mirror of
https://github.com/supabase/supabase.git
synced 2026-10-15 06:09:08 +03:00
ce46509772ea15323cbe0e075e82ff8dc0e5bbfb
37728
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Wen Bo Xie
|
ce46509772 |
chore(studio): delete orphaned first-iteration scoped token form
Scoped/Form/Permissions/, Scoped/Form/ResourceAccess/, and AccessToken.schemas.ts (+ test) belonged to the superseded scoped-form design and had no live importers; the schemas file also still encoded the removed non-expiring token semantics. PERMISSION_LIST / ACCESS_TOKEN_RESOURCES stay: AccessTokenNewBanner still consumes them via useGroupedPermissions. |
||
|
Wen Bo Xie
|
7a610d224e |
feat(studio): remove non-expiring option from access token creation
Tokens must always have an expiry: drop the "Never" preset from EXPIRES_AT_OPTIONS so both classic entry points (flag-off dialog and the experimental V0 dialog) can no longer create non-expiring tokens, matching the scoped/legacy sheet which never offered one. Existing non-expiring tokens are unaffected; the list still displays them. Also deletes the orphaned BasicInfo.tsx (superseded by TokenDetails), the dead 'never' branch in getExpirationDate, and re-baselines the dialog's close reset to the full defaults. |
||
|
Wen Bo Xie
|
45538f86a0 |
feat(studio): add legacy token mode to scoped PAT creation flow
Replaces the scoped form's inline account-level access mode (blur overlay + confirmation checkbox) with a proper legacy-token escape hatch, and tightens expiry handling across both token forms. - "Create legacy token" now switches the sheet to the classic form (name + expiry only, with the classic account-wide warning) and creates the token through the legacy endpoint; the two-step review is skipped. The link also mentions the Supabase MCP server as a reason to need one. - Restore the "Generate token for experimental API" split-button dropdown on the scoped flow, extracted into a shared ExperimentalTokenDropdown used by both the classic button and the scoped sheet. - Cap custom expiry dates at one year from today: single shared getMaxCustomExpiryDate() drives the scoped calendar bounds, zod validation, and the classic dialog's maxDate. Calendars no longer page past the last selectable month (scoped Calendar via startMonth/endMonth; shared DatePicker derives them from minDate/maxDate). - Add an MCP-unsupported warning to the review step (with a link back into legacy mode) and the view-token sheet, sharing one set of copy constants. - Copy: resource access card descriptions, "can't be updated after creation" admonition, and inline links now use InlineLinkClassName. |
||
|
Wen Bo Xie
|
0eff5a0f49 |
fix(studio): model scoped PAT permissions as OR-of-AND alternatives
The permission scope map previously flattened every `x-fga-permissions` annotation into a single conjunctive scope list, turning OR-alternatives (e.g. development vs production branching on `GET /v1/.../branches`) into impossible AND requirements. EndpointMap and McpMap now store ScopeGroupAlternatives (string[][]) verbatim, and an item is enabled when ALL scopes of at least ONE group are granted — matching how the mgmt-api FGA guard actually evaluates the annotation. Edge cases follow plain DNF semantics: `[[]]` (one empty group) is ungated and callable by any token, `[]` (no groups) is satisfied by nobody, and endpoints with unusable annotations are dropped rather than recorded as ungated. The MCP tool map is rewritten as a direct audit of the Management API endpoint each tool's handler in @supabase/mcp-server-supabase actually calls, with the endpoint named above every entry for re-auditing. The old two-hop derivation (tool -> legacy OAuth scope bundle -> FGA permissions) expanded coarse bundles into conjunctions of permissions the tool never uses, hiding tools from tokens that could genuinely call them. The map now covers the full tool registry, including ungated tools (search_docs, get_project_url, get_cost, confirm_cost), and a new test diffs its keys against the installed package's tool schemas so a dependency bump that adds or drops a tool fails CI by name. buildAPIPermissionScopeMap now fetches the v1/v2 specs in parallel and indexes them in one pass (their path prefixes can't collide), replacing the lodash mergeWith custom-merger, and deep-clones the module-level tool mapping so callers can't mutate state that outlives the request. |
