dima/supabase
1
0 Fork 0
mirror of https://github.com/supabase/supabase.git synced 2026-10-05 09:25:06 +03:00
Code Issues Packages Projects Releases Wiki Activity
37,816 Commits 1,797 Branches 62 Tags
86854671e95be31e24fa0785cded0579fe692fcb
Commit Graph
19735 Commits
Author SHA1 Message Date
claude[bot]andClaude 86854671e9 feat(www): add Open Authorization Integration Addendum (#48804) 
<!-- ccr-slack-attribution -->
_Requested by **Nicole Kramer** · [Slack
thread](https://supabase.slack.com/archives/C0161K73J1J/p1786027145751449)_

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Feature — a new legal page on the marketing site (`apps/www`).

## What is the current behavior?

**Before:** the Program Addenda page at
`/legal/partner-resources/program-addenda` lists exactly one addendum,
the Integration Partner Addendum. There is no published Open
Authorization (OAuth) addendum anywhere on the site.

## What is the new behavior?

**After:** the Program Addenda page also lists the **Open Authorization
Integration Addendum**, linking to a new page at
`/legal/partner-resources/program-addenda/oauth-partner-addendum`.
Formatting, breadcrumbs, version selector, and listing badge all match
the existing Integration Partner Addendum.

**How:** three files.

-
`apps/www/data/legal/partner-resources/oauth-partner-addendum/20260806-v1.mdx`
— the addendum text, formatted to match
`integration-partner-addendum/20260615-v1.1.mdx` (escaped section-number
periods, `####` run-in headings for the lettered subsections, italic
`_Label_` run-in labels for the enumerated data-protection clauses,
explicit `[url](url)` links).
-
`apps/www/pages/legal/partner-resources/program-addenda/oauth-partner-addendum.tsx`
— the page, mirroring `integration-partner-addendum.tsx` with a
single-version `versions` array.
- `apps/www/lib/addenda.ts` — adds a small `TITLE_OVERRIDES` map. The
listing derives titles by capitalizing slug words, which turns
`oauth-partner-addendum` into "Oauth Partner Addendum"; the override
makes the listing link read the same as the page's `h1`.

No other wiring was needed: the addenda listing is generated from the
directory, so there is no hub entry, redirect, rewrite, sitemap entry,
or `noindex` rule to add.

## Additional context

Two things for the requester to confirm:

- **The effective date is an assumption.** The addendum document itself
contains no date. The listing and version label derive the effective
date from the `YYYYMMDD` filename prefix, so this file is dated **August
6, 2026**, taken from the source document's own filename (`2026.08.06 -
Supabase-OAuthAddendum-ONLINE.docx`). To change it, rename the file — no
code change required.
- **The legal text is a verbatim transcription.** Source wording,
capitalization, and punctuation are preserved exactly as drafted,
including anything that reads like a typo. Only markup was added; the
plain text was diffed against the transcription and is
character-identical. Please review the wording itself rather than
assuming it was copy-edited.

One wording choice that was not in the source document: the page
subheader, "An addendum to the Master Partner Program Agreement
governing OAuth integrations." It mirrors the one-line subheader style
of the existing addendum page and is easy to reword.

## Also fixed here: a literal `(c)` rendered as `©` in legal headings

While formatting the new addendum we hit a rendering bug that turned out
to be **already live on supabase.com**, not new to this branch.

The heading font, **Manrope**, ships a default-on standard `liga`
feature that maps the glyph sequence `parenleft c parenright` to the
copyright glyph. So a literal `(c)` anywhere inside an `h2`–`h6` on the
marketing site paints as `©`. Body copy is unaffected because it uses
Inter, whose subset has no such ligature — which is why this only ever
shows up in headings.

This branch adds a `legal-prose` utility (`font-variant-ligatures:
no-common-ligatures`) in `apps/www/styles/globals.css` and applies it to
two pages:

- the new **Open Authorization Integration Addendum** page (heading
`#### (c) Security.`), and
- the **Master Partner Program Agreement** page, where the `#### (b)
Such indemnity …` heading in section 17.1 contains `… ; or (c) replace
the Covered Materials …` about 600 characters into the line. That page
was **already published**, and rendered "or © replace the Covered
Materials" in production.

The MPPA change is one word — `className="prose"` → `className="prose
legal-prose"`. **No legal text was modified**: no HTML entities, no
zero-width characters, no rewording, no re-hyphenation. The DOM still
holds `U+0028 U+0063 U+0029`; only the font's shaping is suppressed.
Verified in Chromium against the real heading text and the same two font
subsets `next/font` serves: the `(c)` run measures **15.36px** before
the fix (a single `©` glyph) and **22.05px** after (three literal
glyphs), against a 23.30px control for the `(b)` in the same heading.

All 17 `.mdx` files under `apps/www/data/legal/` were swept for `(c)`
and the other Manrope `liga` input sequences (`--`, `->`, `<-`, `(>)`,
`<3`) on heading lines. The only two hits are the two pages fixed above;
nothing else needs the utility today. (Headings do contain
`ff`/`fi`/`fl`/`tt` — those ligatures are ordinary typography and are
intentionally left alone.)

**For future legal pages:** because the cause is the heading font's
default ligature rather than anything about these documents, any new
legal page whose source has `(c)` in a heading will need `legal-prose`
on its prose container too.

**One side effect worth flagging:** `no-common-ligatures` is blunt, so
on those two pages it also suppresses the ordinary `fi`, `ff` and `tt`
ligatures — a sweep of the legal `.mdx` files counts 107 such
occurrences in headings (`fi` 83, `ff` 21, `tt` 3, `fl` 0), so the note
above about leaving them alone holds for the rest of the site rather
than for these two pages. That is a deliberate trade-off: correctness of
the legal text beats typographic polish on two addendum pages. A
narrower alternative exists — `font-feature-settings: "liga" 0` scoped
to just the offending ligature, or overriding only the
`parenleft_c_parenright` substitution — but it is more fragile and more
subset-specific, so push back here if you would rather have that
instead.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01VtcJJGqw5jL1ESwhs8DGCu

---------

Co-authored-by: Claude <noreply@anthropic.com>
 2026-08-07 15:54:37 +02:00
kemal.earthandClaude Sonnet 5 3a98b0c818 feat(studio): add legacy token mode to scoped pat creation flow (#48844) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Replaces the scoped form's inline account-level access mode with a
proper legacy-token escape hatch: "Create legacy token" switches the
sheet to the classic form (name + expiry only) and creates through the
legacy endpoint, skipping the two-step review. Mirrors the mode-switch
links in both directions and restores the "Generate token for
experimental API" split-button dropdown, extracted into a shared
ExperimentalTokenDropdown.

Ported from origin/w3b6x9/scoped-pat-ui-rework, excluding its expiry
handling (shipped in #48811) and MCP-unsupported warnings (follow-up
PR).


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added support for creating classic account-wide access tokens
alongside scoped tokens.
  * Added an experimental token dropdown for quick token creation.
* Added links to switch between scoped and legacy token creation flows.
* Classic token creation now provides dedicated warnings and simplified
access settings.

* **Improvements**
* Updated token access messaging, descriptions, and labels for clarity.

* **Tests**
* Expanded coverage for token creation, navigation, validation, and
clipboard behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
 2026-08-07 13:05:56 +01:00
shaziya 2e633a3fbe Add blog post: Supabase is now a connector on Perplexity Computer (#48776) 2026-08-07 03:05:23 -07:00
kemal.earthWen Bo XieClaude Opus 5
 		e8f5120dc5 feat(studio): enforce expiry scoped pat (#48811) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

Waiting on #48809


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added custom access-token expiration date limits, allowing dates from
today through one year ahead.
* Date pickers now enforce configured minimum and maximum date
boundaries.

* **Updates**
  * Removed the option to create non-expiring access tokens.
  * Expiration is now required when creating classic access tokens.
  * Improved form reset behavior and expiry tracking.

* **Tests**
* Added validation coverage for required, valid, and out-of-range custom
expiration dates.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Wen Bo Xie <wenbox323@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-08-07 10:09:21 +01:00
kemal.earthWen Bo XieClaude Opus 5
 		f8206a5f81 fix(studio): model scoped pat permissions as OR-of-AND alternatives - smaller version (#48809) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Breaking down #48635


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **New Features**
- Scoped access tokens now support alternative permission requirements,
enabling more precise access for APIs and tools.
- Added clearer role and resource access evaluation, including
project-specific permissions and partial read access.
- Access reviews now identify unavailable or excessive permissions and
group inaccessible resources for easier resolution.
- **Bug Fixes**
- Improved handling of legacy, incomplete, or invalid permission data
with safer fallback behavior.
  - Corrected access filtering for MCP tools and API capabilities.
- **Documentation**
- Updated access-review wording to clarify the relationship between
scopes and related MCP tools.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Wen Bo Xie <wenbox323@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-08-07 09:51:36 +01:00
CharisandJoshen Lim 0b97e37ccf feat: notebook content schema (#48813) 
Related to FE-4109.

## Summary

- **API codegen workaround**: Platform API's `notebook` content type
hasn't shipped to the OpenAPI spec yet, so `pnpm api:codegen` can't be
run. Locally widened `ContentBase.type` to include `'notebook'` (marked
with TODO for removal once spec publishes).
- **Notebook schema & type system**: Introduced Zod schemas mirroring
RFC-defined notebook shape (`schema_version: 1, cells: Cell[]`).
Maintains wire/domain boundary (cell `sql` → `unchecked_sql` branded for
security). Agent-writable schema for `create_notebook` tool omits cell
IDs (backend-generated); future update operations will require them. All
TypeScript types are `z.infer`'d from schemas (no hand-written parallel
interfaces).
- **IsoDateTimeString moved**: Extracted ISO datetime validator from
`querySource.ts` to `lib/iso-datetime.ts` (data layer shouldn't import
from components layer). Needed by notebook `time_range` fields.

