dima/supabase
1
0 Fork 0
mirror of https://github.com/supabase/supabase.git synced 2026-10-05 09:25:06 +03:00
Code Issues Packages Projects Releases Wiki Activity
37,997 Commits 1,797 Branches 62 Tags
b9ad5cede77f83e5aa6df7654fe4730bdfa05b21
Commit Graph
439 Commits
Author SHA1 Message Date
Joshen Lim b9ad5cede7 Bump monaco to 4.80 rc (#49265) 
## Context

Resolves FE-4209

Client crash occurs when re-ordering a QueryCell in the new explorer UI
with the error "InstantiationService has been disposed"

Investigated this with Claude which eluded that it's a bug that's within
the Monaco package which `4.8.0-rc.3` actually patched hence opting to
upgrade the package. Verified that monaco still functions as expected +
re-ordering query cells in the explorer UI no longer crashes

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Updated the Monaco Editor integration to release candidate version
4.8.0-rc.3.
  * No visible end-user functionality changes.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-20 12:26:31 +08:00
claude[bot]ClaudeIvan Vasilov
 		e66d8eb094 chore(deps): bump Supabase CLI to ^2.114.0 (speculative: Selfhosted Studio E2E Start supabase flake) (#49198) 
<!-- ccr-slack-attribution -->
_Requested by **Ivan Vasilov** · [Slack
thread](https://supabase.slack.com/archives/C063LNYJJKS/p1787058646458219?thread_ts=1787058646.458219&cid=C063LNYJJKS)_

**Before:** the root `package.json` pins the Supabase CLI at `supabase:
^2.76.10`, and `pnpm-lock.yaml` resolves it to `2.76.14`.

**After:** it pins `supabase: ^2.114.0`.

This bumps the Supabase CLI that `pnpm run e2e:setup:cli` and `pnpm run
setup:cli` shell out to, so local dev and the E2E workflows boot the
local stack with a CLI from this month instead of one from ~38 minor
releases ago.

**How:** a one-line version change to the `supabase` devDependency in
the root `package.json`. Nothing else in the repo changes — no workflow,
config, or test changes.

### ⚠️ This PR is incomplete: `pnpm-lock.yaml` still needs regenerating

`pnpm-lock.yaml` is **not** updated in this PR, so `pnpm install
--frozen-lockfile` will fail until someone runs:

```bash
pnpm install --lockfile-only
```

and pushes the result to this branch. The lockfile could not be
regenerated in the environment this PR was authored in: pnpm re-resolves
`apps/studio`'s `"@std/path": "npm:@jsr/std__path@^1.0.8"` on every
install, and `npm.jsr.io` is not reachable from there
(`ERR_PNPM_FETCH_403`). Treat this PR as needing one extra commit before
it can go green.

### Why `^2.114.0` and not `^2.115.0`

`2.115.0` is the current `latest` on npm, but it was published only
hours ago, and `pnpm-workspace.yaml` sets `minimumReleaseAge: 4320` (3
days) with `supabase` not in `minimumReleaseAgeExclude`. Pinning
`2.115.0` today would fail the repo's own supply-chain check. `2.114.0`
(2026-08-12) is the newest release that satisfies that policy.

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Dependency bump. **Speculative** — this is an experiment, not a
confirmed fix.

## What is the current behavior?

The `Selfhosted Studio E2E Tests` workflow has been failing on `master`
at the `Start supabase` step. Recent runs:

- https://github.com/supabase/supabase/actions/runs/32092940311
- https://github.com/supabase/supabase/actions/runs/32131961447

In the Slack thread, Ivan Vasilov suggested trying a newer CLI and
Alaister Young endorsed giving it a go.

## What is the new behavior?

The workflow runs `supabase start` with CLI 2.114.0 instead of 2.76.14.

The question this PR is trying to answer is simply **"does a newer CLI
help this flake?"** It is not a diagnosis and not a claimed fix. If CI
still fails at `Start supabase` on this branch, the bump can be kept or
dropped on its own merits and the investigation continues elsewhere.

## Additional context

**Verification status:** none locally. The bump was not exercised
locally — this repo checkout has no `node_modules` (see the lockfile
note above), so `pnpm typecheck`, `pnpm lint`, and `pnpm test:studio`
were not run, and neither was `supabase start`. CI on this PR is the
only signal.

**Call-site compatibility check.** CLI 2.99/2.100 moved to a new
TypeScript shell with a stricter argument parser: command-specific flags
must now come *after* the subcommand. Both call sites in the root
`package.json` already use that order, so no script changes are needed:

```
supabase stop --all --no-backup --workdir ./e2e/studio
supabase start --exclude studio,mailpit --workdir ./e2e/studio
```

**Changelog entries between 2.76.14 and 2.114.0 that touch `supabase
start` or local config.** Listed so reviewers know what changed in the
range — **not** as a claim about what is failing in CI:

- **2.112.0** — `supabase start` no longer hangs when analytics
migrations fail; the analytics container exits and retries instead of
booting against an unmigrated database
([#6093](https://github.com/supabase/cli/pull/6093)).
- **2.112.0** — `supabase start` reuses existing volumes instead of
failing when they already exist
([#6037](https://github.com/supabase/cli/pull/6037)); Kong reloads after
`supabase db reset`
([#6017](https://github.com/supabase/cli/pull/6017)); custom auth email
templates survive `db reset`
([#6065](https://github.com/supabase/cli/pull/6065)); `supabase start`
works on SELinux-enforcing hosts
([#6000](https://github.com/supabase/cli/pull/6000)).
- **2.106.0 — behavior change worth watching.**
`[api].auto_expose_new_tables` now resolves to `false` when unset, and
local start/reset revokes default Data API privileges for newly created
`public` tables, sequences, and functions
([#5524](https://github.com/supabase/cli/pull/5524)). Neither
`supabase/config.toml` nor `e2e/studio/supabase/config.toml` sets this
key, so this default applies. If E2E specs create `public` objects and
then read them through the Data API, they may need explicit `GRANT`s
(the deprecated escape hatch is `auto_expose_new_tables = true`).
- **2.106.0** — when the CLI detects a coding-agent environment, or
`--agent yes` is passed, commands default to JSON output
([#5532](https://github.com/supabase/cli/pull/5532)). `e2e:setup:cli`
already passes `--output json` to `supabase status` explicitly, so this
should be a no-op here.
- **2.100.0** — stricter flag ordering, covered above.
- **2.112.0** — `functions deploy` no longer forwards `NPM_AUTH_TOKEN`
into Docker bundling
([#6005](https://github.com/supabase/cli/pull/6005)). Not used by these
workflows.
- **2.107.0** — pg-delta is the default schema diff engine for `db diff`
/ `db pull` on new projects
([#5511](https://github.com/supabase/cli/pull/5511)).
- Many bundled Docker image bumps across the range (`supabase/postgres`
17.6.1.087 → later patches, `postgres-meta`, `vector` 0.28.1 → 0.53.0,
Studio image), plus `fix(analytics): wait for logflare before starting
vector` (2.84.3) and `fix: use correct docker.sock binding with vector`
(2.84.7).

Full comparison:
https://github.com/supabase/cli/compare/v2.76.14...v2.114.0


---
_Generated by [Claude
Code](https://claude.ai/code/session_0143DrDMGnSSwuHebTPJv7ZY)_

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
 2026-08-19 10:52:25 +02:00
Saxon Fletcher c80f8ad78d chore(studio): upgrade AI SDK to v7 (#49167) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Chore / dependency upgrade.

## What is the current behavior?

Studio is on AI SDK 6 (`ai` ^6.0.174, `@ai-sdk/react` ^3). Tool
approvals still use the v6 `needsApproval` flag on individual tools.

## What is the new behavior?

Upgrades Studio to AI SDK 7 (`ai` 7.0.59) and the matching `@ai-sdk/*`
packages. Aligns call sites with v7 names (`instructions`,
`isStepCount`, `onEnd`, `ToolExecutionOptions`).

This is the bottom of stack #49171. Later layers add a shared Confirm
card and AssistantQueryCell.

## Additional context

- Stack: #49167 → #49168 → #49169 → #49170
- `needsApproval` on tools is left as-is in this PR so the upgrade can
land independently. A follow-up can move those gates to `streamText({
toolApproval })` and `experimental_toolApprovalSecret`.
- Independent of the notebook preview stack
([#49112](https://github.com/supabase/supabase/pull/49112),
[#49159](https://github.com/supabase/supabase/pull/49159)), which should
merge first before we wrap notebook proposals in Confirm.

## Test plan

- [ ] `pnpm --filter studio test` for `lib/ai/tools/*` and assistant
generate path
- [ ] Assistant chat still streams and tool-approval SQL / Edge Function
still pause for confirm
- [ ] Evals still run with mock tools (`needsApproval: false` overrides)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Improvements**
* Updated AI-powered chat, onboarding, SQL, code completion, and recipe
generation workflows for more reliable responses.
* Streaming responses now better preserve reasoning and source
information where available.
* Improved tool privacy notices while preserving dynamically generated
tool descriptions.
* Refined AI response handling, including step limits and structured
policy results.
* **Bug Fixes**
* Improved compatibility across AI-powered tool interactions and
execution scenarios.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-18 17:04:36 +08:00
Ivan Vasilov c1b32ca6ea chore: Bump vulnerable dependencies (#48991) 2026-08-13 16:17:13 +02:00
Pedro RodriguesandClaude Opus 4.8 47595f8ac7 feat(self-hosted): implement queryLogs for the MCP debugging tools (#48900) 
> [!IMPORTANT]  
>
> Only merge this when (https://github.com/supabase/platform/pull/36804)
is merged, as the AI assistant will not have access to the `query_logs`
tool for the remote MCP server

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Feature (self-hosted / CLI Studio MCP server).

## What is the current behavior?

Self-hosted `getDebuggingOperations`
(`apps/studio/lib/api/self-hosted/mcp.ts`) implements only `getLogs`, so
the MCP `debugging` group exposes `get_logs` — a fixed per-service log
dump built by `getLogQuery`. Logs are served by Logflare, which speaks
BigQuery SQL.

## What is the new behavior?

Bumps `@supabase/mcp-server-supabase` to `^0.10.0` (adds `query_logs` +
`logsDialect`, and hides `get_logs` wherever a platform declares
`queryLogs`) and moves logs over to it.

- **Self-hosted `query_logs`:** declares `logsDialect: 'bigquery'` and
implements `queryLogs`, passing the model's SQL straight through to the
same Logflare `logs.all` endpoint (arbitrary `sql` param) — no new
endpoint, no dialect translation.
- **Drops `get_logs` from self-hosted:** `getLogs` throws (the server
hides it once `queryLogs` exists) and the per-service `getLogQuery`
builder is deleted; the model now writes its own BigQuery SQL, guided by
the dialect schema hint.
- **Honors no-logs mode:** `query_logs` throws when `logs:all` is
disabled — the self-hosted default, enabled via the
`docker-compose.logs.yml` override.
- **Assistant:** switches the dashboard assistant from `get_logs` to
`query_logs` (allowlist, drift guard, prompt, mocks, evals).

Refs AI-1046


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * AI debugging can query recent project logs using read-only SQL.
* Log queries support optional time-range filters, filtering,
aggregation, and joins.
* Self-hosted debugging checks whether logging is enabled before running
queries.

* **Bug Fixes**
* Updated debugging workflows and validation to consistently use the new
log-query capability.
* Removed reliance on legacy service-specific log filtering and query
behavior.

* **Documentation**
* Updated MCP debugging tool guidance to describe SQL-based log queries.

* **Tests**
* Expanded coverage for enabled, disabled, and unsupported logging
scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-08-12 13:11:23 +01:00
Miranda LimonczenkoandClaude Opus 5 f10f00ae69 fix(e2e): install e2e-shared when CI filters to a single suite (#48960) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Bug fix. Unblocks the WWW E2E check on `master`.

## What is the current behavior?

The WWW E2E job fails before running any test:

```
Error: Cannot find package '@axe-core/playwright' imported from /home/runner/_work/supabase/supabase/e2e/shared/axe.ts
Error: No tests found
```

Both E2E workflows install with a filter:

```
pnpm install --frozen-lockfile --filter=e2e-www...
```

The `...` suffix pulls in a package's declared dependencies. Neither
`e2e-www` nor `e2e-docs` declared `e2e-shared`; both reach it through
relative imports such as `../../shared/axe.ts`, which pnpm's dependency
graph cannot see. So the filter selected one project,
`e2e/shared/node_modules` was never created, and Node resolving
`@axe-core/playwright` from `e2e/shared/axe.ts` walked up to a root that
does not carry it under pnpm's isolated layout.

`e2e-docs` is broken the same way. It had not run against the shared
module yet, so it has not gone red.

## What is the new behavior?

`e2e-shared` is declared as a workspace dependency of both suites, so
the filter installs it.

| | Filter scope | Importing `e2e/shared/axe.ts` |
| --- | --- | --- |
| Before | 1 of 28 projects | `Cannot find package
'@axe-core/playwright'` |
| After | 2 of 28 projects | Imports cleanly |

The lockfile gains two `link:../shared` entries and no new downloads.

