `package.json` and everyone on a team runs the same one. ## What is the new behavior? - `installCli` becomes `npm install supabase --save-dev`, matching [Install and run the CLI](https://supabase.com/docs/guides/local-development/cli/getting-started). - `initialize` becomes `npx supabase init`. A dev-dependency install leaves no global `supabase` command. - The AI prompt says "as a project dev dependency" and states the reason, so an agent doesn't fall back to a global install. - Updates the same wording in the monitoring and debugging prompt, which shares the constants. - Updates the `AiPrompt` markdown schema test assertion. ## Manual testing 1. Open the [docs front page preview](https://docs-git-docs-cli-local-install-supabase.vercel.app/docs). The AI Prompt tab reads "Install the Supabase CLI as a project dev dependency with `npm install supabase --save-dev`, so the version is pinned per project" and ends with `npx supabase init`. 2. Select the **CLI** tab. It shows `npm install supabase --save-dev` on the first line and `npx plugins add supabase-community/supabase-plugin` on the second. 3. Run `pnpm run -F docs test:local:unwatch internals/markdown-schema/AiPrompt.test.ts`. All tests pass. |
||
|
|
b0de9dd7a6 |
Create log docs (#47047)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? docs update ## What is the current behavior? No docs on how to interpret and configure PG logs ## What is the new behavior? Adds docs on how to interpret and manage PG logs ## Additional context Related Linear issue: - https://linear.app/supabase/issue/DEBUG-131/create-docs-outlining-all-log-settings <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added a new guide for customizing Supabase-hosted Postgres logging. * Documented available log settings with default values, plus SQL examples to inspect effective settings and role-specific overrides. * Covered configuration options (CLI, Management API, SQL), including precedence rules, role-level override/reset examples, and restart guidance for scheduled logging. * Updated the docs navigation with a new “Postgres log configuration” entry. * **Chores** * Updated the MDX spelling allow list to include “subfield”. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Ali Waseem <waseema393@gmail.com> |
||
|
Nik RichersandNik Richers
|
ea79df46bc |
docs: explain purpose of /edit-the-docs in CONTRIBUTING.md rather than the "Write the docs" checklist (#50313)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs authoring guidance: keep `/edit-the-docs` out of the Write the docs checklist and document when to use what skill in `CONTRIBUTING.md`. ## What is the current behavior? The Write the docs checklist mentions `/edit-the-docs` mid-flow and lists it among checklist skills. That skill is a different workflow and audience, so it risks steering people off the six-stage process. ## What is the new behavior? - Checklist lists only Write the docs skills; no `/edit-the-docs` mid-stage note. - `CONTRIBUTING.md` splits **Write the docs skills** from **Edit existing pages**. - Write the docs applies when product intent and code drive the change, including revising or restructuring existing pages. `edit-the-docs` is for style, structure, or brevity when the product story is unchanged. ## Additional context Also drops a redundant `/test-the-docs` note from "What good looks like" (Self-review still covers it). --------- Co-authored-by: Nik Richers <nik@validmind.ai> |
||
|
Ivan VasilovandAli Waseem
|
c60bb37a74 |
chore: Bump nextjs to non-vulnerable version (#50341)
<!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated the Next.js version used by the application and documentation sites. * Aligned workspace tooling with the latest supported Next.js 16.3.5 release and refreshed related platform builds. * Updated application and documentation sites to Next.js 15.5.24. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Ali Waseem <waseema393@gmail.com> |
||
|
Guillaume Faas
|
1531eb427d |
docs(csharp): add new C# Reference for v8.0.0 (#50116)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Documentation update: add a new page for the C# SDK reference v8.0.0 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added C# client reference documentation for version 8.1.0. * Added navigation for the C# Reference v8 documentation. * Documented authentication, database, Realtime, Storage, filtering, and query APIs with C# examples. * **Documentation** * Added C# SDK 8.0.0 and 8.1.0 release notes, including breaking changes, new capabilities, and bug fixes. * Updated documentation version listings and search coverage for C# v8. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Guillaume Faas
