## Context
Found some links pointing to the old logs pages. Should point to unified
logs if unified logs have been enabled
Also deprecates the old `ServiceStatus` file that's no longer used
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated observability “logs” links to open the correct view when
unified logs are enabled, including service-specific filtering.
* Fixed navigation from log views to correctly preserve query strings.
* Refreshed project service status log links and health indicators to
stay consistent with the latest unified logs behavior.
* **Refactor**
* Consolidated service status UI and related logic into the project home
experience, replacing the prior shared implementation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES/NO
## What kind of change does this PR introduce?
Bug fix, feature, docs update, ...
## What is the current behavior?
Please link any relevant issues here.
## What is the new behavior?
Feel free to include screenshots if it includes visual changes.
## Additional context
Add any other context or screenshots.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the site’s credits/team listing to include an additional team
member name.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Stack 2/6** of the TanStack Start migration (#46424). Stacked on
**#47107** (S1) — review that first; this PR's diff is just the compat
shims.
> [!NOTE]
> Purely additive. Next never imports these files — under TanStack
they're wired in via Vite aliases (`next/*` → `@/compat/next/*`). No
routes consume them yet (that begins in stack 3).
## What's in this PR
`apps/studio/compat/next/*` — drop-in shims so the existing pages-router
code runs unchanged under TanStack Start:
- `link`, `router`, `navigation`, `head`, `image`, `legacy/image`,
`script`, `dynamic`, `server`, `_router-events` — React/runtime shims
over `@tanstack/react-router`.
- `api.ts` — `toWebHandler`, which adapts a pages-router API handler
`(req, res)` into a TanStack server-route Web `fetch` handler.
## Verification
On top of S1: `studio` typecheck ✓, lint (0 errors) ✓. Next build is
unaffected (nothing imports these under tsc).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added broad Next.js compatibility support for routing, links, dynamic
imports, images, scripts, head metadata, navigation hooks, server
responses, and API handlers.
* Improved handling of redirects, pathname/search params, base paths,
and event callbacks for smoother app behavior.
* **Tests**
* Added coverage for URL resolution and dynamic route interpolation to
verify Next-style routing behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
## Problem
The `NoticeBar` component is flagged as deprecated and should be
replaced by `Admonition`
## Solution
- Refactor `NoticeBar` usages to `Admonition` (no visual changes
detected)
- Delete `NoticeBar`
You can see one easily in _Project Settings/Compute and Disks_ and
opening the _Advanced disk settings_ collapsible section
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **UI Improvements**
* Updated disk management alerts and guidance to use a newer, more
consistent notification style.
* Improved visibility of messages for pending disk changes, permission
limits, AWS availability, and advanced disk requirements.
* Refreshed the compute-size upgrade prompt with the same updated alert
styling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Bug fix. Resolves DEPR-606.
## What is the current behavior?
On org Security settings, the MFA enforcement switch could appear on
without a green track. Users without personal MFA saw a disabled toggle
with a tooltip.
## What is the new behavior?
- Switch checked state renders correctly (removed tooltip trigger from
the switch).
- Users who need personal MFA first see an admonition with a link to
account security instead of a disabled toggle.
I felt this was a better user experience and more straightforward than
the alternative: fighting the TooltipTrigger’s `data-state` conflict
with the Switch’s checked state.
| Before | After |
| --- | --- |
| <img width="1024" height="563" alt="Security Organization Settings
Toolshed Supabase-4413F7B1-C7DC-4958-8C6F-ADEFDE4F310C"
src="https://github.com/user-attachments/assets/8c71b0d8-db49-4af5-874b-5372df03379d"
/> | <img width="1024" height="563" alt="Security Organization Settings
Toolshed Supabase-ADD5BC82-B433-4EA0-A6BB-874703150663"
src="https://github.com/user-attachments/assets/3c6d3545-fd58-426b-afaf-edd8f7ac4789"
/> |
| <img width="1024" height="563" alt="Security Organization Settings
Toolshed Supabase-F57ED4AA-5A56-4F6A-8F35-569CAC26AFA2"
src="https://github.com/user-attachments/assets/2bc49f34-7819-49fa-ac32-7e59678041fd"
/> | <img width="1024" height="563" alt="Security Organization Settings
Toolshed Supabase-AA795D85-1C17-4C08-9ED1-BBF08C28F2B4"
src="https://github.com/user-attachments/assets/db1822b0-17fc-42df-bdec-0935e46ab5ff"
/> |
| <img width="1024" height="563" alt="Security Organization Settings
Toolshed Supabase-8D8A196F-FA27-4FD3-BC52-DB933E61D59A"
src="https://github.com/user-attachments/assets/bae30a9e-eda9-4a97-845c-0c4751f03a05"
/> | <img width="1024" height="563" alt="Security Organization Settings
Toolshed Supabase-5BD4F063-B402-4E03-ACE4-254BB28C232C"
src="https://github.com/user-attachments/assets/0a3c4d6b-2981-47e9-9679-56bfcd7faf5d"
/> |
## Additional context
Test on `/org/<slug>/security` in light mode with and without personal
MFA enabled. Or just hardcode the ternaries to see the various states on
local.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added clearer guidance for organization security settings when MFA
must first be enabled on a personal account.