||
|
kemal.earth
|
4ed6972d41 |
chore(studio): scoped pat styling clean up (#48689)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? This touches a few things, brushing them up in anticipation of release. **Fixes and updates:** - Fixed sheet width resizing on content changing within sheet. - Tidied up labelling styles on Permissions row. - Show expand icon on multi select input. - Permissions list got a small tidy up. - Vertical padding on footer to match rest of the sheet. - Risk badge updated. - Risk badge tooltip tidied up. - View permissions sheet tidied up and updated to include MCP and API endpoints. - Second step/token summary tidied up. |
||
|
kemal.earth
|
3f1c841561 |
chore(studio): tidy up scoped pat admonition (#48651)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? @w3b6x9 initial pass at the announcement banner here. Please have a read of the copy and feel free to improve where you see fit. I also corrected how the actions are passed to our `<Admonition />` component. There's also an inline comment to remind us to update the `Learn more` link when we go live. | Before | After | |--------|--------| | <img width="755" height="264" alt="Screenshot 2026-08-03 at 14 03 34" src="https://github.com/user-attachments/assets/05b9e577-4d56-4c42-961a-37ac1e753141" /> | <img width="769" height="300" alt="Screenshot 2026-08-03 at 14 03 46" src="https://github.com/user-attachments/assets/11b7bdef-f7a3-47e5-a8b5-a021aafb0bca" /> | |
||
|
Gildas Garcia
|
be8a117548 | Fix organizations multi-select label | ||
|
Ali Waseem
|
4c7c18d531 | Merge branch 'master' into scopedpat/root-branch | ||
|
Gildas Garcia
|
6b8c7f7f07 |
Scoped PAT: apply flex-row-reverse form layout (#48543)
The scoped PAT form does not follow the design system guidelines. No functional changes <img width="755" height="713" alt="image" src="https://github.com/user-attachments/assets/8529c584-e75a-4f20-a40f-db1a3b5aaee0" /> <img width="754" height="693" alt="image" src="https://github.com/user-attachments/assets/66791128-9083-4a93-9b14-1315b1b76ddb" /> |
||
|
ChloeGarciaMillerand
|
e241a21a9a |
fix: ESLint errors relating to accessibility in table editor, API Key and Access Token (#48479)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Added aria-label attributes and Tooltip to buttons ## What is the current behavior? alt attributes and Tooltip were missing ## What is the new behavior? Buttons have now aria-label attributes and Tooltip. ## Additional context No visual changes have been made. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Accessibility Improvements** * Added tooltips and improved accessible labeling for filter removal, sort controls, and action menu triggers. * Enhanced “More actions”/“More options” tooltips and aria-labels for API keys and access tokens. * Updated token scope selection and token banner close actions to use clearer tooltip messaging. * Wrapped panel close control with a tooltip and added an aria-label for clearer screen reader support. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
dependabot[bot]andCharis
|
f758ff132e |
chore(deps): bump docker/login-action from 2.2.0 to 4.4.0 (#48084)
Bumps [docker/login-action](https://github.com/docker/login-action) from 2.2.0 to 4.4.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/login-action/releases">docker/login-action's releases</a>.