## Manual Testing

1. Check out this branch and delete the shared package's modules: `rm
-rf e2e/shared/node_modules`
2. Run the command CI runs: `pnpm install --frozen-lockfile
--filter=e2e-www...`
3. Confirm the output reports `Scope: 2 of 28 workspace projects` and
that `e2e/shared/node_modules` exists again.
4. Repeat steps 1 - 3 with `--filter=e2e-docs...`.

## Additional context

Fixing only the workflow lines, by adding a second
`--filter=e2e-shared`, would work as well. Declaring the dependency was
chosen instead because the dependency is real and every consumer of the
filter gets it, not just the two workflow files.

The imports stay relative. Declaring the workspace dependency is enough
to get the package installed, so no import paths change in this PR.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Updated end-to-end test packages to use shared testing utilities at
runtime.
  * Improved consistency between documentation and website test suites.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
 2026-08-11 16:17:29 -07:00
Miranda LimonczenkoandClaude Opus 5 6d3a4bcc48 feat(www) Add scaffolding for WWW E2E tests and CI check (#48861) 
Closes DOCS-1278

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Feature. Adds E2E test scaffolding and a CI check for the marketing
site.

## What is the current behavior?

Closes [FE-4047](https://linear.app/supabase/issue/FE-4047).

The marketing site has no E2E coverage. Docs has a suite in `e2e/docs`,
but its
runner, git helpers and axe reporting are private to that package, so a
second
site cannot reuse them.

## What is the new behavior?

* **A www suite scoped to changed content.** Changed `.mdx` files in
`_blog`,
`_events`, `_customers` and `_alternatives` map to the URLs they render.
Pages
with `disable_page_build: true` are skipped because they 404 by design.
Capped
at 20 pages. Enforces `heading-order` and `page-has-heading-one`,
matching docs.
* **`e2e/shared` The docs site is also static with similar needs. This
folder shares the docs logic with www.
* **A CI check that is safe to mark required.** Path scoping lives in a
`Detect changed paths` step rather than a `paths:` trigger, so the check
  reports on every pull request instead of being skipped.
`waitForVercelDocsPreview.js` becomes `waitForVercelPreview.js`, shared
by both
  workflows.

## How the check behaves

The job always reports a check run, so it is safe to mark required. Path
scoping
happens in a step rather than a `paths:` trigger, which would leave
non-www pull
requests waiting on a check that never reports.

| Case | Behavior |
| --- | --- |
| Fork pull request adds new pages | Passes without testing. The Vercel
wait is gated on `head.repo.full_name == github.repository`, so forks
resolve no preview URL. The job emits a `::warning` and a job summary
containing a ready-to-run `gh workflow run www-e2e.yml` command with the
resolved page paths, so a maintainer can run it against the preview. |
| Vercel preview times out or fails | Passes without testing. The wait
step is `continue-on-error: true`, so a 900s timeout or a failed
deployment leaves the URL unset and the suite skips. Vercel's own
`Vercel – zone-www-dot-com` check already reports the failure. |
| Draft pull request | Job does not run at all, gated at the job level
on `pull_request.draft == false`. `ready_for_review` is in the trigger's
`types`, so marking it ready runs the check. |
| Another app changed, www untouched | Job runs and every step skips.
The `www` filter matches only the four content directories, `e2e/www`,
`e2e/shared`, the lockfile, and this workflow. |
| Only the harness changed | Passes without testing. Scope resolves to
zero pages, and the Vercel wait is additionally gated on `www_app`, so
it does not wait for a preview Vercel skipped. |
| No preview resolves, any reason | Skips rather than falling back to
production. Production does not serve pages the pull request adds, so
testing it would fail a valid change. |

### Not covered

Changes to `apps/www` components and routes do not trigger this check —
only the
four content directories do. A follow-up can check global components
such as the navigation and the footer.

## Manual testing

1. Start the site: `pnpm dev:www`
2. Run `pnpm e2e:www` with no www content changed. It should resolve
zero pages
   and skip Playwright, not fail.
3. Touch a post, then run `pnpm e2e:www` again:
`echo "" >> apps/www/_blog/2024-01-01-some-post.mdx`. The resolved
`/blog/...`
   path should be listed before Playwright starts.
4. Run against production with no local server:
`PLAYWRIGHT_BASE_URL=https://supabase.com
WWW_E2E_PAGE_PATHS=/blog/postgres-language-server pnpm e2e:www`
5. Point step 4 at a page with a known heading problem. The failure
should name
   the rule, the CSS selector and the markup.
6. Confirm docs still passes on the shared runner: `pnpm dev:docs`, then
   `pnpm e2e:docs`

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added WWW end-to-end testing for affected content pages, including
accessibility checks.
* Added standard and full-site test commands, configurable preview
testing, and failure reports.
* Added shared utilities for page discovery, accessibility scanning, and
test execution.

* **Documentation**
* Documented WWW test setup, coverage, debugging, CI behavior, and
running checks against production or preview environments.

* **Improvements**
* Updated documentation test workflows to better identify affected
changes and handle preview environments.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
 2026-08-11 22:06:51 +00:00
Charis 7798e42435 feat(studio): notebook read tools (#48908) 
## Summary
- Adds `list_notebooks` (cursor-paginated) and `get_notebook` AI tools
in `lib/ai/tools/notebook-tools.ts`, modeled directly on
`report-tools.ts`: server-side `getContent`/`getNotebook` with the
`authorization` header forwarded, zod-validated input.
- `get_notebook` resolves every cell and exposes `unchecked_sql` as a
plain `sql` field for the agent to read — display only, per the
`safe-sql-execution` skill; nothing here executes SQL.
- Registers both tools in `lib/ai/tools/index.ts` (same platform branch
as reports) and in `lib/ai/tool-filter.ts`'s `toolSetValidationSchema` +
`TOOL_CATEGORY_MAP` (`SCHEMA` tier).
- Adds an optional `headers` param to `content-infinite-query.ts`'s
`getContent`, mirroring the sibling `content-query.ts`, so the
cursor-paginated fetch can carry the `Authorization` header from a
server context.
- New tools are behind the Explorer feature flag.

Stacked on #48907 (1.4 — notebook query and mutation hooks), per the
Notebooks implementation plan (stack 2.1).

Resolves FE-4081
Resolves FE-4080

## Test plan
- [x] `pnpm exec tsc --noEmit` — no new errors
- [x] `pnpm exec vitest run lib/ai/tools/notebook-tools.test.ts
lib/ai/tools/index.test.ts lib/ai/tools/report-tools.test.ts
data/content/notebooks` — 36/36 passing
- [x] `pnpm --filter studio run lint` — no new warnings
- [x] `pnpm exec prettier --check` on changed files — clean

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Added AI tools to list project notebooks with pagination.
* Added AI support for retrieving notebook markdown and resolved SQL
cell content.
  * Notebook tools now respect project and authorization context.
* Notebook features are available only when Explorer access is enabled.
  * Content requests can forward custom request headers.

* **Tests**
* Added coverage for notebook tools, Explorer access, feature flags,
authorization, pagination, and error handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-11 08:40:51 -04:00
supabase-supabase-autofixer[bot]andsupabase-workflow-trigger[bot] a6a12c40a9 feat: update @supabase/*-js libraries to v2.112.3 (#48928) 
This PR updates @supabase/*-js libraries to version 2.112.3.

**Source**: manual

**Changes**:
- Updated @supabase/supabase-js to 2.112.3
- Updated @supabase/auth-js to 2.112.3
- Updated @supabase/realtime-js to 2.112.3
- Updated @supabase/postgest-js to 2.112.3
- Refreshed pnpm-lock.yaml

---

## Release Notes

## v2.112.3

## 2.112.3 (2026-08-11)

### 🩹 Fixes

- **supabase:** add trace context headers to canonical CORS allow-list
([#2603](https://github.com/supabase/supabase-js/pull/2603))
- **supabase:** improve trace propagation sampling and diagnostics
([#2604](https://github.com/supabase/supabase-js/pull/2604))

### ❤️ Thank You

- Katerina Skroumpelou @mandarini
## v2.112.2

## 2.112.2 (2026-08-06)

### 🩹 Fixes

- **realtime:** prevent duplicate on bindings
([#2594](https://github.com/supabase/supabase-js/pull/2594))
- **realtime:** clear stale join payload on sign-out
([#2597](https://github.com/supabase/supabase-js/pull/2597))

### ❤️ Thank You

- Filipe Cabaço @filipecabaco
- Vaibhav @7ttp
## v2.112.1

## 2.112.1 (2026-08-05)

### 🩹 Fixes

- **auth:** preserve 5xx error message
([#2587](https://github.com/supabase/supabase-js/pull/2587))
- **realtime:** ensure setAuth doesn't disable token refresh
([#2592](https://github.com/supabase/supabase-js/pull/2592))

### ❤️ Thank You

- Eduardo Gurgel
- Vaibhav @7ttp
## v2.112.0

## 2.112.0 (2026-08-03)

### 🚀 Features

- **supabase:** move OpenTelemetry tracing to opt-in /tracing subpath
([#2583](https://github.com/supabase/supabase-js/pull/2583))

### 🩹 Fixes

- **auth:** accept uppercase UUIDs in validateUUID
([#2467](https://github.com/supabase/supabase-js/pull/2467))
- **postgrest:** honour throwOnError when maybeSingle finds multiple
rows ([#2580](https://github.com/supabase/supabase-js/pull/2580))
- **storage:** resolve createSignedUrls return type mismatch
([#2474](https://github.com/supabase/supabase-js/pull/2474))
- **storage:** expose service error code on StorageApiError
([#2537](https://github.com/supabase/supabase-js/pull/2537))
- **supabase:** forward db retry option
([#2571](https://github.com/supabase/supabase-js/pull/2571))

### ❤️ Thank You

- Anubhav Anand @i-anubhav-anand
- Gourab Singha @gourabsingha1
- Juhef @juheff
- Katerina Skroumpelou @mandarini
- Thribhuvan
- Vaibhav @7ttp
- Zuhef Ahmed @Zuhef
## v2.111.0

## 2.111.0 (2026-07-28)

### 🚀 Features

- **auth:** store PKCE verifiers in per-flow slots to survive
overlapping flows
([#2569](https://github.com/supabase/supabase-js/pull/2569))

### ❤️ Thank You

- Katerina Skroumpelou @mandarini

This PR was created automatically.

Co-authored-by: supabase-workflow-trigger[bot] <266661614+supabase-workflow-trigger[bot]@users.noreply.github.com>
 2026-08-11 11:32:52 +03:00
Miranda LimonczenkoandClaude Opus 5 777c02c205 test(docs): scan changed pages for WCAG 2.1 A/AA in warn mode (#48727) 
Closes DOCS-1233

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Test coverage. The docs accessibility check now covers the full WCAG 2.1
A/AA rule set instead of two rules.

**Note:** This PR tests _only_ the main article of changed pages
(meaning, the content itself). A follow-up Linear issue is to address
scanning the pieces outside of that: header, navigation, and interactive
elements.

## What is the current behavior?

The `@a11y` test in `e2e/docs` runs two axe rules against each in-scope
page, `heading-order` and `page-has-heading-one`. Both already pass
everywhere, so the check only guards a result we have. Nothing else in
WCAG A/AA is checked.

## What is the new behavior?

The same test runs the full WCAG 2.1 A/AA rule set.

- **Existing debt does not block PRs.** Only the two heading rules fail.
Everything else reports.
- **The check stays fast.** It scans the article only and skips nine
rules that cannot fire there. Scan time drops from 2405ms to 981ms.
- **Findings belong to us.** Legacy mode excludes cross-origin frames.
YouTube embeds were counting against us, 11 of 15 violations on one
page.
- **A pass carries meaning.** A 404 reports as a load failure, not an
a11y bug. A page scanned before it hydrates warns instead of quietly
reporting clean.

## How the findings appear

The test is named `has no blocking accessibility violations`, so a
failure listed by CI is always something to fix. It is not named for the
full rule set, because a green check would then claim more than the
check verifies.

| | Rules | Where you see it |
| --- | --- | --- |
| Blocking | `heading-order`, `page-has-heading-one` | Test failure, so
the runner reports it on the PR |
| Reported | Everything else in WCAG A/AA | `::warning` annotation on
the run |

An annotation looks like this, on a run that still passes:

```
::warning title=Accessibility::/docs/guides/database/functions has 1 non-blocking accessibility finding(s): frame-title (4)
```

The full axe result for each page is attached to the report as
`axe-results.json`.

## Matching the Studio ratchet

This follows the ESLint ratchet in `apps/studio`. That pattern warns on
pre-existing debt rather than blocking on it, surfaces findings as
annotations rather than PR comments, and promotes a rule to an error
once its violations reach zero.

The mechanism here is `ENFORCED_RULES` in `utils/axe-helpers.ts`. The
two heading rules are on it because the heading-hierarchy work drove
them to zero site-wide.