* Improved loading behavior while member data is fetched.
* **Bug Fixes**
* Prevented the MFA enforcement form from showing until personal MFA
requirements are met.
* Refined the MFA toggle disabled logic to apply only when appropriate.
* **UI Improvements**
* Replaced the MFA tooltip with an in-page notice.
* Updated the primary action button label from “Save changes” to “Save.”
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## Context
Realised that we were calling both `useDefaultRegionQuery` and
`useOrganizationAvailableRegionsQuery` in the new project page.
`smartRegionEnabled` defaults to `false` at the beginning while the
flags are still being loaded, to this calls `useDefaultRegionQuery`. But
once the flags are loaded and `smartRegionEnabled` becomes `true`, then
the other hook is called
## Changes involved
- Checks that the flags are loaded first before calling either hooks to
prevent unnecessarily triggering both
- Adjust `defaultRegion` to remove hardcode
- Check smart region first, then default back to default specific region
- Renamed variables to be clearer:
- `autoDefaultRegion` (check based on location)
- `fixedDefaultRegion` (hardcoded in repo)
- Update `useEffect` on `regionError` to only reset the region value if
the default value is not undefined
- Also just a tiny nit to re-arrange to group the `useEffects` together
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Region selection now waits for feature flags to load before fetching
default and “smart” region options, preventing premature or incorrect
region choices.
* New project setup now updates the database region and smart
recommendations more consistently, with improved fallback behavior when
region lookup fails.
* AWS Nimbus default region is now environment-aware: non-prod uses
Southeast Asia, while prod uses East US.
* Default privilege settings now stay in sync more reliably during
setup, updating only when appropriate.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
For unified logs, postgres connection logs are being filtered out by
default previously from this
[PR](https://github.com/supabase/supabase/pull/46371) due to its noise.
We're opting to show the connection logs by default instead so this PR
changes that behaviour + adjusts the connection logs filter UI
In particular this is timely as we're adjusting how the DB will log
connections based on this
[changelog](https://github.com/orgs/supabase/discussions/47197), and
we'd want to make sure that users can find their connection logs easily
## Changes involved
- [ ] Search parameter renamed to `show_connection_logs` so that we
don't need to flip its boolean value for the checkbox
- [ ] `show_connection_logs` is subsequently `true` by default
- [ ] Shift connection logs filter to a nested option under Postgres log
type
- Makes it more visual that connection logs are related to the Postgres
service
- Currently its hidden all the way in the bottom under "Misc" which can
be easily missed
- <img width="302" height="151" alt="image"
src="https://github.com/user-attachments/assets/e3e61ac7-aa16-4769-a89e-e911daacea27"
/>
- <img width="289" height="156" alt="image"
src="https://github.com/user-attachments/assets/c70ac7c4-d2f7-4961-a6d6-6653c59d8548"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Unified Logs now supports expandable, nested “Log Type” filter options
for drilling into connection-related entries.
* **UI Improvements**
* Connection logs are visible by default; the visibility control has
been integrated into the main filter experience.
* Filter panels are now streamlined, and key filters (such as “Level”,
“Status”, and “Method”) have been reordered and adjusted for a cleaner
default state.
* **Bug Fixes**
* Updated Unified Logs query/test behavior to match the new
connection-log visibility logic.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Improved AI, database, storage, and platform guides with clearer
explanations and more detailed workflow steps.
* Added descriptive captions and accessible alt text for multiple
diagrams and benchmark charts.
* Expanded MFA, connection, replication, partitioning, and integration
docs with clearer decision points and setup/login flow guidance.
* Clarified database schema and seed-data examples to better explain how
tables and relationships fit together.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Miranda Limonczenko <miranda.limonczenko@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs to expose current Realtime Broadcast Replay limits.
