dima/supabase
1
0 Fork 0
mirror of https://github.com/supabase/supabase.git synced 2026-10-05 09:25:06 +03:00
Code Issues Packages Projects Releases Wiki Activity
37,703 Commits 1,797 Branches 62 Tags
8dda0c3910cca10a9a4d39ffbf49c34a2ad4faa2
Commit Graph
37703 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Miranda LimonczenkoandClaude Sonnet 5 8dda0c3910 Add heading-hierarchy a11y check to docs E2E tests (#48422) 
Closes DOCS-1232

## Problem

We do not have any tests to verify that we are following a proper
heading hierarchy. For a documentation site that deals in mostly static
content, this test is important.

Single h1 + logical heading hierarchy (h1→h2→h3, no skips) matters
because screen reader users navigate by jumping between headings —
broken structure breaks that navigation.

Relevant: WCAG 1.3.1 Info and Relationships (Level A) —
https://www.w3.org/WAI/WCAG21/Understanding/info-and-relationships.html

## Solution

Add Playwright axe-core, which we plan to expand later, to test only the
h1 and header-hierarchy rule.
This is added to our current suite that dynamically checks only pages
that are edited.

## Manual testing

1. Find a docs guide and intentionally break the header hierarchy.
2. Run `pnpm e2e:docs:a11y` and see your errors.
3. Resolve the issue and run again to see errors resolved. Ensure there
is at least a line changed to see the page tested.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Tests**
  * Added automated accessibility checks for documentation pages.
* Verified heading order and the presence of a level-one heading on each
page.
  * Added a dedicated command to run documentation accessibility tests.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
 2026-07-31 12:31:39 -07:00
Charis ec64135f9d perf(pg-meta): scope column privileges query to a single table (#48553) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Performance improvement

## What is the current behavior?

The column privileges page in Studio only ever renders one table, but
the underlying query still `aclexplode`s every column in the whole
schema and filters the result client-side.

## What is the new behavior?

Adds a scoped SQL path that prunes `pg_class`/`pg_namespace` to the
requested schema+table before exploding ACLs, gated behind the
`pgMetaScopedIntrospection` flag, with a plan-guard test asserting
`pg_class`/`pg_attribute` stay index-driven. Studio's query hook and
cache keys now thread the selected table through so column-privilege
invalidation and cold-load races are scoped correctly, and the page
fetches per-table instead of per-schema.

## Additional context

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Improvements**
* Column privileges are now scoped to the selected schema and table for
more accurate results.
* Changing schemas automatically updates the table selection and
refreshes the displayed privileges.
* Privilege updates now refresh only the relevant schema, table, and
column data.
* Loading states are handled more accurately when no table is selected.

* **Bug Fixes**
* Improved consistency between scoped and unscoped column privilege
results, including table-, column-, and grant-option privileges.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-31 15:26:37 -04:00
AnaAnaMatt Rossman
 		d47747477d docs(blog): add Introducing Supabase Evals launch post (#48505) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

- Adds a new blog post announcing the open-source `supabase/evals`
benchmark, published at `/blog/introducing-supabase-evals` (date
2026-07-31)
- Adds the post's images (`og.png`, `thumb.png`, and an inline
benchmark-results chart) under
`apps/www/public/images/blog/introducing-supabase-evals/`

## What is the current behavior?

N/A. No existing post for this launch.

## What is the new behavior?

- New MDX post
`apps/www/_blog/2026-07-31-introducing-supabase-evals.mdx`, author
`matt_rossman`, category `product`
- Post covers what Supabase Evals is, why we built it, how the benchmark
and regression suites work, key findings, and where agents struggle

## Additional context

- Opened as a draft. Content is still under review in Notion, so this is
not ready to merge yet.
- Part of the Introducing Supabase Evals launch (Tier 2, target
2026-07-31).
- Images are placeholders pending final assets from Brand Design if
needed.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Added a new blog post introducing Supabase Evals, an open-source
benchmark for evaluating AI coding agents on real Supabase tasks.
* Described how evaluations run, how scoring works, retry behavior,
update cadence, and common failure areas.
* Included links to explore results and shared plans for expanding
scenarios, improving scoring rigor, and adding feedback capabilities.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Ana <ana1337x@users.noreply.github.com>
Co-authored-by: Matt Rossman <22670878+mattrossman@users.noreply.github.com>
 2026-07-31 14:55:33 -04:00
Miranda LimonczenkoandClaude Sonnet 5 320111b06b fix(docs): replace hardcoded heading tags in 4 shared components (#48456) 
Closes DOCS-1261

_WAVE plugin shows headers creating jumps in hierarchy. Preview on the
left:_
<img width="1022" height="417" alt="Screenshot 2026-07-29 at 2 42 07 PM"
src="https://github.com/user-attachments/assets/f5e3bd09-8dbf-45e3-8a7f-70d7334fd25b"
/>

<img width="408" height="663" alt="Screenshot 2026-07-29 at 2 44 33 PM"
src="https://github.com/user-attachments/assets/6b952a81-40e5-4a9d-b08a-190c71575cac"
/>



## Problem

Four shared components in `apps/docs` render a hardcoded heading tag no
matter where they're used:

- `NamedCodeBlock` renders a code block's filename as an `<h6>`
- `ProjectConfigVariables` renders a variable label as an `<h6>`
- `StepHikeCompact.Details` renders a step title as an `<h3>`
- `IconPanel` renders its title as an `<h5>`

Since these are fixed, they often land in the wrong spot in a page's
heading order (like an h6 right after an h2), which breaks navigation
for screen reader users. This showed up in the [header hierarchy triage
report](https://app.notion.com/p/supabase/Playwright-E2E-Triage-Reports-3ab5004b775f81e3bc60d058fa5a02c1)
— fixing these 4 components alone resolves 72 of the 159 heading-order
violations found.

## Solution

Swapped the heading tag in each component for a `<span>` with the same
classes. None of these are really "headings" for the content that
follows, so they shouldn't be in the tag tree at all.

The one wrinkle: this codebase applies heading font weight/family
through a global CSS rule keyed off the tag name (h1-h6), not something
the tag gives you for free. So each span now sets that styling
explicitly, plus a margin to match what was there before. Nothing else
changed — same classes, same layout.

## Manual testing

Staging preview:
https://docs-git-ui-header-hierarchy-supabase.vercel.app

Check that each one still looks right:
-
[NamedCodeBlock](https://docs-git-ui-header-hierarchy-supabase.vercel.app/docs/guides/self-hosting/docker)
— filenames above the code blocks
-
[ProjectConfigVariables](https://docs-git-ui-header-hierarchy-supabase.vercel.app/docs/guides/auth/quickstarts/react-native)
— the "Project URL" / "Publishable key" labels (this page also has a
`NamedCodeBlock` inside the numbered steps)
-
[StepHikeCompact](https://docs-git-ui-header-hierarchy-supabase.vercel.app/docs/guides/database/beekeeper-studio)
— the step titles ("Create a new connection", etc.)
-
[IconPanel](https://docs-git-ui-header-hierarchy-supabase.vercel.app/docs/guides/resources)
— the "Auth0" / "Firebase Auth" panel titles under "Migrate to Supabase"

I also ran typecheck, lint, and the docs test suite locally — all green.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Style**
* Updated headings and labels across documentation and UI components for
more consistent typography.
* Improved spacing, font weight, and block-level layout for project
variables, step details, code tabs, and icon panels.
  * Preserved existing text content and conditional display behavior.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
 2026-07-31 18:25:23 +00:00
Miranda LimonczenkoandClaude Sonnet 5 81523d5d8c fix(docs): fix heading-order skips in guide and troubleshooting content (#48459) 
Closes DOCS-1260

_See WAVE plugin no longer flags a jump in header hierarchy. Preview on
left._
<img width="708" height="699" alt="Screenshot 2026-07-29 at 2 30 11 PM"
src="https://github.com/user-attachments/assets/be5bf335-9e03-474f-8215-06fa505ab2db"
/>


## Problem

Beyond the 4 shared components fixed in
[#48456](https://github.com/supabase/supabase/pull/48456), the [header
hierarchy
report](https://app.notion.com/p/supabase/Playwright-E2E-Triage-Reports-3ab5004b775f81e3bc60d058fa5a02c1)
found plain content headings that skip a level. For example, you may see
a `##` followed directly by an `####`.

Jumps in headers breaks page navigation for screen reader users, who
jump between headings expecting each level to nest one at a time.

## Solution

Adjusted heading levels across the affected guide and troubleshooting
pages so every section nests correctly, with no skipped levels.

**Staging previews:**

| Page | Preview |
| --- | --- |
| `/guides/api/rest/postgrest-error-codes` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/api/rest/postgrest-error-codes)
|
| `/guides/auth/oauth-server/getting-started` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/auth/oauth-server/getting-started)
|
| `/guides/database/custom-postgres-config` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/database/custom-postgres-config)
|
| `/guides/database/drizzle` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/database/drizzle)
|
| `/guides/database/extensions` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/database/extensions)
|
| `/guides/database/extensions/pgaudit` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/database/extensions/pgaudit)
|
| `/guides/database/postgres-js` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/database/postgres-js)
|
| `/guides/database/replication/manual-replication-monitoring` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/database/replication/manual-replication-monitoring)
|
| `/guides/database/replication/manual-replication-setup` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/database/replication/manual-replication-setup)
|
| `/guides/database/replication/pipelines-monitoring` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/database/replication/pipelines-monitoring)
|
| `/guides/functions/debugging-tools` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/functions/debugging-tools)
|
| `/guides/functions/development-tips` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/functions/development-tips)
|
| `/guides/functions/examples/auth-send-email-hook-react-email-resend` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/functions/examples/auth-send-email-hook-react-email-resend)
|
| `/guides/functions/examples/image-manipulation` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/functions/examples/image-manipulation)
|
| `/guides/functions/examples/semantic-search` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/functions/examples/semantic-search)
|
| `/guides/functions/examples/send-emails` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/functions/examples/send-emails)
|
| `/guides/functions/examples/sentry-monitoring` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/functions/examples/sentry-monitoring)
|
| `/guides/functions/wasm` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/functions/wasm)
|
| `/guides/getting-started` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/getting-started)
|
| `/guides/platform/aws-marketplace` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/platform/aws-marketplace)
|
| `/guides/platform/aws-marketplace/faq` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/platform/aws-marketplace/faq)
|
| `/guides/platform/billing-faq` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/platform/billing-faq)
|
| `/guides/platform/ipv4-address` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/platform/ipv4-address)
|
| `/guides/platform/migrating-within-supabase/backup-restore` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/platform/migrating-within-supabase/backup-restore)
|
| `/guides/platform/privatelink` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/platform/privatelink)
|
| `/guides/queues/api` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/queues/api)
|
| `/guides/resources` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/resources)
|
| `/guides/security/hipaa-compliance` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/security/hipaa-compliance)
|
| `/guides/security/security-testing` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/security/security-testing)
|
| `/guides/security/soc-2-compliance` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/security/soc-2-compliance)
|
| `/guides/self-hosting` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/self-hosting)
|
| `/guides/storage/cdn/fundamentals` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/storage/cdn/fundamentals)
|
| `/guides/storage/debugging/logs` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/storage/debugging/logs)
|
| `/guides/storage/production/scaling` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/storage/production/scaling)
|
| `/guides/storage/schema/helper-functions` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/storage/schema/helper-functions)
|
| `/guides/storage/serving/image-transformations` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/storage/serving/image-transformations)
|
| `/guides/storage/uploads/resumable-uploads` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/storage/uploads/resumable-uploads)
|
|
`/guides/troubleshooting/an-invalid-response-was-received-from-the-upstream-server-error-when-querying-auth-RI4Vl-`
|
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/an-invalid-response-was-received-from-the-upstream-server-error-when-querying-auth-RI4Vl-)
|
|
`/guides/troubleshooting/are-all-features-available-in-self-hosted-supabase-THPcqw`
|
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/are-all-features-available-in-self-hosted-supabase-THPcqw)
|
|
`/guides/troubleshooting/avoiding-timeouts-in-long-running-queries-6nmbdN`
|
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/avoiding-timeouts-in-long-running-queries-6nmbdN)
|
| `/guides/troubleshooting/database-api-42501-errors` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/database-api-42501-errors)
|
| `/guides/troubleshooting/disabling-prepared-statements-qL8lEL` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/disabling-prepared-statements-qL8lEL)
|
|
`/guides/troubleshooting/discovering-and-interpreting-api-errors-in-the-logs-7xREI9`
|
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/discovering-and-interpreting-api-errors-in-the-logs-7xREI9)
|
| `/guides/troubleshooting/edge-function-504-error-response` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/edge-function-504-error-response)
|
|
`/guides/troubleshooting/high-cpu-and-slow-queries-with-error-must-be-a-superuser-to-terminate-superuser-process`
|
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/high-cpu-and-slow-queries-with-error-must-be-a-superuser-to-terminate-superuser-process)
|
|
`/guides/troubleshooting/how-postgres-chooses-which-index-to-use-_JHrf4`
|
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/how-postgres-chooses-which-index-to-use-_JHrf4)
|
|
`/guides/troubleshooting/how-to-change-max-database-connections-_BQ8P5`
|
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/how-to-change-max-database-connections-_BQ8P5)
|
|
`/guides/troubleshooting/how-to-interpret-and-explore-the-postgres-logs-OuCIOj`
|
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/how-to-interpret-and-explore-the-postgres-logs-OuCIOj)
|
|
`/guides/troubleshooting/how-to-migrate-from-supabase-auth-helpers-to-ssr-package-5NRunM`
|
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/how-to-migrate-from-supabase-auth-helpers-to-ssr-package-5NRunM)
|
| `/guides/troubleshooting/http-api-issues` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/http-api-issues)
|
|
`/guides/troubleshooting/increase-vector-lookup-speeds-by-applying-an-hsnw-index-ohLHUM`
|
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/increase-vector-lookup-speeds-by-applying-an-hsnw-index-ohLHUM)
|
|
`/guides/troubleshooting/interpreting-supabase-grafana-cpu-charts-9JSlkC`
|
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/interpreting-supabase-grafana-cpu-charts-9JSlkC)
|
|
`/guides/troubleshooting/interpreting-supabase-grafana-io-charts-MUynDR`
|
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/interpreting-supabase-grafana-io-charts-MUynDR)
|
| `/guides/troubleshooting/new-branch-doesnt-copy-database` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/new-branch-doesnt-copy-database)
|
|
`/guides/troubleshooting/not-receiving-auth-emails-from-the-supabase-project-OFSNzw`
|
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/not-receiving-auth-emails-from-the-supabase-project-OFSNzw)
|
|
`/guides/troubleshooting/resolving-500-status-authentication-errors-7bU5U8`
|
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/resolving-500-status-authentication-errors-7bU5U8)
|
|
`/guides/troubleshooting/resolving-cannot-execute-update-in-a-read-only-transaction-on-transaction-pooler-connections-ef582c`
|
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/resolving-cannot-execute-update-in-a-read-only-transaction-on-transaction-pooler-connections-ef582c)
|
|
`/guides/troubleshooting/resolving-database-hostname-and-managing-your-ip-address-pVlwE0`
|
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/resolving-database-hostname-and-managing-your-ip-address-pVlwE0)
|
| `/guides/troubleshooting/rls-simplified-BJTcS8` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/rls-simplified-BJTcS8)
|
| `/guides/troubleshooting/security-of-anonymous-sign-ins-iOrGCL` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/security-of-anonymous-sign-ins-iOrGCL)
|
|
`/guides/troubleshooting/supabase--your-network-ipv4-and-ipv6-compatibility-cHe3BP`
|
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/supabase--your-network-ipv4-and-ipv6-compatibility-cHe3BP)
|
| `/guides/troubleshooting/supabase-grafana-memory-charts` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/supabase-grafana-memory-charts)
|
| `/guides/troubleshooting/supavisor-faq-YyP5tI` |
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/supavisor-faq-YyP5tI)
|
|
`/guides/troubleshooting/tracking-postgres-role-activity-to-specific-dashboard-users-8d3715`
|
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/tracking-postgres-role-activity-to-specific-dashboard-users-8d3715)
|
|
`/guides/troubleshooting/transferring-from-cloud-to-self-host-in-supabase-2oWNvW`
|
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/transferring-from-cloud-to-self-host-in-supabase-2oWNvW)
|
|
`/guides/troubleshooting/understanding-postgresql-explain-output-Un9dqX`
|
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/understanding-postgresql-explain-output-Un9dqX)
|
|
`/guides/troubleshooting/understanding-postgresql-logging-levels-and-how-they-impact-your-project-KXiJRm`
|
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/understanding-postgresql-logging-levels-and-how-they-impact-your-project-KXiJRm)
|
|
`/guides/troubleshooting/vercel-integration-environment-variables-not-syncing-for-persistent-git-branches-b9191e`
|
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/vercel-integration-environment-variables-not-syncing-for-persistent-git-branches-b9191e)
|
|
`/guides/troubleshooting/why-are-there-gaps-in-my-postgres-id-sequence-Frifus`
|
[Preview](https://docs-git-docs-heading-hierarchy-supabase.vercel.app/docs/guides/troubleshooting/why-are-there-gaps-in-my-postgres-id-sequence-Frifus)
|

