**Stack 1/6** of the TanStack Start migration (#46424), split into
reviewable, independently-mergeable PRs.
> [!IMPORTANT]
> **Next stays the default and only active framework after this PR.**
This wires up the Vite/TanStack-Start build pipeline behind the
`STUDIO_FRAMEWORK` flag, but there are no TanStack routes yet — so the
TanStack build isn't functional or tested until later PRs in the stack.
Nothing about the Next build, dev, or deploy changes behaviourally here.
## What's in this PR
- **Dispatch:** `dev`/`build`/`start` now go through
`scripts/dispatch.js`, which runs the Next variant unless
`STUDIO_FRAMEWORK=tanstack`. The original commands are preserved as
`dev:next`/`build:next`/`start:next`.
- **Build pipeline:** `vite.config.ts`, `serve.js`, `smoke-server.mjs`,
vite/tanstack deps, `turbo.jsonc`.
- **`tsconfig.json`:** `jsx: react-jsx`, `moduleResolution: Bundler`,
`target: ES2022`. Because `include` is `**/*.ts(x)`, this re-typechecks
the whole app, so the companion adaptations below land with it.
- **Shared adaptations (companions to the tsconfig change):**
`BufferSource` casts, `packages/ui` unused-`React` import removals, etc.
- **Routing/middleware plumbing:** `next.config.ts` +
`redirects.shared.ts` (redirect rules now shared with `vercel.ts`),
`proxy.ts`/`start.ts` middleware + `hosted-api-allowlist.ts`.
## Verification
Run locally off `master`: frozen install ✓, `studio` typecheck ✓, **Next
build ✓** (compiles + generates all routes), lint ratchet ✓ ("some rules
improved"), prettier ✓.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a hosted API endpoint allowlist to return 404 for non-supported
`/api/*` routes.
* Introduced a TanStack route-migration checklist and expanded TanStack
Start routing support.
* **Improvements**
* Enhanced deployment refresh/detection by tightening cookie handling
for “latest deployment” updates.
* Centralized redirect/maintenance-mode rules for consistent platform vs
self-hosted behavior.
* Improved production serving with a dedicated static + proxy server and
a post-build smoke test.
* **Dependencies**
* Updated TanStack-related packages and React Table/query tooling
versions.
* **Documentation / Chores**
* Updated formatting and tooling config; added shared build environment
parsing utilities.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Add myself to humans.txt
## What is the current behavior?
I am not in humans.txt
## What is the new behavior?
I am in humans.txt
## Additional context
🎉
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated team contributor list.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What is this PR?
This PR makes some images easier to understand by AI tools.
Some are removed as they served minimal purposes. Some are replaced with
mermaid versions instead, which are more understandable by AI tools.
Next steps after this PR are to continue migrating harder images as well
as improving the text around images in general.
## Testing
```
pnpm install
pnpm dev --filter=docs # or: cd apps/docs && pnpm dev
```
Then visit each converted page and verify:
Diagrams render as Mermaid (not a broken image / raw code fence) in both
light and dark mode:
- /docs/guides/auth/auth-mfa/phone, /totp
- /docs/guides/database/connecting-to-postgres
- /docs/guides/platform/read-replicas (inside the accordion)
- /docs/guides/storage/schema/design
- /docs/guides/local-development/seeding-your-database
- /docs/guides/auth/signing-keys (image gone, prose + table intact)
## Context
Includes `storage_logs` as a source for storage logs
Also shifts the connection filter logic into `buildBaseWhere` - realised
there's an issue with this where the facet count was showing a value but
there's no logs
<img width="1389" height="954" alt="image"
src="https://github.com/user-attachments/assets/5c1ee60f-4729-4e0c-868b-9f8167d82c51"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated unified logs query logic for the `storage` log type so it now
correctly includes both `storage_logs` and matching `edge_logs` entries
(based on request path), improving consistency in results.
* Ensured connection-lifecycle message suppression is applied uniformly
across unified log views and all related count/badge calculations,
keeping sidebar filters and badge counts aligned with the visible data.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
For unified logs, we're currently pulling data from `edge_logs` and
filtering on path like `/rest` to fill the `Postgrest logs`
However, `edge_logs` are logs from the API Gateway and Postgrest logs
has its own source `postgrest_logs`
## Changes involved
- Update source for postgrest logs to include `postgrest_logs`
- Improve labelling of log types
- Improve overflow scroll container max height of
`DataTableFilterCheckbox`
- Previously its max height of 200px was nicely fitting the height of 6
options, so there's no visual indication that there's more to scroll.