## Test plan

- [x] Unit tests: `notebook-schema.test.ts` (9 tests),
`iso-datetime.test.ts` (3 tests), `querySource.test.ts` updated and
passing (26 tests)
- [x] Typecheck: no new errors
- [x] Prettier: formatting clean

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **New Features**
- Added support for validating and processing notebook content,
including markdown, database, log cells, time ranges, and chart
configurations.
  - Added compatibility for notebook content types in content handling.
- Added reliable ISO date-time validation for notebook data and related
features.

- **Tests**
- Expanded coverage for valid and invalid notebook structures, cell
requirements, time ranges, chart settings, and date-time values.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-08-07 13:40:18 +07:00
Monica Khoury a515f3d81f fix(ui): remove extra spacing before custom reports section (#48796) 
Fixes FE-4107.

## What is the current behavior?

The Observability sidebar had unnecessary spacing below the Product
navigation.

- Extra whitespace below the last Product menu item (`Realtime`).

## What is the new behavior?

Removes the global flex gap and applies spacing explicitly to the Custom
Reports section.

- Product navigation ends cleanly at the divider.
- Spacing before the Custom Reports section is intentional and
consistent.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Style**
  * Improved spacing and alignment in the observability menu.
* Added vertical separation around the custom reports section for a
cleaner layout.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-07 13:29:37 +07:00
shaziya a71636f5a0 feat(marketing): add hint text below Go page form labels (#48824) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Small feature addition to `packages/marketing` (Go page form
schema/renderer), plus a copy/layout change on
`/go/select-2026/partner-day`. Supersedes #48821 (closed), which is
folded in here.

## What is the current behavior?

Go page form fields only support a `description` string rendered *below
the input*. There's no way to put a short note directly under a field's
label, above the input — so the Partner Day RSVP's "attending" question
crammed "(your Partner Day invite covers it)" into the question text
itself.

## What is the new behavior?

- Adds an optional `hint` string to the Go page form field schema
(`packages/marketing/src/go/schemas.ts`), rendered as small italic text
directly beneath the label, above the input
(`packages/marketing/src/forms/MarketingForm.tsx`).
- Updates the Partner Day RSVP's "attending" field to use it: the
question is now "Would you like to attend Supabase Select on October 2?"
with "Your Partner Day invite covers it" as a separate grey/italic hint
line underneath.
- No other fields set `hint`, so this is backward compatible — verified
`vip-experience`'s identical select field (no `hint` set) renders
unchanged.

## Additional context

- Verified locally in the browser: the new hint renders correctly on
Partner Day, and other `_go` pages with form fields are unaffected.
- `prettier --check` and `tsc --noEmit` both pass on the changed files.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added optional hint text beneath form field labels, displayed in
smaller italic text.
* Updated the Select RSVP question to clearly distinguish the attendance
prompt from invite coverage details.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-07 05:33:47 +00:00
Joshen Lim 3a383c87c7 Initialize notebooks store (#48801) 
## Context

More groundwork for the Explorer - this one's focused on initializing
the valtio store for managing notebooks
Store architecture will follow closely with the existing
sql-editor-store

No data persistence yet, but can test creating a new notebook
<img width="195" height="143" alt="image"
src="https://github.com/user-attachments/assets/8656fb5b-3a8e-4f71-b2ce-d2f34ca9b552"
/>

Which should open a placeholder page
<img width="1387" height="527" alt="image"
src="https://github.com/user-attachments/assets/4a81b1ae-a740-40e6-9d33-29fa4f83b541"
/>

Closing the notebook brings you back to the explorer home page

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added support for creating and opening project notebooks from the
Explorer.
  * Added notebook tabs alongside existing entity and SQL tabs.
* Added notebook management, including loading, renaming, removing,
editing cells, and tracking unsaved changes.
  * Added support for SQL, logs, and Markdown notebook cells.
  * Added dedicated notebook routes and an initial notebook editor view.
  * Added notebook icons throughout the Explorer interface.

* **Documentation**
* Documented session-scoped notebook state for query results and row
limits.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-07 11:21:38 +07:00
Wendie CheungandWendie Cheung 91a394fc83 Use white wordmark for QA.tech primary logo (#48827) 
Follow-up to #48798. The primary `logo` was a black app-icon-badge
(square background), inconsistent with other customer logos (transparent
wordmark/mark, e.g. Brevo). Per explicit direction, this swaps in the
same white-on-transparent wordmark already used for `logo_inverse`.

**Known tradeoff:** the primary `logo` renders on the site's light-mode
background, so this white wordmark will be invisible there. This was
confirmed and explicitly accepted rather than left as an oversight.

Co-authored-by: Wendie Cheung <wendie.cheung@supabase.io>
 2026-08-07 12:05:47 +10:00
Danny White 5944fe66f0 fix inconsistent product menu dividers (#48787) 
## What kind of change does this PR introduce?

Bug fix.

## What is the current behavior?

Product menu section dividers use the stronger `border-overlay` colour,
while the product heading divider uses `border-default`.

## What is the new behavior?

Product menu section dividers use the same `border-default` token as the
product heading divider in light and dark mode.

| Before | After |
| --- | --- |
| <img width="636" height="1378" alt="CleanShot 2026-08-06 at 15 56
15@2x"
src="https://github.com/user-attachments/assets/1628bef1-47c3-4f66-95a8-51b148784cac"
/> | <img width="636" height="1378" alt="CleanShot 2026-08-06 at 15 55
55@2x"
src="https://github.com/user-attachments/assets/82520caf-0f93-4e0e-951a-c87c9e9e8339"
/> |
| _Harsh borders between sections_ | _Borders match top one_ |


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Style**
* Updated the product menu group separator to use the standard border
color for a more consistent appearance.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-07 10:35:30 +10:00
Wendie Cheung 6ac0316738 Add QA.tech customer case study (#48798) 2026-08-07 08:50:44 +10:00
Eduardo Gurgel 66a4a0b32d fix(docs): realtime deletes can be surfaced and filtered (#48785) 2026-08-07 10:00:53 +12:00
kemal.earthWen Bo XieClaude Opus 5
 		2a3025df25 feat(studio): role inference core for scoped pat (#48805) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Logic-only extraction from #48742. Scoped PATs are enforced server-side
as the intersection of the token's granted scopes and the owner's live
role, re-checked on every request. This lands the pure inference layer
that will power advisory (never blocking) UI feedback; no UI consumes it
yet.

- FGA_SCOPE_MINIMUM_ROLE: all 83 permission scopes transcribed from the
OpenFGA model's role unions, mapped to the lowest base role that holds
them. A drift-guard test pins the key set to the scope ids published in
@supabase/shared-types, so upstream additions fail CI here with
re-transcription instructions.
- estimateRoleLevel: derives the user's base role per org (or per
project for project-invited members) from the ungated /platform/profile/
permissions rows via four discriminating ABAC probes. Works for every
member type with no permission-gated endpoint.
- computeTokenRoleContext + applySelectionToRoleContext: role resolution
(expensive, memoized) is split from selection evaluation (cheap, re-run
per permission toggle).

AccessToken.permissions.ts gains only what the roles module needs: the
PermissionLevel type and the catalog's `level` field (decides whether an
org or project role governs a resource), plus getEntryScopes, which
selectionToScopes now reuses. The UI-only additions from #48742 (risk
badge/dot variants, mode labels, the OverallRisk.text -> description
rename) are deliberately left out so this PR touches no .tsx.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
  * Added role-aware evaluation for scoped access-token permissions.
* Added support for organization- and project-level permission scoping.
* Added guidance when selected permissions exceed the current role,
including read-only downgrades and inaccessible resources.
  * Added clearer grouping of permission access issues by resource.

* **Tests**
* Added comprehensive coverage for role mapping, permission evaluation,
scoping, and failure scenarios.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Wen Bo Xie <wenbox323@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-08-06 17:31:41 +01:00
kemal.earthWen Bo XieClaude Opus 5
 		33008a39e5 chore(studio): remove scoped pat orphaned form (#48803) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

First step in breaking down #48635


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Refactor**
* Removed the scoped access-token form, including token details,
expiration settings, resource access, and permission configuration.
* Removed resource and permission selection controls from the
access-token workflow.