## Manual testing

1. See affected pages. Recommend running a browser plugin like WAVE and
selecting the **Structure** tab.
2. See the headings do not skip.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Release Notes

* **Documentation**
* Standardized heading hierarchy across many guides and troubleshooting
articles to improve readability and navigation.
* Updated several documentation link targets to the correct new
locations.
* Reformatted multiple sections (including replication monitoring, Edge
Functions, Storage, authentication, security, and networking) without
changing instructions.
* Queue Data API docs were restructured via heading-level adjustments
(no operational changes).
* Billing FAQ received clearer, more detailed payment-failure and tax
guidance, plus related link updates.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
 2026-07-31 10:47:14 -07:00
ChloeGarciaMillerand e241a21a9a fix: ESLint errors relating to accessibility in table editor, API Key and Access Token (#48479) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Added aria-label attributes and Tooltip to buttons

## What is the current behavior?

alt attributes and Tooltip were missing

## What is the new behavior?

Buttons have now aria-label attributes and Tooltip.

## Additional context

No visual changes have been made.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Accessibility Improvements**
* Added tooltips and improved accessible labeling for filter removal,
sort controls, and action menu triggers.
* Enhanced “More actions”/“More options” tooltips and aria-labels for
API keys and access tokens.
* Updated token scope selection and token banner close actions to use
clearer tooltip messaging.
* Wrapped panel close control with a tooltip and added an aria-label for
clearer screen reader support.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-31 18:05:41 +02:00
dependabot[bot]andCharis f758ff132e chore(deps): bump docker/login-action from 2.2.0 to 4.4.0 (#48084) 
Bumps [docker/login-action](https://github.com/docker/login-action) from
2.2.0 to 4.4.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/login-action/releases">docker/login-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.4.0</h2>
<ul>
<li>Skip empty <code>registry-auth</code> secret mask by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1035">docker/login-action#1035</a></li>
<li>Bump <code>@​aws-sdk/client-ecr</code> and
<code>@​aws-sdk/client-ecr-public</code> to 3.1077.0 <a
href="https://redirect.github.com/docker/login-action/pull/1034">docker/login-action#1034</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.3.0...v4.4.0">https://github.com/docker/login-action/compare/v4.3.0...v4.4.0</a></p>
<h2>v4.3.0</h2>
<ul>
<li>Preserve names in esbuild bundle by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/1022">docker/login-action#1022</a></li>
<li>Bump <code>@​aws-sdk/client-ecr</code> and
<code>@​aws-sdk/client-ecr-public</code> to 3.1076.0 <a
href="https://redirect.github.com/docker/login-action/pull/999">docker/login-action#999</a>
<a
href="https://redirect.github.com/docker/login-action/pull/1030">docker/login-action#1030</a></li>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.90.0 to 0.92.0 in
<a
href="https://redirect.github.com/docker/login-action/pull/1004">docker/login-action#1004</a>
<a
href="https://redirect.github.com/docker/login-action/pull/1027">docker/login-action#1027</a></li>
<li>Bump <code>@​sigstore/core</code> from 3.1.0 to 3.2.1 in <a
href="https://redirect.github.com/docker/login-action/pull/1023">docker/login-action#1023</a></li>
<li>Bump <code>@​sigstore/verify</code> from 3.1.0 to 3.1.1 in <a
href="https://redirect.github.com/docker/login-action/pull/1029">docker/login-action#1029</a></li>
<li>Bump http-proxy-agent and https-proxy-agent to 9.1.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1017">docker/login-action#1017</a></li>
<li>Bump js-yaml from 4.1.1 to 5.2.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1028">docker/login-action#1028</a></li>
<li>Bump sigstore from 4.1.0 to 4.1.1 in <a
href="https://redirect.github.com/docker/login-action/pull/1031">docker/login-action#1031</a></li>
<li>Bump tmp from 0.2.5 to 0.2.7 in <a
href="https://redirect.github.com/docker/login-action/pull/1002">docker/login-action#1002</a></li>
<li>Bump undici from 6.24.1 to 6.27.0 in <a
href="https://redirect.github.com/docker/login-action/pull/1020">docker/login-action#1020</a></li>
<li>Bump vite from 7.3.3 to 7.3.6 in <a
href="https://redirect.github.com/docker/login-action/pull/1019">docker/login-action#1019</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.2.0...v4.3.0">https://github.com/docker/login-action/compare/v4.2.0...v4.3.0</a></p>
<h2>v4.2.0</h2>
<ul>
<li>Bump <code>@​actions/core</code> from 3.0.0 to 3.0.1 in <a
href="https://redirect.github.com/docker/login-action/pull/976">docker/login-action#976</a></li>
<li>Bump <code>@​aws-sdk/client-ecr</code> and
<code>@​aws-sdk/client-ecr-public</code> to 3.1050.0 in <a
href="https://redirect.github.com/docker/login-action/pull/960">docker/login-action#960</a></li>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.86.0 to 0.90.0 in
<a
href="https://redirect.github.com/docker/login-action/pull/970">docker/login-action#970</a></li>
<li>Bump brace-expansion from 2.0.1 to 5.0.6 in <a
href="https://redirect.github.com/docker/login-action/pull/993">docker/login-action#993</a></li>
<li>Bump fast-xml-builder from 1.1.4 to 1.2.0 in <a
href="https://redirect.github.com/docker/login-action/pull/985">docker/login-action#985</a></li>
<li>Bump fast-xml-parser from 5.3.6 to 5.8.0 in <a
href="https://redirect.github.com/docker/login-action/pull/963">docker/login-action#963</a></li>
<li>Bump http-proxy-agent and https-proxy-agent to 9.0.0 in <a
href="https://redirect.github.com/docker/login-action/pull/961">docker/login-action#961</a></li>
<li>Bump postcss from 8.5.6 to 8.5.10 in <a
href="https://redirect.github.com/docker/login-action/pull/979">docker/login-action#979</a></li>
<li>Bump tar from 6.2.1 to 7.5.15 in <a
href="https://redirect.github.com/docker/login-action/pull/991">docker/login-action#991</a></li>
<li>Bump vite from 7.3.1 to 7.3.3 in <a
href="https://redirect.github.com/docker/login-action/pull/986">docker/login-action#986</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v4.1.0...v4.2.0">https://github.com/docker/login-action/compare/v4.1.0...v4.2.0</a></p>
<h2>v4.1.0</h2>
<ul>
<li>Fix scoped Docker Hub cleanup path when registry is omitted by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/945">docker/login-action#945</a></li>
<li>Bump <code>@​aws-sdk/client-ecr</code> and
<code>@​aws-sdk/client-ecr-public</code> to 3.1020.0 in <a
href="https://redirect.github.com/docker/login-action/pull/930">docker/login-action#930</a></li>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.77.0 to 0.86.0 in
<a
href="https://redirect.github.com/docker/login-action/pull/932">docker/login-action#932</a>
<a
href="https://redirect.github.com/docker/login-action/pull/936">docker/login-action#936</a></li>
<li>Bump brace-expansion from 1.1.12 to 1.1.13 in <a
href="https://redirect.github.com/docker/login-action/pull/952">docker/login-action#952</a></li>
<li>Bump fast-xml-parser from 5.3.4 to 5.3.6 in <a
href="https://redirect.github.com/docker/login-action/pull/942">docker/login-action#942</a></li>
<li>Bump flatted from 3.3.3 to 3.4.2 in <a
href="https://redirect.github.com/docker/login-action/pull/944">docker/login-action#944</a></li>
<li>Bump glob from 10.3.12 to 10.5.0 in <a
href="https://redirect.github.com/docker/login-action/pull/940">docker/login-action#940</a></li>
<li>Bump handlebars from 4.7.8 to 4.7.9 in <a
href="https://redirect.github.com/docker/login-action/pull/949">docker/login-action#949</a></li>
<li>Bump http-proxy-agent and https-proxy-agent to 8.0.0 in <a
href="https://redirect.github.com/docker/login-action/pull/937">docker/login-action#937</a></li>
<li>Bump lodash from 4.17.23 to 4.18.1 in <a
href="https://redirect.github.com/docker/login-action/pull/958">docker/login-action#958</a></li>
<li>Bump minimatch from 3.1.2 to 3.1.5 in <a
href="https://redirect.github.com/docker/login-action/pull/941">docker/login-action#941</a></li>
<li>Bump picomatch from 4.0.3 to 4.0.4 in <a
href="https://redirect.github.com/docker/login-action/pull/948">docker/login-action#948</a></li>
<li>Bump undici from 6.23.0 to 6.24.1 in <a
href="https://redirect.github.com/docker/login-action/pull/938">docker/login-action#938</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/login-action/commit/af1e73f918a031802d376d3c8bbc3fe56130a9b0"><code>af1e73f</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1034">#1034</a>
from docker/dependabot/npm_and_yarn/aws-sdk-dependen...</li>
<li><a
href="https://github.com/docker/login-action/commit/da722bde43bacb027adfc67d42dbaa4c0f9e550b"><code>da722bd</code></a>
[dependabot skip] chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/2916ad60bd5cb72f07aa54c69fdcc61749c09b7a"><code>2916ad6</code></a>
build(deps): bump the aws-sdk-dependencies group across 1 directory with
2 up...</li>
<li><a
href="https://github.com/docker/login-action/commit/ca0a662f786e4cfddce972005bd68f3dafc3a903"><code>ca0a662</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1035">#1035</a>
from crazy-max/fix-registry-auth-empty-mask</li>
<li><a
href="https://github.com/docker/login-action/commit/c455755a579833bf0d2e4e54e3beb413ef10cc80"><code>c455755</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/48351901f89581a7c12870c787d3f06d1f498438"><code>4835190</code></a>
skip empty registry-auth secret mask</li>
<li><a
href="https://github.com/docker/login-action/commit/992421c6e6806a7f6df609d1bfff374f9eca3004"><code>992421c</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1033">#1033</a>
from docker/dependabot/github_actions/docker/bake-ac...</li>
<li><a
href="https://github.com/docker/login-action/commit/b249b43765525dd7951068267a34cf63f22ab4f0"><code>b249b43</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/1032">#1032</a>
from docker/dependabot/github_actions/docker/bake-ac...</li>
<li><a
href="https://github.com/docker/login-action/commit/1b67977736863551a88ff218642a2d7628b10520"><code>1b67977</code></a>
build(deps): bump docker/bake-action from 7.2.0 to 7.3.0</li>
<li><a
href="https://github.com/docker/login-action/commit/9d49d6a3234c78daa10c3c12183ef7b6caa8e69e"><code>9d49d6a</code></a>
build(deps): bump docker/bake-action/subaction/matrix</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/login-action/compare/465a07811f14bebb1938fbed4728c6a1ff8901fc...af1e73f918a031802d376d3c8bbc3fe56130a9b0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=docker/login-action&package-manager=github_actions&previous-version=2.2.0&new-version=4.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Charis <26616127+charislam@users.noreply.github.com>
 2026-07-31 15:49:23 +00:00
dependabot[bot] e1ed157d9a chore(deps): bump actions/stale from 9.0.0 to 10.4.0 (#48082) 
Bumps [actions/stale](https://github.com/actions/stale) from 9.0.0 to
10.4.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/stale/releases">actions/stale's
releases</a>.</em></p>
<blockquote>
<h2>v10.4.0</h2>
<h2>What's Changed</h2>
<h3>Bug Fix</h3>
<ul>
<li>Fixed <code>only-issue-types</code> validation by <a
href="https://github.com/trueberryless"><code>@​trueberryless</code></a>
in <a
href="https://redirect.github.com/actions/stale/pull/1338">actions/stale#1338</a></li>
</ul>
<h3>Dependency Updates</h3>
<ul>
<li>Bump undici to 6.27.0 via override, clean up stale license files,
and version to 10.4.0. by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/stale/pull/1342">actions/stale#1342</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/trueberryless"><code>@​trueberryless</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/stale/pull/1338">actions/stale#1338</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/stale/compare/v10.3.0...v10.4.0">https://github.com/actions/stale/compare/v10.3.0...v10.4.0</a></p>
<h2>v10.3.0</h2>
<h2>What's Changed</h2>
<h3>Bug Fix</h3>
<ul>
<li>Enhancement: ignore stale labeling events by <a
href="https://github.com/shamoon"><code>@​shamoon</code></a> in <a
href="https://redirect.github.com/actions/stale/pull/1311">actions/stale#1311</a></li>
</ul>
