## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES/NO
## What kind of change does this PR introduce?
fixes: #37454
The context menu on the FK row is a lie, its just exposing the cell
underneath. Ideally this should have its own context menu, right now we
only support copy operations.
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
We're exploring support for newer models like
[gpt-5.4-nano](https://openai.com/index/introducing-gpt-5-4-mini-and-nano/)
in Assistant. This model doesn't support the `'minimal'` reasoning
effort level we use for gpt-5-mini which leads to vague errors.
<img width="595" height="263" alt="CleanShot 2026-03-18 at 17 13 05@2x"
src="https://github.com/user-attachments/assets/cf7c2370-322d-4a8a-be55-23e680db0aa0"
/>
Also, we've [previously
discussed](https://supabase.slack.com/archives/C0161K73J1J/p1771544464850199?thread_ts=1771493920.775699&cid=C0161K73J1J)
that reasoning adds unnecessary latency to otherwise simple AI
completion endpoints like `title-v2`. We want more control of reasoning
level independent of model/endpoint.
This PR aims to solve both problems by:
- making reasoning effort configurable on a per-request basis
- adding compile-time guardrails to prevent selecting an incompatible
reasoning level for models
- adding a `DEFAULT_COMPLETION_MODEL` with minimal reasoning that we can
update with newer models that support disabling reasoning (independent
of Assistant chat model reasoning)
Other improvements to our model config logic:
- Fixes bug in `onboarding/design.ts` and `assistant.eval.ts` where
`providerOptions` was being dropped
- `getModel()` now returns a bundled `modelParams` object (spread into
AI SDK calls) so `providerOptions` can't be accidentally omitted (this
[has happened
before](https://supabase.slack.com/archives/C0161K73J1J/p1771518443534309?thread_ts=1771493920.775699&cid=C0161K73J1J))
- Introduces an `ASSISTANT_MODELS` registry as a single source of truth
for assistant model config, eliminating hardcoded model IDs across the
codebase
- Aligns free/pro model conditional logic with `assistant.advance_model`
entitlement naming conventions instead of the `isLimited` pattern
- Adds `console.error` logging of Assistant stream errors so we can
interpret reasoning effort compatibility errors in the future (instead
of just opaque "Sorry, I'm having trouble responding right now" card)
- Removes unnecessary type casts and generally making the model config
logic stricter
- Removes pre-existing dead code: `anthropic` provider variant in
`GetModelParams` / `PROVIDERS` registry that was never implemented in
`getModel()`
Now if you try to select an unsupported reasoning level you get a type
error:
<img width="1306" height="320" alt="CleanShot 2026-03-20 at 14 37 24@2x"
src="https://github.com/user-attachments/assets/a6ac234b-5ea5-4d81-8e01-ac4be34a0800"
/>
And if for some reason an invalid reasoning level slips through, you now
get a server-side error surfacing the issue:
<img width="1268" height="204" alt="CleanShot 2026-03-20 at 14 58 14@2x"
src="https://github.com/user-attachments/assets/aadc1b7a-9495-475f-9741-39979bd27cd7"
/>
I've tested gpt-5 and gpt-5-mini are still working on the staging
preview and verified the models were selected properly in Braintrust
logs. Both models are available on my Pro test account, and my Free test
account shows the Pro upgrade CTA.
Closes AI-446
Closes AI-551
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
When a project's redirect URL list exceeds the 2KB client-side limit,
the preflight length check in onConfirmDeleteUrl prevents users from
removing URLs, showing "Too many redirect URLs, please remove some or
try to use wildcards" on delete operations.
This creates a deadlock where users can neither add nor remove URLs.
The check validates the payload after removing the selected URLs, but if
the remaining list is still over 2KB, it blocks the request. Since
removing URLs can only reduce payload size (never increase it), this
check is unnecessary on the delete path.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
- Index mismatch on ADD then DELETE/EDIT:
formatGridDataWithOperationValues was searching the original rows array
for DELETE_ROW and EDIT_CELL_CONTENT operations, then using those
indices on the modified formattedRows array (which had been shifted by
ADD_ROW's unshift). Both now search formattedRows directly.