|
ae7167fe58 |
docs: update SignUp documentation in C# reference (#48733)
Addresses https://github.com/supabase-community/gotrue-csharp/issues/85 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Clarified sign-up behavior, including returned sessions, email confirmation, automatic session adoption, and sign-in events. - Documented existing-user obfuscation and the error raised when registration is rejected. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordi Enric
|
fb22534439 |
fix: share sentry crash policy and enable www reporting (#50232)
## Problem The website initializes Sentry only on the server and edge runtimes, leaving browser crashes unreported. Its crash-reporting setup also needs the same consent and third-party filtering policy that docs and Studio otherwise maintain separately. ## Fix Add www browser initialization and tagged crash capture for both Next.js routers, with accessible fallback focus. Move the shared consent/platform and third-party filtering into common/sentry, reuse it from all three apps, and remove the duplicated docs/www helpers and tests. Preserve each app's initialization and Studio's additional noise filtering, sampling, and sanitization. Include the source-map upload token in www's build cache inputs, and trigger the shared/www and Studio test workflows when the shared policy changes. ## How to test - Run `pnpm --filter www test ../../packages/common/sentry.test.ts lib/sentry-capture.test.tsx`: all 22 shared-policy and real-SDK capture tests passed locally. - Run `pnpm --filter studio exec vitest run lib/sentry-client-options.test.ts`: all 42 Studio options and policy-parity tests passed locally. - The www capture tests exercise the actual initializer and both router handlers with an in-memory transport, verify crash tags and fallback focus, and enforce consent. Removing initialization, capture calls, boundary tags, or consent gating was verified to fail these tests. - On a www preview with its DSN configured, accept telemetry consent and trigger temporary render errors in both routers. Verify they reach the www Sentry project with the boundary tag and readable stack traces. Formatting passes. Full local app typechecks encounter existing dependency/generated-file drift, with no diagnostics in changed files. Three unchanged TanStack mock call-count tests fail locally and reproduce against the pre-refactor implementation. Live Sentry ingestion and source-map uploads remain deployment checks. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Accessibility** - Error pages now automatically move focus to a clearly labeled error message, helping screen-reader and keyboard users understand when a page fails. - **Reliability** - Browser error reporting now captures application crashes more consistently across supported page types and navigation transitions. - Reporting respects consent and platform availability while filtering unrelated third-party failures. - **Testing** - Expanded automated coverage for error capture, reporting rules, consent handling, and accessible error-page behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
26585dd4a4 |
[bot] Sync from supabase/troubleshooting (#50284)
This PR syncs the latest troubleshooting guides from the supabase/troubleshooting repository. --------- Co-authored-by: github-docs-bot <github-docs-bot@supabase.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Miranda Limonczenko <czenko@users.noreply.github.com> |
||
|
Miranda LimonczenkoandClaude Opus 5
|
c7534b9e29 |
docs: document the stacked PRs workflow in edit-the-docs (#50018)