The intent is to migrate rules into that list one at a time. Pick a
rule, fix its violations, then move it into `ENFORCED_RULES` so it
cannot come back. An exhaustive scan of the site groups the current
backlog by root cause to sequence that work, and two fixes cover 99.1%
of it.

Studio keeps per-file baseline counts, which this does not. A whole-rule
list is coarser, and it works here because docs violations reach zero
across the site rather than per file.

## Manual testing

Install the browser once, then run each step from the repo root. Every
command scans production, so you do not need a local docs server.

```bash
pnpm -C e2e/docs exec playwright install chromium
```

1. Confirm a reported finding does not fail the check.

   ```bash
DOCS_E2E_PAGE_PATHS=/docs/guides/database/functions
PLAYWRIGHT_BASE_URL=https://supabase.com pnpm e2e:docs:a11y
   ```

Expect `1 passed`, and the `::warning` annotation above in the output.

2. Confirm the scan finds that violation. Same page, now failing on
every rule.

   ```bash
A11Y_ENFORCE_ALL=1 DOCS_E2E_PAGE_PATHS=/docs/guides/database/functions
PLAYWRIGHT_BASE_URL=https://supabase.com pnpm e2e:docs:a11y
   ```

Expect `1 failed`, reporting `frame-title (serious, 4 node(s))`. Steps 1
and 2 together are the point of this PR.

3. Confirm the skipped rules stay skipped.

   ```bash
A11Y_ENFORCE_ALL=1
DOCS_E2E_PAGE_PATHS=/docs/guides/getting-started/quickstarts/nextjs
PLAYWRIGHT_BASE_URL=https://supabase.com pnpm e2e:docs:a11y
   ```

Expect `button-name (critical, 2 node(s))` and `label (critical, 2
node(s))`, and no `color-contrast`.

4. Confirm a page that does not load reports a load failure.

   ```bash
DOCS_E2E_PAGE_PATHS=/docs/guides/does-not-exist-xyz
PLAYWRIGHT_BASE_URL=https://supabase.com pnpm e2e:docs:a11y
   ```

Expect `Expected a successful response for
/docs/guides/does-not-exist-xyz, got 404`, and no axe assertion.

5. Confirm the link checker still passes alongside the a11y test.

   ```bash
DOCS_E2E_PAGE_PATHS=/docs/guides/auth/passwords
PLAYWRIGHT_BASE_URL=https://supabase.com pnpm e2e:docs
   ```

   Expect `3 passed`.

## Known gaps

- `/docs/reference/*` is not scanned. Those routes render client-side
into tens of thousands of elements, where axe exceeds its timeout and
results depend on whether the scan caught the page mid-render.
- Shared chrome is outside the article scope, so nav, sidebar, footer,
menus, and drawers are not covered.
- axe catches roughly 30-40% of WCAG issues. Keyboard navigation, focus
management, and screen reader behavior still need manual testing.

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
 2026-08-07 10:41:23 -07:00
Gildas GarciaAli Waseemkemal.earth
 		cddb430310 feat(studio): scoped pat root branch (#48384) 
## Description

This is the Scoped PAT stacked PRs root branch

## How to test

### With the `scopedPAT` enabled (default on staging)

Go to
https://studio-staging-git-scopedpat-merge-token-lists-supabase.vercel.app/dashboard/account/tokens.
- You shouldn't see two tabs anymore
- If you had classic tokens, they should have the _Legacy_ badge
- You can create scoped tokens
- You have a way to copy newly created tokens before closing the form
side panel

### With the `scopedPAT` disabled (use the devtool to override)
- You shouldn't see two tabs anymore
- If you had classic tokens, they should **not** have the _Legacy_ badge
- You can create classic tokens
- You have a way to copy newly created tokens above the list upon form
submission

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Show classic and scoped access tokens together in one list, with
classic tokens labeled “Legacy” when the scoped experience is enabled.
* Add scoped access token creation with a two-step configure → review →
success flow (when enabled).
* Add a dismissible migration notice about scoped tokens with a link to
API docs.
  * Show “View permissions” only for scoped tokens.
* **Bug Fixes**
* Token deletion now supports both classic and scoped tokens with the
correct confirmation and success handling.
* The scoped tokens page now redirects to the unified access tokens
page.
* **Accessibility**
* Improved accessibility by adding a label to the token “more options”
action.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Ali Waseem <waseema393@gmail.com>
Co-authored-by: kemal.earth <606977+kemaldotearth@users.noreply.github.com>
 2026-08-06 07:40:56 -06:00
Danny White 73c9dbfa52 fix(studio): standardise custom icon weight (#48478) 
## What kind of change does this PR introduce?

Bug fix and internal tooling update. Resolves FE-3472.

## What is the current behavior?

Custom Studio icons use inconsistent source stroke widths, and some
child-level styling prevents component props from overriding them. Mixed
custom and Lucide icon sets can therefore appear uneven.

## What is the new behavior?

Custom stroke icons use a root-level `stroke-width="1.5"`; fill-only
logos use `stroke="none"`. The build validates that contract and
regenerated components preserve existing exports and props.

Studio applies the same `1.5` weight across Reports categories and uses
one shared destination icon mapping in the replication selector,
destination rows and diagram.

| Before | After |
| --- | --- |
| <img width="418" height="516" alt="56398"
src="https://github.com/user-attachments/assets/6afa7042-e6be-40e7-9911-af2f61238c9d"
/> | <img width="390" height="550" alt="CleanShot 2026-07-30 at 17 12
37@2x"
src="https://github.com/user-attachments/assets/870f49cf-c8fa-40db-8be8-2eb5f264ff4a"
/> |
| <img width="510" height="734" alt="CleanShot 2026-07-30 at 17 19
28@2x"
src="https://github.com/user-attachments/assets/a5b2c088-dcd2-4907-976b-5820794d06e3"
/> | <img width="554" height="742" alt="CleanShot 2026-07-30 at 17 16
06@2x"
src="https://github.com/user-attachments/assets/ed3a77c4-5d94-4ca7-b9e4-1403b725a981"
/> |


## Testing

At 100% zoom, compare custom and Lucide icon weight in:

- Reports: **Add your first chart** and **Add block**
- Database > Replication: the destination selector, destination rows and
replication diagram
- Command menu (`⌘K`): **Search Database Tables**, **Search RLS
Policies**, **Search Edge Functions** and **Search Storage**
- Authentication > Users: right-click a user row and compare the
context-menu icons
- Database > Schema Visualizer: open a table node overflow menu
- A paused project: **Export your data > Download backups**

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added consistent destination icons across replication panels, rows,
and diagrams.
  * Updated instance health and metric icons for clearer identification.
* Standardized icon stroke weight and reduced default icon stroke
thickness.

* **Documentation**
* Clarified custom icon requirements, default properties, and validation
guidance.

* **Bug Fixes**
* Improved consistency of icon rendering across replication destinations
and reports.

* **Tests**
* Added coverage for icon SVG validation and replication destination
icon rendering.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-03 17:48:50 +10:00
Miranda LimonczenkoandClaude Sonnet 5 8dda0c3910 Add heading-hierarchy a11y check to docs E2E tests (#48422) 
Closes DOCS-1232

## Problem

We do not have any tests to verify that we are following a proper
heading hierarchy. For a documentation site that deals in mostly static
content, this test is important.

Single h1 + logical heading hierarchy (h1→h2→h3, no skips) matters
because screen reader users navigate by jumping between headings —
broken structure breaks that navigation.

Relevant: WCAG 1.3.1 Info and Relationships (Level A) —
https://www.w3.org/WAI/WCAG21/Understanding/info-and-relationships.html

## Solution

Add Playwright axe-core, which we plan to expand later, to test only the
h1 and header-hierarchy rule.
This is added to our current suite that dynamically checks only pages
that are edited.

## Manual testing

1. Find a docs guide and intentionally break the header hierarchy.
2. Run `pnpm e2e:docs:a11y` and see your errors.
3. Resolve the issue and run again to see errors resolved. Ensure there
is at least a line changed to see the page tested.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Tests**
  * Added automated accessibility checks for documentation pages.
* Verified heading order and the presence of a level-one heading on each
page.
  * Added a dedicated command to run documentation accessibility tests.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
 2026-07-31 12:31:39 -07:00
Charis 50e1eb7436 chore(eslint): bump eslint-config-next to v16 for useEffectEvent (#48458) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Chore / build (ESLint config upgrade + lint cleanup).

## What is the current behavior?

`eslint-plugin-react-hooks` v5 (pulled in transitively by
`eslint-config-next` v15) doesn't recognize stable `useEffectEvent`, so
every effect that calls an effect-event handler needs an `eslint-disable
react-hooks/exhaustive-deps` to silence a false positive. There are 30
such dead disables across Studio.

## What is the new behavior?

Bumps `eslint-config-next` to v16, which pulls in
`eslint-plugin-react-hooks` v7 whose `exhaustive-deps` understands
`useEffectEvent`, and removes the 30 now-dead disable directives (and
their orphaned explanatory comments).

Supporting changes:

- **Flat-config migration**: v16 is a native flat-config array (v15 was
eslintrc), so `eslint-config-supabase` now spreads it directly instead
of bridging through `FlatCompat`.
- **React Compiler rules off**: v16 enables react-hooks v7's
`recommended`, which layers the React Compiler lint rules on top of the
two classic rules. These are switched off (derived dynamically from what
next enables) to keep this change scoped to the `exhaustive-deps`
improvement.
- **Plugin-registration fallout** (v16 scopes plugin registration to a
file glob rather than registering globally like FlatCompat did): stop
re-registering `@typescript-eslint` (shared) and `jsx-a11y` (studio);
scope our react / react-hooks / jsx-a11y rule overrides (studio, www) to
v16's plugin glob so they don't error on files outside it (e.g. `.cjs`).
- **Lint surface preserved**: v16's glob newly includes `.mts`/`.cts`
(v15 didn't lint them), which surfaced pre-existing errors in tooling
scripts. The shared config keeps the prior surface by leaving
`.mts`/`.cts` unlinted; linting them is left as a separate change.
- **Ratchet**: rebaselines `@tanstack/query/exhaustive-deps` 9 → 89. v15
forced next's `@babel/eslint-parser` onto `.ts` files, hiding these
deps; v16 parses `.ts` with `@typescript-eslint/parser` and correctly
surfaces the intentional `connectionString`-excluded-from-`queryKey`
pattern. Worth a follow-up to review whether any are real
cache-correctness bugs.
- Drops three now-dead devDeps from `eslint-config-supabase`:
`@eslint/eslintrc`, `@eslint/js`, `@typescript-eslint/eslint-plugin`.

Verified locally: `turbo run lint` → 7/7 packages pass with 0 errors;
Studio `lint:ratchet` passes; Prettier clean on changed files; typecheck
unaffected.

## Additional context

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Refined linting configuration and removed outdated lint suppressions
across Studio.
* Updated Next.js linting support and refreshed related development
configuration.
  * Expanded lint baseline coverage for query-related code.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-31 09:01:05 -04:00
Ivan Vasilov 6b14df7724 chore: Bump vulnerable deps (#48387) 
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
  * Updated Next.js, PostCSS, and tar package versions.
  * Added the required TypeScript native tooling where needed.
* Refined package configuration and dependency ordering across the
project.
  * Removed an unused empty dependency configuration.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-30 14:23:43 +02:00
Miranda LimonczenkoandClaude Sonnet 5 52cb1c2600 feat(docs) Dynamically E2E test all docs-owned content (#48320) 
Closes DOCS-1203

## Problem

The docs E2E workflow only ever tested one hardcoded page: the Next.js
quickstart. All other docs content had no E2E coverage.

## Solution

This PR expands the initial scaffolding to generalize the Next.js
quickstart tests, page runs and checks local links, to all pages
affecting Docs content:


- Add `resolveDocsScope` (`e2e/docs/utils/resolve-docs-scope.ts`) to map
changed guide and troubleshooting `.mdx` files to their `/docs/...` page
paths, and to expand changed `_partials` to every page that includes
them (including transitively, through partials nested inside other
partials). Federated guide sections (`graphql`,
`database/extensions/wrappers`, `ai/python`, `deployment/terraform`,
`deployment/ci`) and reference docs stay out of scope, and resolution is
capped at 20 pages to keep runtime bounded.
- Replace the single `quickstarts.spec.ts` test with a generic
`docs-pages.spec.ts` that loads whatever pages are resolved, asserting
each renders with an `<h1>` and that its docs-owned links resolve.
- Add `run-e2e-docs.ts` so `pnpm e2e:docs` resolves scope locally (from
commits since `origin/master`, plus staged/unstaged changes) and skips
Playwright entirely when nothing in scope changed.
- Update `.github/workflows/docs-e2e.yml` to widen the trigger paths to
all guides/troubleshooting/partials, resolve scope in a dedicated step,
skip the rest of the job when scope is empty, and accept a `page_paths`
input for manual `workflow_dispatch` runs.
- Rewrite `e2e/docs/README.md` to document the new scoping behavior, the
override envs (`DOCS_E2E_PAGE_PATHS`, `DOCS_E2E_BASE_REF`), and how CI
uses the suite.
- `pnpm e2e:docs:all` is also added to run tests on every page locally.
Good for scoping issues but should not be included in CI.