<h3>Dependency Updates</h3>
<ul>
<li>Upgrade dependencies (<code>@​actions/core</code>,
<code>@​octokit/plugin-retry</code>, <a
href="https://github.com/typescript-eslint"><code>@​typescript-eslint</code></a>)
by <a href="https://github.com/Copilot"><code>@​Copilot</code></a> in <a
href="https://redirect.github.com/actions/stale/pull/1335">actions/stale#1335</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/shamoon"><code>@​shamoon</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/stale/pull/1311">actions/stale#1311</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/stale/compare/v10...v10.3.0">https://github.com/actions/stale/compare/v10...v10.3.0</a></p>
<h2>v10.2.0</h2>
<h2>What's Changed</h2>
<h3>Bug Fix</h3>
<ul>
<li>Fix checking state cache (fix <a
href="https://redirect.github.com/actions/stale/issues/1136">#1136</a>)
and switch to Octokit helper methods by <a
href="https://github.com/itchyny"><code>@​itchyny</code></a> in <a
href="https://redirect.github.com/actions/stale/pull/1152">actions/stale#1152</a></li>
</ul>
<h3>Dependency Updates</h3>
<ul>
<li>Upgrade js-yaml from 4.1.0 to 4.1.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/stale/pull/1304">actions/stale#1304</a></li>
<li>Upgrade lodash from 4.17.21 to 4.17.23 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/stale/pull/1313">actions/stale#1313</a></li>
<li>Upgrade actions/cache from 4.0.3 to 5.0.2 and actions/github from
5.1.1 to 7.0.0 by <a
href="https://github.com/chiranjib-swain"><code>@​chiranjib-swain</code></a>
in <a
href="https://redirect.github.com/actions/stale/pull/1312">actions/stale#1312</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/itchyny"><code>@​itchyny</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/stale/pull/1152">actions/stale#1152</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/stale/compare/v10...v10.2.0">https://github.com/actions/stale/compare/v10...v10.2.0</a></p>
<h2>v10.1.1</h2>
<h2>What's Changed</h2>
<h3>Bug Fix</h3>
<ul>
<li>Add Missing Input Reading for <code>only-issue-types</code> by <a
href="https://github.com/Bibo-Joshi"><code>@​Bibo-Joshi</code></a> in <a
href="https://redirect.github.com/actions/stale/pull/1298">actions/stale#1298</a></li>
</ul>
<h3>Improvement</h3>
<ul>
<li>Improves error handling when rate limiting is disabled on GHES. by
<a
href="https://github.com/chiranjib-swain"><code>@​chiranjib-swain</code></a>
in <a
href="https://redirect.github.com/actions/stale/pull/1300">actions/stale#1300</a></li>
</ul>
<h3>Dependency Upgrades</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/stale/commit/1e223db275d687790206a7acac4d1a11bd6fe629"><code>1e223db</code></a>
Bump undici to 6.27.0 via override, clean up stale license files, and
version...</li>
<li><a
href="https://github.com/actions/stale/commit/9461cb10066d1553762bac6a02599ab8c26b14dd"><code>9461cb1</code></a>
fix: <code>only-issue-types</code> does not affect PRs (<a
href="https://redirect.github.com/actions/stale/issues/1338">#1338</a>)</li>
<li><a
href="https://github.com/actions/stale/commit/eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899"><code>eb5cf3a</code></a>
chore: upgrade dependencies and bump version to 10.3.0 (<a
href="https://redirect.github.com/actions/stale/issues/1335">#1335</a>)</li>
<li><a
href="https://github.com/actions/stale/commit/db5d06a4c82d5e94513c09c406638111df61f63e"><code>db5d06a</code></a>
Enhancement: ignore stale labeling events (<a
href="https://redirect.github.com/actions/stale/issues/1311">#1311</a>)</li>
<li><a
href="https://github.com/actions/stale/commit/b5d41d4e1d5dceea10e7104786b73624c18a190f"><code>b5d41d4</code></a>
build(deps-dev): bump lodash from 4.17.21 to 4.17.23 (<a
href="https://redirect.github.com/actions/stale/issues/1313">#1313</a>)</li>
<li><a
href="https://github.com/actions/stale/commit/dcd2b9469d2220b7e8d08aedc00c105d277fd46b"><code>dcd2b94</code></a>
Fix punycode and url.parse Deprecation Warnings (<a
href="https://redirect.github.com/actions/stale/issues/1312">#1312</a>)</li>
<li><a
href="https://github.com/actions/stale/commit/d6f8a33132340b15a7006f552936e4b9b39c00ec"><code>d6f8a33</code></a>
build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 (<a
href="https://redirect.github.com/actions/stale/issues/1304">#1304</a>)</li>
<li><a
href="https://github.com/actions/stale/commit/a21a0816299b11691f9592ef0d63d08e02f06d9d"><code>a21a081</code></a>
Fix checking state cache (fix <a
href="https://redirect.github.com/actions/stale/issues/1136">#1136</a>),
also switch to octokit methods (<a
href="https://redirect.github.com/actions/stale/issues/1152">#1152</a>)</li>
<li><a
href="https://github.com/actions/stale/commit/997185467fa4f803885201cee163a9f38240193d"><code>9971854</code></a>
build(deps): bump actions/checkout from 4 to 6 (<a
href="https://redirect.github.com/actions/stale/issues/1306">#1306</a>)</li>
<li><a
href="https://github.com/actions/stale/commit/5611b9defa6b7799a950489b00163db69f7a3ece"><code>5611b9d</code></a>
build(deps): bump actions/publish-action from 0.3.0 to 0.4.0 (<a
href="https://redirect.github.com/actions/stale/issues/1291">#1291</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/stale/compare/28ca1036281a5e5922ead5184a1bbf96e5fc984e...1e223db275d687790206a7acac4d1a11bd6fe629">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/stale&package-manager=github_actions&previous-version=9.0.0&new-version=10.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-31 11:47:36 -04:00
dependabot[bot] 8565fd6b2a chore(deps): bump actions/labeler from 6.0.1 to 6.2.0 (#48083) 
Bumps [actions/labeler](https://github.com/actions/labeler) from 6.0.1
to 6.2.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/labeler/releases">actions/labeler's
releases</a>.</em></p>
<blockquote>
<h2>v6.2.0</h2>
<h2>What's Changed</h2>
<h3>Bug Fix</h3>
<ul>
<li>Improve PR number validation and warning messages in input handling
by <a
href="https://github.com/chiranjib-swain"><code>@​chiranjib-swain</code></a>
in <a
href="https://redirect.github.com/actions/labeler/pull/939">actions/labeler#939</a></li>
</ul>
<h3>Dependency Updates</h3>
<ul>
<li>Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override
by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>
in <a
href="https://redirect.github.com/actions/labeler/pull/943">actions/labeler#943</a></li>
<li>Bump <code>@​typescript-eslint/eslint-plugin</code> from 8.59.1 to
8.61.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/labeler/pull/942">actions/labeler#942</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/labeler/compare/v6.1.0...v6.2.0">https://github.com/actions/labeler/compare/v6.1.0...v6.2.0</a></p>
<h2>v6.1.0</h2>
<h2>Enhancements</h2>
<ul>
<li>Add changed-files-labels-limit and max-files-changed configuration
options to cap the number of labels added by <a
href="https://github.com/bluca"><code>@​bluca</code></a> in <a
href="https://redirect.github.com/actions/labeler/pull/923">actions/labeler#923</a></li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li>Improve Labeler Action documentation and permission error handling
by <a
href="https://github.com/chiranjib-swain"><code>@​chiranjib-swain</code></a>
in <a
href="https://redirect.github.com/actions/labeler/pull/897">actions/labeler#897</a></li>
<li>Preserve manually added labels during workflow runs and refine label
synchronization logic by <a
href="https://github.com/chiranjib-swain"><code>@​chiranjib-swain</code></a>
in <a
href="https://redirect.github.com/actions/labeler/pull/917">actions/labeler#917</a></li>
</ul>
<h2>Dependency Updates</h2>
<ul>
<li>Upgrade brace-expansion from 1.1.11 to 1.1.12 and document breaking
changes in v6 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/labeler/pull/877">actions/labeler#877</a></li>
<li>Upgrade minimatch from 10.0.1 to 10.2.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/labeler/pull/926">actions/labeler#926</a></li>
<li>Upgrade dependencies (<code>@​actions/core</code>,
<code>@​actions/github</code>, js-yaml, minimatch, <a
href="https://github.com/typescript-eslint"><code>@​typescript-eslint</code></a>)
by <a href="https://github.com/Copilot"><code>@​Copilot</code></a> in <a
href="https://redirect.github.com/actions/labeler/pull/934">actions/labeler#934</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/chiranjib-swain"><code>@​chiranjib-swain</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/labeler/pull/897">actions/labeler#897</a></li>
<li><a href="https://github.com/bluca"><code>@​bluca</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/labeler/pull/923">actions/labeler#923</a></li>
<li><a href="https://github.com/Copilot"><code>@​Copilot</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/labeler/pull/934">actions/labeler#934</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/labeler/compare/v6...v6.1.0">https://github.com/actions/labeler/compare/v6...v6.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/labeler/commit/b8dd2d9be0f68b860e7dae5dae7d772984eacd6d"><code>b8dd2d9</code></a>
Bump <code>@​typescript-eslint/eslint-plugin</code> from 8.59.1 to
8.61.1 (<a
href="https://redirect.github.com/actions/labeler/issues/942">#942</a>)</li>
<li><a
href="https://github.com/actions/labeler/commit/53affe8ca4150876fc7eb7d268d3a1f74511a244"><code>53affe8</code></a>
Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override for
0 vul...</li>
<li><a
href="https://github.com/actions/labeler/commit/f612d9ad188e81643862c2de70f57fbb1d17abd1"><code>f612d9a</code></a>
Fix: Improve PR number validation and warning messages in input handling
(<a
href="https://redirect.github.com/actions/labeler/issues/939">#939</a>)</li>
<li><a
href="https://github.com/actions/labeler/commit/f27b608878404679385c85cfa523b85ccb86e213"><code>f27b608</code></a>
chore: upgrade dependencies (<code>@​actions/core</code>,
<code>@​actions/github</code>, js-yaml, minimat...</li>
<li><a
href="https://github.com/actions/labeler/commit/c5dadc2a45784a4b6adfcd20fea3465da3a5f904"><code>c5dadc2</code></a>
Add 'changed-files-labels-limit' and 'max-files-changed' configs to
allow cap...</li>
<li><a
href="https://github.com/actions/labeler/commit/e52e4fb63ed5cd0e07abaad9826b2a893ccb921f"><code>e52e4fb</code></a>
Bump minimatch from 10.0.1 to 10.2.3 (<a
href="https://redirect.github.com/actions/labeler/issues/926">#926</a>)</li>
<li><a
href="https://github.com/actions/labeler/commit/77a4082b841706ac431479b7e2bb11216ffef250"><code>77a4082</code></a>
Fix: Preserve manually added labels during workflow run and refine label
sync...</li>
<li><a
href="https://github.com/actions/labeler/commit/25abb3cad4f14b7ac27968a495c37798860a5a1a"><code>25abb3c</code></a>
Improve Labeler Action Documentation and Error Handling for Permissions
(<a
href="https://redirect.github.com/actions/labeler/issues/897">#897</a>)</li>
<li><a
href="https://github.com/actions/labeler/commit/395c8cfdb1e1e691cc4bad0dd315820af8eb67fd"><code>395c8cf</code></a>
Bump brace-expansion from 1.1.11 to 1.1.12 and document breaking changes
in v...</li>
<li>See full diff in <a
href="https://github.com/actions/labeler/compare/634933edcd8ababfe52f92936142cc22ac488b1b...b8dd2d9be0f68b860e7dae5dae7d772984eacd6d">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/labeler&package-manager=github_actions&previous-version=6.0.1&new-version=6.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-31 11:40:18 -04:00
kemal.earth bc95a2f19a fix(studio): edge func exec time formatting in reports (#48539) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Fixes Edge Function Execution Time chart within our observability
reports time formatting. This also fixes the non-hovered state which
would lose the `ms` formatting.

| Before | After |
|--------|--------|
| <img width="2160" height="652" alt="cleanshot_2026-07-29_at_02 15
53_2x"
src="https://github.com/user-attachments/assets/cfd6dbc2-f283-4379-a133-581c76990cb5"
/> | <img width="797" height="314" alt="Screenshot 2026-07-31 at 14 30
48"
src="https://github.com/user-attachments/assets/f5f1ace5-b6ef-43db-aebd-e10d31631013"
/> |



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Improved execution-time chart formatting with clearer millisecond
values, thousands separators, and configurable precision.
* Chart highlights now support custom value formatting alongside
existing number, percentage, and byte formats.