Hence adjusting to 215px to "peek" the next option as below:
<img width="283" height="315" alt="image"
src="https://github.com/user-attachments/assets/eb962d66-d575-4ee9-9f80-eaa2af0278ef"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Improvements**
* Enhanced log type filter labels in the Unified Logs interface for
improved readability.
* Expanded PostgREST log detection and categorization.
* Increased vertical space in checkbox filter dropdowns for better
content visibility.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Added alternative means of entry forms and added a new email for legal
contest inquiries.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated the contact email for the contest winners list request in the
contest rules page, improving accessibility.
* Enhanced the legal/amoe form with integrated customer data management
capabilities for more efficient form submission and data handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- Add `invalidatePermissionsQuery` helper to `permissions-query.ts`
- Invalidate it alongside organizations and projects in
`useOrganizationAcceptInvitationMutation`'s `onSuccess`, so permissions
are refetched before the redirect to the org.
## Testing
1. Invite a user to an org.
2. Accept the invite via the invite link.
3. Navigate to the org's Billing page.
4. Verify the Subscription and Cost Control sections load without "you
need additional permissions" errors (no manual reload needed).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed an issue where user permissions were not properly synchronized
after accepting organization invitations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES/NO
## What kind of change does this PR introduce?
docs update
## What is the current behavior?
missing mention of the audit logs drains
## What is the new behavior?
add audit logs drains info
## Additional context
<img width="942" height="396" alt="CleanShot 2026-06-22 at 18 10 06"
src="https://github.com/user-attachments/assets/7ca29e42-3d18-4a6a-9e2e-e9a274f393f4"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a new **“Accessing Audit Log Drains”** section explaining how to
stream platform audit log events in real time using **Audit Log
Drains**, including where to configure this in the dashboard.
* Updated the guide’s introduction to reference external streaming via
Audit Log Drains.
* Revised the **“Limitations”** section to remove the prior note about
lacking drain setup, while retaining the dashboard-export limitation and
the plan-based retention information.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes DOCS-974
<img width="891" height="328" alt="Screenshot 2026-06-22 at 3 11 13 PM"
src="https://github.com/user-attachments/assets/d7b49d56-cf77-4c1d-a933-7cbeab3168c2"
/>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## Problem
From Linear:
Accordion usage in the docs is inconsistent and can render with double
lines instead of single lines.
The current docs contribution guidance appears to recommend wrapping
accordions with an extra div, which seems to be the cause of the extra
divider in some pages.
## Solution
This PR:
- Removes all wrapping `divs` to AccordionItems that adds an extra
border
- For a11y, adds a cursor pointer and a slight bg color change on hover
to make the clickable area more obvious
- For a11y, adds reduce-motion option for animation and `aria-hidden` on
the chevron
**Note:** It is good for a11y to have more than one hover-state
indicator. For example, color-change and an underline.
## Tophatting
To review changes on the preview environment:
1. Go to `/docs/guides/platform/backups` and
`/docs/guides/platform/migrating-to-supabase/auth0#frequently-asked-questions-faq`.
2. Expand accordion.
3. See nothing visually odd such as strange spacing or double borders.
**Note:** To be exhaustive in your review, view all affected URLs and
scan the docs for `border-b` to see if there are any stragglers.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Enhanced accordion components with improved hover state styling for
better visual feedback.
* **Refactor**
* Simplified accordion markup across documentation pages for cleaner,
more consistent layout and improved component nesting structure.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
Yes
## What kind of change does this PR introduce?
Adds my name to the contributors list humans.txt
## What is the current behavior?
List doesn't have my name
## What is the new behavior?
List has my name
## Additional context
Awesome onboarding task
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated team information in documentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- closes https://github.com/supabase/supabase/issues/47221
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added permission-based access control for copying API keys and
environment variables. Users without the appropriate permissions will no
longer be able to copy sensitive values through the copy buttons.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Ali Waseem <waseema393@gmail.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update
## What is the current behavior?
There is no documentation explaining why Kong stops responding under
heavy load during local development with the CLI, or how to resolve it.