--
Fixes REAL-874
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Clarified how broadcast replay storage retention works, including the
daily-partition behavior and that replays are dropped after 72 hours
(messages are available for at least 72 hours and up to ~4 days
depending on send time).
* Updated the “Limits by plan” table with broadcast replay retention (72
hours) and broadcast replay messages per request (25) across all plans.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Bump several packages:
- Bump all instances of dompurify (patch version bump)
- Bump `posthog-js` to get a newer version of `@opentelemetry/core`
- Bump `@sentry/nextjs` to get a newer version of `@opentelemetry/core`
- Bump `redocly-cli` to get a newer version of `@opentelemetry/core`
- Bump `undici`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated several project dependencies to newer versions, including
documentation tooling, analytics, and error-tracking packages.
* These updates may improve stability, compatibility, and access to the
latest fixes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Part of consolidating all our code editors - removes all direct renders
of the `Editor` component and use `CodeEditor` instead
## UIs affected
- [ ] Query performance advisor -> query block
- [ ] Table Editor -> Table definition
- [ ] Table Editor -> Text + JSON editor (From RowEditorSidePanel,
expand input field)
- [ ] Auth -> RLS -> Create/edit policy code sections
- [ ] Storage policies -> Anywhere that has a code section
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Rolled out a consistent PostgreSQL code editor experience across
policy, storage policy, trigger function, table definitions, and query
performance screens.
* Updated policy/template previews to use the shared editor for cleaner
read-only viewing.
* **Bug Fixes**
* Removed extra left padding in the query performance editor wrapper.
* Improved the JSON editor action control with clearer icon behavior.
* **Refactor**
* Standardized editor usage by replacing legacy SQL/Monaco-based editors
with the shared CodeEditor and simplifying related editor components.
* Updated CodeEditor capabilities (read-only handling, wrapper styling,
markdown support) and tightened editor prop contracts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Repo cleanup. Removes stray PR-review screenshots that were accidentally
committed to `.github/pr-screenshots/docs-1080/` during the DOCS-1080
work.
## What is the current behavior?
Three PNGs remain in master under `.github/pr-screenshots/docs-1080/`
after PR #47252 merged:
- `pr1-hipaa-compliance.png`
- `pr1-logs.png`
- `pr1-postgres-connection-logging.png`
These were review artifacts and shouldn't live in the repo.
## What is the new behavior?
- Deletes the three PNGs.
- Leaves the `.github/pr-screenshots/` directory otherwise untouched.
## Additional context
Cleanup only — no code or docs change.
### Test plan
- [ ] Confirm the three files are gone from master after merge.
- [ ] Confirm no other file in the repo references those paths.
Co-authored-by: Nik Richers <nik@validmind.ai>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated the **API settings** link in the documentation intro to take
users to the correct project settings page.
* Cleaned up the surrounding text formatting so the sentence reads more
naturally.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Bug fix.
- Follow-up work to FE-3640
- Contributes to DEPR-604
## What is the current behavior?
Known dynamic OAuth requesters on `/dashboard/authorize` relied on
OAuth-specific hard-coded icon assets that were dark-mode only.
Cursor did not have separate light/dark assets in the shared MCP icon
registry, Perplexity only had a light tile asset with baked-in padding,
and OpenAI used the older blossom mark.
## What is the new behavior?
Known OAuth requester logos now resolve through the shared MCP icon
registry while preserving the existing `SupabaseLogo` treatment for
paired authorisation screens.
Cursor uses transparent SVG light/dark variants, Perplexity has cropped
transparent SVG light/dark variants, and OpenAI/ChatGPT uses the newer
monoblossom SVG in black/white variants. Claude remains static until a
suitable variant is available.
Unknown requester icons still render from the provided URL and fall back
to the requester initial if the image fails.