Closes DOCS-1381 ## Problem The `edit-the-docs` skill describes a page edit as one continuous pass and has no notion of output. No commits, no branches, no PRs. It ends at edited files in the working tree. That leaves a reviewer one diff that mixes reworded prose, moved sections, and corrected claims, where a move can't be told from a rewrite. ## Solution - **Split the edit by change type:** style, structure, technical revision, and additions. Style runs before structure, so the structure diff reads as pure moves against already-clean prose. - **Ship one PR, one change type per commit.** A stack of PRs is an ask, not a default. When the edit both rewrites prose and moves sections and runs over roughly 150 changed lines, the skill says how large the diff is and offers the split. The requester decides, and no answer means one PR. A stack buys clean per-type diffs, and it costs a reviewer the whole-edit view, since no PR page shows it. - **State the scope boundary once.** The edit is exactly the buckets that have content. A dropped bucket is beyond the edit, and a later request for that change type is a new request. Additions stay author-driven, which keeps a mid-edit request from reopening an earlier commit. - **Scope the technical pass with a wrong-outcome test.** A claim changes only when leaving it would hand the reader an error, a different result than the page promises, or a fact that isn't true. An external best-practices rule doesn't clear that gate on its own, and a missing safeguard is an absence, so it goes to additions. Without the test, a verification pass becomes a rewrite. - **Add `reference/stacked-prs.md`** for the `gh stack` commands, branch naming, restack auditing, and the one command that diffs a whole stack at once. ### What driving the skill on a real page changed Running it end to end on a 684-line guide, then shipping the result, corrected five things a read-through didn't: - **The anchor gate grepped the wrong scope.** It said `apps/docs/content`. Five of the seven inbound anchors to that page lived outside it, in Studio components and `apps/www`, and those are the matches that break a Docs button in the product. The gate is now repo-wide and is step 1 of the structure pass, because moving a section preserves its slug and only renaming breaks it. That's what makes an aggressive regroup safe. - **Grouping sections by subject doesn't work.** On a page about tables every section is about tables, so subject grouping produces one task-named bucket that collects the background too. Classification is now by what the reader is doing, and the skill carries the outline that page settled on. - **Snippet testing finds claims, it doesn't just confirm them.** One example re-created a table an earlier example had made, which stopped that block and left a third example referencing a table nothing ever created. Every fence was individually correct; the sequence was not. So the rule is to run every fence in document order, because that order is what the reader pastes. - **Restacking silently drops upper-branch edits.** The conflict presents as new structure versus old content being re-added, and resolving toward the structure takes the edit with it. `stacked-prs.md` says to audit each branch with a grep per expected change rather than reading the diff. - **`build:guides-markdown` dirties a tracked file.** It writes `apps/docs/public/markdown/manifest.json`, which the repo commits as `[]`. Without a note the artifact lands in the next commit. ## Manual testing 1. Open `.agents/skills/edit-the-docs/SKILL.md` and read Phase 0. You can tell whether to ship one PR or offer a stack, and what to say when offering it, without opening the reference file. 2. Read the PR 3 section. The wrong-outcome test, the external-rule tiebreaker, and the absences line together tell you where a best-practices violation goes. 3. Run `npx prettier --check .agents/skills/edit-the-docs apps/docs/CONTRIBUTING.md`. Reports all matched files use Prettier code style. 4. Run `cat .claude/skills/edit-the-docs/reference/stacked-prs.md`. The branch table resolves through the `.claude/skills` symlink and shows `4+` as a pattern. 5. Run `git diff master -- .agents/skills/write-the-docs/SKILL.md`. Reports no changes, so nothing in `write-the-docs` routes a drafter into this workflow. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Updated guidance for editing existing documentation through distinct style, structure, technical, and additions phases. - Added work-sizing, scope, validation, confirmation, and handoff rules for stacked pull requests. - Documented support for multiple topic-based additions branches and their merge order. - Clarified when to use drafting versus editing workflows, including when a draft becomes a restructure. - Improved guidance for validating code examples, checking repository-wide references, handling generated artifacts, and updating pull request titles. - Updated contributor guidance and related documentation references. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> |