## What is the new behavior?
Added a new troubleshooting guide
(`kong-stops-responding-under-heavy-load-locally.mdx`) that:
- Explains why Kong becomes unresponsive under heavy load in local
development (single nginx worker process by default to minimize memory
usage)
- Provides clear solutions using the `KONG_NGINX_WORKER_PROCESSES`
environment variable
- Shows multiple usage examples (auto, fixed number, exported variable)
- Includes instructions for restarting the stack after changes
- Links to related resources (local development guide and CLI
repository)
## Additional context
This guide helps developers troubleshoot a common issue when running
bulk operations (e.g., Storage API operations) against a local Supabase
stack. The solution is straightforward but not immediately obvious
without documentation.
https://claude.ai/code/session_01DXB9PjcuKsNeWYyLFbTXoy
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added troubleshooting guide for Kong API gateway connectivity issues
under heavy load in local development, including symptom identification,
resolution steps for worker process configuration, and links to related
resources.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## Problem
The Selfhosted Studio E2E Tests workflow fails on community (fork) PRs
at the **configure aws credentials** step with:
> Credentials could not be loaded, please check your action inputs:
Could not load credentials from any providers
GitHub does not pass repository secrets to workflows triggered by
`pull_request` from a fork (a deliberate security measure). So on fork
PRs:
- `${{ secrets.PROD_AWS_ROLE }}` evaluates to an empty string, and
- the OIDC `id-token` token isn't available either,
so `aws-actions/configure-aws-credentials` falls through its entire
provider chain and errors out, failing the job.
## Fix
Guard the AWS credential + ECR login steps with
`!github.event.pull_request.head.repo.fork`, the same pattern already
used by the Playwright comment step in this workflow. These steps only
exist to authenticate with AWS ECR to avoid Docker pull rate limiting,
so on fork PRs we simply skip them and pull from `public.ecr.aws`
anonymously, letting the e2e tests run instead of erroring out.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Improved CI/CD pipeline security configuration to better safeguard
authentication credentials during external contributions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Opting to keep the prefetching behaviour on Project cards from the home
page, but skip waking the project if its hibernating
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Optimized project loading to skip unnecessary wake operations during
prefetch, reducing latency when browsing project lists.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This PR syncs the latest troubleshooting guides from the
supabase/troubleshooting repository.
Co-authored-by: github-docs-bot <github-docs-bot@supabase.com>
## What
PR 2 of a stacked refactor of the SQL editor snippet state. **Stacked on
#47203 (PR 1)** — review/merge that first.
Extracts scattered business rules + the upsert-payload builder into a
new **pure** module `apps/studio/state/sql-editor/sql-editor-rules.ts`
(no Valtio, React, toast, or runtime data-layer imports):
- `canEditSnippet` — read-only rule (shared snippet you don't own), was
inline in `MonacoEditor` `disableEdit`
- `isSnippetOwner` — owner check, was inline in `ReadOnlyBadge` /
`SavingIndicator`
- `validateMoveToFolder` — 'shared snippet cannot be within a folder',
was a buried `toast.error`
- `buildUpsertPayload` — the PUT /content payload, was an inline object
literal (all `??` defaults preserved)
- `isLoadedSnippet` — type guard (see below)
## Bug fix: no more empty-content saves (and no non-null assertion)
The old payload builder used `{ ...content!, content_id: id }`. Tracing
that `!` upstream surfaced a real bug: **favoriting a snippet from the
sidebar that had never been opened** enqueued a save with no loaded
content, producing a PUT with an empty content body (rejected by API).
The requirement that a persisted snippet has loaded content is now
enforced **at the type level** rather than by a runtime assertion or
comment:
- `buildUpsertPayload` accepts only a `LoadedSnippet` (content
non-nullable) — the `!` is gone.
- the save subscriber crosses that boundary via the `isLoadedSnippet`
type guard.
- the sidebar favorite toggle loads content first (mirroring
`onSelectDuplicate` / the share modals), narrowing the fetched union
content to the SQL variant via its discriminant — **no type cast**.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved consistency in read-only behavior and ownership checks across
the SQL editor by centralizing permission logic.