* **Tests**
* Removed automated coverage for access-token validation, permission
handling, expiration logic, and resource selection.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Wen Bo Xie <wenbox323@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-08-06 17:20:55 +01:00
Cemal KılıçandJeremias Menichelli 1ff84a239c docs(auth): note that resetPasswordForEmail doesn't send email for un… (#48800) 
add note on `resetPasswordForEmail` doesn't send email for unregistered
emails

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Clarified that password reset requests do not reveal whether an email
address is associated with an account.
* Documented that requests for unrecognized email addresses complete
without an error.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Jeremias Menichelli <jmenichelli@gmail.com>
 2026-08-06 15:41:35 +02:00
Gildas GarciaAli Waseemkemal.earth
 		cddb430310 feat(studio): scoped pat root branch (#48384) 
## Description

This is the Scoped PAT stacked PRs root branch

## How to test

### With the `scopedPAT` enabled (default on staging)

Go to
https://studio-staging-git-scopedpat-merge-token-lists-supabase.vercel.app/dashboard/account/tokens.
- You shouldn't see two tabs anymore
- If you had classic tokens, they should have the _Legacy_ badge
- You can create scoped tokens
- You have a way to copy newly created tokens before closing the form
side panel

### With the `scopedPAT` disabled (use the devtool to override)
- You shouldn't see two tabs anymore
- If you had classic tokens, they should **not** have the _Legacy_ badge
- You can create classic tokens
- You have a way to copy newly created tokens above the list upon form
submission

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Show classic and scoped access tokens together in one list, with
classic tokens labeled “Legacy” when the scoped experience is enabled.
* Add scoped access token creation with a two-step configure → review →
success flow (when enabled).
* Add a dismissible migration notice about scoped tokens with a link to
API docs.
  * Show “View permissions” only for scoped tokens.
* **Bug Fixes**
* Token deletion now supports both classic and scoped tokens with the
correct confirmation and success handling.
* The scoped tokens page now redirects to the unified access tokens
page.
* **Accessibility**
* Improved accessibility by adding a label to the token “more options”
action.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Ali Waseem <waseema393@gmail.com>
Co-authored-by: kemal.earth <606977+kemaldotearth@users.noreply.github.com>
 2026-08-06 07:40:56 -06:00
Monica Khoury 2afb87af05 fix(ui): add bottom padding to scroll container in RLS search (#48759) 
Fixes FE-4075. 

## What kind of change does this PR introduce?

The footer displaying the total number of RLS policies overlaps the last
search result in the RLS Policy Search dialog. As a result, the last
policy entry is partially hidden and cannot be fully read when scrolling
to the bottom.

## What is the current behavior?

The search results container now reserves space for the footer,
preventing it from overlapping the last search result. All policy
entries remain fully visible when scrolling to the bottom.

<img width="400" height="300" alt="image"
src="https://github.com/user-attachments/assets/46529ca4-bdce-4fa2-b0ba-ea87e769cc24"
/>

## What is the new behavior?

<img width="400" height="300" alt="CleanShot 2026-08-05 at 18 19 27@2x"
src="https://github.com/user-attachments/assets/093a3f9e-fd4c-4ff6-b483-2839f3916d13"
/>

## How to test

- Open a project in the Supabase Dashboard.
- Navigate to Database → RLS Policies.
- Open the policy search dialog.
- Search for a term that returns enough results to make the list
scrollable
- Scroll to the bottom of the results.

The
[database.sql](https://gist.github.com/monicakh/49b5ff201893eb43aea329395b3f635b)
to create the tables/policies to test.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
  * Improved scrolling in policy search results.
* Added spacing at the bottom so results remain visible above the fixed
footer.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-06 17:00:28 +07:00
Danny White 840127cd69 let inline error callers own mutation failures (#48640) 
## What kind of change does this PR introduce?

Code clean-up following #48470, #48471, #48472, #48473, and #48474.

## What is the current behavior?

Mutation hooks provide fallback error toasts, so callers that already
render errors inline must suppress those toasts with empty `onError`
handlers.

## What is the new behavior?

The affected callers own their error presentation. Inline interstitial
errors remain unchanged, API authorisation retains its state-reset
handlers, and Project Claim retains its combined caller-owned toast.

## To test

There is no useful before-and-after visual check for this PR: the
rendered error states should be identical on `master` and this branch.
The change only removes the default-toast and no-op-handler pair
underneath the UI.

The existing [Organisation
Invite](https://github.com/supabase/supabase/pull/48470), [API
authorisation, AWS
Marketplace](https://github.com/supabase/supabase/pull/48471), and
[Stripe Projects](https://github.com/supabase/supabase/pull/48472)
failure tests cover the inline errors and confirm that no duplicate
toast appears.
 2026-08-06 16:06:38 +07:00
Jordi Enric 93b5ae71bf chore: remove unused useProjectUsageStats hook (#48792) 
## Problem

`useProjectUsageStats`
(`apps/studio/hooks/analytics/useProjectUsageStats.tsx`) has no
importers anywhere in the codebase — dead code, and it also still
queries BigQuery directly (`logs.all`, no OTEL path), which would've
made it another gap in the reports→ClickHouse migration if it were ever
wired up.

## Fix

Deletes the file. Confirmed nothing imports it, and none of its own
imports (`useFillTimeseriesSorted`, `useTimeseriesUnixToIso`,
`genChartQuery`, `EventChart`) become unused as a result — all are still
used elsewhere.

## How to test

- `pnpm tsc --noEmit` — no errors referencing the removed file.
- `pnpm vitest run hooks/analytics` — 28 tests pass, no breakage.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Refactor**
* Removed the project usage analytics statistics feature, including its
data retrieval, time-series processing, filtering, refresh controls, and
loading/error states.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-06 16:02:56 +07:00
Joshen Lim 8618991b6f Initialize explorer home page (#48790) 
## Context

More groundwork for the Explorer - initializing the home page

Note that nothing here is functional, all just visual still

<img width="1387" height="960" alt="image"
src="https://github.com/user-attachments/assets/d4967578-edbd-476f-8150-d9d5e9d66666"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
  * Added a new Explorer landing page with an assistant chat form.
  * Added quick actions for creating notebooks and SQL work.
* Added notebook and chat template cards for faster project exploration.

* **Improvements**
  * Explorer content now fills the available page height.
* Assistant send button styling now reflects whether submission is
available.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-06 16:02:44 +07:00
Riccardo Busetti 21919ec9b8 feat(pipelines): Use new restart endpoint (#48737) 2026-08-06 09:02:10 +00:00
Etienne Stalmans 51c5b9f013 chore: sync ssl enforcement and temporary access (#48743) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Chore - fix-up

## What is the current behavior?

Temporary access depends on ssl enforcement. The frontend doesn't
enforce this very well or keep state between the two configs.

## What is the new behavior?

This updates the two configs to be interdependent and updates to each
one triggers a frontend state change on the other.

## Additional context

Before:



https://github.com/user-attachments/assets/8f040b62-587c-4268-9e27-27dd09b052a3



After:



https://github.com/user-attachments/assets/c62e006e-6147-4c94-b6cf-375ca300b890



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **New Features**
- Added confirmation dialogs and downtime warnings before changing
database SSL enforcement.
- Added loading states and success or failure notifications for SSL
updates.
- Enabled SSL enforcement directly from temporary database access
settings.

- **Bug Fixes**
- Prevented SSL enforcement from being disabled while temporary database
access is enabled.
  - Improved settings refresh after SSL enforcement changes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-06 10:52:37 +02:00
Joshen Lim 4550ee18a4 Initialize tabs UI for explorer (#48789) 
## Context

Continued ground work for Explorer - just initializes the Tab UI for
Explorer as such:
- Plan is to continue using the existing tabs store + EditorTabs
component
- Purely visual, nothing functional
<img width="1389" height="556" alt="image"
src="https://github.com/user-attachments/assets/d46c5ae7-01a8-4887-9452-11b98327d6bf"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added an Explorer workspace with animated navigation and tab controls.
* Added a home tab and a new-tab menu for creating notebooks, with chat
creation shown as unavailable.
* Added support for notebook tabs in the editor and Explorer navigation.
* Added flexible tab layouts with custom tab content, optional new-tab
actions, and configurable collapse controls.
* Improved editor navigation to recognize Explorer workspaces alongside
existing table and SQL editors.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-06 15:39:26 +07:00
Guilherme Souza a18ee934cd docs(auth): handle incoming deep link URLs on Swift (#48774) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Docs update.

## What is the current behavior?

The Swift tab in the [Native Mobile Deep Linking
guide](https://supabase.com/docs/guides/auth/native-mobile-deep-linking?platform=swift)
only covers registering a custom URL scheme (Info.plist config). Unlike
the React Native, Flutter, and Kotlin tabs, it never shows the runtime
code that actually consumes the incoming URL and completes the sign-in,
so a Swift developer following the guide is left without a working
implementation.

Linear:
[SDK-83](https://linear.app/supabase/issue/SDK-83/swift-improve-docs-on-how-to-handle-deep-link-url)

## What is the new behavior?

Added a "Handling the incoming URL" section to the Swift tab with:
- SwiftUI: `onOpenURL` calling `supabase.auth.handle(url)`
- UIKit app delegate lifecycle:
`application(_:didFinishLaunchingWithOptions:)` and
`application(_:open:options:)`
- UIKit scene delegate lifecycle: `scene(_:openURLContexts:)`
- A note pointing to `session(from:)` for callers that need the returned
`Session` or custom error handling

`handle(url)` and its usage patterns match the current `supabase-swift`
reference spec (`supabase_swift_v2.yml`) and source.

Also added `UIKit` to the docs spelling allowlist
(`supa-mdx-lint/Rule003Spelling.toml`) since it isn't in the dictionary.

## Additional context

`pnpm lint:mdx` passes on the changed file. `pnpm build:guides-markdown`
fails, but on a pre-existing unrelated issue (missing generated
`database-advisors.json`), not on this change.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Added Swift guidance for handling authentication deep links in SwiftUI
and UIKit apps.
* Documented deep-link behavior during cold launches and scene-based URL
delivery.
* Clarified when to use `handle(_:)` and `session(from:)`, including
error-handling considerations.
* Updated the SwiftUI tutorial to pass authentication URLs directly to
the recommended handler.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-06 08:37:47 +00:00
Joshen Lim a7671019a8 Scaffold the explorer layout (#48740) 
## Context

Resolves FE-4074

Just adds scaffolding for the explorer UI - no data fetching yet.
Initializes the page + side nav, based off Saxon's POC in
`poc/explorer-prototype`

<img width="1389" height="500" alt="image"
src="https://github.com/user-attachments/assets/8f293992-97d9-403e-91d6-2e104cd20eb5"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## New Features
- Added a project Explorer page accessible from
`/project/:ref/explorer`.
- Added navigation for browsing notebooks and chats.
- Added search fields, back navigation, animated transitions, and empty
states for Explorer sections.
- Added a conditional Explorer link to the SQL Editor menu when enabled.