</em></p> <blockquote> <h2>v4.4.0</h2> <ul> <li>Skip empty <code>registry-auth</code> secret mask by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/1035">docker/login-action#1035</a></li> <li>Bump <code>@aws-sdk/client-ecr</code> and <code>@aws-sdk/client-ecr-public</code> to 3.1077.0 <a href="https://redirect.github.com/docker/login-action/pull/1034">docker/login-action#1034</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.3.0...v4.4.0">https://github.com/docker/login-action/compare/v4.3.0...v4.4.0</a></p> <h2>v4.3.0</h2> <ul> <li>Preserve names in esbuild bundle by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/1022">docker/login-action#1022</a></li> <li>Bump <code>@aws-sdk/client-ecr</code> and <code>@aws-sdk/client-ecr-public</code> to 3.1076.0 <a href="https://redirect.github.com/docker/login-action/pull/999">docker/login-action#999</a> <a href="https://redirect.github.com/docker/login-action/pull/1030">docker/login-action#1030</a></li> <li>Bump <code>@docker/actions-toolkit</code> from 0.90.0 to 0.92.0 in <a href="https://redirect.github.com/docker/login-action/pull/1004">docker/login-action#1004</a> <a href="https://redirect.github.com/docker/login-action/pull/1027">docker/login-action#1027</a></li> <li>Bump <code>@sigstore/core</code> from 3.1.0 to 3.2.1 in <a href="https://redirect.github.com/docker/login-action/pull/1023">docker/login-action#1023</a></li> <li>Bump <code>@sigstore/verify</code> from 3.1.0 to 3.1.1 in <a href="https://redirect.github.com/docker/login-action/pull/1029">docker/login-action#1029</a></li> <li>Bump http-proxy-agent and https-proxy-agent to 9.1.0 in <a href="https://redirect.github.com/docker/login-action/pull/1017">docker/login-action#1017</a></li> <li>Bump js-yaml from 4.1.1 to 5.2.0 in <a href="https://redirect.github.com/docker/login-action/pull/1028">docker/login-action#1028</a></li> <li>Bump sigstore from 4.1.0 to 4.1.1 in <a href="https://redirect.github.com/docker/login-action/pull/1031">docker/login-action#1031</a></li> <li>Bump tmp from 0.2.5 to 0.2.7 in <a href="https://redirect.github.com/docker/login-action/pull/1002">docker/login-action#1002</a></li> <li>Bump undici from 6.24.1 to 6.27.0 in <a href="https://redirect.github.com/docker/login-action/pull/1020">docker/login-action#1020</a></li> <li>Bump vite from 7.3.3 to 7.3.6 in <a href="https://redirect.github.com/docker/login-action/pull/1019">docker/login-action#1019</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.2.0...v4.3.0">https://github.com/docker/login-action/compare/v4.2.0...v4.3.0</a></p> <h2>v4.2.0</h2> <ul> <li>Bump <code>@actions/core</code> from 3.0.0 to 3.0.1 in <a href="https://redirect.github.com/docker/login-action/pull/976">docker/login-action#976</a></li> <li>Bump <code>@aws-sdk/client-ecr</code> and <code>@aws-sdk/client-ecr-public</code> to 3.1050.0 in <a href="https://redirect.github.com/docker/login-action/pull/960">docker/login-action#960</a></li> <li>Bump <code>@docker/actions-toolkit</code> from 0.86.0 to 0.90.0 in <a href="https://redirect.github.com/docker/login-action/pull/970">docker/login-action#970</a></li> <li>Bump brace-expansion from 2.0.1 to 5.0.6 in <a href="https://redirect.github.com/docker/login-action/pull/993">docker/login-action#993</a></li> <li>Bump fast-xml-builder from 1.1.4 to 1.2.0 in <a href="https://redirect.github.com/docker/login-action/pull/985">docker/login-action#985</a></li> <li>Bump fast-xml-parser from 5.3.6 to 5.8.0 in <a href="https://redirect.github.com/docker/login-action/pull/963">docker/login-action#963</a></li> <li>Bump http-proxy-agent and https-proxy-agent to 9.0.0 in <a href="https://redirect.github.com/docker/login-action/pull/961">docker/login-action#961</a></li> <li>Bump postcss from 8.5.6 to 8.5.10 in <a href="https://redirect.github.com/docker/login-action/pull/979">docker/login-action#979</a></li> <li>Bump tar from 6.2.1 to 7.5.15 in <a href="https://redirect.github.com/docker/login-action/pull/991">docker/login-action#991</a></li> <li>Bump vite from 7.3.1 to 7.3.3 in <a href="https://redirect.github.com/docker/login-action/pull/986">docker/login-action#986</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.1.0...v4.2.0">https://github.com/docker/login-action/compare/v4.1.0...v4.2.0</a></p> <h2>v4.1.0</h2> <ul> <li>Fix scoped Docker Hub cleanup path when registry is omitted by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/945">docker/login-action#945</a></li> <li>Bump <code>@aws-sdk/client-ecr</code> and <code>@aws-sdk/client-ecr-public</code> to 3.1020.0 in <a href="https://redirect.github.com/docker/login-action/pull/930">docker/login-action#930</a></li> <li>Bump <code>@docker/actions-toolkit</code> from 