* Fixed favorite toggle to ensure snippet content is fully loaded before
persisting changes.
* **Refactor**
* Centralized SQL snippet permission rules and validation logic into a
dedicated helper module.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What
PR 1 of a stacked refactor that re-layers the SQL editor snippet state
(`apps/studio/state/sql-editor-v2.ts`). This first PR is a **pure
structural move with zero behavior change** — no consumer files are
touched.
- Relocates the Valtio store body into
`apps/studio/state/sql-editor/sql-editor-state.ts`
- Extracts the type declarations into
`apps/studio/state/sql-editor/types.ts`
- Adds `apps/studio/state/sql-editor/index.ts` as the public surface
- Keeps the old `apps/studio/state/sql-editor-v2.ts` path as a thin
re-export **facade**, so all existing importers keep working unchanged
## How to read the diff
`sql-editor/sql-editor-state.ts` (~507 lines) is the **verbatim
relocation** of the former `sql-editor-v2.ts` body — not new code. Git
does not show it as a rename because the old path is intentionally
retained as the facade. The only genuinely new lines are `types.ts`
(20), `index.ts` (8), and the facade itself (8).
## Why
The store has accreted four tangled responsibilities (snippet/folder
CRUD, query results, persistence, Assistant diff). The stack
incrementally splits these into pure rules, a persistent store, a
session store, and an injectable save mechanism whose trigger is a
swappable policy (setting up a future auto→manual save migration). Each
PR stays ≤300–400 non-test lines and behavior-preserving.
## Verification
- `pnpm --filter studio typecheck` passes (only pre-existing unrelated
module-resolution errors remain).
- Lint passes (no new errors).
- No consumer imports changed.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Restructured SQL editor state management into a modular architecture
with improved separation of concerns and enhanced code organization.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Tiny one - just fixes the URL for the disable advisor rules feature
preview
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved navigation in the Advisor feature to direct users to the
security rules section more accurately.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Adds a log configuration section under database settings, which exposes
2 toggles:
- Log connections
- Log disconnections
<img width="757" height="336" alt="image"
src="https://github.com/user-attachments/assets/e2615baf-f01b-43e2-b2a5-b106aacc59d9"
/>
UI changes are flagged for internal on prod
## To test
- [ ] Can toggle + save either options
- [ ] Configuration should load correctly with a refresh
- [ ] Should only be for hosted
Related docs PR: https://github.com/supabase/supabase/pull/47199
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added connection logging configuration for database projects, allowing
users to toggle logging of database connections and disconnections.
* The new settings UI is available on supported platforms and only when
the feature flag is enabled.
* Included backend-backed retrieval and updates for the PostgreSQL
configuration, with save/cancel behavior, form defaults, and
permission-aware controls.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What
Two fixes to the **Ltree indexes require reindexing** and **Custom
operator selectivity estimators** sections of the upgrade guide (added
in #47003):
1. **ltree affected-check was incomplete.** The section only showed how
to *find* ltree indexes — not how to determine whether the database is
actually affected. A project on a single-byte (e.g. LATIN1) + `libc`
database would run it, see its ltree indexes, and needlessly reindex.
Added the canonical `reindex_required` check (multibyte encoding **or**
non-`libc` collation provider) so unaffected users correctly see "no
action needed." This matches the detection used in the customer email,
the support playbook, and the dashboard upgrade warning.
2. **No version specified.** Neither section said which Postgres version
it applies to. Added `_Applies when upgrading to Postgres 15.18 or
17.10._` to both.
## Notes
- Docs-only change.
- supa-mdx-lint + prettier clean.
- Follow-up to #47003.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated upgrade guides for Postgres 15.18 and 17.10 with explicit
applicability notes
* Clarified the Ltree indexes reindexing workflow by adding an initial
“reindex required” check before identifying affected indexes
* Improved documentation for custom operator selectivity estimators with
clearer version-specific guidance
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
As the e2e workflow starts the Supabase CLI, it downloads all our images
from the AWS ECR for every run. This makes many anonymous pulls that are
rate limited.