||
|
Miranda Limonczenko
|
86f3a98399 |
fix(docs): stop reporting guide 404s to Sentry, redirect missing paths (#50279)
Closes DOCS-1388 ## Problem Expected guide-path 404s were reported to Sentry as errors. They made up roughly 246k events and nearly all Docs volume, with 0 users impacted. The cause is a type check that never matched. `getGuidesMarkdownInternal` tested `error.cause instanceof FileNotFoundError`, but `GuideModelLoader.fromFs` rethrows `FileNotFoundError` directly and sets `cause` to the underlying `ENOENT` error. Every missing guide path fell through to the `else` branch and hit `Sentry.captureException`. Nine storage section paths and `database/postgrest` also 404 in production. They are section `url` values in the nav config with no landing page and no redirect. They are not reachable from the sidebar, because a nav item with children renders as an accordion button, so the traffic is inbound links and crawlers. ## Solution - Check the error itself as well as its cause, so expected 404s take the quiet branch. - Add `ignoreErrors` for `FileNotFound` to `sentry.server.config.ts`, matching the filtering the client config already does. - Redirect nine storage section paths to their first child page, following the existing `storage/cdn` and `storage/uploads` pattern. - Redirect `database/postgrest` to the Data API guide. The path has no git history, so its 27k hits are external inbound links. - Add the missing leading slash to the `storage/access-control` destination. It resolves correctly today, so this is a cleanup, not a fix. ## Redirect previews Redirects are served by the `www` config, so the **Redirect** column uses the www preview. The www preview cannot render `/docs/**` pages, so each link lands on a 404 after the hop. That is expected. Check the `Location` header, or use the **Destination** column to confirm the page itself. | Source | Redirect | Destination | | :--- | :--- | :--- | | `/docs/guides/storage/production` | [test](https://zone-www-dot-com-git-docs-sentry-404s-and-guide-fa783f-supabase.vercel.app/docs/guides/storage/production) | [storage/production/scaling](https://docs-git-docs-sentry-404s-and-guide-redirects-supabase.vercel.app/docs/guides/storage/production/scaling) | | `/docs/guides/storage/security` | [test](https://zone-www-dot-com-git-docs-sentry-404s-and-guide-fa783f-supabase.vercel.app/docs/guides/storage/security) | [storage/security/ownership](https://docs-git-docs-sentry-404s-and-guide-redirects-supabase.vercel.app/docs/guides/storage/security/ownership) | | `/docs/guides/storage/serving` | [test](https://zone-www-dot-com-git-docs-sentry-404s-and-guide-fa783f-supabase.vercel.app/docs/guides/storage/serving) | [storage/serving/downloads](https://docs-git-docs-sentry-404s-and-guide-redirects-supabase.vercel.app/docs/guides/storage/serving/downloads) | | `/docs/guides/storage/management` | [test](https://zone-www-dot-com-git-docs-sentry-404s-and-guide-fa783f-supabase.vercel.app/docs/guides/storage/management) | [storage/management/copy-move-objects](https://docs-git-docs-sentry-404s-and-guide-redirects-supabase.vercel.app/docs/guides/storage/management/copy-move-objects) | | `/docs/guides/storage/s3` | [test](https://zone-www-dot-com-git-docs-sentry-404s-and-guide-fa783f-supabase.vercel.app/docs/guides/storage/s3) | [storage/s3/authentication](https://docs-git-docs-sentry-404s-and-guide-redirects-supabase.vercel.app/docs/guides/storage/s3/authentication) | | `/docs/guides/storage/debugging` | [test](https://zone-www-dot-com-git-docs-sentry-404s-and-guide-fa783f-supabase.vercel.app/docs/guides/storage/debugging) | [storage/debugging/logs](https://docs-git-docs-sentry-404s-and-guide-redirects-supabase.vercel.app/docs/guides/storage/debugging/logs) | | `/docs/guides/storage/schema` | [test](https://zone-www-dot-com-git-docs-sentry-404s-and-guide-fa783f-supabase.vercel.app/docs/guides/storage/schema) | [storage/schema/design](https://docs-git-docs-sentry-404s-and-guide-redirects-supabase.vercel.app/docs/guides/storage/schema/design) | | `/docs/guides/storage/vector` | [test](https://zone-www-dot-com-git-docs-sentry-404s-and-guide-fa783f-supabase.vercel.app/docs/guides/storage/vector) | [storage/vector/introduction](https://docs-git-docs-sentry-404s-and-guide-redirects-supabase.vercel.app/docs/guides/storage/vector/introduction) | | `/docs/guides/storage/analytics/examples` | [test