* **Bug Fixes**
  * Non-finite execution-time values now display safely as `0ms`.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-31 16:20:37 +01:00
Ali Waseem 9b51678fcf Revert "feat: update mgmt api docs (#48282)" (#48545) 
## What kind of change does this PR introduce?

Revert

## What is the current behavior?

#48282 auto-updated the mgmt API docs spec files
(`apps/docs/spec/api_v1_openapi.json`,
`apps/docs/spec/api_v2_openapi.json`,
`apps/docs/spec/common-api-sections.json`, and the deparsed transform
files).

## What is the new behavior?

Reverts those spec/transform files back to their state prior to #48282.

This reverts commit 4adef69037.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Updated API reference documentation with clearer authorization
requirements and more accurate request and response schemas.
* Improved validation details, examples, required fields, and response
variations across projects, authentication, storage, backups, SSO,
analytics, and functions.
* Documented separate paginated listing and count operations for action
runs.
* Added clearer JIT response definitions and refined API behavior
descriptions.
* Removed documentation entries for several retired analytics,
organization, invitation, and private-link operations.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-31 09:19:18 -06:00
Francesco SansalvadoreandClaude 00d12c305c Include Migration steps in changelog bodySection (#48496) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Feature / refactor

## What is the current behavior?

The changelog entry parser extracts `## Migration steps` as a separate
field (`migrationSteps`), and the `bodySection` stops before it. This
requires consumers to handle migration steps separately from the main
body content.

## What is the new behavior?

The `bodySection` now includes `## Migration steps` as part of the
rendered body content. The `migrationSteps` field has been removed from
the `ChangelogEntry` type. The `bodySection` extraction now stops at
internal-only planning sections (`## Rollout timeline`, `## Comms
timeline`) instead of at migration steps, allowing migration steps to be
included in the public-facing body.

## Additional context

- Updated `parseChangelogEntryFile` to extract `bodySection` through
migration steps, excluding only internal planning tables
- Updated the `ChangelogEntry` type documentation to clarify that
`bodySection` includes migration steps
- Added a test case verifying that migration steps are included in the
rendered body while internal sections are excluded
- This simplifies the API by consolidating public body content into a
single field

https://claude.ai/code/session_01X5ikaawVPZwMT5C2dWUyJY

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Improvements**
* Changelog entries now include all public content following the Body
section, including relevant subsections and rollout information.
* Migration guidance is included directly within the main changelog body
for a clearer reading experience.
* Internal notes, communications, and planning details remain excluded
from displayed changelog content.
* Unmatched internal markers now correctly hide all subsequent content
from public changelogs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude <noreply@anthropic.com>
 2026-07-31 16:33:48 +02:00
supabase-supabase-autofixer[bot]andphamhieu 4adef69037 feat: update mgmt api docs (#48282) 
This PR updates mgmt api docs automatically.

Co-authored-by: phamhieu <689843+phamhieu@users.noreply.github.com>
 2026-07-31 07:49:45 -06:00
Charis 50e1eb7436 chore(eslint): bump eslint-config-next to v16 for useEffectEvent (#48458) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Chore / build (ESLint config upgrade + lint cleanup).

## What is the current behavior?

`eslint-plugin-react-hooks` v5 (pulled in transitively by
`eslint-config-next` v15) doesn't recognize stable `useEffectEvent`, so
every effect that calls an effect-event handler needs an `eslint-disable
react-hooks/exhaustive-deps` to silence a false positive. There are 30
such dead disables across Studio.

## What is the new behavior?

Bumps `eslint-config-next` to v16, which pulls in
`eslint-plugin-react-hooks` v7 whose `exhaustive-deps` understands
`useEffectEvent`, and removes the 30 now-dead disable directives (and
their orphaned explanatory comments).

Supporting changes:

- **Flat-config migration**: v16 is a native flat-config array (v15 was
eslintrc), so `eslint-config-supabase` now spreads it directly instead
of bridging through `FlatCompat`.
- **React Compiler rules off**: v16 enables react-hooks v7's
`recommended`, which layers the React Compiler lint rules on top of the
two classic rules. These are switched off (derived dynamically from what
next enables) to keep this change scoped to the `exhaustive-deps`
improvement.
- **Plugin-registration fallout** (v16 scopes plugin registration to a
file glob rather than registering globally like FlatCompat did): stop
re-registering `@typescript-eslint` (shared) and `jsx-a11y` (studio);
scope our react / react-hooks / jsx-a11y rule overrides (studio, www) to
v16's plugin glob so they don't error on files outside it (e.g. `.cjs`).
- **Lint surface preserved**: v16's glob newly includes `.mts`/`.cts`
(v15 didn't lint them), which surfaced pre-existing errors in tooling
scripts. The shared config keeps the prior surface by leaving
`.mts`/`.cts` unlinted; linting them is left as a separate change.
- **Ratchet**: rebaselines `@tanstack/query/exhaustive-deps` 9 → 89. v15
forced next's `@babel/eslint-parser` onto `.ts` files, hiding these
deps; v16 parses `.ts` with `@typescript-eslint/parser` and correctly
surfaces the intentional `connectionString`-excluded-from-`queryKey`
pattern. Worth a follow-up to review whether any are real
cache-correctness bugs.
- Drops three now-dead devDeps from `eslint-config-supabase`:
`@eslint/eslintrc`, `@eslint/js`, `@typescript-eslint/eslint-plugin`.

Verified locally: `turbo run lint` → 7/7 packages pass with 0 errors;
Studio `lint:ratchet` passes; Prettier clean on changed files; typecheck
unaffected.

## Additional context

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Refined linting configuration and removed outdated lint suppressions
across Studio.
* Updated Next.js linting support and refreshed related development
configuration.
  * Expanded lint baseline coverage for query-related code.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-31 09:01:05 -04:00
Jonathan Summers-Muir 009528c6ca chore: update Lovable homepage logo (#48536) 
## Summary

- replace the outdated Lovable homepage logo
 2026-07-31 11:58:34 +00:00
Illia Basalaievgithub-actions[bot]Claude Opus 5Jeremias Menichelli
 		27f18f0359 Spring Boot Quickstart (#48396) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

docs update

## What is the new behavior?

Spring Boot quickstart guide

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **New Features**
- Added a “Use Supabase with Spring Boot” quickstart guide, including
project setup, Session pooler/JPA configuration, sample
entity/repository, seed data, and a `GET /instruments` endpoint.
- Added “Spring Boot” to the Getting Started “Framework Quickstarts”
navigation, shown only when not in JS-only mode.
- Added a Spring Boot AI prompt with step-by-step integration
instructions.
- **Documentation**
- Updated MDX linting rules to allow “Spring Boot” and “Spring Data JPA”
headings, and to permit “Initializr” spelling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Jeremias Menichelli <jmenichelli@gmail.com>
 2026-07-31 13:49:44 +02:00
Andrey A. be136df69e feat(self-hosted): use latest tag in setup.sh plus additional checks (#47848) 2026-07-31 13:43:35 +02:00
Eduardo Gurgel c613a9b92e chore: update realtime error codes & add troubleshotting page (#48381) 
* Update realtime error codes
* Add new troubleshooting page for client presence rate error
* Fix references from error codes to work with relative paths
 2026-07-31 22:09:03 +12:00
Joshen Lim fd67a8014f Joshen/fe 4018 bug gh branch validation in branch modal fails silently if (#48432) 
## Context

Realised that if the project has a GH integration, but the user's
account is not connected to GH - the branch validation in the "Sync with
Git Branch" field will not work. The Edit branch modal also obfuscates
the error being returned from the validation API so its not clear what
the issue is
<img width="500" alt="image"
src="https://github.com/user-attachments/assets/739dfe7c-8920-4edf-a751-63d7f6273db4"
/>

Opting to show an "Authorize" CTA for this scenario so it's clear from
the user's POV what to do (Refer to "To test" below for screenshots)


## To test

- [ ] Verify that on an account which isn't connect to GH + project with
no GH integration - CTA is as per normal ("Configure") which should
direct you to the settings -> integrations page (Same for edit branch)
<img width="500" alt="image"
src="https://github.com/user-attachments/assets/9a010fde-8ab0-43d6-b5c9-ced9fed1426e"
/>
<img width="500" alt="image"
src="https://github.com/user-attachments/assets/d129cccf-7238-4305-913b-0cf78c7dcc26"
/>

- [ ] Set up a GH integration and check Create / Edit branch - the
branch input field should work with proper branch name validation
<img width="500" alt="image"
src="https://github.com/user-attachments/assets/4d643956-2d11-406b-b198-193f3221b7a9"
/>

- [ ] Now go to Account settings and remove the GH connection, then
check the Create / Edit branch modals - should have the "Authorize" CTA
(instead of the input field)
<img width="500" alt="image"
src="https://github.com/user-attachments/assets/ac152c0d-2e9c-4d89-95bc-36127c0fc8df"
/>
<img width="500" alt="image"
src="https://github.com/user-attachments/assets/d1f50d38-d801-4546-96fd-8cf3b5d0f805"
/>




<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a “Sync with a GitHub branch” connection entry with an inline
authorize flow.
* Integrated GitHub authorization awareness into branch create/edit
modals so users are guided to authorize or proceed to syncing.
* **Bug Fixes**
* Unified loading, success, and error handling for GitHub
authorization/connection checks across create and edit flows.
  * Improved Git branch validation messaging to show cleaner error text.
* **Accessibility/UX**
* Updated modal UI text and added an explicit label for the “Include
data” toggle.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-31 16:52:12 +07:00
Guillaume Faas 97a935fb4f docs(csharp): update C# reference docs to SDK 1.5 (#48523) 
## What

Brings the C# client reference in line with `supabase-csharp` 1.5. The
reference spec had drifted ~2 years and was missing most of the Auth,
MFA, Admin, and Storage surface.

## Changes

- **Fix example errors** in the v1 reference spec — corrected the
`From<T>()`/`Table<T>()` model example, `ListenType` realtime enum, a
mislabeled code fence, and other small mismatches.
- **Backfill release notes** from 1.0.1 through 1.5.0, reconstructed by
diffing the `Supabase.csproj` dependency pins across git tags and
pulling highlights from each sub-package changelog.
- **Document the undocumented API surface** (~27 new entries): Auth
(anonymous, ID token, SSO, refresh, link/unlink identity, code exchange,
reauthenticate, scoped sign-out), the full MFA API, the Admin API via
`AdminAuth`, and Storage (`Copy`, signed URLs, signed uploads).
- **Fix a latent bug**: the `ResetPasswordForEmail()` entry used a spec
id that matched no canonical section, so it never rendered. Renamed to
`reset-password-for-email`.

## Notes

- All signatures verified against the 1.5 SDK source.
- Entries render only when their spec id matches a slot in the shared
`common-client-libs-sections.json`; ids were mapped against that set.
- Spec YAML is Prettier-clean under the repo config.

Closes SDK-1369.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
  * Added C# release notes covering versions 1.0.1–1.5.0.
* Updated C# client documentation with current initialization patterns
and expanded authentication, session, identity, PKCE, MFA, Realtime,
Storage, and admin operation examples.
* Added Storage examples for file copying, signed URLs, signed uploads,
and uploads through signed URLs.
* Corrected code samples and clarified scoped sign-out and
password-reset guidance.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-31 11:35:56 +02:00
Jeremias Menichelli a76f1f0c9b feat: Move search functionality to Vercel function (#48443) 2026-07-31 11:25:21 +02:00
Andrey A. 6a99952af5 docs(self-hosted): update nav and minor corrections (#48499) 2026-07-31 10:50:46 +02:00
Steven EubankClaude Sonnet 4.6coderabbitai[bot]Nik Richers
 		ca94d842a7 design demo: security page content additions (content-only) (#48403) 
## Summary

- Adds four missing content cards to the existing `security.mdx` using
the same `Section` component and grid already on the page — no new UI
components or features
- Cards added: **GDPR & European Compliance**, **Data Residency**,
**Data Processing Agreement**, **Shared Responsibility**
- Also fixes the HIPAA shared responsibility link path (`/deployment/`
not `/platform/`)

Worth validating still.

## What this is

A content-only drop-in that addresses some gaps

## What's out of scope here

- No sticky nav, tables, plan comparison grids, or new components
- No DPA request automation — just a plain link to `/legal/dpa`
- No plan-gating claims (removed — accuracy unconfirmed)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Reorganized the security page into clearer, grouped sections
(Compliance, Data, Configuration, and Misc) for easier navigation.
* Expanded compliance coverage with HIPAA, ISO 27001, GDPR & European
compliance, and updated shared responsibility details.
* Added new content for data residency and a Data Processing Agreement
section.
* Reordered configuration items (multi-factor authentication, role-based
access, vulnerability management, DDoS) and moved payment processing
into the Misc section.
  * Updated icons and card layout visuals throughout the page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: Nik Richers <nrichers@gmail.com>
 2026-07-31 08:36:03 +00:00
Pamela Chia c4c58ef3e3 feat: remove pandadoc dpa request flow (#48525) 
Terms of Service v3 (effective August 1, 2026, #48482) incorporates the
Data Processing Addendum by reference, so customers no longer sign a
separate DPA. Legal confirmed the PandaDoc signing flow can go;
previously signed DPAs remain binding. This removes the frontend flow
only. I'll remove the platform endpoint (`POST
/platform/organizations/{slug}/documents/dpa`) separately once the
PandaDoc contract conversation wraps.