| Before | After |
| --- | --- |
| <img width="828" height="636" alt="Authorize OpenAI
Supabase-E2A05664-589F-458F-8452-9CEE008D558A"
src="https://github.com/user-attachments/assets/140021b1-ff05-4092-98ef-2eae94ff2ddb"
/> | <img width="828" height="636" alt="Authorize OpenAI
Supabase-EC7E00BD-439A-45D1-8E55-240B227C6897"
src="https://github.com/user-attachments/assets/93e603f2-5cbf-4219-b692-d36ac98e8d2a"
/> |
| <img width="828" height="636" alt="66 Authorize OpenAI
Supabase-CB31FF76-86DB-43A6-A426-46B99B8B1B91"
src="https://github.com/user-attachments/assets/b261416e-39b8-40b3-87fd-461653aa0334"
/> | <img width="828" height="636" alt="Authorize OpenAI
Supabase-EAFCF2F2-5CEA-4FE6-8AC0-819F764B414E"
src="https://github.com/user-attachments/assets/35ad7525-0fa9-4438-b117-4e70b78eb719"
/> |
## To test
1. Navigate to `http://localhost:8082/authorize?auth_id=test-auth-id`
2. Open DevTools → Network
3. Find `/platform/oauth/authorizations/test-auth-id`
4. Right-click → Override content
5. Replace the response body with:
```js
{
"name": "Perplexity",
"website": "https://perplexity.ai",
"icon": null,
"domain": "perplexity.ai",
"scopes": [],
"expires_at": "2026-12-31T23:59:59.000Z",
"approved_at": null,
"registration_type": "dynamic"
}
```
6. Then change "name" to Cursor, Claude, ChatGPT, or OpenAI and refresh
to inspect each logo
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* OAuth app requester logos now dynamically adapt to light and dark
themes, with improved logo selection for known requesters.
* Cursor now uses a distinct dark icon variant.
* Added Perplexity client icon support.
* **Bug Fixes**
* Improved logo rendering robustness: if a logo can’t be loaded, the UI
falls back to the requester’s initial.
* **Tests**
* Expanded coverage for theme-aware logo rendering and icon variant
handling, including unknown-icon and fallback scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Error messages were failing due to a error code collision with Auth.js
in supabase + gotrue, fix that so the error is not suppressed
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Removed the "Organization not found" error message that appeared when
navigating to invalid organization slugs.
* Streamlined redirect behavior for empty organization lists.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Supabase Studio > Table Editor > New/Edit Table
## What is the current behavior?
The `Default Value` has a white background and not matching the same
styling:
<img width="776" height="837" alt="Screenshot 2026-06-18 at 13 20 12"
src="https://github.com/user-attachments/assets/b48674d9-20cd-409a-8e9f-387d4fe9f87a"
/>
## What is the new behavior?
Input matches the other styling:
<img width="776" height="837" alt="Screenshot 2026-06-18 at 13 20 25"
src="https://github.com/user-attachments/assets/30cef35a-cab7-4141-bc9c-851e0881d8cb"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Updated styling for input fields in the table column editor to provide
a cleaner appearance.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
For notifications which affect a specific project, there's currently no
indication of when the notification was created at all, so this PR
addresses that
## Changes involved
- For notifications, show created at timestamp in header description
- Was previously showing project ref if present in notification
metadata, but it's repeated information as the affected project is
mentioned in the context section
- It'll still show the project ref in the list view, change is only in
the detail view (after clicking on a notification)
### Before
<img width="400" alt="image"
src="https://github.com/user-attachments/assets/e8ce247c-afa4-46df-832f-856d34ce82fd"
/>
<img width="400" alt="image"
src="https://github.com/user-attachments/assets/2e0a6c8a-3bb4-4c05-ae13-36b8a92e7ff0"
/>
### After
No change for notifications list view
<img width="400" alt="image"
src="https://github.com/user-attachments/assets/e741b607-c5ef-4cd0-9985-5957f2b52bfc"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved how advisor panel details are displayed, ensuring timestamps
and secondary text appear in the right situations.
* Hidden metadata when no relevant information is available, reducing
clutter in the panel.
* **Style**
* Updated a link layout in notification details for cleaner, more
consistent formatting.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What
PR 3 of a stacked refactor of the SQL editor snippet state. Replaces the
two overlapping pieces of snippet lifecycle state — the `savingStates`
map (`IDLE|UPDATING|UPDATING_FAILED`) and the `isNotSavedInDatabaseYet`
boolean — with a single `SnippetStatus` enum.
## Status is attached at the data layer (never absent)
- `SnippetStatus` + `SnippetWithContent` now live in `data/content`. The
snippet queries attach `status: 'saved'` via a typed `withSavedStatus()`
helper, and `upsertContent` returns `SnippetWithContent` so move/rename
responses carry status too.
- A SQL-typed `getSqlSnippetById`/`useSqlSnippetByIdQuery` returns
`SnippetWithContent` (the generic `useContentIdQuery` stays for Reports,
which use it). `[id].tsx` loads content with **no casting**.
- `'new'` is attached on local creation (`createSqlSnippetSkeletonV2`).