## Manual testing

Walk through the following steps to verify this works:

- [x] `pnpm e2e:docs` from repo root resolves the expected pages for a
local guide edit and can run against local dev
**Note:** Challenges with testing on local in part because of the long
lag for first page load. Recommendation to use a hosted URL is added to
docs.
- [x] Editing a shared `_partials` file resolves to every page that
includes it (including through nested partials)
- [x] `pnpm e2e:docs` exits cleanly with no Playwright run when no
in-scope files changed
- [x] `git diff --name-only ... | pnpm -C e2e/docs resolve-docs-scope`
prints the expected page list for a sample diff
- [x] Workflow run on a PR that only touches `e2e/docs`/workflow files
skips the Playwright steps
- [x] Manual `workflow_dispatch` run with `page_paths` set tests only
those pages
- [x] Run `pnpm e2e:docs:all` to run the suite on all docs content,
which takes awhile

## Next steps

After this PR merges, we have the scaffolding to add more fun tests like
a11y 😁

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added scoped Docs E2E runs that target eligible doc pages based on
changes, plus manual page-targeted runs and an “all eligible pages”
mode.
* Introduced `DOCS_E2E_PAGE_PATHS` (and updated base ref/base URL
behavior) to control which pages are tested.
* **Bug Fixes**
* Automatically skips Playwright setup when no relevant pages are in
scope; Playwright reporting now uploads only on failure.
* **Documentation**
* Updated the Docs E2E README with new run/CI behavior, troubleshooting
notes, and commands to inspect the resolved page list.
* **Tests**
* Added a Docs-owned pages E2E suite; removed the Next.js quickstart E2E
spec.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
 2026-07-28 00:04:58 +00:00
supabase-supabase-autofixer[bot]andsupabase-workflow-trigger[bot] b77f4f678c feat: update @supabase/*-js libraries to v2.110.9 (#48363) 
This PR updates @supabase/*-js libraries to version 2.110.9.

**Source**: supabase-js-stable-release

**Changes**:
- Updated @supabase/supabase-js to 2.110.9
- Updated @supabase/auth-js to 2.110.9
- Updated @supabase/realtime-js to 2.110.9
- Updated @supabase/postgest-js to 2.110.9
- Refreshed pnpm-lock.yaml

---

## Release Notes

## v2.110.9

## 2.110.9 (2026-07-27)

### 🩹 Fixes

- **auth:** downgrade stale refresh token console noise
([#2559](https://github.com/supabase/supabase-js/pull/2559))
- **realtime:** preserve presence refs
([#2566](https://github.com/supabase/supabase-js/pull/2566))
- **repo:** override sharp to >=0.35.0 to clear libvips advisory
([#2548](https://github.com/supabase/supabase-js/pull/2548))
- **repo:** populate symbols in sdk-compliance so capabilities are
verifiable ([#2547](https://github.com/supabase/supabase-js/pull/2547))
- **repo:** bump postcss, babel, next to clear audit advisories
([#2561](https://github.com/supabase/supabase-js/pull/2561))

### ❤️ Thank You

- Katerina Skroumpelou @mandarini
- Vaibhav @7ttp

This PR was created automatically.

Co-authored-by: supabase-workflow-trigger[bot] <266661614+supabase-workflow-trigger[bot]@users.noreply.github.com>
 2026-07-27 18:41:03 +03:00
Alaister YoungandAlaister Young 8d4d3b57e0 feat(studio): add tanstack variant to the studio docker image (#48091) 
Makes the self-hosted Docker image buildable with the TanStack/Vite
build alongside the existing Next one. The Dockerfile's new
`STUDIO_FRAMEWORK` build arg (default: `next`) selects which framework
lands in the image — the same variable `scripts/dispatch.js` keys on
everywhere else, so `--build-arg STUDIO_FRAMEWORK=tanstack` is the
docker spelling of the existing switch. Both flavors assemble a
normalized `/srv` tree, so a single production stage serves either with
the same CMD (`node apps/studio/server.js`), port 3000, and healthcheck.

Unlike Next's self-contained standalone output, the Vite SSR bundle
externalizes studio's dependencies and resolves them from `node_modules`
at request time, so the tanstack runtime tree is a prod-only `pnpm
deploy` plus the built `dist/`. The boot smoke test runs a second time
against that pruned tree, so a runtime import that's missing from
`dependencies` fails the image build instead of 500ing the deployed
container — which is exactly how this PR caught four packages
misclassified as devDependencies (`braintrust` +
`@smithy/property-provider` via the AI routes, `libpg-query` via the
parse-query API route, `@radix-ui/react-use-escape-keydown` via the
Queues panel; split into its own commit).

**Changed:**
- `apps/studio/Dockerfile`: `ARG STUDIO_FRAMEWORK` selects `build-next`
/ `build-tanstack` stages via `FROM build-${STUDIO_FRAMEWORK}`; both
normalize into one production layout
- `apps/studio/package.json`: moved the four runtime-imported packages
from devDependencies to dependencies (versions unchanged)
- `apps/studio/vite.config.ts`: pinned `preview.host` to `127.0.0.1` —
the prerender step boots `vite preview` and crawls its resolved URL, and
the default `localhost` host lets the server bind the IPv6 loopback
while the crawler fetches `127.0.0.1`, which ECONNREFUSEDs the whole
build inside BuildKit containers
- `.github/workflows/studio-docker-build.yml`: builds the tanstack image
as a second step (reuses the first build's layer cache; job name
unchanged)

**Added:**
- `build:studio:docker:tanstack` root script

Note: the tanstack image is ~2.0GB vs ~1.2GB for Next (externalized
`node_modules`); shrinking it via file tracing is a follow-up. Nothing
self-hosters pull changes until a tanstack-built image is published —
this makes it buildable and CI-checked.

## To test

- `pnpm build:studio:docker` then run the image against a stack —
behavior unchanged (healthcheck `/api/platform/profile` 200, `/` 307s to
`/project/default`)
- `pnpm build:studio:docker:tanstack` then run that image with the same
env — same healthcheck, redirect, and data endpoints (projects, pg-meta)
respond 200; browser loads Project Overview / Table Editor with no
requests leaving the container
- Both verified locally against the CLI stack (`host.docker.internal`
env, container reports `healthy`)
- Vercel + e2e checks on this PR exercise the `preview.host` change on
their runners

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **New Features**
- Added TanStack-based Studio build support with a framework-selectable
Docker image.
  - Added a local build command for the TanStack Studio Docker image.
- **Build & Deployment**
- Updated the Studio Docker build workflow to also publish a
TanStack-tagged Studio image when relevant.
- **Bug Fixes**
- Improved `vite preview` behavior in containers by binding to IPv4
loopback.
  - Standardized the Studio container runtime port to `3000`.
- **Chores**
  - Updated Studio runtime packages to support the TanStack build.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
 2026-07-24 15:32:05 +00:00
Danny White 6cff728742 feat(studio): polish Connect sheet mode selector and steps (#48266) 
## What kind of change does this PR introduce?

UI polish for the Connect sheet: clearer mode selection, wider sheet
layout, and step/content chrome across Direct, Server, MCP, and shadcn
flows.

## What is the current behavior?

- Connect modes use a weak selected state and an awkward grid layout.
- The sheet can jump width below the `lg` breakpoint when switching
modes.
- Direct connection chrome is noisy (reset in a footer, Title Case /
mono pooler labels, mismatched copy-button sizes).
- Several steps use admonitions or extra tips that repeat footer
guidance.
- Case-sensitive import of `InlineLink` breaks Linux/Vercel builds.

## What is the new behavior?

### Mode selector and sheet
- Stronger selected/hover treatment; comfortable single row that wraps
via `@container`.
- Empty odd slots use a sunk placeholder cell.
- Sheet uses `size="lg"` with `max-w-4xl` and `w-full min-w-0` so width
stays stable when switching modes.

### Steps chrome
- “Follow these steps” header with a copy-prompt action for coding
agents.
- Optional steps labelled `(optional)`.
- Shared `CodeBlock` for install snippets; MCP feature groups preselect
all except Storage.
- Server / shadcn tips folded into footers; IPv4 add-on admonition is
responsive with an inline Learn more link and a single Enable action.

### Direct connection
- Connection string and connection parameters stay one step (same
credentials, two formats).
- Reset database password lives in the string card title row beside
Shared/Dedicated pooler.
- Card titles use sans + sentence case (`Shared pooler`, `Connection
parameters`); `.env` stays mono.
- Icon-only copy buttons match CodeBlock square sizing; row actions sit
slightly closer to the right edge (`pr-2`).
- Shared pooler toggle copy clarified.

| Before | After |
| --- | --- |
| <img width="390" height="763" alt="API Keys Settings Chisel Toolshed
Supabase"
src="https://github.com/user-attachments/assets/adca3cc5-94f8-47e5-a4a2-2831790f430a"
/> | <img width="390" height="763" alt="API Keys Settings Chisel
Toolshed Supabase"
src="https://github.com/user-attachments/assets/f03afe58-e654-435e-a821-835f6243ca95"
/> |
| <img width="1718" height="1323" alt="API Keys Settings Chisel Toolshed
Supabase"
src="https://github.com/user-attachments/assets/79f08620-7e1e-4246-a70f-801606c0f499"
/> | <img width="1718" height="1323" alt="API Keys Settings Chisel
Toolshed Supabase"
src="https://github.com/user-attachments/assets/fb45e851-955e-46c2-90f1-afecb93d6ac4"
/> |
| <img width="1718" height="1323" alt="API Keys Settings Chisel Toolshed
Supabase"
src="https://github.com/user-attachments/assets/eda36d21-bba7-46ab-ad48-134acf93b471"
/> | <img width="1718" height="1323" alt="API Keys Settings Chisel
Toolshed Supabase"
src="https://github.com/user-attachments/assets/b7b728c6-fc92-46a7-8e3f-2f182c56ece7"
/> |

### Test plan

- [ ] Open **Connect** and confirm mode cells select/hover clearly;
narrow the sheet and confirm wrap + stable width.
- [ ] Direct: switch Direct / Transaction / Session; confirm pooler
title, reset in title row, parameters table, and percent-encode note.
- [ ] Toggle IPv4 shared pooler on Transaction; confirm string updates
and admonition/Learn more behaviour when on IPv4-only paths.
- [ ] Server: `.env` Copy all / row copy sizing; install command copy.
- [ ] MCP / shadcn / Framework: steps still resolve and copy prompt
still builds a useful agent prompt.
- [ ] Spot-check light/dark and a Linux/Vercel build (InlineLink import
casing).
 2026-07-25 00:13:54 +10:00
Francesco Sansalvadore 7c20cc574c feat(www): new changelog sync (#47880) 
## What kind of change does this PR introduce?

Sync changelog from private supabase/changelog.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Changelog entries now come from the structured changelog repository.
* Added filters for change type, product stage, and self-hosted impact.
* Updated badge UI for affected products and change types with filter
links.
* Changelog detail sidebar now shows lifecycle stage, sunset dates, and
self-hosted impact (when available).

* **Improvements**
  * Product category discovery and filtering now use affected products.
  * Discussion links show only when legacy discussion data is present.
* RSS feeds and generated changelog markdown now use the updated
metadata.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-23 11:16:39 +02:00
Ivan Vasilov 2428bddcb5 chore: Bump vulnerable deps (#48178) 
Fixes the following vulnerabilities:
- https://github.com/supabase/supabase/security/dependabot/3963
- https://github.com/supabase/supabase/security/dependabot/3963
- https://github.com/supabase/supabase/security/dependabot/3964
- https://github.com/supabase/supabase/security/dependabot/3965
- https://github.com/supabase/supabase/security/dependabot/3966
- https://github.com/supabase/supabase/security/dependabot/3927
- https://github.com/supabase/supabase/security/dependabot/3955
- https://github.com/supabase/supabase/security/dependabot/3913
- https://github.com/supabase/supabase/security/dependabot/3972
- https://github.com/supabase/supabase/security/dependabot/3959
- https://github.com/supabase/supabase/security/dependabot/3960
- https://github.com/supabase/supabase/security/dependabot/3916
- https://github.com/supabase/supabase/security/dependabot/3918
- https://github.com/supabase/supabase/security/dependabot/3947
- https://github.com/supabase/supabase/security/dependabot/3948
- https://github.com/supabase/supabase/security/dependabot/3956
- https://github.com/supabase/supabase/security/dependabot/3957
- https://github.com/supabase/supabase/security/dependabot/3958
- https://github.com/supabase/supabase/security/dependabot/3917
- https://github.com/supabase/supabase/security/dependabot/3919
- https://github.com/supabase/supabase/security/dependabot/3970
- https://github.com/supabase/supabase/security/dependabot/3928
- https://github.com/supabase/supabase/security/dependabot/3949
- https://github.com/supabase/supabase/security/dependabot/3950
- https://github.com/supabase/supabase/security/dependabot/3973
- https://github.com/supabase/supabase/security/dependabot/3920
- https://github.com/supabase/supabase/security/dependabot/3951

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Updated the bundled `tar` dependency to a newer patch version for
consistency and security across the workspace.
* Added/adjusted overrides to pin a few transitive dependencies to
specific versions.
* Normalized workspace configuration formatting and made minor
development configuration cleanup (no functional change).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-22 14:45:45 +02:00
supabase-supabase-autofixer[bot]andsupabase-workflow-trigger[bot] d847c48464 feat: update @supabase/*-js libraries to v2.110.8 (#48156) 
This PR updates @supabase/*-js libraries to version 2.110.8.