- Cross-table operation leaking: The entire operation queue was passed
to formatGridDataWithOperationValues without filtering by the current
table, causing pending ADD_ROW and DELETE_ROW operations from one table
to appear in other tables. Operations are now filtered by tableId before
rendering.
## Problem
- The auth providers forms still use `formik` and we want to remove it
in favour of `react-hook-form` to keep only one form library
- The auth providers forms do not follow the design system guidelines
## Solution
- Migrate to `react-hook-form`
- Apply the design system guidelines
## Screenshots
<img width="1530" height="1920" alt="image"
src="https://github.com/user-attachments/assets/04627e93-2aa5-4a7f-a24e-0ae41d6e6b10"
/>
---------
Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com>
## What kind of change does this PR introduce?
Bug fix that resolves DEPR-414.
## What is the current behavior?
Browser titles in the table/SQL editors can keep showing an old entity
name after a rename.
## What is the new behavior?
- `EditorBaseLayout` now prefers the live tab label when composing the
browser title entity, so existing stale tab metadata no longer wins.
- Updating a tab label now also syncs the persisted `metadata.name`, so
renamed entities recover cleanly on reload instead of carrying stale
names in local storage.
- Adds a regression test covering the stale-metadata case in the editor
layout.
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## What kind of change does this PR introduce?
Bug fix.
## What is the current behavior?
The `Recent items` list shown in the table editor empty-state can keep
showing an old label after a table or SQL snippet is renamed.
That UI is mounted from:
- `/project/[ref]/editor`
- `/project/[ref]/editor/new`
## What is the new behavior?
- Re-adding an existing recent item now refreshes its label and metadata
instead of only bumping the timestamp.
- Updating an open tab label now also updates the matching recent item,
so rename flows stay aligned with the recent-items list.
- The fix is applied in the shared tabs store, so table and SQL editor
tab state stay consistent even though the visible `Recent items` UI
currently appears in the table editor empty-state.
- Adds a small store-level regression test for both cases.
| Before | After |
| --- | --- |
| <img width="1024" height="563" alt="test Table Editor Mallet Toolshed
Supabase-DA49998A-FE09-4197-8EE7-5D5366FABDC7"
src="https://github.com/user-attachments/assets/d0475437-4486-4581-82f8-a84b97b08250"
/> | <img width="1024" height="563" alt="test Table Editor Mallet
Toolshed Supabase-8F2B6CC9-0721-4348-A094-EE94D6919B08"
src="https://github.com/user-attachments/assets/f055be35-4373-4b1b-a2e1-ffe59f12c177"
/> |
## What kind of change does this PR introduce?
Bug fix.
## What is the current behavior?
When Queue table operations is enabled, Table Editor cell edit
affordances still say `Save changes`, even though the edit is queued for
later review and save.
## What is the new behavior?
Cell edit affordances in the Table Editor now say `Queue changes` when
the Queue table operations feature preview is enabled, and continue to
say `Save changes` otherwise.
| Before | After |
| --- | --- |
| <img width="640" height="796" alt="CleanShot 2026-03-25 at 17 55
20@2x"
src="https://github.com/user-attachments/assets/e0de99f0-2c08-4723-8f79-a7489ebdd355"
/> | <img width="672" height="838" alt="CleanShot 2026-03-25 at 17 55
08@2x-68362D24-A25C-41D5-920C-38B85E816F54"
src="https://github.com/user-attachments/assets/7b437259-673c-46c7-85df-51f1daa8826b"
/> |
## Additional context
This updates the inline text, JSON, and date/time editors, plus the JSON
side-panel cell editor path.
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## What kind of change does this PR introduce?
Chore that references DEPR-394.