## Behavior
Behavior-preserving for the existing auto-save flow (faithful mapping of
both old fields, including the replication-lag swallow). One incidental
fix: the read-only/saving indicator now also covers a brand-new
snippet's first save (previously only re-saves of persisted snippets had
distinct saving/failed states in some paths).
## Tests
New `sql-editor-lifecycle.test.ts` (29 tests) covering every predicate
and transition; existing rules tests updated. `pnpm --filter studio
typecheck` clean; 52 state/sql-editor unit tests pass.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Refactor**
* Restructured SQL snippet persistence tracking, replacing boolean flags
with a comprehensive status system for clearer visibility into save
progress.
* Enhanced saving indicator UI to reflect accurate snippet save states.
* **Tests**
* Added test coverage for snippet persistence state transitions and
lifecycle scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The `alternative` variant for `<Button>` has been deprecated but is
still used in a few places.
## Solution
- Migrate usages to the recommended `primary` variant
- Delete the `alternative` variant
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Updated several buttons across forms, logs, recent queries, and
release headers to use the primary visual style.
* Button styling is now more consistent throughout the app, with a
cleaner default emphasis for key actions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Updated the link for checking IPv6 compatibility.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
docs update
## What is the current behavior?
https://test-ipv6.com, the original site we recommended to users to
check for IPv6 compatibility appears to be dead.
## What is the new behavior?
Changed the link to https://ipv6test.google.com/
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated IPv6 network support guidance to reference a new testing
resource.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Stack 1/6** of the TanStack Start migration (#46424), split into
reviewable, independently-mergeable PRs.
> [!IMPORTANT]
> **Next stays the default and only active framework after this PR.**
This wires up the Vite/TanStack-Start build pipeline behind the
`STUDIO_FRAMEWORK` flag, but there are no TanStack routes yet — so the
TanStack build isn't functional or tested until later PRs in the stack.
Nothing about the Next build, dev, or deploy changes behaviourally here.
## What's in this PR
- **Dispatch:** `dev`/`build`/`start` now go through
`scripts/dispatch.js`, which runs the Next variant unless
`STUDIO_FRAMEWORK=tanstack`. The original commands are preserved as
`dev:next`/`build:next`/`start:next`.
- **Build pipeline:** `vite.config.ts`, `serve.js`, `smoke-server.mjs`,
vite/tanstack deps, `turbo.jsonc`.
- **`tsconfig.json`:** `jsx: react-jsx`, `moduleResolution: Bundler`,
`target: ES2022`. Because `include` is `**/*.ts(x)`, this re-typechecks
the whole app, so the companion adaptations below land with it.
- **Shared adaptations (companions to the tsconfig change):**
`BufferSource` casts, `packages/ui` unused-`React` import removals, etc.
- **Routing/middleware plumbing:** `next.config.ts` +
`redirects.shared.ts` (redirect rules now shared with `vercel.ts`),
`proxy.ts`/`start.ts` middleware + `hosted-api-allowlist.ts`.
## Verification
Run locally off `master`: frozen install ✓, `studio` typecheck ✓, **Next
build ✓** (compiles + generates all routes), lint ratchet ✓ ("some rules
improved"), prettier ✓.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a hosted API endpoint allowlist to return 404 for non-supported
`/api/*` routes.
* Introduced a TanStack route-migration checklist and expanded TanStack
Start routing support.
* **Improvements**
* Enhanced deployment refresh/detection by tightening cookie handling
for “latest deployment” updates.
* Centralized redirect/maintenance-mode rules for consistent platform vs
self-hosted behavior.
* Improved production serving with a dedicated static + proxy server and
a post-build smoke test.
* **Dependencies**
* Updated TanStack-related packages and React Table/query tooling
versions.
* **Documentation / Chores**
* Updated formatting and tooling config; added shared build environment
parsing utilities.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Add myself to humans.txt
## What is the current behavior?
I am not in humans.txt
## What is the new behavior?
I am in humans.txt
## Additional context
🎉
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated team contributor list.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What is this PR?
This PR makes some images easier to understand by AI tools.
Some are removed as they served minimal purposes. Some are replaced with
mermaid versions instead, which are more understandable by AI tools.
Next steps after this PR are to continue migrating harder images as well
as improving the text around images in general.