## Documentation
- Marked the Explorer route migration as complete in the migration
checklist.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-06 12:11:35 +07:00
shaziya e0cc680653 feat(www): update Partner Day at Select 2026 go page copy (#48778) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Content update (marketing copy) for the `www` app.

## What is the current behavior?

`/go/select-2026/partner-day` copy is a couple of revisions behind the
latest Notion draft (see #48771 and #48773 for prior rounds).

## What is the new behavior?

Updates the page copy to match the newest draft.

## Additional context

- Verified locally in the browser against the Notion copy doc,
word-for-word.
- `prettier --check` passes on the changed file.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Content Updates**
* Clarified Partner Day event details, including the day-before-Select
note.
  * Improved venue information messaging.
* Updated the RSVP question to reference Select on October 2 and the
Partner Day invitation.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-06 01:08:56 +00:00
Guilherme Souza d61d3533f2 docs: fix broken Swift example in joins-and-nesting guide (#48775) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Docs fix.

## What is the current behavior?

Fixes
[SDK-958](https://linear.app/supabase/issue/SDK-958/docs-incomplete-documentation),
reported via the docs feedback widget on
[joins-and-nesting](https://supabase.com/docs/guides/database/joins-and-nesting).

In the "Specifying the `ON` clause for joins with multiple foreign keys"
section, the Swift example was broken relative to the other language
tabs (JS, Dart, Kotlin, Python, C#):

- The query string aliased the second embed as `scans: scan_id_end`,
which isn't valid PostgREST embed syntax (should be
`end_scan:scans!scan_id_end`).
- The `Shift` struct only declared a single `scans: [Scan]` property
with no `CodingKeys` entry for `start_scan` or `end_scan` — so it never
actually decoded either aliased relation, which is why the reporter
couldn't tell where `start_scan` was supposed to come from.

## What is the new behavior?

- Query now aliases both relations consistently:
`start_scan:scans!scan_id_start (...)` and `end_scan:scans!scan_id_end
(...)`, matching the other language examples.
- `Shift` struct now declares `startScan: Scan` and `endScan: Scan`,
mapped via `CodingKeys` to `start_scan` and `end_scan`.

## Additional context

Docs-only change to a code sample inside
`apps/docs/content/guides/database/joins-and-nesting.mdx`. Verified with
`prettier --check` (mdx lint tool failed locally due to an unrelated
missing native module, `node-pty`).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Updated the Swift join example to represent separate start and end
scan relationships.
* Revised response field selections and coding keys to match the updated
relationship names.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-05 21:50:31 -03:00
Danny WhiteandJoshen Lim 6b1fc3d11d recover failed Vercel deploy connections (#48474) 
## What kind of change does this PR introduce?

Bug fix.

## What is the current behavior?

A failed Vercel connection after project creation is only logged,
leaving the project-creation screen in its loading state.

## What is the new behavior?

The flow preserves the created project and shows the connection error
with retry and open-project actions in the standard project-creation
footer.

Project-creation failures remain ordinary inline form errors. Connection
failures are owned by this flow without a duplicate toast or a no-op
error handler.

| Before | After |
| --- | --- |
| ![Create Vercel Project
Supabase](https://github.com/user-attachments/assets/18dfb6d1-614a-4298-bf28-8399d86c7bca)
| <img width="1024" height="563" alt="Create Vercel Project Supabase"
src="https://github.com/user-attachments/assets/b7d3fdca-d7a0-4b50-9231-3cf7dc371a87"
/> |

## To test

### Before on master

1. Switch to `master`.
2. With local Studio running and while signed in, open an organisation
you can access. Copy its slug from
`http://localhost:8082/org/<YOUR_ORG_SLUG>`.
3. Open
`apps/studio/components/interfaces/ProjectCreation/ProjectCreationForm.tsx`.
4. Find `isSuccessNewProject={isSuccessNewProject}` in the
`ProjectCreationFooter` props and temporarily change it to:
   ```tsx
   isSuccessNewProject={true}
   ```
5. Replace `<YOUR_ORG_SLUG>` in this URL with the slug from step 2, then
open it:
`http://localhost:8082/integrations/vercel/<YOUR_ORG_SLUG>/deploy-button/new-project`.
6. Confirm **Create new project** remains in its loading state and there
is no error, retry action, or route to the created project. This
represents the current stuck state.
7. Revert the temporary edit before switching branches.

### After on this branch

1. Switch to `dnywh/vercel-deploy-recovery`.
2. With local Studio running and while signed in, open an organisation
you can access. Copy its slug from
`http://localhost:8082/org/<YOUR_ORG_SLUG>`.
3. Open
`apps/studio/pages/integrations/vercel/[slug]/deploy-button/new-project.tsx`.
4. Find the conditional beginning with `newProjectRef === undefined`
inside `InterstitialLayout`.
5. Replace that whole conditional with:
   ```tsx
   <VercelConnectionError
     projectRef="abcdefghijklmnopqrst"
     message="Connection request failed"
     onRetry={() => undefined}
   />
   ```
6. Replace `<YOUR_ORG_SLUG>` in this URL with the slug from step 2, then
open it:
`http://localhost:8082/integrations/vercel/<YOUR_ORG_SLUG>/deploy-button/new-project`.
7. Confirm the admonition says **Unable to connect to Vercel** and
**Your Supabase project was still created. Error: Connection request
failed**.
8. Confirm **Open project** and **Retry connection** appear as compact,
right-aligned footer buttons. The retry action is intentionally inert in
this visual-only mock, and no project or Vercel connection is created.
9. Revert the temporary edit.

## Additional context

Follows #48473. The consistency follow-up #48640 is stacked on this PR.



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **New Features**
- Added inline error messages to project creation forms for integration,
API, and validation failures.
- Added clear Vercel connection states, including waiting, connecting,
success, and error screens.
  - Added retry actions and links to open successfully created projects.

- **Bug Fixes**
- Improved error handling so Vercel connection issues remain visible in
context instead of appearing only as notifications.

- **Tests**
- Added coverage for partial-success messaging, project links, and retry
behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-08-06 10:49:50 +10:00
Matt Smiley 801ef21ce6 Add Matt Smiley to humans.txt (#48729) 
Add myself (Matt Smiley) to humans.txt as part of onboarding to
Supabase.

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Docs update to add new joiner (me)

## What is the current behavior?

NA

## What is the new behavior?

Adds new team member

## Additional context

Part of my onboarding process


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
  * Added Matt Smiley to the team member list in the project credits.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-05 16:37:21 -07:00
shaziya 8d1ff7d38f feat(www): update Partner Day at Select 2026 go page copy (#48773) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Content update (marketing copy) for the `www` app.

## What is the current behavior?

`/go/select-2026/partner-day` copy is one revision behind the latest
draft (see #48771 for the prior round).

## What is the new behavior?

Updates the page copy to match the newest Notion draft.

## Additional context

- Verified locally in the browser against the Notion copy doc,
word-for-word.
- Verified the RSVP form's "Are you attending Select 2026?" select field
opens, selects, and submits correctly.
- `prettier --check` passes on the changed file.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **Content Updates**
- Refined Partner Day event messaging and “What to expect” descriptions.
  - Simplified the hero description by removing timing-specific wording.
- Shortened inaugural-event messaging for clearer, more concise
communication.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-05 15:54:18 -07:00
shaziya 2736abf4c7 feat(www): update Partner Day at Select 2026 go page copy (#48771) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Content update (marketing copy) for the `www` app.

## What is the current behavior?

`/go/select-2026/partner-day` has stale copy from an earlier draft of
the event: a time-boxed agenda table and a "What you'll gain" feature
grid that no longer match the approved messaging.

## What is the new behavior?

Updated copy! :)

## Additional context

- Verified the RSVP form's "Are you attending Select 2026?" select field
opens, selects, and submits correctly, with no React hydration warnings
on a clean `.next` build.
- `pnpm --filter=www exec tsc --noEmit` and `prettier --check` both pass
on the changed file.
- `pnpm build --filter=www` fails locally, but this is pre-existing and
unrelated to this change — it requires a `DOCS_GITHUB_APP_PRIVATE_KEY`
secret (for the `docs` app's federated-content prebuild step) that isn't
available in this local environment. Confirmed the identical failure
occurs on `master` with no changes applied.
 2026-08-05 15:10:51 -07:00
claude[bot]andClaude b97ad08be5 docs: updating Edge Functions error codes (#48767) 
<!-- ccr-slack-attribution -->
_Requested by **Kalleby Santos** · [Slack
thread](https://supabase.slack.com/archives/C02KMRX22NR/p1785949561216739?thread_ts=1785949561.216739&cid=C02KMRX22NR)_

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Docs update. Adds two missing entries to the Edge Functions **Error
codes** page (`apps/docs/content/guides/functions/error-codes.mdx`).

Refs https://github.com/supabase/supabase/issues/47739

## What is the current behavior?

Neither `NOT_FOUND_FUNCTION_BLOB` nor `LOAD_FUNCTION_UNBUNDLING_ERROR`
appears on the Error codes page. Someone who gets a 404 with
`sb-error-code: NOT_FOUND_FUNCTION_BLOB` and searches the page finds
nothing — and because the response body is the same `Requested function
was not found` string that generic `NOT_FOUND` returns, the existing
`NOT_FOUND` entry reads like it covers the case when it doesn't.