0.77.0 to 0.86.0 in <a href="https://redirect.github.com/docker/login-action/pull/932">docker/login-action#932</a> <a href="https://redirect.github.com/docker/login-action/pull/936">docker/login-action#936</a></li> <li>Bump brace-expansion from 1.1.12 to 1.1.13 in <a href="https://redirect.github.com/docker/login-action/pull/952">docker/login-action#952</a></li> <li>Bump fast-xml-parser from 5.3.4 to 5.3.6 in <a href="https://redirect.github.com/docker/login-action/pull/942">docker/login-action#942</a></li> <li>Bump flatted from 3.3.3 to 3.4.2 in <a href="https://redirect.github.com/docker/login-action/pull/944">docker/login-action#944</a></li> <li>Bump glob from 10.3.12 to 10.5.0 in <a href="https://redirect.github.com/docker/login-action/pull/940">docker/login-action#940</a></li> <li>Bump handlebars from 4.7.8 to 4.7.9 in <a href="https://redirect.github.com/docker/login-action/pull/949">docker/login-action#949</a></li> <li>Bump http-proxy-agent and https-proxy-agent to 8.0.0 in <a href="https://redirect.github.com/docker/login-action/pull/937">docker/login-action#937</a></li> <li>Bump lodash from 4.17.23 to 4.18.1 in <a href="https://redirect.github.com/docker/login-action/pull/958">docker/login-action#958</a></li> <li>Bump minimatch from 3.1.2 to 3.1.5 in <a href="https://redirect.github.com/docker/login-action/pull/941">docker/login-action#941</a></li> <li>Bump picomatch from 4.0.3 to 4.0.4 in <a href="https://redirect.github.com/docker/login-action/pull/948">docker/login-action#948</a></li> <li>Bump undici from 6.23.0 to 6.24.1 in <a href="https://redirect.github.com/docker/login-action/pull/938">docker/login-action#938</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/docker/login-action/commit/af1e73f918a031802d376d3c8bbc3fe56130a9b0"><code>af1e73f</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1034">#1034</a> from docker/dependabot/npm_and_yarn/aws-sdk-dependen...</li> <li><a href="https://github.com/docker/login-action/commit/da722bde43bacb027adfc67d42dbaa4c0f9e550b"><code>da722bd</code></a> [dependabot skip] chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/2916ad60bd5cb72f07aa54c69fdcc61749c09b7a"><code>2916ad6</code></a> build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...</li> <li><a href="https://github.com/docker/login-action/commit/ca0a662f786e4cfddce972005bd68f3dafc3a903"><code>ca0a662</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1035">#1035</a> from crazy-max/fix-registry-auth-empty-mask</li> <li><a href="https://github.com/docker/login-action/commit/c455755a579833bf0d2e4e54e3beb413ef10cc80"><code>c455755</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/48351901f89581a7c12870c787d3f06d1f498438"><code>4835190</code></a> skip empty registry-auth secret mask</li> <li><a href="https://github.com/docker/login-action/commit/992421c6e6806a7f6df609d1bfff374f9eca3004"><code>992421c</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1033">#1033</a> from docker/dependabot/github_actions/docker/bake-ac...</li> <li><a href="https://github.com/docker/login-action/commit/b249b43765525dd7951068267a34cf63f22ab4f0"><code>b249b43</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1032">#1032</a> from docker/dependabot/github_actions/docker/bake-ac...</li> <li><a href="https://github.com/docker/login-action/commit/1b67977736863551a88ff218642a2d7628b10520"><code>1b67977</code></a> build(deps): bump docker/bake-action from 7.2.0 to 7.3.0</li> <li><a href="https://github.com/docker/login-action/commit/9d49d6a3234c78daa10c3c12183ef7b6caa8e69e"><code>9d49d6a</code></a> build(deps): bump docker/bake-action/subaction/matrix</li> <li>Additional commits viewable in <a href="https://github.com/docker/login-action/compare/465a07811f14bebb1938fbed4728c6a1ff8901fc...af1e73f918a031802d376d3c8bbc3fe56130a9b0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Charis <26616127+charislam@users.noreply.github.com> |
||
|
dependabot[bot]
|
e1ed157d9a |
chore(deps): bump actions/stale from 9.0.0 to 10.4.0 (#48082)