**Source**: supabase-js-stable-release

**Changes**:
- Updated @supabase/supabase-js to 2.110.8
- Updated @supabase/auth-js to 2.110.8
- Updated @supabase/realtime-js to 2.110.8
- Updated @supabase/postgest-js to 2.110.8
- Refreshed pnpm-lock.yaml

---

## Release Notes

## v2.110.8

## 2.110.8 (2026-07-21)

### 🩹 Fixes

- **auth:** downgrade aborted/transient fetch failures from
console.error to warn
([#2544](https://github.com/supabase/supabase-js/pull/2544))
- **functions:** clean up cross-signal abort listener on invoke() return
([#2487](https://github.com/supabase/supabase-js/pull/2487))
- **functions:** match response Content-Type case-insensitively
([#2515](https://github.com/supabase/supabase-js/pull/2515))
- **storage:** url-encode object key in CDN purge methods
([#2545](https://github.com/supabase/supabase-js/pull/2545))
- **supabase:** skip Node warning in Deno
([#2541](https://github.com/supabase/supabase-js/pull/2541))

### ❤️ Thank You

- Franco Kaddour @FrancoKaddour
- Katerina Skroumpelou @mandarini
- Pedro Henrique
- Vaibhav @7ttp
## v2.110.7

## 2.110.7 (2026-07-16)

### 🩹 Fixes

- **postgrest:** correct self-reference inference
([#2525](https://github.com/supabase/supabase-js/pull/2525))
- **realtime:** trigger set auth on INITIAL_SESSION event
([#2531](https://github.com/supabase/supabase-js/pull/2531))
- **realtime:** update phoenix to fix presence issue
([#2532](https://github.com/supabase/supabase-js/pull/2532))

### ❤️ Thank You

- Eduardo Gurgel
- Filipe Cabaço @filipecabaco
- Vaibhav @7ttp

This PR was created automatically.

Co-authored-by: supabase-workflow-trigger[bot] <266661614+supabase-workflow-trigger[bot]@users.noreply.github.com>
 2026-07-22 14:30:30 +03:00
Miranda LimonczenkoandCopilot Autofix powered by AI 9199aad57e feat(docs) Add scaffolding and CI/CD step for Docs Playwright (#48120) 
Closes DOCS-1197



## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## Problem

We do not have any E2E testing established. 

## Solution

This PR creates an ultra-lean starting place for Docs Playwright:

- A CI/CD step that skips on draft and relies on Preview for testing
- One simple broken link check for one page

The goal: 
- Playwright is implemented where we want it, with an architecture we
want, with set-up steps we can build from

The anti-goal of this PR:
- We have meaningful tests running

## CI/CD steps

<img width="1191" height="72" alt="Screenshot 2026-07-21 at 10 17 06 AM"
src="https://github.com/user-attachments/assets/eeb2454c-d864-4574-a050-ce39bb3f083f"
/>

1. Checkout a thin slice of the repo (`apps/docs`, `packages`,
`patches`).
2. Wait for the Vercel **docs** preview for that commit SHA.
3. Use that preview URL as `PLAYWRIGHT_BASE_URL`.
4. Install Node deps and Chromium.
5. Run `pnpm run e2e:docs` (`--grep @quickstart`).
6. If anything fails, upload the HTML report + traces.

Manual runs skip the Vercel wait and default to `https://supabase.com`
(or whatever URL you enter), then run the full suite (`pnpm run e2e`).

## What the test checks

Because this PR is scaffolding, it is doing something very basic:

1. Opens `/docs/guides/getting-started/quickstarts/nextjs` only if a
connected file was edited in CI/CD step
2. Asserts the page loaded and the H1 is visible.
3. Collects docs-owned `/docs/**` links from
`#sb-docs-guide-main-article`.
4. HTTP-checks each link (no full navigation) and soft-fails so every
broken link is reported.

Config keeps it cheap: Chromium only, 1 worker, 2 CI retries, failure
screenshots/traces.


## Docs vs Studio/Dashboard

The setup of Docs Playwright differs from Studio.

| | Docs E2E | Studio E2E |
|---|---|---|
| Location |`e2e/docs/` | `e2e/studio/` |
| What it tests | One published docs page + its links | Many Studio UI
flows (tables, auth, storage, …) |
| Where the app runs | Already-deployed **Vercel preview** | Built and
started **on the runner** |
| Backend needed | None | Local Supabase via Docker |
| Path filtering | Native `on.pull_request.paths` (skip whole workflow)
| `dorny/paths-filter` after checkout (workflow starts, heavy steps
gated) |
| Parallelism | 1 worker, no shards | Matrix of frameworks × 2 shards |
| Retries | 2 in CI | 5 in CI |
| Reports | HTML report on failure | Blob reports per shard → merge → PR
comment |
| Draft handling | Explicit draft skip | No draft skip today |
| Manual broader run | Yes (`workflow_dispatch`) | No |

The big conceptual difference: **Studio owns the environment** (build
Studio, start Supabase, hit `localhost`). **Docs borrows Vercel’s
preview** and only asks “does this page and its docs links work on the
deployed site?”

## Docs architecture justification

The docs architecture is deliberately lightweight because docs are
**static, published content served by Vercel**, not an interactive app
with a backend. That single fact justifies every difference:

- **Borrow the Vercel preview instead of building on the runner.** The
preview is already the exact artifact users will see, and Vercel builds
it for free on every PR. Rebuilding docs on the runner would duplicate
that work and risk testing something different from what ships. Studio,
by contrast, needs a running app plus a local Supabase, so it *has* to
own its environment.

- **No backend.** Docs pages don't need a database or auth to render, so
there's nothing to spin up. This is what keeps the job cheap enough to
run per-PR.

- **Native `paths` filtering.** Since the job is cheap and
self-contained, an all-or-nothing skip at the workflow level is
sufficient—no need for `dorny/paths-filter` to gate expensive setup
steps mid-run like Studio does.

- **Low parallelism and modest retries.** One page and its links is a
tiny surface, so 1 worker is plenty and there's no sharding to
coordinate. Retries exist only to absorb transient network flakiness
against a live URL, hence 2 rather than Studio's 5 (which also cushions
a heavier, stateful environment).

- **Non-blocking + draft skip + manual dispatch.** As initial
scaffolding checking link health on a deployed site, it should inform
rather than gate merges, avoid burning minutes on drafts, and still be
runnable on demand against production.

In short: **Studio owns its environment because it must; docs borrows
Vercel's preview because it can.** The scope is intentionally minimal
today.

## Testing

1. Break a docs-owned link in the Next.js quickstart.
1. Follow README instructions to set up and run e2e docs test.
1. Confirm the suite fails.
1. Restore the broken link and re-run.
1. Confirm the suite **passes** (`1 passed`).



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary

- **New Features**
- Added a GitHub Actions workflow to run Playwright docs end-to-end
tests on PRs and via manual dispatch (with optional base URL), including
docs-preview waiting and concurrency cancellation.
- **Documentation**
- Added `e2e/docs` README with setup, how to run the suite (including
UI/debug and single-spec), and how base URL selection works.
- **Tests**
- Added a quickstarts E2E spec that validates the page and soft-checks
docs-owned links resolve.
- **Chores**
- Added shared Playwright configuration/package scripts and an
`e2e/docs` `.gitignore` for test outputs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-07-21 14:59:10 -07:00
Ivan VasilovandClaude Opus 4.8 3d1d34bbc7 chore(studio): add valtio and react-hook-form ESLint ratchet rules (#48037) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Chore / tooling — adds new ESLint rules for `valtio` and
`react-hook-form`.

## What is the current behavior?

Studio uses `valtio` and `react-hook-form` heavily, but neither
library's dedicated ESLint plugin was installed, so their common API
pitfalls were only caught at runtime.

## What is the new behavior?

Adds `eslint-plugin-valtio` and `eslint-plugin-react-hook-form` (6 rules
total) as `warn`, wired into the existing lint ratchet
(`scripts/ratchet-rules.json` + baselines) so current violations are
grandfathered and only new ones fail CI — no existing code is changed.
Since `eslint-plugin-react-hook-form@0.3.1` still calls the removed
ESLint 8 `context.getScope()`, it is wrapped with `fixupPluginRules`
from `@eslint/compat` so its rules run under flat config / ESLint 9.

## Additional context

Baselines captured: `valtio/state-snapshot-rule` (1),
`valtio/avoid-this-in-proxy` (1), `react-hook-form/no-use-watch` (77),
and the three recommended react-hook-form rules (0 each).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Code Quality**
* Expanded linting for Valtio state usage, including safer proxy usage
and snapshot-related patterns.
* Added React Hook Form lint rules to encourage safer form state
handling and discourage problematic watch usage.
* Updated accessibility lint configuration and improved ESLint
reliability by enabling an ESLint 8→9 compatibility shim for affected
rules.

* **Maintenance**
* Updated ESLint rule baselines and ratcheting settings to match newly
enabled rules.
  * Added required ESLint plugins to the Studio linting setup.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-21 14:29:21 +02:00
Ivan Vasilov 24ce0ba5f8 chore: migrate repo to pnpm v11 (#48033) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Chore / dependency tooling update.

## What is the current behavior?

The repo is pinned to pnpm 10.24.0. Closes
https://linear.app/supabase/issue/FE-3673/migrate-the-repo-to-use-pnpm-v11.

## What is the new behavior?

The repo is pinned to pnpm 11.13.1, pnpm v11 workspace settings are
migrated to `allowBuilds`, and the Studio Dockerfile installs pnpm
11.13.1.

## Additional context

Validated with `CI=true mise exec node@22 -- pnpm install
--frozen-lockfile`, `mise exec node@22 -- pnpm run typecheck`, and `mise
exec node@22 -- pnpm run lint`; full Prettier check still fails on
existing generated docs/router files outside this migration.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Updated tooling requirements (pnpm **11.13.1**, Node **>=22.13**) and
aligned container build tooling accordingly.
* Adjusted package manager behavior (scoped registry override, update
notifications disabled) and workspace build/engine validation settings.

* **Maintenance**
* Updated `clean` scripts across apps/packages to remove only
build/cache artifacts (no longer delete installed dependencies).
* Reduced Turbo `clean` task output to **errors-only** for cleaner logs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-20 12:57:42 +02:00
Ivan Vasilov dc3c8684cc chore(deps): upgrade valtio to v2 (#48031) 
Audited all proxy()/useSnapshot() usage against the v1→v2 migration
guide; no breaking changes apply (no reused proxy() inputs, no
promise-valued state, all consumers already client components).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Updated the Valtio dependency to a newer version for improved
compatibility.

* **Bug Fixes**
* Improved AI assistant persistence in IndexedDB so chat sessions
reliably save (while keeping only the most recent 20 messages per chat).
* Hardened tabs restoration from storage to fall back to fresh defaults
when data is missing, invalid, or fails validation.

* **Refactor**
* Switched multiple studio panels to use fresh initial-state factories
for initialization and reset reliability.
* Updated advisor state so the derived notification filter count is no
longer exposed.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-17 15:51:54 +02:00
Alaister YoungandAlaister Young b9c8857394 fix(studio): TanStack route parity fixes from Next comparison audit (#48028) 
Audited every TanStack route (~300 files) against its Next.js
pages-router counterpart — layout wrapping, root providers, API routes,
and deploy config — and fixed the divergences found. Same bug class as
#48024, plus a few setup-level gaps.