## Solution
Authenticate on AWS ECR
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Chores
* Updated the Studio E2E test workflow to include AWS ECR
authentication. The workflow now uses tightened job permissions and
conditionally authenticates with AWS and Docker registries to reliably
pull required container images while improving security.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The unified logs feature preview displayed a message saying the
interface was only available for Enterprise plan organizations. The
feature is now available to all plans, making this notice inaccurate and
potentially confusing.
## Fix
Removed the paragraph containing the Enterprise-only restriction notice
from the unified logs preview component.
## How to test
1. Open Studio and navigate to any project
2. Open the Feature Previews panel
3. Find the "Unified Logs" preview entry
4. Confirm the Enterprise restriction notice is no longer shown
5. Expected result: only the description and screenshot are visible,
with no plan restriction text
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Refreshed Unified Logs interface description to emphasize enhanced
capabilities including improved filtering, real-time updates, and a
unified view across services.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Context
Part of efforts to consolidate all the code editors that we have in the
repository
`CodeEditor` will serve as the base monaco editor file that all UIs
should consume from
It's aimed to be generic and just stores the common logic that will be
generally used where-ever we need a code editor (editor options, base
editor set up on mount, etc)
The idea is that `CodeEditor` holds just 3 default actions (run queyr,
format document and placeholder fill)
If any editor needs specific behaviours (e.g SQL Editor), they can
declare them in the `onMount` prop of `CodeEditor` which gives some
flexibility
## Changes involved
- Use `CodeEditor` component for SQL Editor's `MonacoEditor`
- Shifted Cmd K behaviour into `CodeEditor` since that's probably needed
everywhere that we render that UI
- Deprecate `MonacoEditor` from the table editor's `grid` folder
- All files that were using that component to use `CodeEditor` component
instead
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Refactor**
* Migrated the studio’s code editing UI (including JSON, text, and
payload viewers) to a unified CodeEditor experience.
* **New Features**
* Added plaintext language support for read-only/truncated views.
* **Behavior Changes**
* Improved editor startup by setting cursor position consistently and
deferring autofocus.
* Streamlined editor context-menu actions to the core set (run query,
format, placeholder fill).
* Updated SQL editor wiring for more consistent command/menu and
selection handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the CONTRIBUTING.md file.
YES
## What kind of change does this PR introduce?
Bug fix, docs update, Studio UX improvement.
Closes DOCS-400.
## What is the current behavior?
- Linear item: Docs: can't read Terminology table name column
- `break-all` on all `.prose td code` breaks `{{ .ConfirmationURL }}`
mid-token
- Studio template editor only linked to local-development
customizing-email-templates
## What is the new behavior?
- First-column code uses `break-words`; other columns keep `break-all`
- First column `min-width: 12rem` / `width: 30%`
- Studio TemplateEditor: **Terminology** + **Local development** links
- Template detail page: **Terminology** InlineLink beside Docs button
- `Table.tsx` MDX wiring deferred
On desktop:
<img width="864" height="1086" alt="image"
src="https://github.com/user-attachments/assets/f8439d1a-f607-4925-a250-ff142a357a2a"
/>
On mobile:
<img width="400" height="1383" alt="image"
src="https://github.com/user-attachments/assets/334769e8-3821-4bf4-8256-f4fae9ce45ea"
/>
Correct link:
<img width="1502" height="710" alt="Capto_Capture
2026-06-22_03-34-48_PM"
src="https://github.com/user-attachments/assets/87506751-d72b-4892-a8fb-63ef298a8260"
/>
## Additional context
- Verification (author): CSS diff only; table fixture screenshots
captured
- Frontend note: docs-only CSS in `apps/docs/styles/globals.css`; Studio
shadcn tables unchanged
### Test plan
- [ ] Check out worktree branch and run docs app locally (`cd apps/docs
&& pnpm dev`)
- [ ] Open `/docs/guides/auth/auth-email-templates#terminology` at
desktop width — Name column readable
- [ ] Same page at mobile/narrow width — first column has adequate
min-width
- [ ] Spot-check 1–2 other docs pages with code in table first column —
no regression
- [ ] Open Studio → Auth → Email Templates → edit any template
- [ ] Confirm new link to
`/guides/auth/auth-email-templates#terminology` opens correct anchor
- [ ] Confirm existing link to `customizing-email-templates` still works
- [ ] Confirm `apps/docs/components/Table.tsx` was **not** wired into
MDX
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Improved table cell code wrapping behavior in documentation to prevent
width expansion
* **Documentation & UI**
* Updated email templates editor with enhanced documentation links for
Terminology and Local development
* Added Terminology documentation link to email templates page header
for convenient access to reference materials
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Nik Richers <nik@validmind.ai>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## TL;DR