Bumps [actions/stale](https://github.com/actions/stale) from 9.0.0 to 10.4.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/stale/releases">actions/stale's releases</a>.</em></p> <blockquote> <h2>v10.4.0</h2> <h2>What's Changed</h2> <h3>Bug Fix</h3> <ul> <li>Fixed <code>only-issue-types</code> validation by <a href="https://github.com/trueberryless"><code>@trueberryless</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1338">actions/stale#1338</a></li> </ul> <h3>Dependency Updates</h3> <ul> <li>Bump undici to 6.27.0 via override, clean up stale license files, and version to 10.4.0. by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1342">actions/stale#1342</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/trueberryless"><code>@trueberryless</code></a> made their first contribution in <a href="https://redirect.github.com/actions/stale/pull/1338">actions/stale#1338</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/stale/compare/v10.3.0...v10.4.0">https://github.com/actions/stale/compare/v10.3.0...v10.4.0</a></p> <h2>v10.3.0</h2> <h2>What's Changed</h2> <h3>Bug Fix</h3> <ul> <li>Enhancement: ignore stale labeling events by <a href="https://github.com/shamoon"><code>@shamoon</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1311">actions/stale#1311</a></li> </ul> <h3>Dependency Updates</h3> <ul> <li>Upgrade dependencies (<code>@actions/core</code>, <code>@octokit/plugin-retry</code>, <a href="https://github.com/typescript-eslint"><code>@typescript-eslint</code></a>) by <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1335">actions/stale#1335</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/shamoon"><code>@shamoon</code></a> made their first contribution in <a href="https://redirect.github.com/actions/stale/pull/1311">actions/stale#1311</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/stale/compare/v10...v10.3.0">https://github.com/actions/stale/compare/v10...v10.3.0</a></p> <h2>v10.2.0</h2> <h2>What's Changed</h2> <h3>Bug Fix</h3> <ul> <li>Fix checking state cache (fix <a href="https://redirect.github.com/actions/stale/issues/1136">#1136</a>) and switch to Octokit helper methods by <a href="https://github.com/itchyny"><code>@itchyny</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1152">actions/stale#1152</a></li> </ul> <h3>Dependency Updates</h3> <ul> <li>Upgrade js-yaml from 4.1.0 to 4.1.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1304">actions/stale#1304</a></li> <li>Upgrade lodash from 4.17.21 to 4.17.23 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1313">actions/stale#1313</a></li> <li>Upgrade actions/cache from 4.0.3 to 5.0.2 and actions/github from 5.1.1 to 7.0.0 by <a href="https://github.com/chiranjib-swain"><code>@chiranjib-swain</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1312">actions/stale#1312</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/itchyny"><code>@itchyny</code></a> made their first contribution in <a href="https://redirect.github.com/actions/stale/pull/1152">actions/stale#1152</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/stale/compare/v10...v10.2.0">https://github.com/actions/stale/compare/v10...v10.2.0</a></p> <h2>v10.1.1</h2> <h2>What's Changed</h2> <h3>Bug Fix</h3> <ul> <li>Add Missing Input Reading for <code>only-issue-types</code> by <a href="https://github.com/Bibo-Joshi"><code>@Bibo-Joshi</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1298">actions/stale#1298</a></li> </ul> <h3>Improvement</h3> <ul> <li>Improves error handling when rate limiting is disabled on GHES. by <a href="https://github.com/chiranjib-swain"><code>@chiranjib-swain</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1300">actions/stale#1300</a></li> </ul> <h3>Dependency Upgrades</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/stale/commit/1e223db275d687790206a7acac4d1a11bd6fe629"><code>1e223db</code></a> Bump undici to 6.27.0 via override, clean up stale license files, and version...