## What is the current behavior?
This stack is consolidating RHF key/value array UIs in smaller
reviewable steps.
After PR 1, Database Webhooks HTTP parameters and Database Functions
configuration parameters still use separate bespoke implementations.
## What is the new behavior?
- reuses the shared `KeyValueFieldArray` for Database Webhooks HTTP
parameters
- reuses the shared `KeyValueFieldArray` for Database Functions
configuration parameters
- keeps existing form shapes and submission logic intact
- adds focused tests for those two follow-up consumers
## Additional context
This is PR 2 of a 3-PR stack for DEPR-394.
Base PR: #43938
### Summary
This PR updates the billing address required modal so it also shows for
users with billing read access but without billing write access, such as
developers and users with read-only acess.
For users with BILLING_WRITE, the existing blocking behavior remains in
place:
- the modal has no visible close button
- it closes only after a successful billing address update
For users with BILLING_READ but not BILLING_WRITE, the modal now:
- the modal includes a visible close button
- no editable billing form is shown
- the copy tells the user to ask an organization administrator or owner
to update the billing address
<img width="1280" height="626" alt="Screenshot 2026-03-24 at 7 18 49 PM"
src="https://github.com/user-attachments/assets/ddc5e90d-c7d8-4d67-a138-59a5a5baf71b"
/>
### Manual testing
#### Admins/owners
1. As a user with BILLING_WRITE, open an org that is missing a billing
address.
2. Confirm the modal appears with the billing address form.
3. Confirm there is no visible close button.
4. Submit a valid billing address and verify the modal closes after a
successful save.
For testing whether an update successfully closes the modal, you can:
- You can create a free org without a billing address
- You will need to tweak this logic (on the frontend)
```
const shouldShow = Boolean(
IS_PLATFORM &&
// showMissingAddressModal &&
org &&
// org.plan.id !== 'free' &&
org.organization_missing_address &&
!org.billing_partner &&
permissionsLoaded &&
canViewModal
)
```
- Tweak the backend logic which computes `organization_missing_address`
to exclude free orgs
#### Developers/users with readp-only access
1. As a user with BILLING_READ but not BILLING_WRITE, open an org that
is missing a billing address.
2. Confirm the modal appears with informational copy only and no
editable form.
3. Click the close button and verify the modal dismisses.
## Problem
React Query cache keys for permissions and organizations are generic
(`['permissions']`, `['organizations']`) with no user identifier. When a
new session is established without going through the explicit sign-out
flow (e.g. clicking an email verification link while still logged in as
another account), stale data from the previous user persists in cache.
The new user ends up seeing the old user's permissions and org list,
which makes the project creation form appear enabled. When submitted,
the backend rejects with "not an owner" because the token belongs to the
new account which has no ownership of the old org.
A hard refresh clears the in-memory React Query state and forces a fresh
fetch, which is why it resolved the issue.
## Fix
Scope `permissionKeys.list` and `organizationKeys.list` by user ID so
different accounts never share the same cache slot. When a different
user logs in, their queries simply get fresh cache entries and never see
data from the previous session. Updated all invalidation and
`setQueriesData` call sites across 18 files to pass the current user ID.
## How to test
I don't think it can be tested in the preview environment sadly since
the request to verify has to go to auth.supabase.green instead of
vercel-ref.supabase.green
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Select returns null
return returns hello world
(so this example has always been broken)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the database functions guide with refined code examples.
Documentation now demonstrates improved Postgres function syntax and
streamlined return mechanisms, providing developers with clearer
guidance for implementing database functions following current best
practices.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Clarifies that installing the Supabase CLI globally via npm is not
supported.
## Details
The CLI already throws a clear error when attempting a global npm
install, but the documentation did not mention this.
This update adds a clear note to the Node.js installation section and
points users to supported alternatives.