## Testing
```
pnpm install
pnpm dev --filter=docs # or: cd apps/docs && pnpm dev
```
Then visit each converted page and verify:
Diagrams render as Mermaid (not a broken image / raw code fence) in both
light and dark mode:
- /docs/guides/auth/auth-mfa/phone, /totp
- /docs/guides/database/connecting-to-postgres
- /docs/guides/platform/read-replicas (inside the accordion)
- /docs/guides/storage/schema/design
- /docs/guides/local-development/seeding-your-database
- /docs/guides/auth/signing-keys (image gone, prose + table intact)
## Context
Includes `storage_logs` as a source for storage logs
Also shifts the connection filter logic into `buildBaseWhere` - realised
there's an issue with this where the facet count was showing a value but
there's no logs
<img width="1389" height="954" alt="image"
src="https://github.com/user-attachments/assets/5c1ee60f-4729-4e0c-868b-9f8167d82c51"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated unified logs query logic for the `storage` log type so it now
correctly includes both `storage_logs` and matching `edge_logs` entries
(based on request path), improving consistency in results.
* Ensured connection-lifecycle message suppression is applied uniformly
across unified log views and all related count/badge calculations,
keeping sidebar filters and badge counts aligned with the visible data.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
For unified logs, we're currently pulling data from `edge_logs` and
filtering on path like `/rest` to fill the `Postgrest logs`
However, `edge_logs` are logs from the API Gateway and Postgrest logs
has its own source `postgrest_logs`
## Changes involved
- Update source for postgrest logs to include `postgrest_logs`
- Improve labelling of log types
- Improve overflow scroll container max height of
`DataTableFilterCheckbox`
- Previously its max height of 200px was nicely fitting the height of 6
options, so there's no visual indication that there's more to scroll.
Hence adjusting to 215px to "peek" the next option as below:
<img width="283" height="315" alt="image"
src="https://github.com/user-attachments/assets/eb962d66-d575-4ee9-9f80-eaa2af0278ef"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Improvements**
* Enhanced log type filter labels in the Unified Logs interface for
improved readability.
* Expanded PostgREST log detection and categorization.
* Increased vertical space in checkbox filter dropdowns for better
content visibility.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Added alternative means of entry forms and added a new email for legal
contest inquiries.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated the contact email for the contest winners list request in the
contest rules page, improving accessibility.
* Enhanced the legal/amoe form with integrated customer data management
capabilities for more efficient form submission and data handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- Add `invalidatePermissionsQuery` helper to `permissions-query.ts`
- Invalidate it alongside organizations and projects in
`useOrganizationAcceptInvitationMutation`'s `onSuccess`, so permissions
are refetched before the redirect to the org.
## Testing
1. Invite a user to an org.
2. Accept the invite via the invite link.
3. Navigate to the org's Billing page.
4. Verify the Subscription and Cost Control sections load without "you
need additional permissions" errors (no manual reload needed).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed an issue where user permissions were not properly synchronized
after accepting organization invitations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES/NO
## What kind of change does this PR introduce?
docs update
## What is the current behavior?
missing mention of the audit logs drains
## What is the new behavior?
add audit logs drains info
## Additional context
<img width="942" height="396" alt="CleanShot 2026-06-22 at 18 10 06"
src="https://github.com/user-attachments/assets/7ca29e42-3d18-4a6a-9e2e-e9a274f393f4"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a new **“Accessing Audit Log Drains”** section explaining how to
stream platform audit log events in real time using **Audit Log
Drains**, including where to configure this in the dashboard.
* Updated the guide’s introduction to reference external streaming via
Audit Log Drains.
* Revised the **“Limitations”** section to remove the prior note about
lacking drain setup, while retaining the dashboard-export limitation and
the plan-based retention information.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes DOCS-974
<img width="891" height="328" alt="Screenshot 2026-06-22 at 3 11 13 PM"
src="https://github.com/user-attachments/assets/d7b49d56-cf77-4c1d-a933-7cbeab3168c2"
/>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## Problem
From Linear:
Accordion usage in the docs is inconsistent and can render with double
lines instead of single lines.
The current docs contribution guidance appears to recommend wrapping
accordions with an extra div, which seems to be the cause of the extra
divider in some pages.
## Solution
This PR:
- Removes all wrapping `divs` to AccordionItems that adds an extra
border
- For a11y, adds a cursor pointer and a slight bg color change on hover
to make the clickable area more obvious
- For a11y, adds reduce-motion option for animation and `aria-hidden` on
the chevron
**Note:** It is good for a11y to have more than one hover-state
indicator. For example, color-change and an underline.
## Tophatting
To review changes on the preview environment:
1. Go to `/docs/guides/platform/backups` and
`/docs/guides/platform/migrating-to-supabase/auth0#frequently-asked-questions-faq`.