</li> <li><a href="https://github.com/actions/stale/commit/9461cb10066d1553762bac6a02599ab8c26b14dd"><code>9461cb1</code></a> fix: <code>only-issue-types</code> does not affect PRs (<a href="https://redirect.github.com/actions/stale/issues/1338">#1338</a>)</li> <li><a href="https://github.com/actions/stale/commit/eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899"><code>eb5cf3a</code></a> chore: upgrade dependencies and bump version to 10.3.0 (<a href="https://redirect.github.com/actions/stale/issues/1335">#1335</a>)</li> <li><a href="https://github.com/actions/stale/commit/db5d06a4c82d5e94513c09c406638111df61f63e"><code>db5d06a</code></a> Enhancement: ignore stale labeling events (<a href="https://redirect.github.com/actions/stale/issues/1311">#1311</a>)</li> <li><a href="https://github.com/actions/stale/commit/b5d41d4e1d5dceea10e7104786b73624c18a190f"><code>b5d41d4</code></a> build(deps-dev): bump lodash from 4.17.21 to 4.17.23 (<a href="https://redirect.github.com/actions/stale/issues/1313">#1313</a>)</li> <li><a href="https://github.com/actions/stale/commit/dcd2b9469d2220b7e8d08aedc00c105d277fd46b"><code>dcd2b94</code></a> Fix punycode and url.parse Deprecation Warnings (<a href="https://redirect.github.com/actions/stale/issues/1312">#1312</a>)</li> <li><a href="https://github.com/actions/stale/commit/d6f8a33132340b15a7006f552936e4b9b39c00ec"><code>d6f8a33</code></a> build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 (<a href="https://redirect.github.com/actions/stale/issues/1304">#1304</a>)</li> <li><a href="https://github.com/actions/stale/commit/a21a0816299b11691f9592ef0d63d08e02f06d9d"><code>a21a081</code></a> Fix checking state cache (fix <a href="https://redirect.github.com/actions/stale/issues/1136">#1136</a>), also switch to octokit methods (<a href="https://redirect.github.com/actions/stale/issues/1152">#1152</a>)</li> <li><a href="https://github.com/actions/stale/commit/997185467fa4f803885201cee163a9f38240193d"><code>9971854</code></a> build(deps): bump actions/checkout from 4 to 6 (<a href="https://redirect.github.com/actions/stale/issues/1306">#1306</a>)</li> <li><a href="https://github.com/actions/stale/commit/5611b9defa6b7799a950489b00163db69f7a3ece"><code>5611b9d</code></a> build(deps): bump actions/publish-action from 0.3.0 to 0.4.0 (<a href="https://redirect.github.com/actions/stale/issues/1291">#1291</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/stale/compare/28ca1036281a5e5922ead5184a1bbf96e5fc984e...1e223db275d687790206a7acac4d1a11bd6fe629">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
8565fd6b2a |
chore(deps): bump actions/labeler from 6.0.1 to 6.2.0 (#48083)
Bumps [actions/labeler](https://github.com/actions/labeler) from 6.0.1 to 6.2.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/labeler/releases">actions/labeler's releases</a>.</em></p> <blockquote> <h2>v6.2.0</h2> <h2>What's Changed</h2> <h3>Bug Fix</h3> <ul> <li>Improve PR number validation and warning messages in input handling by <a href="https://github.com/chiranjib-swain"><code>@chiranjib-swain</code></a> in <a href="https://redirect.github.com/actions/labeler/pull/939">actions/labeler#939</a></li> </ul> <h3>Dependency Updates</h3> <ul> <li>Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/labeler/pull/943">actions/labeler#943</a></li> <li>Bump <code>@typescript-eslint/eslint-plugin</code> from 8.59.1 to 8.61.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/labeler/pull/942">actions/labeler#942</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/labeler/compare/v6.1.0...v6.2.0">https://github.com/actions/labeler/compare/v6.1.0...v6.2.0</a></p> <h2>v6.1.0</h2> <h2>Enhancements</h2> <ul> <li>Add changed-files-labels-limit and max-files-changed configuration options to cap the number of labels added by <a href="https://github.com/bluca"><code>@bluca</code></a> in <a href="https://redirect.github.com/actions/labeler/pull/923">actions/labeler#923</a></li> </ul> <h2>Bug Fixes</h2> <ul> <li>Improve Labeler Action documentation and permission error handling by <a href="https://github.com/chiranjib-swain"><code>@chiranjib-swain</code></a> in <a href="https://redirect.github.com/actions/labeler/pull/897">actions/labeler#897</a></li> <li>Preserve manually added labels during workflow runs and refine label synchronization logic by <a href="https://github.com/chiranjib-swain"><code>@chiranjib-swain</code></a> in <a href="https://redirect.github.com/actions/labeler/pull/917">actions/labeler#917</a></li> </ul> <h2>Dependency Updates</h2> <ul> <li>Upgrade brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/labeler/pull/877">actions/labeler#877</a></li> <li>Upgrade minimatch from 10.0.1 to 10.2.