## Related issue
Closes#4496
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a clear admonition in the getting started guide clarifying that
the Supabase CLI should not be installed globally via npm. Recommends
Homebrew, Scoop, or the standalone binary, and suggests using npx or a
local/dev dependency as alternatives. The guidance appears both after
the Node.js note and within the npm install tab.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Since queue operations is a feature users can opt-out of, we need to
make it cleaner to toggle between queuing vs straight edits. To do this,
refactor all the operations into a single hook and reference it in
places where we mutate the rows.
## Testing
- Test edit cells, rows, and deletes for non queue operations
- Test edit cells, rows, and deletes for queue operations, also double
check modifying the same rows that are not yet added
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
OpenAI claims to support recursive schemas with $defs/$ref, but in
practice it's unreliable. When Zod's z.lazy() is converted to JSON
Schema, it produces recursive $ref entries that OpenAI's structured
output frequently rejects with errors like "Recursive reference
detected" or "Invalid schema for response_format".
Simplify the AI generation schema since we only support AND and don't
need the recursion because we don't support nesting of groups.
### Summary
This PR removes the visible close button from the billing address
required modal to make it non dismissable, since the majority of users
on paid orgs are still not filling their billing address.
The modal already prevents dismissal via Esc and outside/backdrop
interaction, and this change preserves that behavior. The existing
submit flow is unchanged, so the modal still closes after a successful
billing address update.
### Manual testing:
1. Open Studio in a state where the billing address required modal
appears.
2. Confirm the top-right close button is no longer shown.
3. Press Esc and verify the modal remains open.
4. Click outside the modal / on the backdrop and verify the modal
remains open.
5. Submit a valid billing address and verify the modal closes after a
successful save.
For testing whether an update successfully closes the modal, you can:
- You can create a free org without a billing address
- You will need to tweak this logic (on the frontend)
```
const shouldShow = Boolean(
IS_PLATFORM &&
// showMissingAddressModal &&
org &&
// org.plan.id !== 'free' &&
org.organization_missing_address &&
!org.billing_partner &&
permissionsLoaded &&
canBillingWrite
)
```
- Tweak the backend logic which computes `organization_missing_address`
to exclude free orgs
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update — Rewrite the Agent Skills documentation as a single flat
page with a skills table.
## What is the current behavior?
The Agent Skills docs have a nested structure with an index page and
individual dynamic pages for each skill (fetched from the
`supabase/agent-skills` repo). Skills also inject sub-items into the
sidebar navigation.
## What is the new behavior?
This PR replaces the nested skill pages with a single, flat Agent Skills
page that:
- Lists all skills in a **table** with name, description, and a
**copy-to-install button** (fetched dynamically from the
[supabase/agent-skills](https://github.com/supabase/agent-skills) repo)
- Includes **installation commands** for both the skills CLI (`npx
skills add`) and Claude Code plugins
- Links skill names directly to their source on GitHub instead of
rendering full skill content inline
- Removes the dynamic `[slug]` route, sidebar nav injection, and local
skill example files
### Navigation Structure
```
Start
> AI Tools
> Agent Skills (new)
> Prompts (existing)
> Supabase MCP server (existing)
```
Closes
[AI-361](https://linear.app/supabase/issue/AI-361/create-skills-documentation-page-in-ai-tooling-docs)
---------
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
## Summary
Customers were upgrading to Pro to clear service restrictions, unaware
that restrictions aren't lifted immediately when the billing cycle
resets — there's a delay. This adds a clarifying note to both the docs
FAQ and the Studio restricted alert so users know what to expect.
Note: upgrading your plan or disabling spend cap *does* lift
restrictions immediately (unchanged). The delay only applies to the
billing-cycle-reset path for usage-limit violations.