2. Expand accordion.
3. See nothing visually odd such as strange spacing or double borders.
**Note:** To be exhaustive in your review, view all affected URLs and
scan the docs for `border-b` to see if there are any stragglers.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Enhanced accordion components with improved hover state styling for
better visual feedback.
* **Refactor**
* Simplified accordion markup across documentation pages for cleaner,
more consistent layout and improved component nesting structure.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
Yes
## What kind of change does this PR introduce?
Adds my name to the contributors list humans.txt
## What is the current behavior?
List doesn't have my name
## What is the new behavior?
List has my name
## Additional context
Awesome onboarding task
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated team information in documentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- closes https://github.com/supabase/supabase/issues/47221
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added permission-based access control for copying API keys and
environment variables. Users without the appropriate permissions will no
longer be able to copy sensitive values through the copy buttons.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Ali Waseem <waseema393@gmail.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update
## What is the current behavior?
There is no documentation explaining why Kong stops responding under
heavy load during local development with the CLI, or how to resolve it.
## What is the new behavior?
Added a new troubleshooting guide
(`kong-stops-responding-under-heavy-load-locally.mdx`) that:
- Explains why Kong becomes unresponsive under heavy load in local
development (single nginx worker process by default to minimize memory
usage)
- Provides clear solutions using the `KONG_NGINX_WORKER_PROCESSES`
environment variable
- Shows multiple usage examples (auto, fixed number, exported variable)
- Includes instructions for restarting the stack after changes
- Links to related resources (local development guide and CLI
repository)
## Additional context
This guide helps developers troubleshoot a common issue when running
bulk operations (e.g., Storage API operations) against a local Supabase
stack. The solution is straightforward but not immediately obvious
without documentation.
https://claude.ai/code/session_01DXB9PjcuKsNeWYyLFbTXoy
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added troubleshooting guide for Kong API gateway connectivity issues
under heavy load in local development, including symptom identification,
resolution steps for worker process configuration, and links to related
resources.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## Problem
The Selfhosted Studio E2E Tests workflow fails on community (fork) PRs
at the **configure aws credentials** step with:
> Credentials could not be loaded, please check your action inputs:
Could not load credentials from any providers
GitHub does not pass repository secrets to workflows triggered by
`pull_request` from a fork (a deliberate security measure). So on fork
PRs:
- `${{ secrets.PROD_AWS_ROLE }}` evaluates to an empty string, and
- the OIDC `id-token` token isn't available either,
so `aws-actions/configure-aws-credentials` falls through its entire
provider chain and errors out, failing the job.
## Fix
Guard the AWS credential + ECR login steps with
`!github.event.pull_request.head.repo.fork`, the same pattern already
used by the Playwright comment step in this workflow. These steps only
exist to authenticate with AWS ECR to avoid Docker pull rate limiting,
so on fork PRs we simply skip them and pull from `public.ecr.aws`
anonymously, letting the e2e tests run instead of erroring out.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Improved CI/CD pipeline security configuration to better safeguard
authentication credentials during external contributions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Opting to keep the prefetching behaviour on Project cards from the home
page, but skip waking the project if its hibernating
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Optimized project loading to skip unnecessary wake operations during
prefetch, reducing latency when browsing project lists.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This PR syncs the latest troubleshooting guides from the
supabase/troubleshooting repository.
Co-authored-by: github-docs-bot <github-docs-bot@supabase.com>
## What
PR 2 of a stacked refactor of the SQL editor snippet state. **Stacked on
#47203 (PR 1)** — review/merge that first.
Extracts scattered business rules + the upsert-payload builder into a
new **pure** module `apps/studio/state/sql-editor/sql-editor-rules.ts`
(no Valtio, React, toast, or runtime data-layer imports):
- `canEditSnippet` — read-only rule (shared snippet you don't own), was
inline in `MonacoEditor` `disableEdit`
- `isSnippetOwner` — owner check, was inline in `ReadOnlyBadge` /
`SavingIndicator`
- `validateMoveToFolder` — 'shared snippet cannot be within a folder',
was a buried `toast.error`
- `buildUpsertPayload` — the PUT /content payload, was an inline object
literal (all `??` defaults preserved)
- `isLoadedSnippet` — type guard (see below)
## Bug fix: no more empty-content saves (and no non-null assertion)
The old payload builder used `{ ...content!, content_id: id }`. Tracing
that `!` upstream surfaced a real bug: **favoriting a snippet from the
sidebar that had never been opened** enqueued a save with no loaded
content, producing a PUT with an empty content body (rejected by API).