**Fixed (user-visible):**
- `routes/__root.tsx` was missing `TimezoneProvider` + the
`TimestampInfoProvider` bridge, so the stored timezone preference was
silently ignored app-wide (timestamps always rendered in browser-local
time)
- `routes/_auth.tsx` wrapped all 10 auth pages in `AuthenticationLayout`
(status banners + extra full-screen scroll container); in Next only
`/sign-in` has it via getLayout. The parent is now a passthrough and
sign-in wraps at the leaf
- `routes/project/$ref/integrations.tsx` hardcoded
`ProjectIntegrationsLayout`; the Next pages use
`ProjectIntegrationsLayoutDispatch`, which switches to the Marketplace
layout when that flag is enabled
- `GlobalShortcuts` wasn't mounted, so the shortcuts-reference sheet
(`?`) and its command-menu entry were unreachable
- `routes/join.tsx` added a full-screen wrapper the Next page doesn't
have (double `min-h-screen` around `InterstitialLayout`)

**Fixed (behavior/config):**
- ConfigCat flags lost the `plan` custom attribute, so plan-targeted
flags could evaluate differently
- `vercel.ts`: `api/server.js` had no `maxDuration` (Next sets up to
300s per route — stripe-sync, AI streaming); added the
`/.well-known/vercel/flags` rewrite + JSON content-type (Flags Explorer
endpoint previously fell through to the HTML shell); added
`img`/`favicon` cache-control headers
- `routes/api/v1/.../functions/$slug/body.ts` (bespoke reimplementation)
dropped `apiWrapper`'s global catch — errors now get Sentry capture +
the same 500 `{ error }` body
- Reverted migration drift in `__root.tsx`: tooltip `delayDuration` 0 →
Radix default (matching Next), `og:image` back to `supabase-og.png`
- lodash → lodash-es for the whole SSR module graph (#48029, merged into
this branch): the lodash CJS build's named-export interop yields
non-functions under the Vite SSR module runner, which 500'd every page
once `GlobalShortcuts` (or anything calling lodash during SSR render)
mounted. An `options.ssr`-gated `resolveId` plugin in `vite.config.ts`
serves `lodash-es` (same version, real ESM) to app source, workspace
packages, and deps alike; client bundles untouched. Note: dev servers
need a restart after pulling this (config change)

Also corrected two stale route comments claiming the CLI/Stripe login
pages inline `APIAuthorizationLayout` (they inline
`InterstitialLayout`).

**Not changed (audited, intentionally left):**
- Redirect-only pages briefly flash `DefaultLayout` chrome under
TanStack (normally unreachable — router-level redirects fire first)
- Org pages inherit an inert `AppLayout` div via `routes/_app.tsx`
(visually a no-op; Next org pages don't have it)
- Adapter-level differences: framework 405s instead of Next's
`Allow`-header JSON, `bodyParser.sizeLimit` not enforced on two routes,
narrower favicon non-prod detection (commented as known)
- Known pre-existing dev console error (also on Next master): closing
the shortcuts sheet logs a setState-in-render warning —
`@tanstack/react-hotkeys@0.10.0` calls `setOptions` in the
`useHotkeySequence` render body, notifying `useHotkeyRegistrations`
subscribers mid-render. Worth an upstream report/dep bump as a follow-up

## To test

Verified on the local TanStack dev server via Playwright (all pass):
- Set a timezone in the account dropdown → log timestamps show that
timezone's row in the hover tooltip
- `?` opens the shortcuts sheet; `⌘K` → "Show all keyboard shortcuts"
does too
- `/sign-in` still shows banners/window chrome; `/sign-up`,
`/sign-in-sso`, `/forgot-password`, `/cli/login` render without the
extra wrapper
- `/project/<ref>/integrations` renders (legacy sidebar when marketplace
flag off)
- `/join` renders a single centered interstitial
- `og:image` meta is `supabase-og.png`
- Vercel deploy-button new-project page renders the consolidated #47995
form inside the window chrome
- `vercel.ts` changes are deploy-config only — verify Flags Explorer +
function timeout on a preview deploy

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **New Features**
  - Added timezone-aware timestamp handling across Studio.
  - Added support for global keyboard shortcuts.
- Updated authentication page layouts for a more consistent sign-in
experience.
  - Refreshed social sharing imagery.

- **Bug Fixes**
- Improved error reporting and responses when loading function source
files fails.
  - Improved handling of integration page layouts.
  - Fixed Vercel routing for feature configuration requests.

- **Performance**
  - Added caching for static images and favicons.
  - Increased server execution time for longer-running requests.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
 2026-07-17 16:42:10 +08:00
Alaister YoungandAlaister Young 58621818d0 feat(studio): switch TanStack skew protection to ?dpl= query params (#48008) 
Switches the TanStack build's Vercel skew protection from the `__vdpl`
session cookie to `?dpl=<deployment-id>` query params baked into asset
URLs at build time. Assets stay pinned to the deployment that built
them, while document navigations and API fetches always reach the latest
deployment (with the cookie, a session stayed fully pinned — including
reloads — until the tab closed).

**Removed:**
- `pinDeploymentForSession` (the `__vdpl` cookie) from `router.tsx`,
plus the cookie clearing in the refresh toast and the
`vite:preloadError` backstop
- `credentials: 'omit'` on the deployment-commit check — its only
purpose was escaping the cookie pin, and API fetches are now inherently
unpinned

**Added:**
- `skewProtectionDpl` plugin + `experimental.renderBuiltUrl` in
`vite.config.ts`, active only when `VERCEL_SKEW_PROTECTION_ENABLED=1`.
Full coverage needs three mechanisms (Vite has no single hook for this —
see
[vitejs/vite#13834](https://github.com/vitejs/vite/discussions/13834#discussioncomment-7469745)):
1. `renderBuiltUrl` — CSS `url()`s, images, workers, and
`__vite__mapDeps` preload lists
2. a `generateBundle` (`order: 'post'`) rewrite of chunk-to-chunk
`import`/`from` specifiers, which Rolldown emits as bare relative paths
that `renderBuiltUrl` never sees — with sourcemaps recombined per chunk
(`magic-string` + `@jridgewell/remapping` devDeps) so Sentry columns
stay exact
3. a post-`buildApp` patch of the prerendered `_shell.html`
(script/preload tags + embedded router manifest come from TanStack, not
Vite's asset pipeline); without it the entry graph double-downloads
because preload and import URLs differ

## To test

- Built with fake `VERCEL_SKEW_PROTECTION_ENABLED=1
VERCEL_DEPLOYMENT_ID=dpl_TESTPIN123abc`: every chunk import specifier
(static + dynamic), `__vite__mapDeps` entry, CSS font URL, and
`_shell.html` asset URL carries `?dpl=`; zero unpinned `/assets/`
references remain
- Sourcemap accuracy verified by tracing a minified position through the
recombined map: resolves to the exact original file/line/column
(`use-check-latest-deploy.tsx:62:8`)
- Built without the env vars: output contains no `dpl=` anywhere
(self-hosted/e2e builds unaffected)
- `smoke:tanstack` passes on both builds; `tsc --noEmit` and eslint
clean
- On the preview: load the dashboard, check Network tab — chunk/CSS
requests should carry `?dpl=` matching the deployment; hard reload
should hit the latest deployment (no pin on document requests)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Improvements**
* Improved deployment consistency by pinning generated asset and module
URLs to the current deployment (using `?dpl=`).
* Simplified refresh and preload-error recovery to reduce reload-loop
risk.
* Kept API request behavior aligned with the updated deployment
routing/pinning approach.
  * Preserved correct routing across deployment configurations.
* **Developer Experience**
* Added build-time tooling to rewrite pinned URLs for client assets
while maintaining source map integrity.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
 2026-07-16 23:46:40 +08:00
supabase-supabase-autofixer[bot]andsupabase-workflow-trigger[bot] 360bae3871 feat: update @supabase/*-js libraries to v2.110.6 (#47968) 
This PR updates @supabase/*-js libraries to version 2.110.6.

**Source**: supabase-js-stable-release

**Changes**:
- Updated @supabase/supabase-js to 2.110.6
- Updated @supabase/auth-js to 2.110.6
- Updated @supabase/realtime-js to 2.110.6
- Updated @supabase/postgest-js to 2.110.6
- Refreshed pnpm-lock.yaml

---

## Release Notes

## v2.110.6

## 2.110.6 (2026-07-15)

### 🩹 Fixes

- **postgrest:** type hinted self-referencing embeds as arrays
([#2520](https://github.com/supabase/supabase-js/pull/2520))
- **realtime:** forward opts to send() in track()
([#2490](https://github.com/supabase/supabase-js/pull/2490))
- **supabase:** warn instead of throw for unrecognized sb_ API key
subtypes ([#2526](https://github.com/supabase/supabase-js/pull/2526))

### ❤️ Thank You

- Franco Kaddour @FrancoKaddour
- Katerina Skroumpelou @mandarini
## v2.110.5

## 2.110.5 (2026-07-14)

### 🩹 Fixes

- **supabase:** avoid edge runtime warning
([#2522](https://github.com/supabase/supabase-js/pull/2522))

### ❤️ Thank You

- Vaibhav @7ttp
## v2.110.4

## 2.110.4 (2026-07-14)

### 🩹 Fixes

- **functions:** stop sending API key in Authorization header for
function calls
([#2511](https://github.com/supabase/supabase-js/pull/2511))
- **realtime:** encode broadcast header fields as UTF-8
([#2516](https://github.com/supabase/supabase-js/pull/2516))

### ❤️ Thank You

- Katerina Skroumpelou @mandarini
- Pedro Henrique
## v2.110.3

## 2.110.3 (2026-07-13)

### 🩹 Fixes

- **auth:** preserve pkce verifier
([#2513](https://github.com/supabase/supabase-js/pull/2513))
- **postgrest:** pin tstyche target off floating latest
([#2509](https://github.com/supabase/supabase-js/pull/2509))

### ❤️ Thank You

- Katerina Skroumpelou @mandarini
- Vaibhav @7ttp
## v2.110.2

## 2.110.2 (2026-07-09)

### 🩹 Fixes

- **auth:** clear local session on signout failures
([#2504](https://github.com/supabase/supabase-js/pull/2504))

### ❤️ Thank You

- Luc Peng

This PR was created automatically.

Co-authored-by: supabase-workflow-trigger[bot] <266661614+supabase-workflow-trigger[bot]@users.noreply.github.com>
 2026-07-15 19:25:03 +03:00
Francesco SansalvadoreAlan DanielAlex HallMiranda Limonczenko
 		d23f86021a feat(www): Partner Catalog update (#46757) 
## Info architecture change around "Partners"

The www "integrations" now become more partner-driven.
`/partners/integrations` -> now Partner Catalog under
`/partners/catalog` (old links redirect to new paths)

Moved them close together in the nav dropdown and in the footer
<img width="494" height="336" alt="Screenshot 2026-07-09 at 11 06 41"
src="https://github.com/user-attachments/assets/a875fef0-0ab8-47ca-8756-d658b27c4892"
/>
<img width="1149" height="665" alt="Screenshot 2026-07-09 at 11 09 48"
src="https://github.com/user-attachments/assets/9631bb72-fe25-4fb4-b1af-9f14a37d02e7"
/>

## /partners 

This page remains untouched in this PR, updates to layout, content and
intake form are delegated to #47874

## /partners/catalog

Listed in the
[catalog](https://zone-www-dot-com-git-feat-www-partners-pages-supabase.vercel.app/partners/catalog)
are now partners. Some partners match with a listing.

<img width="1207" height="866" alt="Screenshot 2026-07-09 at 11 14 17"
src="https://github.com/user-attachments/assets/b65216be-976f-4ef5-91f8-1ad49da87b45"
/>

## /partners/catalog/[partner]

Each partner can have one or more "listings" which are either 
- simple guides
- foreign data wrappers
- dashboard integrations

Integrations available in the dashboard now all have a prominent
"Install integration" cta to open it in the dashboard [integrations
page](https://supabase.com/dashboard/project/_/integrations).

<img width="1269" height="776" alt="Screenshot 2026-07-09 at 11 16 51"
src="https://github.com/user-attachments/assets/3c7bb715-ffce-4d0a-905f-9a660c3b1f5a"
/>

## Docs

Update docs →
[Preview](https://docs-git-feat-www-partners-pages-supabase.vercel.app/docs/guides/integrations)
- remove "Supabase marketplace"
- use "Dashboard Integrations and Partner Catalog
- update integrations in sidenav to link to updated /partners/catalog/**
listings

<img width="1520" height="696" alt="Screenshot 2026-07-15 at 12 54 47"
src="https://github.com/user-attachments/assets/9f5a2794-4536-4299-97df-9732d3d75b4c"
/>

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a Partner Catalog experience with search, category filters,
official-partner toggle, responsive filtering (sidebar + bottom sheet),
grid/list views, and featured partners.
* Added Partner Catalog detail pages with tabbed listings, MDX-rendered
content, image gallery with zoom overlay, and “add/install” actions.
* **Improvements**
* Updated “Become a Partner” layout and form support for prefilled
values and checkbox-group fields (including validation).
* Updated navigation/footer/docs and partner tile links to use Partner
Catalog routes; expanded redirects from legacy integrations paths.
  * Added public agent-skills discovery manifest.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Alan Daniel <stylesshjs@gmail.com>
Co-authored-by: Alex Hall <alex.hall@supabase.io>
Co-authored-by: Miranda Limonczenko <miranda.limonczenko@supabase.io>
 2026-07-15 11:10:51 +00:00
Guilherme Souza fd5ec9fade Revert "feat: update @supabase/*-js libraries to v2.110.5" (#47918) (#47945) 
Reverts #47918.

## Summary
- Reverts `@supabase/auth-js`, `@supabase/postgrest-js`,
`@supabase/realtime-js`, `@supabase/supabase-js` from 2.110.5 back to
2.110.1 in `pnpm-workspace.yaml` and `pnpm-lock.yaml`.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Updated Supabase package versions to improve compatibility and
consistency across the project.