**Changed:**

- **Dashboard DPA card no longer requests PandaDoc documents**: the
Request DPA button and confirm modal are replaced with a View DPA link
to the canonical legal page, with evergreen copy explaining the DPA is
part of the Terms. Tracked via the same `document_view_button_clicked`
event the other document cards use.
- **Legacy `/legal/dpa` page retired**: the page told users to request a
signed DPA from the dashboard, which no longer exists. It now
permanently redirects to
`/legal/customer-resources/data-processing-addendum` (the follow-up
already flagged in #48483), and the footer link is removed. The
`dpa_pdf_opened` and `dpa_request_button_clicked` events are removed
with their last call sites. The latest privacy version links the
canonical page directly; archived v1/v2 keep their original `/legal/dpa`
link, served by the redirect.
- **Orphaned DPA PDFs removed**: the four dated `Supabase+DPA+*.pdf`
files under `/downloads/docs` had zero remaining references once the
signing flow is gone. No redirect: nothing links these URLs, so they
404.
- **Subscription tracking**: the subprocessor updates form now fires
`www_subprocessor_updates_subscribed` on successful submit, so we can
measure uptake of the notification list that replaces per-customer DPA
emails.

## To test

Verified on the Vercel previews (Playwright):

- [x] Studio: `/org/_/documents` shows the DPA card with the
incorporation copy and a working View DPA link (href = canonical page);
no Request DPA button, no PandaDoc mention; TIA/SOC2/ISO27001/HIPAA
cards unaffected
- [x] www: `/legal/dpa` permanently redirects to
`/legal/customer-resources/data-processing-addendum`; footer no longer
shows DPA; zero console errors
- [x] www: subscribing on the subprocessor page succeeds (200 from the
form route, profile created with topic_4) and fires
`www_subprocessor_updates_subscribed` (201 from the telemetry endpoint);
test profile unsubscribed afterwards
- [x] www: `/downloads/docs/Supabase+DPA+260601.pdf` returns 404 with no
redirect; DPA card copy verified without the effective date

## Linear

- fixes GROWTH-1068
 2026-07-31 16:18:25 +08:00
Pamela Chia 4ae0c08967 feat: tos v3 update banner + publish subprocessor list (#48524) 
Terms of Service v3 (effective August 1, 2026, #48482) incorporates the
Data Processing Addendum by reference, and Legal asked for an in-app
notice announcing the change. The subprocessor list page that the new
Terms, DPA, and notice all point at was merged as an intentionally
hidden draft (#48100) and never un-hidden.

**Changed:**

- **Dashboard ToS-update banner**: re-enables `BannerTOSUpdate` with the
v3 copy provided by Legal (DPA incorporation, subprocessor list
location, fees provisions). New expiry (August 29) and a new
localStorage key, since anyone who dismissed the May v2 banner would
otherwise never see this one.
- **Subprocessor list page published**: removes `noindex,nofollow` and
links the page from the Legal Hub index, so the page customers are told
to subscribe on is actually discoverable.
- **Studio e2e fixture updated**: the global Playwright fixture
suppressed the banner via the old localStorage key; with the gate live
again it would have rendered the banner into every e2e run. It now sets
the new key.

## To test

Verified on the Vercel previews :

- [x] Studio: banner renders on dashboard load with the Notice badge and
new copy; Learn more dialog shows the three changes with correct hrefs
(DPA page, subprocessor list, /terms); Understood dismisses and persists
across reload via `terms-of-service-update-2026-08-01`
- [x] www: `/legal` lists Subprocessor List under Customer Legal
Resources; `/legal/customer-resources/subprocessor-list` serves `robots`
meta `index,follow` and renders the download button + subscribe form;
zero console errors on all tested pages

## Linear

- fixes GROWTH-1067


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added a publicly accessible Subprocessor List to the legal resources.
* Updated the Terms of Service notice to reflect the August 1, 2026
update, including data processing, subprocessors, fraud prevention, and
consumer provisions.

* **Documentation**
* Made the Subprocessor List discoverable through standard search
indexing and the legal resources page.
* Extended the Terms of Service banner availability through August 29,
2026.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-31 15:49:08 +08:00
fadymak e6b8725571 feat(account): require a user to name their TOTP authenticator (#48493) 
Currently it's an autogenerated name. We want users to explicitly enter
a name for their authenticator so that:

- They can remember that they took the action of registering an
authenticator
- They can see a meaningful name during sign-in if they have multiple
TOTP authenticators

<img width="536" height="269" alt="Screenshot 2026-07-30 at 16 05 10"
src="https://github.com/user-attachments/assets/e43de27f-b4ca-4d4f-969a-578267eeebe4"
/>

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **Bug Fixes**
* Improved TOTP enrollment: confirmation is no longer enabled unless an
authenticator app name is provided (validated beyond whitespace).

* **UI Improvements**
* Updated the authenticator app name label/description, added an example
placeholder, and auto-focused the field when the confirmation step
appears.
* Refined the on-screen guidance for suggested authenticator apps (e.g.,
Google Authenticator or 1Password).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-31 09:16:41 +02:00
Joshen Lim 0e92a9574c Joshen/fe 3932 support branching conversations (#48519) 
## Context

Adds support for branching off from an Assistant's Response - which
creates a new chat with all the previous messages including from where
we're branching off from
<img width="204" height="97" alt="image"
src="https://github.com/user-attachments/assets/0b171ae6-f2b4-4b58-87fa-0010ad45f777"
/>

Branched conversations will have an indication of where it was branched
off from
<img width="404" height="427" alt="image"
src="https://github.com/user-attachments/assets/bed8502f-3f83-4f76-bc00-feac86fa57a6"
/>


## Other changes
- Also added support for copying an Assistant's Response
<img width="190" height="115" alt="image"
src="https://github.com/user-attachments/assets/5e4aa0b8-eb6e-485f-80c0-3028b95720f7"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Branch conversations from assistant messages into a new chat.
  * View the originating conversation and navigate back to it.
  * Copy assistant message content with visual confirmation.
  * Access branching and copying actions from message controls.
* **UI Updates**
  * Added “Branched from” indicators for branched conversations.
  * Updated the assistant disclaimer text to “The Assistant.”
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-31 13:38:02 +07:00
Alaister YoungandAlaister Young fc5e03f9e3 [FE-4019] fix(studio): direct-only connection strings with SSL params for Multigres (#48433) 
Multigres (high-availability) projects only accept TLS connections with
direct SSL negotiation, and they don't support connection pooling at all
— neither Supavisor nor the dedicated PgBouncer pooler exists for them.
Studio previously showed pooler connection strings that would fail with
"server closed the connection unexpectedly". This PR makes every
connection-string surface direct-only for HA projects and appends
`?sslmode=require&sslnegotiation=direct` to the examples. Non-HA
projects are unchanged.

Addresses
[FE-4019](https://linear.app/supabase/issue/FE-4019/append-ssl-params-to-multigres-connection-string-examples-in-ui)

**Changed:**

- `buildConnectionStringPooler` gets an HA branch that collapses every
slot in the bag to the direct connection string with the SSL params
appended (mirroring the existing CLI branch, which also has no pooler) —
dedicated slots come back `undefined` and
`ipv4SupportedForDedicatedPooler` is forced off. Since HA never reaches
the pooler layout anymore, the earlier per-URI SSL-append logic on
pooler strings is removed
- `useConnectState` coerces `connectionMethod` to `direct` and
`useSharedPooler` to `false` for HA projects. The Connect sheet restores
the last-used method from localStorage shared across projects, so a
"Transaction pooler" selection made on a regular project could otherwise
leak pooler-flavored notices, badges, and telemetry into an HA project
- Prisma and Drizzle ORM tabs get an HA branch:
`DATABASE_URL`/`DIRECT_URL` both use the direct connection, no
`?pgbouncer=true` appended, with a comment explaining Multigres doesn't
support pooling. The 5-arm nested ternaries in both files are flattened
into `getEnvCode` helpers that switch on a shared
`resolveOrmConnectionScenario` helper (`OrmConnection.utils.ts`), so the
deployment-mode/HA branching lives in one tested place and each file
keeps only its own formatting
- The PgBouncer and Supavisor config queries are disabled (`enabled:
!isHighAvailability`) in the Connect sheet — those endpoints serve
pooler config that doesn't exist on Multigres
- `parseConnectionParams` keeps the URI's query string in a new `search`
field so formats rebuilt from parsed parts can carry it
- psql switches from the `-h/-p/-d/-U` flag form to the quoted-URI form
when query params are present (flags can't express them; psql still
prompts for the password)
- JDBC appends the params using pgJDBC's casing (`sslNegotiation`,
supported since 42.7.4)
- Prisma's `?pgbouncer=true` appends are query-aware (join with `&` when
the URI already has a query string) via a new
`appendConnectionStringParams` helper
- The project home "Direct connection string" copy item also appends the
params for HA projects

**Added:**

- Unit tests for the HA collapse behavior (all slots direct, dedicated
config and IPv4 add-on ignored, no SSL params on non-HA output), the
`useConnectState` coercion, the psql/JDBC builders (moved from
`content.tsx` into `ConnectionString.utils.ts` so they're testable), and
`resolveOrmConnectionScenario` (every deployment-mode/HA/pooler branch)

**Known gaps (left out deliberately):**

- The grid ExportDialog psql/pg_dump commands, the .NET
`appsettings.json` (Npgsql only supports direct negotiation from v9 via
`SSL Negotiation=Direct`), and the SQLAlchemy keyword-style `.env` are
flag/keyword forms that can't carry the URI params — these would still
fail against Multigres and need a follow-up
- Settings > Database's Connection Pooling section and the pooler logs
page have no HA gating yet — they'd still render pooler config UI for a
Multigres project and should be hidden in a follow-up

## To test

On a **Multigres (HA) project** (staging only supports `us-east-1` for
Multigres):

- Open the Connect sheet → Direct tab: there's no connection-method
picker, and the connection string is the direct one ending with
`?sslmode=require&sslnegotiation=direct` for the URI, PHP, and psql
(quoted-URI form) types; JDBC includes
`&sslmode=require&sslNegotiation=direct`
- ORM tab → Prisma: both `DATABASE_URL` and `DIRECT_URL` are the direct
connection string with the SSL params, no `pgbouncer=true`, with a
"Multigres does not support connection pooling" comment. Drizzle
likewise shows the direct string only
- Framework tabs (e.g. Next.js): every `DATABASE_URL` carries the direct
string with the params exactly once
- Open the network tab: no requests to `/config/pgbouncer` or
`/config/supavisor` while using the Connect sheet
- To check the localStorage coercion: on a **regular** project pick
"Transaction pooler" in the Connect sheet, then open the sheet on the
Multigres project — no pooler badge/notices, string is still direct
- Copy the URI, substitute your password, and `psql "<string>"` — it
should connect
- Project home → Copy dropdown → "Direct connection string" includes the
params

On a **regular (non-Multigres) project** — confirm nothing changed:

- Connect sheet: direct/session/transaction strings for all connection
types (URI, psql flag form, JDBC, PHP) look the same as before, no SSL
params appended
- Prisma/Drizzle tabs render identically (`?pgbouncer=true` still
appended with `?`, dedicated-pooler alternatives still shown per IPv4
add-on state)
- Project home copy dropdown is unchanged


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Enhanced connection-string generation for high-availability projects,
including required SSL settings for direct connections.
* Preserved URI query parameters in PostgreSQL, `psql`, JDBC, and
generated environment configurations.
* Improved ORM environment templates with clearer handling for pooler
and high-availability connection scenarios.

* **Bug Fixes**
* High-availability projects now consistently use direct connections
instead of pooler options.
* Connection strings and generated templates update correctly when
availability settings change.

* **Tests**
* Expanded coverage for query parameters, high-availability behavior,
and connection scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
 2026-07-31 14:34:31 +08:00
Joshen Lim 78957bcd68 Replace disable pipelines cta with enable pipelines if pipelines not enabled yet (#48518) 
## Context

Addresses 2 issues found for the Replication UI

- "Disable Pipelines" CTA was still being shown despite Pipelines not
being enabled yet
- Opting to show the "Enable Pipelines" CTA instead in this case, which
will open the `EnablePipelinesModal`
<img width="269" height="162" alt="image"
src="https://github.com/user-attachments/assets/41e5ec7d-11b1-4008-ae9d-64def00329eb"
/>
- Fixes "Disable Pipelines" being incorrectly disabled


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added options to enable or disable Pipelines directly from the
replication destinations menu.
* Added an enablement modal with messaging and upgrade actions based on
available access.
* Added support for opening the Pipelines modal through external
controls.

* **Bug Fixes**
  * Corrected action disabled states and destination-removal guidance.
* Improved error handling when disabling Pipelines, including a reliable
fallback message.
* Refined modal and dialog layout spacing for a more consistent
presentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-31 11:43:02 +07:00
Danny White 4381e1290c fix(studio): replace form-group green focus shadows with focus-ring (#48221) 
## What kind of change does this PR introduce?

Bug fix / a11y cleanup
([DEPR-629](https://linear.app/supabase/issue/DEPR-629)).

## What is the current behavior?

`apps/studio/styles/globals.css` still styles `.form-group` /
`.form-control` inputs with a legacy soft green focus glow (`box-shadow:
… rgba(62, 207, 142, …)` plus `ring-current`). That can fight modern
focus rings if those classes are ever present.