## What is the new behavior?

Both codes are documented under `## Server Errors` with a cause and a
remedy, in the page's existing `**Cause:**` / `**Solution:**` shape.

- `NOT_FOUND_FUNCTION_BLOB` goes directly after `### NOT_FOUND`, since
readers hitting it will scan for `NOT_FOUND` first. The cause explains
the metadata/bundle version mismatch (concurrent or batched deploys
double-incrementing the metadata version), notes that the message is
identical to `NOT_FOUND` so the `sb-error-code` header is the
distinguisher, and links the existing [Edge Function 404 error
response](https://supabase.com/docs/guides/troubleshooting/edge-function-404-error-response)
troubleshooting guide. Solution: redeploy with the latest CLI, avoid
concurrent deploys of the same function, contact support to re-sync
metadata if it persists.
- `LOAD_FUNCTION_UNBUNDLING_ERROR` goes at the end, keeping the
`LOAD_FUNCTION_*` cluster together. Cause: the bundle was fetched but
decompression/parsing failed, which points at a corrupt or
partially-written bundle. Solution: redeploy, contact support if it
persists.

## Additional context

Both codes are real and currently emitted by
`supabase/edge-functions-ingress` (`main`):

- `NOT_FOUND_FUNCTION_BLOB` — 404, declared at `src/main/errors.ts:29`,
emitted at `src/main/cache.ts:180`
- `LOAD_FUNCTION_UNBUNDLING_ERROR` — 503, declared at
`src/main/errors.ts:27`, emitted at `src/main/cache.ts:226`

Both were introduced by supabase/edge-functions-ingress#464.

### Notes for reviewer

- **Scope.** The comment on #47739 asked only for
`NOT_FOUND_FUNCTION_BLOB`. `LOAD_FUNCTION_UNBUNDLING_ERROR` is included
because it shipped in the same ingress PR and is equally undocumented —
happy to drop it if you'd rather keep this PR to exactly what was
requested.
- **No HTTP statuses in the copy.** The 404/503 above are deliberately
left out of the page text, because the Error codes page states no HTTP
status anywhere for any code. Adding them here would be a format
departure. Easy to add if you'd prefer to start including them.
- **Message mismatch, not fixed here.**
`apps/docs/content/troubleshooting/edge-function-404-error-response.mdx`
declares `message = "Function deployment bundle not found"` for
`NOT_FOUND_FUNCTION_BLOB`, but the runtime actually emits `"Requested
function was not found"` (`cache.ts:181`), which matches the response
pasted in #47739. Left untouched in this PR — flagging it for a
follow-up.

### Checks run

- `prettier --check` on the changed file: passes.
- `supa-mdx-lint` (v0.3.2) on the changed file: no new findings. The one
remaining warning (`error-codes.mdx:11` — "Use 'view and resolve errors'
instead of 'handle errors'") is pre-existing on `master` and untouched
here.
- The `{/* supa-mdx-lint-disable Rule001HeadingCase */}` pragma at line
8 sits above both new H3s, so the uppercase headings pass.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01Qw5D2wdScBN5TWuA2FgnDW)_

---------

Co-authored-by: Claude <noreply@anthropic.com>
 2026-08-05 14:05:03 -06:00
Matt Rossman 5049f3eb81 docs: supabase evals note in AI tools page (#48663) 
Following announcement
https://supabase.com/blog/introducing-supabase-evals

Adds an admonition to the [AI
Tools](https://supabase.com/docs/guides/ai-tools) overview calling out
the recently launched [Supabase
Evals](https://supabase.com/blog/introducing-supabase-evals) project to
demonstrate performance of (some of) the tools shown.

Preview:
https://docs-git-mattrossman-ai-969-link-to-evals-from-47d719-supabase.vercel.app/docs/guides/ai-tools

<img width="3600" height="1606" alt="CleanShot 2026-08-03 at 15 13
06@2x"
src="https://github.com/user-attachments/assets/8ea23f6c-fde0-4b04-bed1-035941570ac1"
/>

If preferred, we can move it below the fold, I just figure it's good for
visibility on the recent launch and it helps sell the "why" for using
these tools.

Closes AI-969


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **Documentation**
* Added a link and note about Supabase Evals, an open-source benchmark
for AI coding agents.
* **Chores**
  * Updated spelling checks to recognize “eval” in any capitalization.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-05 14:47:46 -04:00
Nik RichersNik RichersClaude
 		08867f94ff docs: lead self-hosting overview with what/why/CTA, restructure secondary content (#48415) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Docs restructure of the self-hosting overview: short fit intro, Get
started / community listings above the fold, parallel h2 sections for
how self-hosting differs (including local development),
responsibilities, and telemetry, plus a streamlined support listing with
better card content.

Closes DOCS-1251.

## What is the current behavior?

- Linear item: Explore two PR approaches for the self-hosting page
- The self-hosting overview page (`/guides/self-hosting`) is the top
search hit for "supabase self-hosting," but reads as a wall of text:
three full prose/bullet sections (differs / responsibilities /
telemetry) come before the getting-started CTA, which is buried as one
small card partway down the page.

## What is the new behavior?

- Short fit intro; `self-hosting-get-started` and
`self-hosting-community` listings sit directly under the intro.
- Top-level h2s for how self-hosting differs, responsibilities,
telemetry, and support (no "More about self-hosting" wrapper).
- Under differs: rewritten single-project + platform-gap copy, plus `###
Not the same as local development` (CLI stack is not a production
self-host; points to Docker / community options).
- Telemetry clarifies CLI local-dev telemetry vs Docker Compose (no
phone-home).
- Merged support into a single `self-hosting-support` listing;
Enterprise subsection unchanged.
- Minor a11y: `aria-hidden` on GlassPanel decorative icon background.

## Additional context

- Worktree:
`~/GitHub/supabase/supabase-worktrees/nikrichers/docs-1251-self-hosting-inform`
- Review: removed the "More about self-hosting" grouping after feedback
that it undersold differs / responsibilities.
- Companion prototype PR 48416 is closed; this branch is the direction
under review.
- Verification:

| Check | Result |
| ----------------------------------------------- |
------------------------------------------------------------------ |
| `pnpm lint:mdx content/guides/self-hosting.mdx` | Pass — no
errors/warnings on this file |
| Vercel docs preview | Pass — full-page after screenshot captured from
the preview deploy |

### Proof: intro and get-started above the fold; parallel h2s for
differs, responsibilities, and telemetry

**Verified:** `pnpm lint:mdx content/guides/self-hosting.mdx` (pass) ·
Vercel docs preview (pass)

### Before & After

| [Before (production)](https://supabase.com/docs/guides/self-hosting) |
[After (PR
preview)](https://docs-git-nikrichers-docs-1251-self-hosting-inform-supabase.vercel.app/docs/guides/self-hosting)
|
|
------------------------------------------------------------------------------------------------------------------------------------------------
|
----------------------------------------------------------------------------------------------------------------------------------------------
|
|
![Before](https://moijyfpvgnmgoxvwcikq.supabase.co/storage/v1/object/public/pr-proof/supabase/supabase/pr48415/self-hosting-before-23d8ce92.png)
|
![After](https://moijyfpvgnmgoxvwcikq.supabase.co/storage/v1/object/public/pr-proof/supabase/supabase/pr48415/self-hosting-after-96d27909.png)
|

### Test plan

- [ ] Visit the preview link and confirm the page opens with intro above
the Get started listings
- [ ] Confirm parallel h2s for differs / responsibilities / telemetry /
support (no "More about self-hosting")
- [ ] Confirm "Not the same as local development" distinguishes the CLI
stack from self-hosting
- [ ] Confirm Support and community is one card grid
- [ ] Check mobile width — layout should still be usable
- [ ] Confirm `/guides/self-hosting/docker` link still works

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **Documentation**
- Reorganized the self-hosting guide with clearer getting-started
resources and community links.
- Added dedicated guidance for local development, managed Supabase,
telemetry, and self-hosting responsibilities.
- Consolidated support resources into one section covering discussions,
issues, chat, Reddit, and sharing experiences.
- **Accessibility**
- Marked decorative icon backgrounds as hidden from assistive
technologies.
  <!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Nik Richers <nik@validmind.ai>
Co-authored-by: Claude <noreply@anthropic.com>
 2026-08-05 10:57:09 -07:00
Aaron ByrneandClaude 47b8660d8d docs(troubleshooting): troubleshooting guide so users can amend their failed migrations (#48257) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Troubleshooting guide

## What is the current behavior?

NA
## What is the new behavior?

Troubleshooting guide
## Additional context

Add any other context or screenshots.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Added a new troubleshooting page: “Troubleshooting MIGRATIONS_FAILED:
missing tables or an incomplete schema on your branch” for Preview
Branch creation.
* Explained why replayed `main` migration history can fail when it no
longer matches the branch’s live schema.
* Included a step-by-step workflow to diagnose the failing migration via
logs, repair migration status, and then recreate or rebase the branch to
verify.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude <noreply@anthropic.com>
 2026-08-05 18:12:20 +01:00
Jordi Enric a28214c236 feat(studio): add ClickHouse OTEL SQL for the Auth report's v2 metrics (#48750) 
## Problem

Part of DEBUG-73 (migrate reports queries to the OTEL/ClickHouse
endpoint).

The Auth report's v2 metrics (ActiveUsers, SignInAttempts,
PasswordResetRequests, TotalSignUps, sign-in/sign-up processing time,
error breakdowns) currently only query the BigQuery-backed logs.all
endpoint.