<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-14 20:21:19 -04:00
supabase-supabase-autofixer[bot]andsupabase-workflow-trigger[bot] 3ed7c8f522 feat: update @supabase/*-js libraries to v2.110.5 (#47918) 
This PR updates @supabase/*-js libraries to version 2.110.5.

**Source**: supabase-js-stable-release

**Changes**:
- Updated @supabase/supabase-js to 2.110.5
- Updated @supabase/auth-js to 2.110.5
- Updated @supabase/realtime-js to 2.110.5
- Updated @supabase/postgest-js to 2.110.5
- Refreshed pnpm-lock.yaml

---

## Release Notes

## v2.110.5

## 2.110.5 (2026-07-14)

### 🩹 Fixes

- **supabase:** avoid edge runtime warning
([#2522](https://github.com/supabase/supabase-js/pull/2522))

### ❤️ Thank You

- Vaibhav @7ttp
## v2.110.4

## 2.110.4 (2026-07-14)

### 🩹 Fixes

- **functions:** stop sending API key in Authorization header for
function calls
([#2511](https://github.com/supabase/supabase-js/pull/2511))
- **realtime:** encode broadcast header fields as UTF-8
([#2516](https://github.com/supabase/supabase-js/pull/2516))

### ❤️ Thank You

- Katerina Skroumpelou @mandarini
- Pedro Henrique
## v2.110.3

## 2.110.3 (2026-07-13)

### 🩹 Fixes

- **auth:** preserve pkce verifier
([#2513](https://github.com/supabase/supabase-js/pull/2513))
- **postgrest:** pin tstyche target off floating latest
([#2509](https://github.com/supabase/supabase-js/pull/2509))

### ❤️ Thank You

- Katerina Skroumpelou @mandarini
- Vaibhav @7ttp
## v2.110.2

## 2.110.2 (2026-07-09)

### 🩹 Fixes

- **auth:** clear local session on signout failures
([#2504](https://github.com/supabase/supabase-js/pull/2504))

### ❤️ Thank You

- Luc Peng

This PR was created automatically.

Co-authored-by: supabase-workflow-trigger[bot] <266661614+supabase-workflow-trigger[bot]@users.noreply.github.com>
 2026-07-14 18:22:18 +03:00
Joshen Lim 1d29b4c5b4 Clean up RLS Tester artifacts (#47866) 
## Context

As per PR title - we're pausing the development of the RLS Tester
feature preview while we re-evaluate its direction. Have also updated
the GH discussion
[here](https://github.com/orgs/supabase/discussions/45233) RE this! 🙏

Removes the RLS Tester UI + Sandbox functionality

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Removed Features**
* Removed the RLS Tester feature preview, banner, and database policy
testing workflow.
* The related SQL testing, role selection, policy summaries, sandbox
management, and result views are no longer available.
* **Bug Fixes**
* Improved accessibility on the database policies page by adding a label
to the clear-filter button.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-13 17:01:05 +08:00
Ivan Vasilov d863da8680 chore: Bump vulnerable dependencies (#47686) 
Bump deps to fix
https://github.com/supabase/supabase/security/dependabot/3911.
 2026-07-10 14:01:09 +02:00
Alaister YoungAlaister YoungJoshen Lim
 		ad181489b1 feat(studio): adopt @sentry/tanstackstart-react server instrumentation on the TanStack build (#47724) 
Stacked on #47666 (base `alaister/tanstack-sentry-init`; retarget to
`master` when that merges). **Supersedes #47721** (the manual
`@sentry/node` wrapper). Client stays on #47666's `@sentry/react` setup.

Adopts the official `@sentry/tanstackstart-react` SDK **on the server
only**, after a spike (#47723) evaluating the full unified client+server
SDK. The spike found the SDK's **browser**
`tanstackRouterBrowserTracingIntegration` is a broken no-op stub at
10.59.0/10.64.0 — so the client stays on `@sentry/react` (whose
equivalent integration is a real, working implementation, already
shipped in #47666). The **server** exports, however, are a clear upgrade
and slot in cleanly.

### What this adds (server-side, TanStack build only)
- **`instrument.server.mjs`** — `Sentry.init` from
`@sentry/tanstackstart-react`, mirroring `sentry.server.config.ts` +
`release: VERCEL_GIT_COMMIT_SHA`.
- **`start.ts`** — `sentryGlobalRequestMiddleware` +
`sentryGlobalFunctionMiddleware` at the front of the existing
`createStart(...)` middleware. **This is the win**: it captures request-
and server-function errors *including the ones swallowed into 500s* —
the exact class the manual wrapper (and the Next server SDK) miss.
- **`api/server.js` / `scripts/serve.js`** — gated
(`STUDIO_FRAMEWORK==='tanstack'`) instrument init +
`wrapFetchWithSentry` on the handler.
- **`vite.config.ts`** — `sentryTanstackStart({ …,
autoInstrumentMiddleware: false })` as the last plugin: source-map
upload + release injection (skips gracefully without an auth token).
Middleware is wired explicitly rather than via the plugin's
string-rewrite.

### Guarantees
- **Client untouched** — the `@sentry/nextjs`→`@sentry/react` alias and
#47666's client init are unchanged.
- **Next untouched** — `instrumentation.ts` / `sentry.server.config.ts`
etc. stay as-is; all new code is TanStack-gated.
- **No server SDK in the client bundle** — verified after build: no
`@sentry/node` / server middleware / `wrapFetchWithSentry` in
`dist/client/assets` (`start.ts`'s server import is tree-shaken out).

### Verified
TanStack build exit 0 (past `assertNoChunkCycles`), post-build server
boot served `/api/get-utc-time → 200`, `tsc --noEmit` clean,
prettier/eslint clean. Node smoke: no-DSN init is a clean no-op; wrapped
handler returns 200.

### To test (deploy with a server DSN)
Throw a server error from an `/api/*` route (or a `/_serverFn/*`) —
including one that gets turned into a 500 without rethrowing — and
confirm a server event in Sentry with `release` = the deploy SHA.
Compared to #47721, the swallowed-500 case should now be captured via
the middleware.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added Sentry integration for the Studio app’s TanStack Start runtime,
including request and server-function instrumentation.
* Wrapped server request handling to capture errors reliably, with
tracing enabled.
* Updated build tooling to conditionally upload source maps when
credentials are present.

* **Bug Fixes**
* Improved resilience by safely falling back to a no-op Sentry setup if
instrumentation cannot be loaded.
* Ensured existing request protection remains enabled while adding
observability middleware.

* **Chores / Config**
* Added `SKIP_ASSET_UPLOAD` to the build environment list to control
cache/build behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-07-10 16:52:07 +08:00
Alaister YoungAlaister YoungIvan Vasilov
 		a3f2c4ffc1 chore(deps): upgrade to TypeScript 7 (native compiler) (#47757) 
Upgrades the monorepo to TypeScript 7.0.2, released 2026-07-08. `tsc` is
now the native Go compiler
([announcement](https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/))
— full turbo typecheck drops from ~56s to ~19s locally.

TS 7.0 ships **without a programmatic API** (it lands in 7.1), so this
uses Microsoft's recommended side-by-side setup: the `typescript` name
resolves to `@typescript/typescript6` (the 6.0 API republished) for API
consumers — typescript-eslint and Next.js build typechecking — while
`@typescript/native` (the real `typescript@7.0.2`) owns the `tsc` bin
that typecheck scripts run. Exactly one version of each is in the
lockfile; nothing imports the native package as a library. When 7.1 +
tool support lands we can collapse back to a single `typescript` dep in
the catalog.

**Changed:**
- `pnpm-workspace.yaml`: catalog aliases for `typescript` /
`@typescript/native`
- 17 package.json files: `@typescript/native` added beside each
`typescript` dep so every package's `tsc` is the native binary
- `apps/studio/tsconfig.json`: exclude `dist/` (gitignored build output)
from typechecking

**Fixed** (real type errors TS 6 under-reported):
- `packages/ui-patterns` CodeBlock: `borderLeft: null` → `undefined`
(`CSSProperties` doesn't accept null)
- `apps/www` CodeBlock: removed a JSX `@ts-ignore` comment that tsgo
doesn't honor and fixed what it masked (untyped `.js` theme objects,
possibly-undefined highlighter children)

⚠️ **Merge timing:** the new packages are inside pnpm's 3-day
`minimumReleaseAge` window until ~July 11. Installs from the committed
lockfile are unaffected (resolution is skipped), but anything that
forces a re-resolution before then will fail — hold off merging until
the window passes.

Note for editors: the compat package has no `lib/tsserver.js`, so VS
Code's "Use Workspace Version" won't work — use the bundled TS or the
TypeScript Native Preview extension.

## To test

- `pnpm install && pnpm typecheck` — all 15 tasks green, and
`./node_modules/.bin/tsc --version` prints 7.0.2
- `pnpm lint --filter=studio` — typescript-eslint still parses (resolves
the 6.0 API)
- `pnpm build --filter=design-system` (or any Next app) — Next's
tsconfig validation and build typecheck still work
- CodeBlock rendering on www (syntax highlighting, line highlights
with/without border) — the two fixes are behavior-neutral but worth an
eyeball

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Improvements / New Features**
* Enhanced TypeScript tooling support across the workspace for smoother
development builds and checks.

* **Bug Fixes**
  * Code blocks render more reliably when content is empty or missing.
  * Highlighted code line styling applies more consistently.

* **Maintenance**
* Studio TypeScript builds now avoid including generated output (such as
`dist`) during compilation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
 2026-07-09 14:07:17 +02:00
Ivan VasilovandClaude Opus 4.8 369744eb2b chore: replace concurrently with npm-run-all in docs and design-system (#47697) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Chore / dependency cleanup.

## What is the current behavior?

`apps/docs` and `apps/design-system` use the `concurrently` package to
run their parallel dev scripts, while the rest of the monorepo (e.g.
`packages/pg-meta`) already relies on `npm-run-all`.

## What is the new behavior?

Both apps now use `npm-run-all` (`run-p`), and `concurrently` is dropped
from their dependencies and the lockfile; `apps/docs` keeps its
kill-on-exit behavior via `run-p --race`, and `apps/design-system`'s
`dev:full` is collapsed into `dev` using the `run-p dev:*` glob (with
`dev:next`/`dev:content` sub-tasks and README updated to match).

## Additional context

N/A

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Updated design system setup instructions to reflect the new
development workflow and MDX watching behavior.
* **Chores**
* Simplified local development scripts for the design system and docs
apps.
* Split the dev workflow into separate commands for the app server and
content watcher, making it easier to run and troubleshoot.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-07 15:47:23 +00:00
supabase-supabase-autofixer[bot]andsupabase-workflow-trigger[bot] 69121ed8e6 feat: update @supabase/*-js libraries to v2.110.1 (#47687) 
This PR updates @supabase/*-js libraries to version 2.110.1.

**Source**: supabase-js-stable-release

**Changes**:
- Updated @supabase/supabase-js to 2.110.1
- Updated @supabase/auth-js to 2.110.1
- Updated @supabase/realtime-js to 2.110.1
- Updated @supabase/postgest-js to 2.110.1
- Refreshed pnpm-lock.yaml

---

## Release Notes

## v2.110.1

## 2.110.1 (2026-07-07)

### 🩹 Fixes

- **auth:** defer init-time notifications until initializePromise
resolves ([#2498](https://github.com/supabase/supabase-js/pull/2498))
- **realtime:** suppress disconnected status from onHeartbeat consumers
([#2496](https://github.com/supabase/supabase-js/pull/2496))

### ❤️ Thank You

- Katerina Skroumpelou @mandarini
## v2.110.0

## 2.110.0 (2026-06-30)

### 🚀 Features

- **repo:** drop Node.js 20 support
([#2482](https://github.com/supabase/supabase-js/pull/2482))

### ❤️ Thank You

- Katerina Skroumpelou @mandarini
## v2.109.0

## 2.109.0 (2026-06-30)

### 🚀 Features

- **auth:** add custom_claims_allowlist to custom providers admin API
([#2473](https://github.com/supabase/supabase-js/pull/2473))
- **realtime:** add postgres_changes filter builder, new operators and
select ([#2463](https://github.com/supabase/supabase-js/pull/2463))
- **storage:** expose purgeCache for buckets and single objects
([#2429](https://github.com/supabase/supabase-js/pull/2429))

### 🩹 Fixes

- **functions:** honor a caller's Content-Type override regardless of
casing ([#2455](https://github.com/supabase/supabase-js/pull/2455))
- **realtime:** pin @supabase/phoenix and browser test CDN deps
([#2457](https://github.com/supabase/supabase-js/pull/2457))
- **realtime:** add replication connection system message option
([#2470](https://github.com/supabase/supabase-js/pull/2470))
- **storage:** keep sortBy defaults when list() is given a partial
sortBy ([#2454](https://github.com/supabase/supabase-js/pull/2454))

### ❤️ Thank You

- Anubhav Anand @i-anubhav-anand
- Cemal Kılıç @cemalkilic
- Claude Opus 4.8 (1M context)
- Filipe Cabaço @filipecabaco
- Katerina Skroumpelou @mandarini
- Lenny
- Rodrigo Mansueli @mansueli

This PR was created automatically.