## What is the new behavior?

Those legacy focus rules are removed. Matching inputs use `@apply
focus-ring` instead.

| Before | After |
| --- | --- |
| <img width="882" height="246" alt="CleanShot 2026-07-31 at 13 28
42@2x"
src="https://github.com/user-attachments/assets/3aa00e2f-918f-4e72-9db0-4ad75864cc58"
/> | <img width="864" height="244" alt="CleanShot 2026-07-31 at 13 28
57@2x"
src="https://github.com/user-attachments/assets/4a96439d-16de-4ebb-ab07-2ae7cbf46c0b"
/> |

## To test

These CSS selectors are legacy. Easiest before/after is a one-line probe
in the browser.

1. Open the **Studio preview** for this PR (and, for comparison,
production Studio or `master`).
2. Go to any project (any page is fine).
3. Open DevTools → Console and paste:

```js
document.body.insertAdjacentHTML(
  'beforeend',
  `<div class="form-group" style="position:fixed;right:16px;bottom:16px;z-index:9999;padding:12px;background:var(--background);border:1px solid var(--border);border-radius:8px">
    <label style="display:block;margin-bottom:8px">Legacy form-group probe</label>
    <input type="text" value="Tab to me" />
  </div>`
)
```

4. Click the injected input (or Tab to it).

| | Focus look |
| --- | --- |
| **Before** (production / `master`) | Soft **green** halo |
| **After** (this PR) | Shared **`focus-ring`** only (no green glow, no
double stack) |

Optional smoke (no visual change expected): **Project Settings → General
→ Project name** — Tab into the field; normal shared focus ring still
works.

## Additional context

- Related: #41575, DEPR-628
 2026-07-31 14:29:13 +10:00
Danny White d1e7c403ac fix(ui): align Admonition titles and docs link hover with prose (#48428) 
## What kind of change does this PR introduce?

UI bug fix.

## What is the current behavior?

After the recent Admonition a11y refactor:

- Titled Admonitions in MDX (blog and docs) could pick up large prose
top margin on the title, or (after follow-ups) end up with a title much
smaller than the body because the title was a `div` at `text-sm` while
body `<p>`s took prose ~15px
- Docs MDX links (including inside Admonitions) had a weak hover: prose
only shifted underline colour

Prior issues:

- A couple of guide callouts bolded link text via `[**…**](…)`
- Some funky Admonition formatting as called out in comments below

## What is the new behavior?

- `AlertTitle` is a `<p>` with `!mt-0 mb-0.5 font-medium` (not an `h5` /
bare `div`), so it does not break heading hierarchy and matches
admonition body font-size under prose
- Admonition uses `AlertTitle` again (though with `<p>` as explained
above) and wraps MDX `children` in `AlertDescription` (same as
`description`)
- `Alert` / `AlertTitle` / `AlertDescription` get `data-slot`
attributes; description keeps string→`<p>` wrapping, Studio density,
plus `text-balance`
- Docs link hover: typography `a:hover` and `MdxAnchor` now move text +
decoration toward foreground (InlineLink-like), without stealing brand
link colour via `text-inherit`
- Content: remove accidental bold on oauth-scopes and
multi-factor-authentication guide links

| Before | After |
| --- | --- |
| <img width="1360" height="378" alt="CleanShot 2026-07-29 at 16 44
48@2x"
src="https://github.com/user-attachments/assets/1aa98cb4-e691-428e-b7e2-a78afcdf518d"
/> | <img width="1350" height="362" alt="CleanShot 2026-07-29 at 16 44
08@2x"
src="https://github.com/user-attachments/assets/63c9c7df-c1c7-49c4-8fdb-0411ae251a71"
/> |
| <img width="1518" height="448" alt="CleanShot 2026-07-29 at 16 46
18@2x"
src="https://github.com/user-attachments/assets/d618e138-fcd7-4a44-b16d-cb0ac5ba6b0e"
/> | <img width="1524" height="424" alt="CleanShot 2026-07-29 at 16 46
30@2x"
src="https://github.com/user-attachments/assets/dbc7710e-42c6-483c-b367-19b2ff3a6475"
/> |
| <img width="1524" height="598" alt="CleanShot 2026-07-29 at 16 47
15@2x"
src="https://github.com/user-attachments/assets/c9c07f37-4e2b-40fa-bc90-c86a17e5ea32"
/> | <img width="1530" height="584" alt="CleanShot 2026-07-29 at 16 47
39@2x"
src="https://github.com/user-attachments/assets/806735f0-fa44-42e6-bd5a-127899d0bfc2"
/> |

## To test

**Docs**

1. [Functions
quickstart](https://docs-git-fix-admonition-alert-title-prose-supabase.vercel.app/docs/guides/functions/quickstart):
titled tip near the top. Title and body should be the same size, no
giant gap above the title
2. [BYO
MCP](https://docs-git-fix-admonition-alert-title-prose-supabase.vercel.app/docs/guides/ai-tools/byo-mcp):
tip with links. Hover a link (text + underline should both go
foreground)
3. [OAuth
scopes](https://docs-git-fix-admonition-alert-title-prose-supabase.vercel.app/docs/guides/integrations/build-a-supabase-oauth-integration/oauth-scopes):
note link is not bold
4. [Multi-factor
authentication](https://docs-git-fix-admonition-alert-title-prose-supabase.vercel.app/docs/guides/platform/multi-factor-authentication):
same, note link not bold

**Blog**

5. [CLI v2 config as
code](https://zone-www-dot-com-git-fix-admonition-alert-title-prose-supabase.vercel.app/blog/cli-v2-config-as-code):
titled Admonitions. Title size matches body, no huge top margin

**Other**

6. [Design system:
Admonition](https://design-system-git-fix-admonition-alert-title-prose-supabase.vercel.app/design-system/docs/fragments/admonition):
component reference
7. Studio (e.g. project Edge Functions secrets): Admonitions should stay
compact `text-sm` outside prose. Preview:
[studio-staging](https://studio-staging-git-fix-admonition-alert-title-prose-supabase.vercel.app)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **New Features**
  * None

* **Style**
* Improved link decoration consistency (underline/hover) across internal
and external documentation content, with safer external link handling.

* **Bug Fixes**
* Refined alert/admonition rendering for clearer title/description
semantics and better spacing/text wrapping.
* Updated documentation image rendering to avoid forwarding
whitespace-only children and adjusted chart image layout.

* **Tests**
  * Expanded assertions for alert/admonition structure and styling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-31 12:23:16 +10:00
Danny White 0e5c073b46 fix(docs): unblock prerender by closing Image JSX without blank lines (#48465) 
## What kind of change does this PR introduce?

Bug fix

## What is the current behavior?

Docs production builds can fail during prerender with:

`TypeError: Cannot read properties of undefined (reading 'children')`

Seen on `/guides/ai/going-to-prod` (and the same pattern exists on
several other guides).

Root cause: blank lines inside MDX JSX such as `<Image ...>` make the
MDX parser treat the element as closed early, which corrupts the AST.
Separately, `apps/docs/components/Image.tsx` forwarded accidental
`children` (and could overwrite `src`) onto `next/image`.

## What is the new behavior?

- Remove blank lines before the closing `/>` on the affected guide MDX
files so the JSX stays one element.
- Make the docs `Image` wrapper drop `children` and keep `src` from
props only, so a bad MDX tree is less likely to crash the build.

## Additional context

Split out of #48428 so that PR stays focused on Admonition/Alert
typography.

### To test

1. Check out this branch and run the docs app locally (`apps/docs`), or
wait for the Vercel docs preview on this PR.
2. Confirm these pages render without a prerender / `children` crash:
-
[/docs/guides/ai/going-to-prod](https://docs-git-fix-docs-image-mdx-blank-lines-supabase.vercel.app/docs/guides/ai/going-to-prod)
-
[/docs/guides/ai/engineering-for-scale](https://docs-git-fix-docs-image-mdx-blank-lines-supabase.vercel.app/docs/guides/ai/engineering-for-scale)
-
[/docs/guides/ai/choosing-compute-addon](https://docs-git-fix-docs-image-mdx-blank-lines-supabase.vercel.app/docs/guides/ai/choosing-compute-addon)
-
[/docs/guides/ai/vector-indexes/hnsw-indexes](https://docs-git-fix-docs-image-mdx-blank-lines-supabase.vercel.app/docs/guides/ai/vector-indexes/hnsw-indexes)
-
[/docs/guides/database/orioledb](https://docs-git-fix-docs-image-mdx-blank-lines-supabase.vercel.app/docs/guides/database/orioledb)
-
[/docs/guides/database/connecting-to-postgres](https://docs-git-fix-docs-image-mdx-blank-lines-supabase.vercel.app/docs/guides/database/connecting-to-postgres)
-
[/docs/guides/telemetry/reports](https://docs-git-fix-docs-image-mdx-blank-lines-supabase.vercel.app/docs/guides/telemetry/reports)
3. Spot-check that the guide images still show at the expected size (no
broken/missing images from the `Image` wrapper change).
4. Confirm Docs CI / Vercel docs build passes on this PR (this was the
failure mode on master-ish builds).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added zoomable behavior to the Disk Size chart, with optimized light
and dark theme images.

* **Bug Fixes**
* Improved image rendering in documentation pages by handling captions,
styling, and MDX content more reliably.
* Corrected image markup formatting across multiple guides to ensure
content parses and displays correctly.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-31 10:27:07 +10:00
kanadClaude Fable 5Miranda Limonczenko
 		99599a843d docs(cli): address review feedback on getting-started update tabs (#48504) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Docs update — follow-up to #48426, addressing review feedback on the npm
panel of "Updating the Supabase CLI".

## What is the current behavior?

- Lead-in text doesn't match the short imperative style of the other
platform tabs ([review
comment](https://github.com/supabase/supabase/pull/48426#discussion_r3678295762),
[review
comment](https://github.com/supabase/supabase/pull/48426#discussion_r3678299519))
- Beta instructions use `npm update supabase@beta`, which stays within
the semver range in `package.json` and can't move a stable install to
the `beta` dist-tag ([review
comment](https://github.com/supabase/supabase/pull/48426#discussion_r3671400751))

## What is the new behavior?

- Lead-ins rewritten to match the other tabs: "Update the CLI with npm:"
- Beta command changed to `npm install supabase@beta --save-dev`, which
works for both updating an existing beta install and switching channels

## Additional context

Prettier passes locally; MDX lint couldn't run locally (`node-pty` build
issue), so relying on CI.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
  * Streamlined the Supabase CLI upgrade instructions for npm installs.
* Clarified the stable update command and updated the beta-channel
guidance to use the beta install command for switching.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Miranda Limonczenko <miranda.limonczenko@supabase.io>
 2026-07-30 13:42:55 -07:00
Danny White 3b06c6c7cc fix(docs): unify docs card hover and retire IconPanel (#48379) 
## What kind of change does this PR introduce?

Bug fix / docs UI polish.

## What is the current behavior?

- Many docs `GlassPanel`s use `background={false}`, so hover only tweaks
the border and reads as having no hover state
- Compact icon+label grids still use `IconPanel`, which has a broken
`-z-10` hover fill and overlaps with the newer `IconLink` pattern
- Description card grids jump to 3-up too early on medium widths

## What is the new behavior?

**GlassPanel**
- Removes the `background` prop; cards always use the filled surface
with stronger border hover
- Tightens icon→description gap (`gap-6` → `gap-3`)
- Decorative icons/logos use empty `alt` so screen readers don’t hear
the title twice

**Icon tiles**
- Retires `IconPanel` from docs and deletes it from `ui-patterns`
- Uses `IconLink` / `IconLinkList` for compact navigation tiles (auth
providers, social login, etc.)
- Adds `IconLinkButton` for SMS provider pickers (same chrome, opens a
dialog)
- Adds focus styles, list labelling, and dialog-trigger ARIA where
needed

**Layout / content**
- Migrate-to-Supabase description cards on resources use `GlassPanel`
(not slim icon tiles)
- Grid spans use `md:… xl:…` so cards stay 2-up until ~1280px
- Fixes migrate links to `/guides/platform/migrating-to-supabase/…` and
SSR quickstarts to `creating-a-client` with framework query params
- Moves the Extensions list `key` onto the outer `Link`

| Before | After |
| --- | --- |
| <img width="1185" height="1323" alt="Resources Supabase Docs"
src="https://github.com/user-attachments/assets/1677bf65-d3a3-4202-8c70-e758f7c3bcce"
/> | <img width="1185" height="1323" alt="Resources Supabase Docs"
src="https://github.com/user-attachments/assets/51760f0f-62b6-4010-9841-de26039f37b4"
/> |

## Additional context

Homepage compact sections already use `IconLinkList` from #48317; this
PR finishes that pattern for remaining docs `IconPanel` callsites and
cleans up GlassPanel hover.

`www/customers` only drops the removed `background` prop; those cards
already use the filled surface via `logo`.

## Test plan

- [ ] `/guides/getting-started`: GlassPanels show filled surface and
clearer border hover
- [ ] `/guides/resources`: migrate cards are GlassPanels with working
`/platform/…` links; 2-up until xl
- [ ] `/guides/auth/social-login` and auth providers partial: IconLink
tiles hover/focus correctly
- [ ] `/guides/auth/phone-login`: SMS provider buttons open dialogs;
keyboard focus works
- [ ] Docs homepage: migrate / self-host IconLinkLists unchanged in
behaviour
- [ ] `/guides/auth/server-side`: Next.js / SvelteKit cards resolve on
docs preview

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Improved Layouts**
* Made “GlassPanel” card grids more responsive and consistent; refined
card and success badge spacing for a cleaner presentation.
* **Updated Documentation**
* Refreshed multiple guide and resource pages (including quickstarts and
migration content) with standardized card layouts and updated link
destinations.
* **Component Updates**
* Standardized “GlassPanel” styling (background toggle removed) and
simplified icon-based panels; added an `IconLinkButton` for action
tiles; updated authentication provider grids to use the shared tile UI.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-31 06:34:05 +10:00
Danny WhiteandJoshen Lim 5edcaef74c chore: show organization invite errors inline (#48470) 
## What kind of change does this PR introduce?

Bug fix and design-system documentation update.

## What is the current behavior?

Invite acceptance failures only appear in a transient toast.