](https://zone-www-dot-com-git-docs-sentry-404s-and-guide-fa783f-supabase.vercel.app/docs/guides/storage/analytics/examples) | [storage/analytics/examples/duckdb](https://docs-git-docs-sentry-404s-and-guide-redirects-supabase.vercel.app/docs/guides/storage/analytics/examples/duckdb) | | `/docs/guides/database/postgrest` | [test](https://zone-www-dot-com-git-docs-sentry-404s-and-guide-fa783f-supabase.vercel.app/docs/guides/database/postgrest) | [api](https://docs-git-docs-sentry-404s-and-guide-redirects-supabase.vercel.app/docs/guides/api) | | `/docs/guides/storage/access-control` | [test](https://zone-www-dot-com-git-docs-sentry-404s-and-guide-fa783f-supabase.vercel.app/docs/guides/storage/access-control) | [storage/security/access-control](https://docs-git-docs-sentry-404s-and-guide-redirects-supabase.vercel.app/docs/guides/storage/security/access-control) | All eleven return `308` on the www preview with the `Location` shown in the Destination column. Every destination returns `200`. ## Manual testing 1. Open any **Redirect** link above. The URL changes to the Destination path, confirming the redirect fires. 2. Open any **Destination** link. The page renders. 3. Confirm the sources 404 on production today, for example `https://supabase.com/docs/guides/storage/production`. 4. On the [docs preview](https://docs-git-docs-sentry-404s-and-guide-redirects-supabase.vercel.app/docs/guides/storage/schema), request a missing guide path and check the deployment logs. The line reads `Could not read Markdown at path`, not `Error processing Markdown file at path`. The second form is the branch that calls `Sentry.captureException`. |
||
|
Anthony Lio
|
42f1401769 |
fix(ui-patterns): a11y accessible names for ExpandableVideo (#50226)
## What kind of change does this PR introduce? bug fix a11y `ExapndableVideo` ## What is the current behavior? `ExpandableVideo` blurred thumbnail has `alt="Video guide preview"` sitting behind an overlay that already reads "Watch video guide" making screen readers announcing the same thing twice ## What is the new behavior? - adds an optional `videoTitle` prop that names the video once and feeds both the button's `aria-label` and the player's `title`. ## Test 1. visit `/docs/guides/functions` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Enhancements** - Video previews in guides now display the relevant guide title. - Partner introduction videos now include a descriptive title. - Video controls and embedded players provide more specific accessibility labels when titles are available. - Preview images without meaningful alternative text are treated as decorative to reduce redundant screen-reader output. - **Bug Fixes** - Guide titles with Markdown formatting now appear as clean, readable text in video labels. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Anthony Lio
|
71d652483e |
fix(docs): youtube iframe lack titles (#50225)
## What kind of change does this PR introduce? a11y bug fix on youtube embed ## What is the current behavior? YouTube iframes across guide pages have no `title` attribute, so screen readers announce them as an unnamed frame ## What is the new behavior? - extracts a `YouTube.tsx` ui component - adds `<YouTube id title />` + `title` as a required prop ## Test 1. visit `/docs/guides/ai/examples/openai` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Standardized embedded YouTube videos across guides with a consistent video player. - Added descriptive titles to improve accessibility and clarity. - Preserved existing video content and playback behavior. - Updated video embeds across AI, authentication, database, functions, realtime, self-hosting, storage, and migration documentation. - **New Features** - Added privacy-enhanced YouTube playback for embedded documentation videos. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Miranda Limonczenko
|
15a7b0ab18 |
docs(database): correct the dashboard_user and storage admin role descriptions (#50274)