Co-authored-by: supabase-workflow-trigger[bot] <266661614+supabase-workflow-trigger[bot]@users.noreply.github.com>
 2026-07-07 17:26:15 +03:00
Gildas Garcia 4b7cb27ba9 chore: refactor docs tabs (#47557) 
## Problem

Now that `docs` is the only place where we use the deprecated `ui/Tabs`,
we can move this component and the related HOC from `ui-patterns` in
`docs`

## Solution

- Move `ui/Tabs`, `ui-patterns/ComplexTabs/withQueryParams` and
`ui-patterns/ComplexTabs/withSticky` to `docs`
- Refactor `ui-patterns/ComplexTabs/withQueryParams` and
`ui-patterns/ComplexTabs/withSticky` HOCs as hooks to make them easier
to understand
- Refactor `Tabs` accordingly

No visual nor functional changes.

## How to test

On
https://docs-git-chore-refactor-docs-tabs-supabase.vercel.app/docs/guides/auth/passwords
(Tabs are driven by URL and the flow tabs should have sticky headers
even though there's a CSS bug already reported)
- check that by default, the first tab in each tabs is active
- change the tabs in different groups and validate it works
- refresh the page and check that previously selected tabs are active
(URL based selection)
- In a new tab, visit
https://docs-git-chore-refactor-docs-tabs-supabase.vercel.app/docs/guides/auth/passwords
again and check that previously selected tabs are active (LocalStorage
based selection)

Do the same on
https://docs-git-chore-refactor-docs-tabs-supabase.vercel.app/docs/guides/database/database-advisors
(This one is driven by URL but does not have sticky tab headers)

Do the same on
https://docs-git-chore-refactor-docs-tabs-supabase.vercel.app/docs/guides/deployment/terraform/reference
(this one is not driven by URL nor has sticky tab headers)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Docs tabs now persist and restore the active tab via URL query
parameters.
* Added optional “sticky” tab behavior that keeps the active panel in
view.
  * Enhanced keyboard interaction for selecting tabs.
* **Bug Fixes**
* Improved active-tab initialization and synchronization when the URL
query changes.
* **Chores**
* Refreshed the tabs UI implementation and styling to improve
consistency and remove deprecated tab exports from shared UI packages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-07-04 02:44:29 +10:00
Greg RichardsonChris ChinchillaChris Chinchilla
 		74881cbb73 feat: render the mcp config component as markdown (#47292) 
Renders the MCP config component as markdown for static markdown builds.
Currently we have no special case for `<McpConfigPanel />`, so it gets
stripped out during markdown rendering. This adds a static markdown
version of this component that renders all agents/tools consecutively.

Adds a new `McpConfigPanel.md.tsx` component that reuses data structures
used by `McpConfigPanel.tsx` but renders as markdown instead of React.
Instead of building the markdown via string concatenation, we use
[supabase-community/mdast-jsx](https://github.com/supabase-community/mdast-jsx)
which allows you to author markdown using JSX (providing type safety,
better DX, maintainability). E.g.

```jsx
<code lang="json" value='{ "key": "value" }' />
```
produces:
````md
```json
{ "key": "value" }
```
````

## Preview

https://docs-git-feat-mcp-config-markdown-supabase.vercel.app/docs/guides/ai-tools/mcp.md

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

- **New Features**
- Added a docs-only MCP configuration panel with client-specific setup
steps, deep links, and generated configuration snippets.
- Enhanced guide generation to render richer, component-produced
markdown content.

- **Bug Fixes**
- Improved MCP config serialization and display for consistent
JSON/YAML/TOML output.

- **Refactor**
- Centralized MCP client metadata, instruction content, and config
build/serialization logic for reuse.

- **Chores**
- Expanded package exports for MCP URL builder assets and utilities;
improved runtime code-block language validation and updated PNG asset
typing.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
 2026-07-02 14:00:33 +02:00
Gildas Garcia 0e3364bbad Chore/cleanup studio deps (#47399) 
## Problem

Knip reported some unused dependencies. Some are actually used in
builds, etc but others are not.

## Solution

Remove the really unused dependencies

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Cleaned up unused dependencies and removed some obsolete test/support
files.
* Updated project ignore rules to better match current app structure and
generated files.
* **Bug Fixes**
* No user-facing behavior changed; this release is focused on
maintenance and cleanup.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-30 14:03:40 +02:00
Ivan Vasilov 0361d1b727 chore: Remove CDN loading for the Monaco editor in all environments (#47182) 
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Standardized Monaco Editor package versions across the workspace using
the shared dependency catalog.
* **Bug Fixes**
* Improved Monaco initialization by configuring asset loading only on
the client and serving Monaco assets from a single base-path URL
(removing platform-specific switching).
* Streamlined Monaco stylesheet injection in Studio’s document
rendering.
* **New Features**
* Added/updated Monaco language support in Studio, including GraphQL,
SQL, and PostgreSQL, with refreshed HTML, JSON, and CSS editor modes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-30 13:57:31 +02:00
Francesco Sansalvadore cd62b0b9d4 www: product pages (#47271) 
Update product pages in marketing website.

PR breakdown of #43455 
Related: #47226 #47227 #47228 #47236
 2026-06-26 15:47:52 +02:00
Ivan Vasilov 631209f7ce chore: Bump vulnerable dependencies (#47269) 
Bump several packages:
- Bump all instances of dompurify (patch version bump)
- Bump `posthog-js` to get a newer version of `@opentelemetry/core`
- Bump `@sentry/nextjs` to get a newer version of `@opentelemetry/core`
- Bump `redocly-cli` to get a newer version of `@opentelemetry/core`
- Bump `undici`

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Updated several project dependencies to newer versions, including
documentation tooling, analytics, and error-tracking packages.
* These updates may improve stability, compatibility, and access to the
latest fixes.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-25 08:50:27 +02:00
Alaister YoungAlaister YoungIvan Vasilov
 		9eab4f8fbf build(studio): Vite/TanStack-Start build pipeline behind flag (stack 1/6, from #46424) (#47107) 
**Stack 1/6** of the TanStack Start migration (#46424), split into
reviewable, independently-mergeable PRs.

> [!IMPORTANT]
> **Next stays the default and only active framework after this PR.**
This wires up the Vite/TanStack-Start build pipeline behind the
`STUDIO_FRAMEWORK` flag, but there are no TanStack routes yet — so the
TanStack build isn't functional or tested until later PRs in the stack.
Nothing about the Next build, dev, or deploy changes behaviourally here.

## What's in this PR
- **Dispatch:** `dev`/`build`/`start` now go through
`scripts/dispatch.js`, which runs the Next variant unless
`STUDIO_FRAMEWORK=tanstack`. The original commands are preserved as
`dev:next`/`build:next`/`start:next`.
- **Build pipeline:** `vite.config.ts`, `serve.js`, `smoke-server.mjs`,
vite/tanstack deps, `turbo.jsonc`.
- **`tsconfig.json`:** `jsx: react-jsx`, `moduleResolution: Bundler`,
`target: ES2022`. Because `include` is `**/*.ts(x)`, this re-typechecks
the whole app, so the companion adaptations below land with it.
- **Shared adaptations (companions to the tsconfig change):**
`BufferSource` casts, `packages/ui` unused-`React` import removals, etc.
- **Routing/middleware plumbing:** `next.config.ts` +
`redirects.shared.ts` (redirect rules now shared with `vercel.ts`),
`proxy.ts`/`start.ts` middleware + `hosted-api-allowlist.ts`.

## Verification
Run locally off `master`: frozen install ✓, `studio` typecheck ✓, **Next
build ✓** (compiles + generates all routes), lint ratchet ✓ ("some rules
improved"), prettier ✓.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a hosted API endpoint allowlist to return 404 for non-supported
`/api/*` routes.
* Introduced a TanStack route-migration checklist and expanded TanStack
Start routing support.
* **Improvements**
* Enhanced deployment refresh/detection by tightening cookie handling
for “latest deployment” updates.
* Centralized redirect/maintenance-mode rules for consistent platform vs
self-hosted behavior.
* Improved production serving with a dedicated static + proxy server and
a post-build smoke test.
* **Dependencies**
* Updated TanStack-related packages and React Table/query tooling
versions.
* **Documentation / Chores**
* Updated formatting and tooling config; added shared build environment
parsing utilities.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
 2026-06-24 17:55:22 +08:00
Raminder Singh 96dfc746b7 fix: bump stripe sync engine package (#47105) 
Bumps the Stripe Sync Engine package to version 1.0.32. Note that the
package name has also changed from `stripe-experiment-sync` to
`@stripe/sync-engine`.

Manual tests run on preview:

- [x] Install a fresh version of 1.0.32.
- [x] Uninstall freshly installed version 1.0.32
- [x] Upgrade from a lower version (1.0.31 tested)
- [x] Upgrade to 1.0.32 and uninstall
- [x] Confirm that data is being synced
 2026-06-22 13:55:55 +05:30
Gildas Garcia 91861c4a1f feat: allow to filter function by code (#46743) 
## Problem

It's hard to find a function that references another database entity:
users have to open each of them and look for matches themselves.

## Solution

Add a search input dedicated to function content filtering. Reusing the
existing input to match both names and content may be worse than before
as it would match too many functions if some of them have common sql
keywords in their name.

## Screenshots

<img width="2908" height="672" alt="image"
src="https://github.com/user-attachments/assets/38e35512-d733-434e-8b44-6ff043c01c7e"
/>

<img width="2904" height="560" alt="image"
src="https://github.com/user-attachments/assets/36643865-a1c8-4943-8f13-00272e44eea1"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Search now performs fuzzy matching over function names and bodies,
ranks exact-name matches higher, and respects
schema/return-type/security filters via centralized filtering logic.
* **Style / UI**
  * Search input placeholder updated to "Search for a function by name".
* **Documentation / Messaging**
* Empty-state messaging clarified to distinguish no functions vs. no
search matches.
* **Tests**
  * Added tests covering the new filtering and ranking behavior.
* **Chores**
  * Added runtime dependency for fuzzy-search library.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-18 09:11:12 +02:00
Ivan Vasilov 8d46dafc0a chore: Bump vulnerable dependencies (#47029) 
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

* **Chores**
* Updated shared development dependencies including build tools and code
transformation utilities to latest compatible versions for improved
performance and stability across the workspace.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-06-17 14:18:53 +02:00
supabase-supabase-autofixer[bot]andsupabase-workflow-trigger[bot] f761c66a9f feat: update @supabase/*-js libraries to v2.108.2 (#46927) 
This PR updates @supabase/*-js libraries to version 2.108.2.

**Source**: supabase-js-stable-release

**Changes**:
- Updated @supabase/supabase-js to 2.108.2
- Updated @supabase/auth-js to 2.108.2
- Updated @supabase/realtime-js to 2.108.2
- Updated @supabase/postgest-js to 2.108.2
- Refreshed pnpm-lock.yaml

---

## Release Notes

## v2.108.2

## 2.108.2 (2026-06-15)

### 🩹 Fixes

- **auth:** preserve valid session on refresh failure and cooldown
repeat failures
([#2436](https://github.com/supabase/supabase-js/pull/2436))
- **realtime:** clarify httpSend() 404 error and server migration note
([#2444](https://github.com/supabase/supabase-js/pull/2444))
- **release:** pin Deno and bound JSR publish to survive stranded-task
hangs ([#2439](https://github.com/supabase/supabase-js/pull/2439))
- **release:** restore JSR publish flags and enable for beta
([#2440](https://github.com/supabase/supabase-js/pull/2440))

### ❤️ Thank You

- Katerina Skroumpelou @mandarini
## v2.108.1

## 2.108.1 (2026-06-09)

### 🩹 Fixes

- **ci:** forward DOGFOOD_APP_CLIENT_ID to dogfood workflow
([#2434](https://github.com/supabase/supabase-js/pull/2434))
- **postgrest:** then typing
([#2349](https://github.com/supabase/supabase-js/pull/2349))

### ❤️ Thank You

- Katerina Skroumpelou @mandarini
- Vaibhav @7ttp

This PR was created automatically.

Co-authored-by: supabase-workflow-trigger[bot] <266661614+supabase-workflow-trigger[bot]@users.noreply.github.com>
 2026-06-16 10:19:28 +03:00
Ivan VasilovandGildas Garcia e1ccc31fcc chore: Disable some of the Studio features on Multigres projects (#46775) 
This PR disables the following features on Multigres projects

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
  * Enhanced replication interface with improved visual states.

* **Bug Fixes**
* Added validation to prevent incompatible database configuration
combinations.

* **Changes**
* High Availability projects now display informational notices
indicating unavailable features: Realtime, Replication, and PITR
backups.

* **Removed**
  * Removed redundant UI component from the application.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com>
 2026-06-15 14:09:41 +02:00