## What is the new behavior?

Invite failures remain visible beside the actions. The design-system
guidance now distinguishes field, action, state, and toast feedback.

| Before | After |
| --- | --- |
| <img width="759" height="619" alt="Join Organization Supabase"
src="https://github.com/user-attachments/assets/ed8e974c-5da3-477a-81da-628d3f847131"
/> | <img width="741" height="768" alt="Join Organization Supabase"
src="https://github.com/user-attachments/assets/4c3f6bcd-4ed9-40b2-8280-e8c8a44ecbd6"
/> |

## To test

With local Studio running at `http://localhost:8082`:

1. Open
`apps/studio/components/interfaces/OrganizationInvite/OrganizationInvite.utils.ts`.
2. At line 37, immediately inside `getOrganizationInviteStatus`, add:
   ```tsx
   return 'ready'
   ```
This deliberately bypasses invite lookup and account checks for the
visual test.
3. Open
`apps/studio/components/interfaces/OrganizationInvite/OrganizationInvite.tsx`.
4. At line 30, change:
   ```tsx
   const [joinError, setJoinError] = useState<string>()
   ```
   to:
   ```tsx
const [joinError, setJoinError] = useState<string>('Invite token can
only be accepted via an SSO account')
   ```
5. Open `http://localhost:8082/join?token=test&slug=test` while signed
in.
6. Confirm the card says **Join an organization** and shows the error
below **Decline**, separated from the actions by a divider.
7. Revert both temporary edits before committing anything.

## Additional context

First PR in a five-PR stack.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **New Features**
- Added a new connect interstitial example showcasing an inline
action-error state with clear retry guidance.

- **Bug Fixes**
- Invitation acceptance failures now show inline destructive feedback
under “Accept invite,” keeping the button enabled for retry (and
removing prior toast-based failure behavior).
  - Updated the invalid-invitation title to “Invalid invitation.”
  - Changed the “Decline” link destination to `/organizations`.

- **Documentation**
  - Expanded Sonner toast “When to use” guidance.
- Refined form and connect interstitial action-feedback patterns (inline
vs toast usage).

- **Tests**
- Updated and added coverage for the inline error rendering and “Invalid
invitation” text.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-07-31 06:23:24 +10:00
Danny WhiteandJoshen Lim 205527c716 feat(studio): tune up replication page layout and empty state (#48265) 
## What kind of change does this PR introduce?

UI polish for Database → Replication: empty state, page layout, diagram
containment, filter actions, and destination sheet copy.

## What is the current behavior?

- Empty destinations use a custom dashed box with generic copy.
- The diagram is full-bleed with `border-y`.
- Page chrome still uses legacy Scaffold wrappers and a long header
description that duplicates the empty state.
- Filter-row “Add destination” is a default button ahead of secondary
actions; Usage always shows.
- Local ETL warning sits on the page list.
- Destination sheet title/helper/access copy is more verbose; Type
helper sits beside the label.

## What is the new behavior?

- Empty state uses `EmptyStatePresentational` with clearer CTA copy;
toolbar “Add destination” is primary at the end of the filter row;
empty-state CTA stays default.
- Usage only appears when there is at least one Pipelines destination.
- Page uses `PageHeader` / `PageContainer` / `PageSection`, with a short
header: “Read replicas and analytics pipelines”.
- Diagram sits in a rounded bordered frame inside the page container
(same treatment as project overview).
- Local ETL warning shows in the add-destination sheet for Pipelines
types only, without blocking the form; Type + warning scroll with the
sheet body.
- Type helper sits under the dropdown as one flowing paragraph (“Cannot
be changed after creation…” plus shortened stage notice).
- Sheet title is “Add destination”; close only fires on dismiss; Lucide
icons (e.g. Snowflake) use consistent stroke width.

| Before | After |
| --- | --- |
| <img width="1479" height="930" alt="Replication Database Chisel
Toolshed Supabase"
src="https://github.com/user-attachments/assets/a3caf0ba-ed1a-4659-bdef-f66b67e85be4"
/> | <img width="1479" height="930" alt="Replication Database Chisel
Toolshed Supabase"
src="https://github.com/user-attachments/assets/d5a82641-a316-4577-9480-959346994c40"
/> |
| <img width="1479" height="930" alt="Replication Database Chisel
Toolshed Supabase"
src="https://github.com/user-attachments/assets/4f956e26-b8d4-4653-a60e-ceca7ec1e070"
/> | <img width="1479" height="930" alt="Replication Database Chisel
Toolshed Supabase"
src="https://github.com/user-attachments/assets/a72461ab-dea9-48a6-ab88-852a12ac80a5"
/> |

### Test plan

- [x] Open **Database → Replication** with no replicas/destinations:
empty state, primary filter-row Add destination, default empty-state Add
destination, no Usage button.
- [x] Confirm header→diagram and diagram→filter spacing feel even;
filter→empty state/table stays tight (`space-y-4`).
- [x] Confirm diagram is contained (rounded border), not full-bleed.
- [x] Add a Pipelines destination (or use a project that has one): Usage
appears; table still works; search “no results” still works.
- [ ] Open **Add destination**: title “Add destination”; Type helper
under the dropdown; Read Replica has no local warning; Pipelines type
shows local warning without hiding fields (when ETL isn’t set up
locally).
- [ ] Without Pipelines access: request-access panel shows “alpha” copy
and “Request alpha access”.
- [ ] Spot-check dark/light themes.

---------

Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-07-31 06:20:38 +10:00
Danny White 3a1b1e391d chore(design-system): match studio font stack (#48477) 
## What kind of change does this PR introduce?

Chore

## What is the current behavior?

Design system still uses the old CustomFont family, so documented
components no longer match Studio, www, and docs after the Inter /
Manrope rollout.

## What is the new behavior?

Design system uses the same font stack as the other apps:

- Inter for body (`--font-sans`)
- Manrope for headings (`--font-heading`)
- Source Code Pro for mono

Also adopts the Inter-optimised type scale and base weight (`450`) used
in Studio.

## Additional context

Based on Francesco's unshipped `chore/update-fonts` draft (design-system
slice only). Related shipped work: #47306, #47227.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Style**
* Updated the design system with refreshed typography using Inter and
Manrope, with Source Code Pro for code.
* Refined theme typography and spacing tokens, including a more complete
text scale, updated font weights, and container sizing.
* Improved heading styling and ensured `code`/`pre`/`kbd`/`samp` use
consistent monospace treatment.
* Adjusted default border styling and improved font loading/fallback
behavior for more consistent rendering.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-31 06:02:51 +10:00
Andrey A. 4466cc4e45 fix(self-hosted): override dns ttl in kong config to avoid wrong routing (#47846) 2026-07-30 17:29:12 +00:00
Andrey A. 18bad2e61c chore(self-hosted): remove em-dashes (#48498) 2026-07-30 17:20:22 +00:00
Andrey A. 3e02ce74b8 fix(self-hosted): pin rustfs to beta.11 and fix s3 tests (#48500) 2026-07-30 19:09:02 +02:00
Thomas 63a74d488f chore(billing): rework texts on aws marketplace onboarding page (#47735) 2026-07-30 17:31:13 +02:00
Gildas Garcia e558779969 Fix: RadioGroupCard focus state design (#48494) 
Fix the `<RadioGroupCard>` focus state design

Before:
<img width="676" height="117" alt="image"
src="https://github.com/user-attachments/assets/39849fd3-e6de-43dc-b4d7-67edcce3812d"
/>

After:
<img width="741" height="167" alt="image"
src="https://github.com/user-attachments/assets/13dad707-bc63-48da-8574-eb3d90b29625"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Style**
* Updated radio group card selection styling for a cleaner, more
consistent focus and checked-state appearance.
  * Added improved outline handling for radio group card items.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-30 16:50:06 +02:00
Monica Khoury 3c30514818 fix: open integrated support form from Feedback → Issue → Contact sup… (#48488) 
PR description:

## Summary

- Clicking Feedback → Issue → Contact support was navigating to
`/support/new` (the old full-page form) instead of opening the
integrated sidebar support form
- Fixed by setting a `helpPanelState.requestedView` signal before
opening the Help sidebar, so it opens directly at the support form view
- Added a small valtio store (`state/help-panel-state.ts`) to
communicate the desired view between `FeedbackDropdown` and `HelpPanel`

## Test plan

- [ ] Feedback → Issue → Contact support opens the Help sidebar at the
support form (not `/support/new`)
- [ ] Help button → Contact support still works as before
- [ ] Closing and reopening the Help sidebar via the Help button opens
at the home view

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Selecting **Support** from the Help menu now opens the Help Panel
directly to the Support view.
* The Help Panel automatically updates to the requested section when
opened.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-30 17:15:52 +03:00
Daniel Guerra 5a3e3598d0 feat(billing): Lazy load BillingSettings queries for components that are not in view (#48454) 
## What kind of change does this PR introduce?

There are some expensive queries that are requested every time the
Billing Settings page loads, some of them happen for components that are
outside of the initial viewport. We can avoid performing those requests
unless the user explicitly scrolls to the relevant section. A similar
pattern has been implemented in the past for the Credit Balance section
in https://github.com/supabase/supabase/pull/45481.

I decided to skip the lazy load pattern in the components that appear at
the top of the Billing Settings (Subscription and Cost Control).

## What is the current behavior?

When loading the billing settings page, all components (except
CreditBalance) will perform requests to load the data they need.

## What is the new behavior?

The components will perform the request to load their data until they
are inside the viewport. You can verify this by opening the developer
tools and monitor the requests as you scroll through the page.

## Testing

These changes can be easily tested by making your browser's height very
short then opening the org billing settings `/org/{slug}/billing`. Open
the developer tools and filter for XHR requests. As you scroll through
the page, the requests will be made.

To verify that all potential requests are covered, I compared the
requests done during a fresh load with another settings page, the only
extra requests made by the billing settings page are the ones relevant
to the components at the very top (or the BillingSettings container
itself, which requests the subscription).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Performance Improvements**
* Billing, payment methods, billing customer details, upcoming invoices,
and invoice lists now load only when their sections scroll into view,
reducing initial loading.
* Existing access/permission checks are still applied before fetching
billing-related data.

* **Tests**
* Updated billing and invoices tests to mock viewport intersection
behavior (IntersectionObserver) to match the new lazy-loading behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-30 07:55:40 -06:00
Steven EubankClaude Sonnet 4.6Jeremias Menichelli
 		bf5a729f2d docs(telemetry): rename section and restructure as Monitoring and Debugging (#48243) 
## Summary

- Renames the **Telemetry** nav section to **Monitoring and Debugging**
(nav label + sidebar title)
- Rewrites the section overview (`telemetry.mdx`) as a clean navigation
page using `ContentListings` — three panels (Debugging / Monitoring / AI
& automation) with no how-to prose
- Adds new `telemetry.data.ts` content-listings data file with three
groups registered in `index.ts`
- Adds a new **Debugging** guide (`debugging.mdx`) — request-stack
model, symptom-to-layer router with troubleshooting links for every
service, logging guidance
- Adds cross-links between `debugging.mdx`, `logs.mdx`, and
`advanced-log-filtering.mdx`
- Adds a new **AI agents and MCP** page (`ai-agents.mdx`) — MCP tools
table, `get_logs` usage, debugging skill workflow
- Restructures sidebar into three groups: **Debugging** / **Monitoring**
/ **AI & automation**

## Motivation

- No central entry point existed for debugging — content was scattered
across products with no index
- The overview page had almost no links for agents to follow
- The section name "Telemetry" caused confusion (also used for CLI usage
telemetry)
- Unblocks the `supabase` debugging skill, which routes agents to this
section as its source of truth

## Test plan

- [ ] `/docs/guides/telemetry` — three ContentListings panels render, no
prose how-to text
- [ ] `/docs/guides/telemetry.md` (markdown) — clean link list,
navigable by LLMs
- [ ] `/docs/guides/telemetry/debugging` — renders correctly, symptom
table links resolve
- [ ] `/docs/guides/telemetry/ai-agents` — new page renders correctly
- [ ] Sidebar shows 3 groups: Debugging / Monitoring / AI & automation
- [ ] All cross-links between debugging, logs, and
advanced-log-filtering resolve


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary

- **New Features**
- Added new documentation coverage for AI agent–assisted monitoring and
debugging, including an observability-driven troubleshooting workflow.

- **Documentation**
- Updated the “Telemetry” area to “Monitoring and Debugging” with a
refreshed landing page and reorganized sections (Debugging, Monitoring,
and AI).
- Revised the debugging and logs guides to improve step-by-step guidance
and highlight advanced log filtering.

- **Navigation**
- Renamed and restructured the top-level navigation entry to reflect the
new Monitoring and Debugging content layout.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Jeremias Menichelli <jmenichelli@gmail.com>
 2026-07-30 15:19:00 +02:00
CharisandJoshen Lim c16c7e94cc feat(studio): SQL editor logs source — toolbar UI + creation flow (#48452) 
## What

PR 6 of the SQL-editor "query source (Database vs Logs)" stack (builds
on the merged PR 5, #48414). Adds the user-facing toolbar surface for
the logs query source and consolidates the SQL-editor toolbar into a
single **source menu**.

Everything stays behind `sqlEditorLogsSource` + `otelLegacyLogs`
(dual-flag gated); with the flags off the toolbar is unchanged.