aligns the remaining Phase 2 Edge Functions docs snippets with
`@supabase/server`
## Whats Fixed?
updated outdated imports and version references, and refreshed JSON
examples to use Response.json()
where it makes sense. left non-JSON responses as is where the
integration or format actually needs them
## Ref:
- towards COM-269
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated numerous Edge Function guides and examples to use modern
`npm:`/`jsr:` import specifiers instead of legacy Deno URL imports.
* Standardized success and error responses to return JSON consistently
(using `Response.json()` and equivalent helpers) and added/clarified
appropriate HTTP status codes.
* Improved example error payload shapes in several guides for clearer,
structured failures.
* **Chores**
* Refreshed version ranges in documentation and examples across SDKs and
client libraries.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds integrations settings page to each oauth integration to show
associated resources (e.g. API keys, config, oauth apps, etc)
<img width="1150" height="892" alt="Screenshot 2026-06-16 at 2 44 31 PM"
src="https://github.com/user-attachments/assets/035cc602-886d-43bc-a5a7-e14f76dd37c3"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary
* **New Features**
* Added a Marketplace “Settings” tab with a grouped **Connected
resources** view (OAuth apps, API keys, Edge Function secrets, SMTP),
including loading/empty/missing-resource states and per-kind removal
actions.
* Added a resource-group section UI plus integration-aware grouping/copy
customization and missing-kind zero-states.
* **Bug Fixes**
* Improved installed-state detection for Grafana and Doppler by
broadening conditions.
* Added an orphaned-resources warning when expected OAuth apps are
missing.
* **Refactor**
* Unified connected-resource removal into a single flow with
OAuth-specific revoke handling.
* **Tests**
* Added comprehensive UI and utility coverage for grouping, states, and
destructive removal behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update
## What is the current behavior?
A bug causes the CLI to fail when the `--project-ref` flag is not
applied last in the chain
## What is the new behavior?
Moved it to the end of the chain
## Additional context
Slack:
- https://supabase.slack.com/archives/C02BJ2239GA/p1781816645742719
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated CLI command examples for managing Postgres configuration,
including corrected parameter ordering and improved line formatting for
the related `postgres-config` update/delete commands.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## What kind of change does this PR introduce?
Bug fix
## What is the current behavior?
When you open the SQL editor with prefilled SQL via
`/sql/new?content=<sql>`, the editor seeds its contents from the
`content` query param, then navigates to the newly created snippet with
`router.push`.
That leaves the (often very long) `/sql/new?content=...` URL in the
browser history. Pressing Back returns to that URL instead of the page
you came from. It is a wasted step, and it re-seeds and recreates a
fresh snippet.
This affects every entry point that opens the SQL editor with prefilled
SQL, such as the table definition "Open in SQL Editor" button, create
index, and the SQL command menu.
## What is the new behavior?
When the editor is seeded from a `content` deep link, the navigation to
the new snippet uses `router.replace` instead of `router.push`. This
collapses the one-shot `/sql/new?content=...` URL out of the history.
Back now returns straight to the page you came from, with no wasted step
and no duplicate snippet. Normal new query creation (no `content` param)
is unchanged.
## To test
1. Open any table in the Table Editor, switch to the Definition view,
and click "Open in SQL Editor". Any deep link with prefilled SQL works.
You can also visit `/project/<ref>/sql/new?content=SELECT%201` directly.
2. Confirm the SQL editor opens with the SQL prefilled, and the URL no
longer contains `?content=`.
3. Press the browser Back button.
4. You return straight to the previous page in a single Back.
Before this fix, the first Back landed on `/sql/new?content=...` and
recreated a snippet, and only a second Back reached the page you came
from.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved navigation behavior in SQL Editor when creating snippets from
imported content, resulting in more efficient routing.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
## Problem
We now use the Shadcn breadcrumb everywhere but we still have the old
breadcrumb code.