## Changes
- `billing-faq.mdx`: Removes the implication that restrictions clear the
moment the billing period resets; adds "Note that there may be a short
delay after your billing period resets before restrictions are fully
lifted"
- `Restriction.tsx`: Updates the restricted alert to make clear that
upgrading lifts restrictions immediately, while the billing-reset path
may have a delay
## Testing
To test the Studio banner, find or create an org with
`restriction_status === 'restricted'`, or temporarily hardcode
`shownAlert = 'restricted'` in `Restriction.tsx` to preview:
- [x] Restricted alert reads clearly and distinguishes immediate
(upgrade) vs delayed (billing reset) paths
- [x] Docs FAQ answer under "How can I remove restrictions" reads
correctly with the new caveat
## Linear
- fixes GROWTH-704
The [`docs-mgmt-api-update`
workflow](https://github.com/supabase/supabase/blob/master/.github/workflows/docs-mgmt-api-update.yml#L21)
uses `sparse-checkout`, only pulling `apps/docs` and patches. After PR
#42987, the Makefile's `redocly` commands were changed to run via `pnpm
exec` `redocly` from `packages/generator`, but that directory was never
checked out, causing the can't `cd` error. Adding `packages/generator`
to `sparse-checkout` makes the existing Makefile dependency explicit in
the workflow.
## Context
Related to the queue table operations feature preview
Adding a "cancel" action in the save queue operation bar for convenience
to clear all changes (instead of having to go into the review panel)
Also aligning the positioning of the CTAs to match the review panel
- "Review" imo is a secondary action, while "Save" or "Cancel" are the
primary ones
- Hence am shifting the "review" CTA to the left, contextually beside
the number of pending changes text
<img width="449" height="100" alt="image"
src="https://github.com/user-attachments/assets/c3faa6c1-e244-40ee-b251-44ab1e785c6e"
/>
- This also aligns with the CTA placements in the review panel
<img width="502" height="71" alt="image"
src="https://github.com/user-attachments/assets/35b7de0a-dbf4-4e8a-acef-53508c9b13b9"
/>
- Also removed plural grammar for the button CTAs - thinking thats not
necessary, wanna keep button CTA texts short and sweet + The "x pending
change(s)" also captures the plurality
## Context
Shifts all remaining dashboard queries into pg-meta so that we
centralize all manually written queries in one place
Having them in packages/pg-meta also allows us to write tests for them
## To test
Just needs a smoke test on
- Role Impersonation
- Lints
- Data API
- Database
- Enumerated Types
- Integrations
- Foreign Data Wrappers
- Vault
## Description
Fixes#43800
When editing SMTP settings while custom SMTP is already enabled, the
form footer was incorrectly displaying "Rate limit for sending emails
will be increased to 30". The rate limit is only set during the initial
enable transition, so the message and submit behavior were out of sync.
## Changes
This fix aligns the footer message with the submit logic (Option A from
the issue):
- **Enabling SMTP**: Shows rate limit increase message
- **Already enabled, editing settings**: Shows "Custom SMTP settings
will be updated"
- **Disabling SMTP**: Shows rate limit reduction message
## Testing
1. Go to Authentication → SMTP Settings
2. Enable custom SMTP and save (rate limit is set to 30)
3. Edit any SMTP field (e.g. change host or port)
4. Footer now correctly shows "Custom SMTP settings will be updated"
instead of the rate limit message
Made with [Cursor](https://cursor.com)
---------
Co-authored-by: vj2303 <vishnu.jangid@ax-ia.ai>
Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com>
## Context
Edge functions code editor which uses the FileExplorerAndEditor
component doesn't resize when the viewport shrinks
This PR fixes that + also refactors the FileExplorerAndEditor a bit to
resolve the lint issue with `nodeRenderer` by refactoring the prop into
a renderer that uses `useCallback`
This version fixes a problem in which the upgrade button was not
enabled. The last two versions (1.0.29 and 1.0.30) of
`stripe-experiment-sync` package returned version 1.0.28 from the
exported function `getCurrentVersion`. The `getCurrentVersion` function
is used by studio code to show the upgrade button if the installed
version is lower than the current version. Version 1.0.31 fixes this
bug.