The requirement that a persisted snippet has loaded content is now
enforced **at the type level** rather than by a runtime assertion or
comment:
- `buildUpsertPayload` accepts only a `LoadedSnippet` (content
non-nullable) — the `!` is gone.
- the save subscriber crosses that boundary via the `isLoadedSnippet`
type guard.
- the sidebar favorite toggle loads content first (mirroring
`onSelectDuplicate` / the share modals), narrowing the fetched union
content to the SQL variant via its discriminant — **no type cast**.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved consistency in read-only behavior and ownership checks across
the SQL editor by centralizing permission logic.
* Fixed favorite toggle to ensure snippet content is fully loaded before
persisting changes.
* **Refactor**
* Centralized SQL snippet permission rules and validation logic into a
dedicated helper module.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What
PR 1 of a stacked refactor that re-layers the SQL editor snippet state
(`apps/studio/state/sql-editor-v2.ts`). This first PR is a **pure
structural move with zero behavior change** — no consumer files are
touched.
- Relocates the Valtio store body into
`apps/studio/state/sql-editor/sql-editor-state.ts`
- Extracts the type declarations into
`apps/studio/state/sql-editor/types.ts`
- Adds `apps/studio/state/sql-editor/index.ts` as the public surface
- Keeps the old `apps/studio/state/sql-editor-v2.ts` path as a thin
re-export **facade**, so all existing importers keep working unchanged
## How to read the diff
`sql-editor/sql-editor-state.ts` (~507 lines) is the **verbatim
relocation** of the former `sql-editor-v2.ts` body — not new code. Git
does not show it as a rename because the old path is intentionally
retained as the facade. The only genuinely new lines are `types.ts`
(20), `index.ts` (8), and the facade itself (8).
## Why
The store has accreted four tangled responsibilities (snippet/folder
CRUD, query results, persistence, Assistant diff). The stack
incrementally splits these into pure rules, a persistent store, a
session store, and an injectable save mechanism whose trigger is a
swappable policy (setting up a future auto→manual save migration). Each
PR stays ≤300–400 non-test lines and behavior-preserving.
## Verification
- `pnpm --filter studio typecheck` passes (only pre-existing unrelated
module-resolution errors remain).
- Lint passes (no new errors).
- No consumer imports changed.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Restructured SQL editor state management into a modular architecture
with improved separation of concerns and enhanced code organization.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Tiny one - just fixes the URL for the disable advisor rules feature
preview
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved navigation in the Advisor feature to direct users to the
security rules section more accurately.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Adds a log configuration section under database settings, which exposes
2 toggles:
- Log connections
- Log disconnections
<img width="757" height="336" alt="image"
src="https://github.com/user-attachments/assets/e2615baf-f01b-43e2-b2a5-b106aacc59d9"
/>
UI changes are flagged for internal on prod
## To test
- [ ] Can toggle + save either options
- [ ] Configuration should load correctly with a refresh
- [ ] Should only be for hosted
Related docs PR: https://github.com/supabase/supabase/pull/47199
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added connection logging configuration for database projects, allowing
users to toggle logging of database connections and disconnections.
* The new settings UI is available on supported platforms and only when
the feature flag is enabled.
* Included backend-backed retrieval and updates for the PostgreSQL
configuration, with save/cancel behavior, form defaults, and
permission-aware controls.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What
Two fixes to the **Ltree indexes require reindexing** and **Custom
operator selectivity estimators** sections of the upgrade guide (added
in #47003):
1. **ltree affected-check was incomplete.** The section only showed how
to *find* ltree indexes — not how to determine whether the database is
actually affected. A project on a single-byte (e.g. LATIN1) + `libc`
database would run it, see its ltree indexes, and needlessly reindex.
Added the canonical `reindex_required` check (multibyte encoding **or**
non-`libc` collation provider) so unaffected users correctly see "no
action needed." This matches the detection used in the customer email,
the support playbook, and the dashboard upgrade warning.
2. **No version specified.** Neither section said which Postgres version
it applies to. Added `_Applies when upgrading to Postgres 15.18 or
17.10._` to both.
## Notes
- Docs-only change.
- supa-mdx-lint + prettier clean.
- Follow-up to #47003.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated upgrade guides for Postgres 15.18 and 17.10 with explicit
applicability notes
* Clarified the Ltree indexes reindexing workflow by adding an initial
“reindex required” check before identifying affected indexes
* Improved documentation for custom operator selectivity estimators with
clearer version-specific guidance
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Joshen Lim