## Fix

Adds `AUTH_REPORT_SQL_OTEL`, a ClickHouse-dialect mirror of the existing
`AUTH_REPORT_SQL`, covering all 10 metrics. Threads a `useOtel`
parameter through `fetchLogs` and the three report config creators
(`createUsageReportConfig`, `createErrorsReportConfig`,
`createLatencyReportConfig`), defaulting to `false` everywhere.

This PR is inert on its own: nothing yet passes `useOtel: true`, so it
changes no runtime behavior. The follow-up PR (stacked on this one)
wires the `otelReports` feature flag through the Auth report page to
actually select the OTEL SQL.

Also includes: one dataProvider now validates its raw rows with a Zod
schema instead of casting to `any`, and removal of a few functions in
this file that had zero callers (`AUTH_ERROR_CODE_VALUES`,
`createAuthReportConfig`, an exact duplicate of a status-code color map,
an unused hook).

## How to test

- Unit: `cd apps/studio && npx vitest run
data/reports/v2/auth.config.otel.test.ts`
- No manual testing needed for this PR alone since it changes no runtime
behavior (useOtel defaults to false, unwired). The follow-up PR covers
manual testing of the actual flag-gated behavior.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Added OpenTelemetry-backed authentication reports.
* Authentication reports now include usage, errors, latency, sign-ins,
sign-ups, and edge-log metrics.
  * Added filtering by provider, status code, action, and time range.
  * Added selectable telemetry sources for retrieving report logs.
* **Bug Fixes**
  * Improved validation of authentication error codes.
* Improved handling of missing report data with consistent empty
results.
  * Improved report formatting for more consistent attribute display.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-05 18:25:41 +02:00
Abhishek Tripathi d101d6f3de docs: document NOT_FOUND_FUNCTION_BLOB Edge Function error (#48411) 
This PR addresses the documentation portion of #47739.

## What the issue means

`NOT_FOUND_FUNCTION_BLOB` means the runtime cannot find the deployed
bundle for an Edge Function. This differs from the existing `NOT_FOUND`
error, which normally indicates that the function name in the request
URL is not recognized.

The dashboard status alone may not reveal this failure because the
function can still appear as `ACTIVE`.

## Changes

- Documented `NOT_FOUND_FUNCTION_BLOB` as an HTTP 404 error.
- Explained how it differs from `NOT_FOUND`.
- Added the command for redeploying one affected function.
- Added the command for redeploying all functions when several are
affected.
- Added guidance to retry the request and contact Support if
redeployment does not resolve the problem.

## Files changed

-
`apps/docs/content/troubleshooting/edge-function-404-error-response.mdx`

## Validation

- The change uses the troubleshooting page's existing TOML frontmatter
and MDX conventions.
- `git diff --check` passes.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
  * Expanded troubleshooting guidance for Edge Function 404 responses.
* Added coverage of the `NOT_FOUND_FUNCTION_BLOB` error, including
example responses and clarification of how it differs from `NOT_FOUND`.
* Updated redeployment instructions with options for deploying a single
function or all functions.
  * Refined retry and support guidance.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-05 17:11:00 +01:00
Charis 8831e15fc3 Revert "refactor(studio): static tab kind registry and tab id codec (PR 1/9)" (#48762) 
Reverts supabase/supabase#48718
 2026-08-05 16:03:16 +00:00
Miranda LimonczenkoandClaude Opus 5 d45e0cd3d5 fix(docs ci): stop Docs E2E blocking pull requests it shouldn't (#48726) 
Supersedes #48725, which GitHub closed when its head branch was renamed.
Same commits, same diff.

Fixes
[DOCS-1270](https://linear.app/supabase/issue/DOCS-1270/fail-the-e2e-pipeline-if-the-docs-preview-never-loads).

`Docs E2E` is a required check on `master`, so anything that turns it
red blocks a merge. It had three ways of going red that had nothing to
do with whether the author's docs were correct.

## Problem

**1. Every troubleshooting page could fail, with nothing actionable.**
Troubleshooting entries were selected by `article.prose`. That class is
not unique — `apps/docs/app/not-found.tsx` renders `<article
className="prose …">` too — and nothing guaranteed it matched the
entry's article at all. When it missed, the link test failed with `Page
article should be present` and the a11y test failed inside axe with `No
elements found for include in page Context` plus a stack trace. Neither
tells the author what to do.

This is what DOCS-1270 actually was. The ticket describes tests running
"against a preview build that was never created", but the [failing
run](https://github.com/supabase/supabase/actions/runs/30949924515/job/92132543658)
for #48719 shows the preview resolved fine and `response.ok()` passed —
it broke at the article assertion. **Blocked:** anyone adding or editing
a troubleshooting entry.

**2. Fork pull requests failed for being forks.** Fork runs get no
`VERCEL_TOKEN`, so no preview URL resolves, and the base-URL step fell
back to `https://supabase.com`. The page paths under test can include
pages the pull request *adds*, which do not exist on production, so they
404. **Blocked:** every external contributor adding a docs page,
unconditionally, with no action available to them.

**3. A Vercel problem failed the docs check.**
`waitForVercelDocsPreview.js` throws when Vercel reports a failed
deployment, omits a `target_url`, or does not post a status within 900s.
The step had no `continue-on-error`, so any of those turned `Docs E2E`
red. **Blocked:** any author whose pull request coincided with a Vercel
incident. This is live right now — two Vercel checks on this very pull
request are failing with "unable to fetch required git information", a
git-integration auth error that happens before any build runs.

## Solution

**1. Select on a stable, purpose-named attribute.** Add
`id="sb-docs-troubleshooting-main-article"` on the troubleshooting
article, mirroring `#sb-docs-guide-main-article` on guides, and select
on that instead of the class. Per review feedback, a plain id doesn't
say it's a test hook, so both articles also get `data-testid` with the
same value — matching the convention `apps/studio` already uses with
Playwright's `getByTestId` — and the e2e selectors target that attribute
instead. Guides keep their `id` — `GuidesMdx.client.tsx` and
`GuidesSidebar.tsx` both query it directly for the table of contents and
the "copy article" fallback — and gain `data-testid` alongside it.

**2 and 3. Resolve a preview or skip — never substitute production,
never fail on Vercel.** The production fallback is gone.
`continue-on-error: true` on the preview wait means a Vercel failure
resolves no URL instead of failing the job, which lands in the same path
as a fork: `should_test=false`, so Playwright is skipped and the check
passes. Both cases emit a `::warning::` and a job summary with the exact
`gh workflow run` command to test the preview by hand, and manual runs
against a non-production base URL now send the protection bypass so that
command actually works.

Skipping does not let a broken preview through: `Vercel – docs` is
itself a required check on `master`, so a genuine preview failure still
blocks the merge — via the check that describes the real problem.


## Manual test

**1. The selector matches the markup, and it needs this pull request's
preview.** `data-testid` isn't deployed anywhere yet — not on
production, not on any other branch — so this is the one claim in this
PR that production cannot confirm. Verified directly against this
branch's own Vercel preview:

```bash
curl -s https://docs-git-docs-e2e-stop-false-blocks-supabase.vercel.app/docs/guides/database/overview \
  | grep -o 'data-testid="[^"]*"'
curl -s https://docs-git-docs-e2e-stop-false-blocks-supabase.vercel.app/docs/guides/troubleshooting/42501--permission-denied-for-table-httprequestqueue-KnozmQ \
  | grep -o 'data-testid="[^"]*"'
```

Expect `data-testid="sb-docs-guide-main-article"` and
`data-testid="sb-docs-troubleshooting-main-article"` respectively. Then
run the suite against that same preview — expect all page/link/a11y
checks to pass:

```bash
PLAYWRIGHT_BASE_URL=https://docs-git-docs-e2e-stop-false-blocks-supabase.vercel.app \
DOCS_E2E_PAGE_PATHS=/docs/guides/database/overview,/docs/guides/troubleshooting/42501--permission-denied-for-table-httprequestqueue-KnozmQ \
pnpm -C e2e/docs exec playwright test --reporter=list
```

Running the same command with `PLAYWRIGHT_BASE_URL=https://supabase.com`
fails both pages right now — expected until this merges, not a
regression. Once merged, exercise it through the real pipeline:

```bash
gh workflow run docs-e2e.yml --ref docs-e2e/stop-false-blocks \
  -f base_url=<preview-url> \
  -f page_paths=/docs/guides/troubleshooting/42501--permission-denied-for-table-httprequestqueue-KnozmQ
```

**2. No preview means skip, not a run against production.** Exercise the
base-URL step's three paths from the repository root:

```bash
export GITHUB_OUTPUT=$(mktemp) GITHUB_STEP_SUMMARY=$(mktemp) PAGE_PATHS=/docs/guides/a
script=$(python3 -c "import yaml;print([s for s in yaml.safe_load(open('.github/workflows/docs-e2e.yml'))['jobs']['e2e']['steps'] if s.get('name')=='Resolve base URL'][0]['run'])")
for c in "workflow_dispatch|https://supabase.com|" "pull_request||https://docs-abc.vercel.app" "pull_request||"; do
  IFS='|' read -r ev url dep <<< "$c"
  : > "$GITHUB_OUTPUT"
  EVENT_NAME="$ev" BASE_URL_INPUT="${url:-https://supabase.com}" DEPLOYMENT_URL="$dep" bash -c "$script" >/dev/null 2>&1
  echo "$ev deployment=[${dep:-none}] -> $(tr '\n' ' ' < "$GITHUB_OUTPUT")"
done
tail -4 "$GITHUB_STEP_SUMMARY"
```

Expected:

```
workflow_dispatch deployment=[none] -> url=https://supabase.com use_bypass=false should_test=true
pull_request deployment=[https://docs-abc.vercel.app] -> url=https://docs-abc.vercel.app use_bypass=true should_test=true
pull_request deployment=[none] -> url= use_bypass=false should_test=false
```

followed by a runnable `gh workflow run docs-e2e.yml` command in the job
summary. The third line covers both the fork case and the Vercel-failure
case: no base URL, no test, no block.