## Solution
- Remove the old breadcrumb code
- Fix import paths where needed
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Consolidated UI component imports across the codebase to use unified
package entrypoints.
* Removed legacy breadcrumb component implementation in favor of
standardized components.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Extracted from the TanStack Start migration (#46424) to shrink that PR.
The self-hosted storage/auth API routes each constructed a module-scope
admin client (`createClient(process.env.SUPABASE_URL!,
process.env.SUPABASE_SERVICE_KEY!)`). Those env vars only exist on
self-hosted, so eager module-scope construction is wasteful on platform
and fragile on any runtime that evaluates an API module before its route
is hit (constructing with `undefined` credentials throws on import).
**Changed:**
- Add `lib/api/self-hosted-admin.ts` — `selfHostedSupabaseAdmin`, a
`Proxy` that defers `createClient(...)` until first property access
(inside a handler, i.e. on self-hosted where the vars are set).
- Swap **all 17** storage/auth/vector-bucket handlers from module-scope
`createClient(...)` to `import { selfHostedSupabaseAdmin as supabase }`.
- **Enforce it:** add an eslint `no-restricted-syntax` rule banning
module-scope `createClient` in `pages/api/**` + `routes/**` (now that
every flagged handler is lazy). The same eslint config block also
carries an analytics-SQL boundary rule — 0 violations on master.
Behaviour is unchanged (the client is still built lazily inside the
handler). This is also the change that makes those routes safe under
TanStack's single-handler module evaluation.
## To test
- Self-hosted Studio: storage buckets/objects, vector buckets, and auth
users operations work as before.
## Verification
studio lint (0 errors, both rules active) ✓ · studio typecheck ✓.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Standardized self-hosted Supabase admin client usage across platform
authentication and storage endpoints, removing per-route client setup.
* Improved reliability by lazily creating the admin client only when
first used.
* **Chores / Tooling**
* Updated ESLint rules to prevent module-scope Supabase client creation
in API routes and to enforce safe analytics SQL access patterns.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Ali Waseem <waseema393@gmail.com>
Follow-up to #47077, extracted from the TanStack Start migration
(#46424).
Three `waitForResponse` waits in `database.spec.ts` were registered
*after* their triggering action, so the response could resolve before
the listener attached and the wait would time out (this surfaced under
TanStack, where the data is SSR-streamed, but the waits are redundant on
Next too).
**Removed:**
- Schema Visualizer *actions*:
`waitForSchemaVisualizerToLoad(...'auth')` registered after the
schema-selector click — the `focusTableInVisualizer` loop immediately
below already auto-waits for the auth schema's tables.
- table update / duplicate: `waitForDatabaseToLoad(...)` after the save
mutation — the `toBeVisible` assertion right after each already waits
for the list to refetch.
- the now-unused `waitForDatabaseToLoad` /
`waitForSchemaVisualizerToLoad` imports.
The UI assertions are the real synchronization points, so behaviour is
unchanged on Next.
## To test
- Studio E2E `database.spec.ts` passes (the Schema Visualizer + Tables
groups).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Improved database e2e test reliability by optimizing synchronization
logic and eliminating timing-sensitive helpers that could introduce
flakiness during schema and table operations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
## Context
Allows forward slashes for branch names
Also fixes validation behaviour in the form, as currently the error
shows up `onSubmit`, but the button is disabled until the form state is
valid, so the error never shows up
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Extended branch naming rules to support forward slashes and additional
special characters, allowing more flexible branch names.
* Enhanced form validation to provide real-time feedback as you type.
* **Style**
* Refined form field label text formatting.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Another pass on refactoring the ETL code, specifically for
`DestinationForm/index.tsx`
Splits out the validation + pipeline submission logic into its own hook
`useDestinationForm.ts` so the main file is broken into smaller pieces
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Streamlined the database replication destination form by centralizing
validation and save/submission workflow in a dedicated hook.
* Improved the validation flow so failed validations guide users by
scrolling to the inline validation section, and warning confirmations
submit through the standard pipeline flow.
* Updated form reset behavior when the panel opens to ensure validation
state clears consistently.
* **Bug Fixes**
* Corrected autogenerated S3 key “description” to derive from the
selected warehouse when using Analytics Bucket destinations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