## Changes

- **Consolidated source menu** (`QuerySourceMenu`) — one `Database ▾` /
`Logs ▾` dropdown that both labels the snippet's source and hosts the
source-specific controls as flyout submenus:
- Database: database selector (`Primary` / read replicas), `Run as`
(role impersonation), and `Row limit`.
- Logs: `Time range` — the same relative presets as the Logs Explorer
plus a `Custom range…` calendar dialog.
- **Source is immutable** — the Database/Logs rows aren't a toggle. An
existing (materialized) snippet opens a *fresh* tab of the target source
(never reinterpreting a query against the wrong backend); a blank new
tab re-flavors in place. Extracted as the pure, unit-tested
`resolveSourceSwitch`.
- **New-snippet-with-source** threaded through `/sql/new?source=`, the
nav "Create a new logs query" entry, and the duplicate flow. Logs
snippets hide the (db-dialect) Export action.
- **Run-affordance guard** — the Run button is disabled + annotated for
a logs snippet on a non-ClickHouse org (sits above PR 5's execution
short-circuit).
- **Retention entitlement gating** — both preset and custom logs ranges
past `log.retention_days` surface the upgrade prompt instead of applying
silently. Prettify is disabled for logs (sql-formatter mangles
ClickHouse).

## Tests

- `querySource.test.ts` — `logDateRangesEqual` (structural
relative/absolute matching, incl. the "Last hour" vs "Last 1 hour" label
case).
- `QuerySourceMenu.utils.test.ts` — `resolveSourceSwitch`
push-vs-replace / no-op behavior.

`pnpm --filter studio typecheck` · `lint:ratchet` · Prettier · SQL
editor suite (307 tests) all green.

## For reviewers

To test manually, enable the `sqlEditorLogsSource` feature flag for
yourself on local/staging. There is no nav for Log SQL snippets
currently (that is by design, this PR is big enough as-is), so to check
an existing logs snippet, you can create one using the existing Logs
Explorer, copy its UUID, and force navigate to that snippet in the SQL
editor via URL.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added support for creating and switching between database and logs
queries.
  * Added log time-range presets and custom date-range selection.
  * Added database, run-as role, and row-limit controls.
* Added read-replica selection, including options to create a new
replica when available.
* **Improvements**
  * Added clearer explanations when query execution is unavailable.
* Disabled SQL formatting and query export where unsupported for logs
queries.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-07-30 08:38:11 -04:00
Ivan Vasilov 6b14df7724 chore: Bump vulnerable deps (#48387) 
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
  * Updated Next.js, PostCSS, and tar package versions.
  * Added the required TypeScript native tooling where needed.
* Refined package configuration and dependency ordering across the
project.
  * Removed an unused empty dependency configuration.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-30 14:23:43 +02:00
Pedro RodriguesandClaude Opus 4.8 91b40f15ab docs: how to fully remove account access when deleting a user (#48487) 
The [User Management → Deleting
users](https://supabase.com/docs/guides/auth/managing-user-data) section
warned that deleting a user does not sign them out, but did not say what
to do about it. Adds a **Removing account access** subsection: revoke
sessions before deleting, why a soft-delete flag or
[ban](https://supabase.com/docs/reference/javascript/auth-admin-updateuserbyid)
is not a substitute, and the residual [access-token
window](https://supabase.com/docs/guides/auth/sessions) after
revocation.

Fills a docs gap surfaced by
[supabase/agent-skills#194](https://github.com/supabase/agent-skills/pull/194)
while investigating the
[`investigate-auth-001-deleted-user-access`](https://github.com/supabase/evals/blob/main/evals/investigate-auth-001-deleted-user-access/PROMPT.md)
eval scenario.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Updated the “Deleting users” guidance to specify deleting via
`auth.admin.deleteUser()` (with `shouldSoftDelete: false`) and clarify
that this cascades to sessions, invalidates refresh tokens, and blocks
new access-token minting.
* Rewrote the explanation to emphasize that it does not substitute for
temporary bans or application-level “deleted” states.
* Clarified the access-token window: already-issued stateless JWTs
remain valid until `exp`, and recommended mitigations include short JWT
expiry and enforcing session validation (via `session_id`) for sensitive
actions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-30 13:22:10 +01:00
claude[bot]andClaude 76a9ba968c refactor(www): unify legal page shells and versioning (#48483) 
<!-- ccr-slack-attribution -->
_Requested by **Francesco Sansalvadore, Nicole Kramer** · [Slack
thread](https://supabase.slack.com/archives/C0161K73J1J/p1785399057853249?thread_ts=1785399057.853249&cid=C0161K73J1J)_

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Refactor of the marketing site's legal pages, plus two small content
fixes (removal of duplicated dates, two heading corrections) and two
permanent redirects.

## What is the current behavior?

The documents linked from the Legal Hub are built three different ways:

- `/terms` and `/enterprise-terms` render a plain inline heading with no
breadcrumbs.
- `/sla`, `/support-policy`, `/aup` and `/privacy` are standalone MDX
pages carrying their own layout.
- `/legal/dpa` has a one-off centered heading and grid of its own.

On top of that, the documents that already have a version selector
*also* print a "Last Modified" line inside the document body, so the
same fact is stated twice on the page. On `/terms` and
`/enterprise-terms` the two statements disagree: the selector says
"Version 2 — May 6, 2026" while the body says "Last Modified: 1 May
2026".

`/privacy` handles its history differently again — earlier versions live
at their own archived URLs (`/privacy-260316` and `/privacy-250528`),
strung together by "Previous Version" links at the bottom of each page.

## What is the new behavior?

Every legal page now renders through one shell: `PageHeader` with a
`PageBreadcrumb`, so the Legal Hub is one click away from any document.

- The duplicate "Last Modified" rows are removed from the five versioned
documents. The version selector is now the single place a date appears.
- `/aup` and `/privacy` gain the version selector.
- `/privacy`'s three historical versions are now selectable from the one
page, and the two old archived URLs permanently redirect to it.
- `/sla` and `/support-policy` pick up the shell and breadcrumbs but
intentionally show neither a date nor a selector — neither document has
ever carried one, and Legal asked that the SLA stay that way for now.

Implementation-wise the canonical pattern is the one the Data Processing
Addendum page was already using: `DefaultLayout` > `NextSeo` >
`PageHeader` (with a `breadcrumb` slot) > `MDXProvider` >
`SectionContainer className="prose"` > `LegalDocVersions`. The
standalone MDX pages were moved to `apps/www/data/legal/<slug>/vN.mdx`
as bare content partials, with a new TSX shell taking over the original
route. No route changed except the two archived privacy pages, which
redirect.

Dates were carried across from the "Last Modified" lines being deleted
rather than invented: `/aup` becomes Version 1 — June 1, 2026, and
privacy v1/v2/v3 become May 28 2025, March 16 2026 and May 13 2026.

## Additional context

**This is a stacked PR.** It is sequenced behind three PRs that touch
the same files and should land first: the Terms of Service v3 bump, the
Enterprise SaaS Subscription Agreement v3 bump, and #48481 (DPA
effective date → August 1, 2026). #48481 edits the very "Last Modified"
line this PR removes from the DPA content file, so a trivial conflict
there is expected. This branch will be rebased onto master before it
leaves draft.

**Two contracts now contain a clause that no longer describes the
page.** `apps/www/data/legal/terms/v1.mdx` and `v2.mdx` — and the same
sentence in the MPPA and both integration-partner addenda — still read
"The date on which the Agreement was last modified will be updated at
the top of this Agreement". There is no longer a date in the document
body; it sits in the version selector above it. Left untouched here
because it is contract text, but Legal should re-word it.

**The date mismatch is resolved in favour of the selector.** On `/terms`
and `/enterprise-terms`, deleting the body line leaves May 6, 2026 as
the only date on the page. Nicole Kramer confirmed in Slack that May 6
is the correct date.

**Two headings change visibly**, to line up with the labels used on the
Legal Hub: "Terms of service" → "Terms of Service", and "Service Level
Agreements" → "Service Level Agreement".

**`/legal/dpa` now looks almost identical to
`/legal/customer-resources/data-processing-addendum`** — same heading,
same breadcrumb, different content. The legacy page is a PDF download
plus a signing flow and was deliberately left live, but the overlap is
more obvious than it was. Redirecting it to the versioned page is the
natural follow-up; it is not done here.

**Build verification was incomplete in this environment.** `pnpm
install` could not finish because `npm.jsr.io` is blocked by network
policy (403), so `next build` never gave a real signal. What did run and
pass:

- `tsc --noEmit` on `apps/www`, with output byte-identical to clean
master
- ESLint on every changed file — 0 errors
- Prettier using the repo's actual config
- a direct MDX compile of all 14 `data/legal/**/*.mdx` files using the
app's own MDX options

The one thing left unverified is webpack resolving
`ui-patterns/PrivacySettings` from the privacy content's new directory.
CI will confirm that.

Co-authored-by: Claude <noreply@anthropic.com>
 2026-07-30 14:05:46 +02:00
claude[bot]andClaude 8a607a6108 feat(www): add Enterprise SaaS Subscription Agreement v3 (#48484) 
<!-- ccr-slack-attribution -->
_Requested by **Nicole Kramer** · [Slack
thread](https://supabase.slack.com/archives/C0161K73J1J/p1785399555203219)_

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Content update — a new version of a published legal agreement.

## What is the current behavior?

The version selector on `/enterprise-terms` offers two versions of the
Enterprise SaaS Subscription Agreement: Version 2 (May 6, 2026) and
Version 1 (April 17, 2026). Version 2 is what the page shows by default.

## What is the new behavior?

**Before:** opening `/enterprise-terms` showed Version 2 — May 6, 2026.
**After:** it shows **Version 3 — August 1, 2026**. Versions 2 and 1 are
unchanged and still reachable from the dropdown (`?version=v2`,
`?version=v1`).

Two files change:

- **New** `apps/www/data/legal/enterprise-terms/v3.mdx` — the Version 3
text, transcribed from the source Word document supplied in the Slack
thread (`2026.07.29 - Supabase - Enterprise Terms.docx`).
- `apps/www/pages/enterprise-terms.tsx` — imports the new MDX and
prepends `{ id: 'v3', label: 'Version 3', effectiveDate: 'August 1,
2026', Component: V3 }` to the `versions` array. Since the array is
newest-first, v3 becomes the default.

## Additional context

### Transcription fidelity

The legal text was not edited, reworded, reordered, or corrected — only
re-rendered in the MDX conventions already used by `v1.mdx` and
`v2.mdx`. This was verified mechanically rather than by eye: markdown
markup was stripped from `v3.mdx` and the result diffed
paragraph-by-paragraph against text extracted directly from the source
document's OOXML.

- **137 paragraphs in the source, 137 in `v3.mdx`, 0 differing.**
- 14 top-level sections and 48 subsections, matching the source's
heading counts exactly.
- All 3 distinct URLs preserved, written as bare URLs per the existing
convention in this file family (remark-gfm autolinks them).
- Pure ASCII apart from 5 `§` characters in the 48 C.F.R. citations,
matching `v1.mdx`/`v2.mdx`.
- Prettier clean; no British spellings that would trip the US-locale
misspell check.

Formatting decisions worth knowing: the source document contains no bold
or italic runs at all, but `v1.mdx` and `v2.mdx` both bold defined terms
and section numbers, so v3 follows that house style for consistent
rendering across the three versions. The source also carries no date or
version line of its own; the `_Last Modified: 1 August 2026_` first line
is repo convention, matching how every other legal MDX in
`apps/www/data/legal/` is written.

### What changed from v2, in the legal text

Structure is identical — same 14 sections, same 48 subsection titles.
Five substantive prose changes:

1. **Preamble** — the effective date is now "the date of last signature
of an Order referencing these terms", replacing v2's unfilled
`[Deal.CloseDate]` merge-field placeholder. "Signature block below"
becomes "signature block in an Order".
2. **New § 1.4 "Data Processing Addendum"** — defined by reference to
`https://supabase.com/legal/customer-resources/data-processing-addendum`,
with a carve-out for a separately executed agreement covering the same
subject matter. Former § 1.4–1.12 shift to § 1.5–1.13; nothing was
removed or reordered.
3. **§ 7.2 Data Processing** replaced — v2's GDPR / UK GDPR / Swiss
clause is gone, replaced by a general compliance paragraph that
incorporates the Data Processing Addendum into the Agreement.
4. **§ 13.3** cross-reference corrected from Section 10.1 (Mutual) to
Section 10.3 (Limited Warranty), which is the clause the refund remedy
actually depends on.
5. **§ 14.4 Amendment and Modification** rewritten — v2 required a
writing executed by both Parties; v3 gives Supabase a unilateral right
to modify by posting a revised version at
`https://supabase.com/enterprise-terms`, effective the first day of the
following calendar month, or at the start of the next Renewal
Subscription Period for Orders with a fixed Subscription Period of 12
months or longer, with non-renewal under § 13.1 as Customer's sole and
exclusive remedy.

Two things carried over verbatim from the source rather than fixed,
since the text must not be edited: § 7.2 is now near-duplicative of §
7.1 (three of its four sentences repeat § 7.1 almost word for word), and
"HIPAA" is used in both § 7.1 and § 7.2 without being defined.

One pre-existing inconsistency, unrelated to this change: `v2.mdx`'s own
first line reads `_Last Modified: 1 May 2026_` while the page lists
Version 2's effective date as `May 6, 2026`. Left alone here.

### Overlap with concurrent work

Two sibling changes are in flight for the same requester today — one
adjusting the new Data Processing Addendum page's dates, one publishing
Terms of Service v3. Neither touches these two files, but all three
touch the `apps/www/data/legal/` tree, and note that § 1.4 above now
links to the DPA page.

[#48483](https://github.com/supabase/supabase/pull/48483) removes the
`_Last Modified:` first line from every versioned legal MDX, on the
principle that the version selector should be the only place a date
appears. It is sequenced to land after this PR, and its file list
predates `v3.mdx`. A three-way merge of the two branches is clean, but
whoever rebases #48483 should add
`apps/www/data/legal/enterprise-terms/v3.mdx` to that removal —
otherwise v3 keeps a body date after v1 and v2 lose theirs.

The `_Last Modified: 1 May 2026` / `May 6, 2026` mismatch on v2 is also
handled in #48483 and is deliberately left alone here, so the same line
isn't touched by two PRs.

Co-authored-by: Claude <noreply@anthropic.com>
 2026-07-30 12:49:40 +02:00