**3. A Vercel failure no longer fails the job.** `continue-on-error:
true` on the wait step is what routes a throw into that third line:

```bash
python3 -c "
import yaml
s=[x for x in yaml.safe_load(open('.github/workflows/docs-e2e.yml'))['jobs']['e2e']['steps'] if x.get('name')=='Wait for Vercel docs preview'][0]
print('continue-on-error:', s.get('continue-on-error'))
for n in ('Install dependencies','Install Playwright Chromium','Run docs E2E'):
    print(n, '->', [x for x in yaml.safe_load(open('.github/workflows/docs-e2e.yml'))['jobs']['e2e']['steps'] if x.get('name')==n][0]['if'])
"
```

Expect `continue-on-error: True` and all three run steps gated on
`steps.base-url.outputs.should_test == 'true'`.

**Note on this pull request's own check.** The scope resolver only maps
`apps/docs/content/**` to pages, and this pull request changes none, so
`Docs E2E` resolves zero pages and skips — which is correct, and why the
dispatch above is the real test.

🤖 Generated with [Claude Code](https://claude.com/claude-code)


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved documentation preview checks so unavailable or delayed
previews no longer cause unnecessary workflow failures.
* Added clearer handling for manual documentation checks and missing
preview deployments.

* **Tests**
* Improved end-to-end documentation testing reliability across preview
and production environments.
* Added stable targeting for the troubleshooting article to reduce test
failures caused by page structure changes.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
 2026-08-05 15:23:26 +00:00
Jordi Enric aed332b663 feat: migrate Edge Functions report to ClickHouse OTEL logs (#48756) 
## Problem

The Edge Functions report (`observability/edge-functions`) only queries
BigQuery. As part of the broader Reports→ClickHouse OTEL migration
(DEBUG-73), we need each report migrated one at a time behind the
`otelReports` flag.

## Fix

Adds a ClickHouse OTEL SQL variant (`METRIC_SQL_OTEL`) for the 4 Edge
Functions metrics (TotalInvocations, ExecutionStatusCodes,
InvocationsByRegion, ExecutionTime), querying the unified `logs` table
filtered to `source = 'function_edge_logs'`, with fields read from
`log_attributes` (`function_id`, `response.status_code`,
`response.headers.x_sb_edge_region`, `execution_time_ms`) — the same
mapping already used by `edge-functions-last-hour-stats-query.ts`.

`edgeFunctionReports()` now takes a `useOtel` flag that picks between
the BQ and OTEL query sets and forwards it to `fetchLogs`. The page
wires this up via `useFlag('otelReports')`, matching the pattern used
for the Auth report. No behavior change while the flag is off — report
still fetches from BigQuery.

Also removed two pieces of dead code spotted in `report.utils.ts` while
touching it: the unused `useEdgeFnIdToName` hook and a
`STATUS_CODE_COLORS` map that was an exact duplicate of
`REPORT_STATUS_CODE_COLORS` (the one actually imported elsewhere).

This PR is standalone — no dependency on the in-flight Auth report OTEL
stack.

## How to test

- `pnpm vitest run data/reports/v2/edge-functions.config.otel.test.ts` —
9 new tests covering the OTEL SQL shape (single logs table,
unix-microsecond timestamp bucketing, field mapping, filters).
- `pnpm vitest run data/reports` and `pnpm vitest run
data/edge-functions components/interfaces/Reports` — existing suites (46
+ 54 tests) still pass, confirming no regression to the BQ path.
- Manually: with `otelReports` flag enabled, visit a project's Edge
Functions observability report and confirm charts render from the
ClickHouse endpoint.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added OpenTelemetry support for Edge Functions observability metrics,
including invocations, status codes, regional activity, and execution
time.
* Reports can now dynamically use either the standard or OpenTelemetry
logs source.

* **Bug Fixes**
* Improved filtering and timestamp handling for OpenTelemetry-based Edge
Functions metrics.
* Added coverage for status, execution time, function, and region
filters.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-05 17:13:34 +02:00
Etienne Stalmans 55095dcd00 chore: highlight totp app friendly name (#48755) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

UI update

## What is the current behavior?

We only show the alternative factor's name, if one exists.

## What is the new behavior?

When presenting user with the MFA screen, make the MFA factor's
friendly_name appear.

## Additional context

Before:

<img width="456" height="371" alt="Screenshot 2026-08-05 at 15 41 07"
src="https://github.com/user-attachments/assets/7d506641-6a9e-49fe-8c40-98c1eef4b384"
/>


After:
<img width="459" height="394" alt="Screenshot 2026-08-05 at 15 38 27"
src="https://github.com/user-attachments/assets/034312ba-691e-4f56-b4e3-a82df2a17273"
/>
<img width="468" height="434" alt="Screenshot 2026-08-05 at 15 37 43"
src="https://github.com/user-attachments/assets/4c585eae-b8e2-4f93-8210-2c8ac7c20278"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved multi-factor authentication prompts with clearer formatting
and more consistent factor labels.
* Ensured the primary code label appears whenever a verification factor
is selected.
* Added a fallback label for authentication factors without a display
name.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-05 22:07:22 +07:00
Charis ffd6d6636d refactor(studio): static tab kind registry and tab id codec (PR 1/9) (#48718) 
## Summary

First PR in the tab/snippet decoupling stack. Purely additive: no
existing call sites change behavior except the `EntityTypeIcon` rewire,
which preserves its API exactly.

- **`state/tabs/kinds.ts`** — static `TAB_KINDS` descriptor table
(`TabKind`, `TabSurface`, `surfaceOf`, `kindsOnSurface`, `isTabKind`).
Leaf-safe: its only reference to the domain `Tab` type is a type-only
import, so it stays importable at module scope (needed later for the
valtio store and the persistence migration reader) without creating a
runtime cycle.
- **`state/tabs/kinds.icons.tsx`** — per-kind icon leaf module (`ui` +
`lucide-react` + `TabKind` type only), plus the preserved
`LogsSnippetIcon`.
- **`state/tabs/tab-id.ts`** — `createTabId` / `parseTabId` /
`toUrlSegment` / `parseUrlSegment(segment, surface)` codec.
`parseUrlSegment` is surface-scoped: a bare segment only resolves to a
kind when the surface has exactly one bare kind (true for `sql`). The
table surface has five bare kinds (`r`/`v`/`m`/`f`/`p`) with no URL
disambiguator between them, matching `/editor/[id]`, which learns kind
from the fetched entity rather than the URL — so a bare table segment
correctly resolves to nothing.
- **`components/ui/EntityTypeIcon.tsx`** — rewired to a thin wrapper
delegating to `kinds.icons.tsx`, preserving its exact prop API (`type`,
`size`, `strokeWidth`, `isActive`, `sqlSource`) for all existing
consumers.
- **`state/tabs/tab-id.test.ts`** — codec round-trips per kind,
bare-vs-prefixed URL segments, the `templates`/`examples`/`new`
sentinels, and surface scoping (including the table-surface ambiguity
above).

Full plan: `apps/studio/TABS_DECOUPLING_PLAN.md` (not included in this
PR).

## Test plan

- [x] `pnpm typecheck`
- [x] `pnpm lint --filter=studio` (0 errors)
- [x] `pnpm --filter studio run lint:ratchet` (warning counts did not
increase)
- [x] `pnpm test:studio` (full suite green, including 50 new/updated
tests in `state/tabs/`)
- [x] `pnpm format` (no-op)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added consistent icons and metadata for SQL, notebook, chat, table,
view, and related tab types.
* Added support for creating, parsing, and converting tab identifiers to
URL segments.
  * Improved handling of tab types across SQL and table surfaces.

* **Bug Fixes**
* Invalid, empty, or ambiguous tab identifiers and URL segments are now
rejected.

* **Tests**
* Added coverage for tab identifiers, URL conversion, supported tab
types, and edge cases.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-05 10:39:58 -04:00
AnaandAna 69b1f06152 docs(blog): add Enhancements for Postgres Changes launch post (#48711) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

- Adds the launch blog post for Enhancements for Postgres Changes, dated
2026-08-05
- Adds the social card and listing thumbnail for the post

## What is the current behavior?

N/A. New post.

## What is the new behavior?

- New post at `/blog/postgres-changes-filters-and-column-selection`
covering AND filter composition, the expanded filter operator set, and
column selection on Postgres Changes subscriptions
- Authored by Filipe Cabaço, using the existing `filipe` author id, so
no change to `apps/www/lib/authors.json`

## Additional context

**Please do not merge before 7:00 am PT on 2026-08-05.**

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Documentation

* Added a product blog post covering enhanced Postgres Changes
filtering, including comma-separated AND filters across multiple
columns.
* Documented additional filter operators and the new filter builder.
* Explained optional column selection for event payloads, permissions
and row-level security behavior, DELETE limitations, unsupported
options, client-version requirements, usage examples, and upgrade
guidance.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Ana <ana1337x@users.noreply.github.com>
 2026-08-05 10:24:44 -04:00
Tina Hagithub-actions[bot]Rodrigo MansueliAli Waseem
 		1f0fb64ce9 docs: CLI 'Transport error' caused by antivirus/proxy TLS interception (#48719) 
## Summary
- Adds a troubleshooting entry for the Supabase CLI's generic
`HttpClientError: Transport error` when a Management API call (e.g.
`projects list`, `link`) fails.
- Root cause documented: antivirus software or corporate SSL-inspecting
proxies (e.g. Norton Safe Web/Web & Mail Shield, Zscaler, Netskope)
substituting their own TLS certificate, which the CLI's HTTP client
rejects and reports as a generic transport error rather than a
certificate error.
- Includes a vendor-agnostic diagnostic method (compare `curl`/browser
vs. CLI behavior, check the served certificate's Issuer field) plus the
specific Norton fix confirmed via a support ticket (disabling Smart
Firewall alone does not stop the interception; Safe Web/Web & Mail
Shield does).

## Test plan
- [ ] `pnpm --filter docs lint:mdx` passes in CI
- [ ] Frontmatter renders correctly on the troubleshooting page

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Added troubleshooting guidance for Supabase CLI transport errors
caused by antivirus software or corporate TLS inspection.
* Included diagnostic steps, common error messages, and resolution
guidance for Norton 360 and SSL-inspecting proxies.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Rodrigo Mansueli <rodrigo@mansueli.com>
Co-authored-by: Ali Waseem <waseema393@gmail.com>
 2026-08-05 09:09:13 -04:00
Andrey A. af384e136f chore(self-hosted): update tags in docker guide (#48739) 2026-08-05 14:19:11 +02:00
Alaister YoungAlaister YoungJoshen Lim
 		9952d6f10f [FE-4067] fix(studio): re-allow all regions in local project creation (#48704) 
Local dev stacks can run in any of the three supported regions (e.g.
Bobbie's is in `ap-southeast-1`), but enabling High Availability on the
project creation form pinned local to Frankfurt only. This unrestricts
local so all three regions are selectable again.

**Changed:**
- `getHighAvailabilityRegionCode()` returns `undefined` for `local`
(same as prod), so `filterHighAvailabilityRegions()` no longer collapses
the list — staging stays pinned to `us-east-1`
- The three-region warning in `RegionSelector` now adds a local-only
recommendation: "Use Central EU (Frankfurt) unless you're on a personal
dev stack."
- Updated unit tests, including an `ap-southeast-1` fixture region to
prove pass-through

## To test

- On a local stack, open the new project form and enable High
Availability — the region selector should offer all three regions (East
US, Frankfurt, Southeast Asia) instead of locking to Frankfurt, and the
warning should recommend Frankfurt unless you're on a personal dev stack
- Confirm staging behavior is unchanged (HA still pins to East US)
- `pnpm --filter studio exec vitest run
components/interfaces/ProjectCreation`

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Local development projects can now use high-availability regions
beyond Central EU.
* Region filtering and availability messaging now correctly reflect the
active environment, including staging restrictions.

* **User Experience**
* Added guidance recommending Central EU for local projects, unless
using a personal development stack.
* Region selection now provides clearer environment-specific information
when options are limited.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-08-05 14:51:57 +07:00
Danny White 3c811b9c29 fix(studio): extend SupportForm project waitFor timeout (#48211) 
## What kind of change does this PR introduce?

Test flake fix.

## What is the current behavior?

`SupportFormPage` → “submits support request with attachments…” can fail
under CI load:

- expected project selector text `Project 1`
- received `No specific project`

Org is applied first; the project is filled asynchronously via
`onInitialLoad` after org projects fetch. That wait still used the
default ~1s `waitFor`, while every sibling Project 1 assertion already
uses `{ timeout: 5_000 }` (see #45852).

## What is the new behavior?

- Attachments test waits up to 5s for Organization 1 + Project 1
- Same timeout for the org-switch → Project 2 waiter (same pattern)

No production code changes.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Tests**
* Improved support form test reliability by allowing additional time for
organization and project selectors to load during asynchronous
interactions.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-05 07:15:20 +00:00
Danny White 9b3e0a9060 show Vercel connection errors inline (#48473) 
## What kind of change does this PR introduce?

Bug fix.

## What is the current behavior?

Vercel install and project-link failures use transient toasts.

## What is the new behavior?

Failures remain visible below the relevant action and clear when the
user retries or changes a selection.

The Vercel mutation hooks expose errors without choosing their
presentation. Interstitial callers render them inline, while existing
non-interstitial callers explicitly retain their toasts.

| Before | After |
| --- | --- |
| <img width="1024" height="759" alt="Install Vercel Integration
Supabase"
src="https://github.com/user-attachments/assets/6348cdd2-220a-4ad8-89f9-7fc51de36a3c"
/> | <img width="1024" height="759" alt="Install Vercel Integration
Supabase"
src="https://github.com/user-attachments/assets/ecc50c4e-daab-4f6d-bf86-7282e2aff92c"
/> |

## To test

1. Switch to `dnywh/inline-vercel-errors` (this branch).
2. Open `apps/studio/pages/integrations/vercel/install.tsx`.
3. Find the `actionError` assignment immediately below
`useVercelIntegrationCreateMutation` and replace the whole assignment
with:
   ```tsx
   const actionError = 'Creating Vercel integration failed: Test error'
   ```
4. With local Studio running and while signed in, open
`http://localhost:8082/integrations/vercel/install?code=test&configurationId=test&source=marketplace`
5. Confirm the error remains visible below **Install integration**. No
Vercel installation or real authorisation code is required.
6. Revert the temporary edit.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Bug Fixes

* Improved error handling across Vercel project connection and
installation flows.
* Validation, duplicate-connection, and connection failures now appear
inline in the relevant setup steps.
* Errors clear automatically when the selected project or organization
changes.
* Notifications remain available in supported flows, including new
project creation and side-panel setup.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-05 16:06:58 +10:00
claude[bot]andClaude 89a5d03817 docs: add eu-central-2 to Edge Functions regional invocation page (#48721) 
<!-- ccr-slack-attribution -->
_Requested by **Kalleby Santos** · [Slack
thread](https://supabase.slack.com/archives/C02KMRX22NR/p1785871243937099?thread_ts=1785871243.937099&cid=C02KMRX22NR)_

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Docs update — one-line content fix.

## What is the current behavior?

The [Regional
Invocations](https://supabase.com/docs/guides/functions/regional-invocation)
page's "Available regions" section lists every Edge Functions region
**except `eu-central-2`** (AWS Europe, Zurich). The region has been live
in production for a while, but it was never added to the docs. A user
reading this page to pick a region for `x-region` / `FunctionRegion` had
no way to know Zurich was an option — the page reads as an exhaustive
list, so the omission actively implies the region doesn't exist.

Reported by Kalleby Santos (Edge Functions team).

Linear: [FUNC-761 — Add eu-central-2 to regional invocation docs
page](https://linear.app/supabase/issue/FUNC-761/add-eu-central-2-to-regional-invocation-docs-page)

## What is the new behavior?

**Before:** the Europe group listed `eu-central-1`, `eu-west-1`,
`eu-west-2`, `eu-west-3`.

**After:** `eu-central-2` (Zurich) is listed alongside the others, so
the page reflects the regions Edge Functions actually serves.

### How

One line added to
`apps/docs/content/guides/functions/regional-invocation.mdx`, in the
**Europe** group directly after `eu-central-1`, following the list's
existing sort-by-region-code order and the surrounding `` `code` (Short
location) `` label style:

```diff
 **Europe:**

 - `eu-central-1` (Frankfurt)
+- `eu-central-2` (Zurich)
 - `eu-west-1` (Ireland)
 - `eu-west-2` (London)
 - `eu-west-3` (Paris)
```

No other files changed. This page's region list is hand-maintained in
the MDX and is deliberately narrower than the project-creation region
list in `packages/shared-data/regions.ts` (which also includes
`us-east-2` and `eu-north-1`), so no shared constant needed updating and
no other product's region list was touched.

## Additional context

**Verification that `eu-central-2` is a real Edge Functions invocation
region** — confirmed in three independent places:

1. `supabase/platform` → `pulumi/edge-runtime/Pulumi.prod.yaml:533` —
`region: eu-central-2`, with `enabled: true` at `:531`. A fully
provisioned prod region (360–540 always-on tasks), not a placeholder.
Branch `develop`, HEAD `1f44167768f951c0c794313006bc2c9f9758c344`.
2. `supabase/platform` →
`pulumi/edge-runtime-next/stack-config/Pulumi.prod.aws.euc2.yaml:6` —
`aws:region: eu-central-2` under the `Edge-Functions/K8s-Prod`
environment, tagged `product: functions`.
3. `supabase/api-gateway` → `customer-router/wrangler.toml` —
`eu-central-2` is present in the `EDGE_FUNCTIONS_REGIONAL_ORIGINS` map
(`eu-central-2 = "https://eu-central-2.edge-runtime.supabase.green"`).
This is the table that resolves the `x-region` header, so regional
invocation into Zurich is genuinely routable — not just deployed.

**For a reviewer to confirm separately (intentionally not in this
diff):** production infra has 16 enabled Edge Functions regions, so
`us-east-2` (Ohio, `pulumi/edge-runtime/Pulumi.prod.yaml:507`, `enabled:
true`) is *also* missing from this page. It's excluded here because we
don't yet know whether that omission is deliberate; it's being confirmed
with the team and can be a follow-up.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_017UJhSvVpPfYNaHZ8Y1x3sy

---
_Generated by [Claude
Code](https://claude.ai/code/session_017UJhSvVpPfYNaHZ8Y1x3sy)_

Co-authored-by: Claude <noreply@anthropic.com>
 2026-08-04 22:09:37 +01:00