Closes DOCS-1387 ## Problem The Postgres roles guide describes `dashboard_user` as "For running commands via the Supabase UI." That was the original intent, not current behavior. Dashboard queries run as `postgres` and carry a `-- source: dashboard` comment, which the [Postgres logs troubleshooting guide](https://supabase.com/docs/guides/troubleshooting/how-to-interpret-and-explore-the-postgres-logs-OuCIOj) already documents. The two pages contradict each other. Two smaller problems in the same list: - `supabase_storage_admin` is described as an Auth middleware role, copied from the `supabase_auth_admin` entry above it. - Studio ships both stale strings in its own role tooltips. The docs list and `QUERY_PERFORMANCE_ROLE_DESCRIPTION` are near-verbatim copies of each other. ## Solution - Replace the `dashboard_user` description with what the Dashboard connects as instead, and point readers to the `-- source: dashboard` comment for finding Dashboard queries in the logs. - Attribute `supabase_storage_admin` to the Storage middleware. - Apply both corrections to the Query Performance and Query Insights role tooltips. ## Manual testing 1. Open the [roles guide on the deploy preview](https://docs-git-docs-dashboard-user-role-supabase.vercel.app/docs/guides/database/postgres/roles). 2. Scroll to `dashboard_user`. It states that the Dashboard doesn't connect as the role, and that Dashboard queries execute as `postgres` with a `-- source: dashboard` comment. 3. Select **find them in the Postgres logs**. The Postgres logs troubleshooting guide loads. 4. Scroll to `supabase_storage_admin`. It reads "Used by the Storage middleware," not "Auth middleware." 5. In Studio, open **Observability > Query Performance** and hover a `dashboard_user` or `supabase_storage_admin` value in the **Role** column. The tooltip shows the same two corrected descriptions. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Corrected the description of the `supabase_storage_admin` role to reference Storage middleware. - Clarified that the Dashboard does not connect using the `dashboard_user` role. - Documented that Dashboard queries run as `postgres` and can be identified in Postgres logs with a `source: dashboard` comment. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jason Voegele
|
6cc6e36d58 |
chore(docs): add Jason Voegele to humans.txt (#50272)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Adds new entry into `humans.txt`. ## What is the current behavior? Jason Voegele is not in `humans.txt`. ## What is the new behavior? Jason Voegele _is_ in `humans.txt` :) ## Additional context This completes the onboarding task "Add yourself to humans.txt" <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Added Jason Voegele to the team member list in the site’s public credits file. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Anthony Lio
|
3de0e3a614 |
fix(docs): a11y alt text on Colab badge (#50222)
## What kind of change does this PR introduce? a11y fix ## What is the current behavior? Colab badge image is missing alt attribute leaving both image and the link unnamed _ screen reader users have no way to tell what the link does ## What is the new behavior? - adds `alt="Open in Colab"`, matching the text rendered inside the SVG so voice control users can activate it by its visible label ## Test 1. visit [/docs/guides/ai/google-colab](https://supabase.com/docs/guides/ai/google-colab) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Improved accessibility across AI guides and quickstarts by adding descriptive alternative text to “Open in Colab” badge images. - Updated Google Colab, LlamaIndex, face similarity, hello world, and text deduplication documentation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Anthony Lio
|
2e861b5415 |
fix(docs): guides table overflow (#50221)
## What kind of change does this PR introduce? bug fix of table usage within guides ## What is the current behavior? table markup is used within the observability guide causing overflow of the content ## What is the new behavior? favors table component usage within mdx guide to fix the overflow and enable scroll | state | preview | | -------|------| | before | <img width="1171" height="668" alt="image" src="https://github.com/user-attachments/assets/bdbb905e-0ea9-4cde-b20b-84b4ef9a4137" /> | | after | <img width="1171" height="668" alt="image" src="https://github.com/user-attachments/assets/9e062222-1dad-49da-bdbe-616d89703301" /> | ## Test 1. visit [/docs/guides/observability/log-field-reference](https://supabase.com/docs/guides/observability/log-field-reference?queryGroups=source&source=edge_logs) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Improved table rendering in the log field reference documentation. - Updated documentation tables to use the shared table presentation for a more consistent layout. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |