## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix / UI Polish
## What is the current behavior?
Interactive menu items in the User Account dropdown (top right profile
picture) use the `default` (arrow) cursor. This makes it less intuitive
that these items are clickable.
Closes#42360
## What is the new behavior?
This PR adds `cursor-pointer` to all interactive menu items in both the
[UserDropdown](cci:1://file:///home/erik/Documents/supabase/apps/studio/components/interfaces/UserDropdown.tsx:27:0-140:1)
(platform) and
[LocalDropdown](cci:1://file:///home/erik/Documents/supabase/apps/studio/components/interfaces/LocalDropdown.tsx:21:0-68:1)
(local/self-hosted) components. This provides correct visual feedback to
users when hovering over:
- Account preferences
- Feature previews
- Command menu (local)
- Theme selections
- Logout
## Additional context
Verified the changes locally for both
[LocalDropdown](cci:1://file:///home/erik/Documents/supabase/apps/studio/components/interfaces/LocalDropdown.tsx:21:0-68:1)
and
[UserDropdown](cci:1://file:///home/erik/Documents/supabase/apps/studio/components/interfaces/UserDropdown.tsx:27:0-140:1).
### Screenshots
Before:
<img width="262" height="301" alt="image"
src="https://github.com/user-attachments/assets/0c985b1b-065c-49d4-94d4-8dd07fa0ff67"
/>
After:
<img width="262" height="301" alt="image"
src="https://github.com/user-attachments/assets/e2ade471-0a84-4405-8e2c-8f757f5dfaf4"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Cursor-pointer indicators added to interactive dropdown items across
the app (account settings, feature previews, command menu entries, theme
selection radios, logout), improving hover feedback and visual
consistency for menu interactions.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Part of dashboard scalability project
Opting to use the connection string of the project's read replica (if
available) for read queries on the database.
Trialing with the Table Editor as a first pass - changes involved will
opt to use replica connection string for `useTableRowsQuery`,
`useTableRowsCountQuery`, and `useForeignKeyConstraintsQuery`
There's definitely optimizations to be done for deciding which replica
to use - but am starting off with a rather naive logic to prioritize
replicas in the same region as the project.
## Changes involved
- We're no longer passing `connectionString` as a param into the
affected hooks, the `connectionString` is derived from within those
hooks instead
- Change is feature flagged, so things should be status quo if flag is
off (use primary database's connection string)
- Added `useConnectionStringForReadOps` hook which returns the replica's
connection string if (Otherwise defaults to primary database connection
string)
- Feature flag is on
- Project has a replica available
## To test
- [ ] Verify that the table editor works as expected for a project that
has read replicas (There shouldn't be any change really)
- [ ] Also just double check that updating cells in the table editor
works as well (There's no change there, we're using the primary DB's
connection string for mutation ops)
- [ ] ^ Same thing for a project that doesn't have read replicas
- [ ] ^ Same thing for local / self-host
## Context
Just cleaning up the `unifiedReplication` feature flag now that this is
fully rolled out
Also addresses some bugs that I came across while cleaning up,
specifically for the new home page
- Add enabled features flag check for read replicas in database
replication
- Infra diagram, read replicas
- View connection string CTA to open connect UI with the right database
selected
- Replaced all other actions with a "Manage replica" CTA which links to
the replica details page
## Context
Follow up from https://github.com/supabase/supabase/pull/43329, but
mutually exclusive
Just cleaning up feature flags that have been toggled on for all users
and unchanged for the past 2 months
- edgefunctionreport
- storagereport
- realtimeReport
- postgrestreport
- authreportv2
- newEdgeFunctionOverviewCharts
- apiReportCountries (Already not used)
- SentryLogDrain
- reportGranularityV2
- storageAnalyticsVector
- ShowIndexAdvisorOnTableEditor
## Context
Just cleaning up feature flags that have been toggled on for all users
and unchanged for the past 2 months
- advisorRules
- newJwtSecrets
- isWorkOSTPAEnabled
- EnableOAuth21
- gitlessBranching
- showRefreshToast
- awsPrivateLinkIntegration
- useBedrockAssistant (Already not used)
- enableStripeSyncEngineIntegration
- ShowExplainWithAiInQueryPerformance
Doing it in 2 parts so its easier for review
Adds entitlements check to the `DiskSizeConfiguration` and
`DiskSizeConfigurationModal` components
## Testing
### Database Settings
- You'll need an Org in the Pro Plan with spend cap disabled, and a
Project with Fly as the cloud provider.
- Head to `/project/_/database/settings`
- Assert that the Disk Size configuration section is visible:
<img width="707" height="459" alt="image"
src="https://github.com/user-attachments/assets/ce98ed20-cab7-44db-a118-b84d9f9f935c"
/>
- With a Free Project with Fly as the cloud provider, assert that the
Disk Size configuration is gated:
<img width="707" height="260" alt="image"
src="https://github.com/user-attachments/assets/23374b03-7981-42cd-b928-0e8808d128b1"
/>
### Observability > Database
- You'll need an Org in the Pro Plan with spend cap disabled, and a
Project with Fly as the cloud provider.
- Head to `project/_/observability/database`, and scroll to the
`Database Size` section
- Assert that clicking the `Increase disk size` button shows this modal:
<img width="829" height="469" alt="image"
src="https://github.com/user-attachments/assets/ae121e3f-a68b-4de6-803d-aff8462e0c7c"
/>
- With a Free Project with Fly as the cloud provider, assert that the
increase size modal doesn't allow you to increase the size
<img width="707" height="398" alt="image"
src="https://github.com/user-attachments/assets/3e97ce27-4ecd-4152-80a0-d5e0d141f44b"
/>
### Changes
- Replace `isFreePlan` with entitlement-based check in infrastructure
warnings: `CPUWarnings`, `RAMWarnings`, and `DiskIOBandwidthWarnings`
previously derived their button label ("Upgrade project" vs "Change
compute add-on") from checking the org's plan. This is now driven by the
`instances.compute_update_available_sizes` entitlement.
## Problem
When using chrome, it's impossible to enter a time value
## Solution
Avoid controlling the input value and only bubble up the change when the
value is a valid time or is empty
## How to test
- Create a table with a `time` column
- Add a new row and start entering a value using the keyboard
This PR adds new feature flags for controlling etl destinations
visibility based on the org slug.
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Feature
## What is the current behavior?
Region-specific incidents are only shown in the global StatusPageBanner,
which doesn't clearly indicate that an incident only affects specific
regions during project creation.
## What is the new behavior?
Region-specific incidents are now displayed inline in the RegionSelector
with smart region matching to show which regions are affected. The
StatusPageBanner logic is updated to avoid duplicate incident notices
for region-specific incidents when creating projects.
## Additional context
<img width="1394" height="650" alt="CleanShot 2026-03-02 at 16 32 34@2x"
src="https://github.com/user-attachments/assets/fd3734dc-8049-4c24-82d8-456bfbdbd4fd"
/>
Resolves FE-2652
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Enhancement
## What is the current behavior?
Incidents are displayed regardless of impact.
## What is the new behavior?
Filters out incidents with impact = none
## Additional context
Resolves FE-2649
## Context
Main fix is to adjust the new home page + connect dialog (and connect
sheet) to render the project's custom domain if available
<img width="471" height="255" alt="image"
src="https://github.com/user-attachments/assets/3a208b2e-bdeb-43f5-a2e7-3495881dbaaa"
/>
<img width="1065" height="233" alt="image"
src="https://github.com/user-attachments/assets/2a7b8f81-8c0b-4803-bf0a-fc16a2f1e0e1"
/>
## Changes involved
- Created a `useProjectApiUrl` hook that will return the API URL
depending if custom domains is available, otherwise default to default
project API URL
- Refactored all the other places that were manually deriving the
project's endpoint
- Storage Explorer -> copy URL
- Edge Functions
- Integrations -> Data API + API Docs
- Auth Providers -> Callback URL
- Also updated the copy CTA for the addons page
- Instead of just "Change xxx", make it a bit more actionable
- For add ons with binary states (Custom domains, IPv4)
- If not enabled yet, "Enable xxx", otherwise "Toggle xxx"
- For PITR
- If not enabled yet, "Enable PITR", otherwise "Change recovery
duration"
- Also added "Edit custom domain" CTA if enabled
<img width="1144" height="518" alt="image"
src="https://github.com/user-attachments/assets/4f152ea5-0cc7-412c-95e8-ad5bb37c19c3"
/>
## To test
- [ ] Verify that for a project with custom domain set up, all the
affected UI mentioned in the above section look correct
## What kind of change does this PR introduce?
UI change
## What is the current behavior?
Organization settings are currently spread across a NavMenu. This is
getting unweildy as the amount of children within Organization settings
grows.
## What is the new behavior?
Organization settings are now on a sidebar, just like Project Settings
and most other surfaces.
| Before | After |
| --- | --- |
| <img width="1024" height="563" alt="Supabase"
src="https://github.com/user-attachments/assets/3889858c-157a-4deb-8714-71fe9cf002e6"
/> | <img width="1024" height="563" alt="General Supabase"
src="https://github.com/user-attachments/assets/1b4eb2c3-a67c-4eda-ab3c-e6610dd5ccf4"
/> |
## Additional context
@fsansalvadore and the design team have have other efforts going on to
reduce interface clutter, e.g. nested sidebars.
## Problem
The Performance Advisor warning "Auth Absolute Connection Management
Strategy" persists after switching from "Absolute" to "Percentage"
allocation strategy, even after project restart.
PR #41652 added cache invalidation but the frontend doesn't immediately
refetch, so stale lint data may be displayed until the next natural
refetch occurs.
## Solution
Force an immediate refetch of lint data after invalidating the cache.
This ensures the backend re-evaluates the `auth_db_connections_absolute`
lint with the updated `DB_MAX_POOL_SIZE_UNIT` configuration value.
## Changes
- Added `refetchQueries` call after cache invalidation in
`useAuthConfigUpdateMutation`
- Uses `type: 'active'` to only refetch active queries (React Query best
practice)
## Related
- Extends: https://github.com/supabase/supabase/pull/41652
- Closes: https://github.com/supabase/supabase/issues/41619
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved data consistency by ensuring validation information is
automatically refreshed following authentication configuration updates.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Feature restoration
## What is the current behavior?
Incident banners cannot be dismissed by users.
## What is the new behavior?
Users can dismiss incident banners again.
## Additional context
## What kind of change does this PR introduce?
UI update
## What is the current behavior?
AlertError is usually full of prose yet has `horizontal` button
placement. This looks incredibly awkward at smaller breakpoints.
## What is the new behavior?
AlertError swaps the default `layout` to `responsive`, making the
smaller breakpoint composition much nicer.
| Before | After |
| --- | --- |
| <img width="370" height="850" alt="Spinner Toolshed
Supabase-FBF6DD34-258E-4E36-B3DF-533F0EDDC307"
src="https://github.com/user-attachments/assets/cb38c270-bdc1-46b7-8fed-7c6ff9f15ccc"
/> | <img width="370" height="850" alt="Spinner Toolshed
Supabase-37BDDE9A-DF90-4B96-95F4-4AA15A12682A"
src="https://github.com/user-attachments/assets/d8ff89bf-2451-44e0-a048-418272f7514a"
/> |
## Additional context
2+ buttons (`additionalActions`) still forces the `vertical` layout
type.
## To test
The pictured example is not available on this branch. An easy one to
test is
[CreateBranchModal](https://github.com/supabase/supabase/blob/2cc275fd51818752a7ff16eb46c2697e9f1f2c9a/apps/studio/components/interfaces/BranchManagement/CreateBranchModal.tsx#L410):
```diff
- {isErrorConnections && (
+ {true && (
<AlertError
error={connectionsError}
subject="Failed to retrieve GitHub connection information"
/>
)}
```
Sentry was flooded with un-actionable events: browser extension errors,
network blips, React hydration
noise from DOM-manipulating extensions, and CriticalError issues that
were impossible to route because
they grouped by message string rather than type. This made it hard to
spot real regressions.
## Changes:
- Improved client-side Sentry signal quality in
apps/studio/instrumentation-client.ts by replacing
custom third-party stack filtering with
Sentry.thirdPartyErrorFilterIntegration, plus stricter
allowUrls filtering for Supabase/app frames.
- Added build-time Sentry bundle annotation in
apps/studio/next.config.js via
unstable_sentryWebpackPluginOptions.applicationKey = 'supabase-studio'
to support reliable third-party
frame filtering.
- Expanded and reorganized ignoreErrors rules across client/server/edge
Sentry configs to suppress known
non-actionable noise (Next.js navigation internals, network/transient
chunk failures, extension/DOM-
manipulation noise, hydration-noise patterns).
- Refactored critical error reporting in
apps/studio/lib/error-reporting.ts from captureMessage to
captureException with scoped tags (critical=true, context=<action>) and
synthetic CriticalError
exceptions for better alerting/grouping.
- Updated tests in apps/studio/lib/error-reporting.test.ts to match the
new Sentry API usage (withScope
+ captureException) and assert on exception objects/tags behavior.
- 100% sampling (codeSampleRate = 1) for normal/useful errors.
- 1% sampling (codeSampleRate = 0.01) only for explicitly noisy classes:
- Failed to construct 'URL': Invalid URL
- Session error detected
- chunk-load failures (ChunkLoadError, Loading chunk ... failed, Loading
CSS chunk ... failed)
- Sent events are tagged with codeSampleRate so you can filter/segment
in Sentry dashboards.
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Refactor
## What is the current behavior?
Many utility functions are in the Valtio object which is overly large
and complex.
## What is the new behavior?
Some utility functions are moved out and tested. No behaviour has been
changed, they've just been moved with any necessary changes to
arguments.
Mobile sheet nav doesn't close on route change and viewport resizing
after #43184.
This PR fixes that and also makes it optional to close on nav and
resizing, because the sidepanels need them _not_ to resize, while mobile
navigation menu does.
Also added some tests. 🪄
- Deleted SQL Snippets leave a hanging block that loads forever in
custom reports, and its not possible to delete them.
- Now you can delete blocks if they get stuck loading
- Also shows correct error state when a block couldn't load because the
sql snippet was removed
## before
- stuck forever
<img width="1296" height="936" alt="CleanShot 2026-02-26 at 13 23 25@2x"
src="https://github.com/user-attachments/assets/bb65cc5f-c2a4-4027-876e-db9682ec6f3c"
/>
## after
- show error state
- allow user to delete snippet
<img width="1388" height="862" alt="CleanShot 2026-02-26 at 13 23 45@2x"
src="https://github.com/user-attachments/assets/c5d6c114-071b-4e4d-a913-25b3c788db95"
/>
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
This pull request refactors how the `TabsStateContextProvider` receives
the project reference and updates related imports for consistency and
maintainability. The main change is to pass `projectRef` explicitly as a
prop instead of fetching it internally, which improves context control
and makes the component easier to test and reuse. Additionally, the PR
updates import paths to use absolute aliases and removes an unused
function.
This fixes an issue which you can replicate by:
1. Go to SQL editor
2. Open any snippet
3. Delete the local storage `supabase_studio_tabs_{project ref}`
4. Refresh the page while still the snippet is open
This will make the snippet to enter in a ghost state where the tab name
is not visible but you see the content.
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## What kind of change does this PR introduce?
UI update
## What is the current behavior?
- Database settings uses an older, much wider, layout
- This will become problematic later on as more complex elements are
added to the page
- Titles and descriptions are inconsistently formatted
## What is the new behavior?
| Before | After |
| --- | --- |
| <img width="1728" height="994" alt="Oldie 2 Toolshed
Supabase-EE998752-3696-45E4-A842-9666049153D8"
src="https://github.com/user-attachments/assets/8f0004cf-3bb4-4b00-900a-b116b80371a6"
/> | <img width="1728" height="994" alt="Oldie 2 Toolshed
Supabase-7E86FD58-35BB-4912-8B2F-8C7AAA03B462"
src="https://github.com/user-attachments/assets/606b51b4-21a0-4b7b-870b-ac92ed363f3c"
/> |
## Context
Should've removed the `status` prop when fetching notifications in
`AdvisorButton` for a more accurate indication of
`hasCriticalNotifications` as we should show that dot for read critical
notifications too (not just new)
## Context
With the new home page, we have a stat to show the overall status of the
project + individual service health, both of which data is pulled from
an endpoint
<img width="283" height="400" alt="image"
src="https://github.com/user-attachments/assets/c7cbfdc6-b46b-41ce-9a89-59a3df98b586"
/>
At the time of project creation, some of the services start of as
UNHEALTHY, which results in the status stat here showing a label of
"Unhealthy" (while accurate in the sense that we're showing what's
coming from the API, its inaccurate as the services are still spinning
up)
## Changes involved
For each service, am opting to show their status as "COMING_UP" if the
service status is UNHEALTHY + the project's status is COMING_UP or
UNKNOWN. The overall status label should also show "Coming up" if the
project's status is COMING_UP or UNKNOWN as well
## Context
Renaming folders on the Storage Explorer has a tendency to be flaky as
we're using the `POST /objects/move` storage API to move files to the
renamed folder which handles one file per request.
For a big folder (e.g 100+ files), users will easily hit rate limits and
run into 429s with the API, in which the current behaviour just shows
toast errors as the error handler, leaving an odd state upon running
through every file in the folder where some files are in the old folder,
and others in the new one
## Changes involved
Main solution is to implement an automatic retry logic for
`renameFolder`, but changes involved are:
- Remove batching logic for renaming folders (Which fires `n` requests
per batch)
- The batch logic was negligible anyways since our batch size was only 2
😅
- Instead we now handle moving of files sequentially
- If a file runs into an error during the `POST` request, retry the
request after `n` seconds
- If the error was a 429, retry after 60 seconds, otherwise just 5
seconds
- Will attempt the request for a total of 3 times
- Toast progress description will also be updated to show the message
(timer will also count down to keep the UI interactive and not look
stuck)
<img width="362" height="98" alt="image"
src="https://github.com/user-attachments/assets/52ba685a-2f35-42f1-8fcf-98351184fd56"
/>
- After the whole process is completed, if any file ran into an error,
toast description will add a CTA to retry the rename
## Demo
https://github.com/user-attachments/assets/d65b3c22-f9f8-4984-9521-6fc83a69f82e
## To test
Have a folder in your project's storage bucket with 100+ files (can
stress test with nested folders)
- [ ] Verify that you can rename the folder, and the dashboard
automatically handles errors
## Context
Adjust advisor panel to not show "Project required" UI for the "All"
panel since messages do not require to be in a specific project
<img width="434" height="251" alt="image"
src="https://github.com/user-attachments/assets/8a999ca7-1a81-4c63-a6f7-c73cbdd676e3"
/>
Also adjusts the red dot for advisor center button to show if there's
critical notifications
## What kind of change does this PR introduce?
- Feature
- Resolves DEPR-355
## What is the current behavior?
Only one email address can be invited to an organization at a time.
## What is the new behavior?
- Multiple email addresses can be invited (at a single scope) to an
organization at one time
- List of email addresses detected via comma-separation
- Pluralization on fields and labels
- Table and copywriting cleanup
| Before | After |
| --- | --- |
| <img width="808" height="691" alt="Supabase"
src="https://github.com/user-attachments/assets/f6450c26-968c-4ee8-bb7c-d6f6a3af1209"
/> | <img width="808" height="691" alt="8298"
src="https://github.com/user-attachments/assets/2d7e3869-b9d4-4a4f-89aa-ae55d67e794b"
/> |
| <img width="1024" height="560" alt="Supabase"
src="https://github.com/user-attachments/assets/9a255167-fcd3-4294-ba3a-9160bd500cff"
/> | <img width="1024" height="560" alt="Supabase"
src="https://github.com/user-attachments/assets/daba5bb8-eb12-43dc-86de-217e9baf0b72"
/> |
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for inviting multiple team members simultaneously via
comma-separated emails.
* **Improvements**
* Enhanced member management interface with clearer status indicators
(You, Invited, SSO, MFA enabled/disabled).
* Improved feedback messages for invitation outcomes and member status
changes.
* Updated member table layout with summary footer displaying member
count.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Summary
- Reverts the middleware changes to `apps/studio` and `apps/docs` from
#43153 that caused full page reloads on every client-side navigation in
Studio
- Root cause: broadening the `middleware` matchers to match all routes
and returning `NextResponse.next()` unconditionally interferes with
client-side navigation in the multi-zone production setup (`www` proxies
`/dashboard/*` → Studio, `/docs/*` → Docs)
- Cookie stamping is unnecessary in Studio and Docs because `apps/www`
sits in front of both apps in production and already handles
first-referrer cookie attribution for all incoming traffic
- The `apps/www` middleware, packages/common cookie utilities, and
telemetry changes from #43153 are left intact
Test plan
- Verify client-side navigation works without full page reloads in
Studio (production or preview deploy)
- Verify first-referrer cookie is still stamped via `www` middleware on
initial visit
Summary
- Fixes full page reloads on every client-side navigation in Studio
caused by the first-referrer cookie middleware (#43153)
- In the multi-zone production setup (www proxies /dashboard/* →
Studio), returning `NextResponse.next()` unconditionally processes every
response through Next.js's middleware pipeline, interfering with
client-side navigation
- Now only returns NextResponse.next() when a cookie actually needs to
be stamped; returns undefined otherwise so Next.js handles the request
untouched
- Also fixes valid API routes (e.g. /api/ai/sql/generate-v4) falling
through to cookie-stamping code instead of passing through cleanly