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/labeler/pull/926">actions/labeler#926</a></li> <li>Upgrade dependencies (<code>@actions/core</code>, <code>@actions/github</code>, js-yaml, minimatch, <a href="https://github.com/typescript-eslint"><code>@typescript-eslint</code></a>) by <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/actions/labeler/pull/934">actions/labeler#934</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/chiranjib-swain"><code>@chiranjib-swain</code></a> made their first contribution in <a href="https://redirect.github.com/actions/labeler/pull/897">actions/labeler#897</a></li> <li><a href="https://github.com/bluca"><code>@bluca</code></a> made their first contribution in <a href="https://redirect.github.com/actions/labeler/pull/923">actions/labeler#923</a></li> <li><a href="https://github.com/Copilot"><code>@Copilot</code></a> made their first contribution in <a href="https://redirect.github.com/actions/labeler/pull/934">actions/labeler#934</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/labeler/compare/v6...v6.1.0">https://github.com/actions/labeler/compare/v6...v6.1.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/labeler/commit/b8dd2d9be0f68b860e7dae5dae7d772984eacd6d"><code>b8dd2d9</code></a> Bump <code>@typescript-eslint/eslint-plugin</code> from 8.59.1 to 8.61.1 (<a href="https://redirect.github.com/actions/labeler/issues/942">#942</a>)</li> <li><a href="https://github.com/actions/labeler/commit/53affe8ca4150876fc7eb7d268d3a1f74511a244"><code>53affe8</code></a> Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override for 0 vul...</li> <li><a href="https://github.com/actions/labeler/commit/f612d9ad188e81643862c2de70f57fbb1d17abd1"><code>f612d9a</code></a> Fix: Improve PR number validation and warning messages in input handling (<a href="https://redirect.github.com/actions/labeler/issues/939">#939</a>)</li> <li><a href="https://github.com/actions/labeler/commit/f27b608878404679385c85cfa523b85ccb86e213"><code>f27b608</code></a> chore: upgrade dependencies (<code>@actions/core</code>, <code>@actions/github</code>, js-yaml, minimat...</li> <li><a href="https://github.com/actions/labeler/commit/c5dadc2a45784a4b6adfcd20fea3465da3a5f904"><code>c5dadc2</code></a> Add 'changed-files-labels-limit' and 'max-files-changed' configs to allow cap...</li> <li><a href="https://github.com/actions/labeler/commit/e52e4fb63ed5cd0e07abaad9826b2a893ccb921f"><code>e52e4fb</code></a> Bump minimatch from 10.0.1 to 10.2.3 (<a href="https://redirect.github.com/actions/labeler/issues/926">#926</a>)</li> <li><a href="https://github.com/actions/labeler/commit/77a4082b841706ac431479b7e2bb11216ffef250"><code>77a4082</code></a> Fix: Preserve manually added labels during workflow run and refine label sync...</li> <li><a href="https://github.com/actions/labeler/commit/25abb3cad4f14b7ac27968a495c37798860a5a1a"><code>25abb3c</code></a> Improve Labeler Action Documentation and Error Handling for Permissions (<a href="https://redirect.github.com/actions/labeler/issues/897">#897</a>)</li> <li><a href="https://github.com/actions/labeler/commit/395c8cfdb1e1e691cc4bad0dd315820af8eb67fd"><code>395c8cf</code></a> Bump brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v...</li> <li>See full diff in <a href="https://github.com/actions/labeler/compare/634933edcd8ababfe52f92936142cc22ac488b1b...b8dd2d9be0f68b860e7dae5dae7d772984eacd6d">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
kemal.earth
|
bc95a2f19a |
fix(studio): edge func exec time formatting in reports (#48539)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Fixes Edge Function Execution Time chart within our observability reports time formatting. This also fixes the non-hovered state which would lose the `ms` formatting. | Before | After | |--------|--------| | <img width="2160" height="652" alt="cleanshot_2026-07-29_at_02 15 53_2x" src="https://github.com/user-attachments/assets/cfd6dbc2-f283-4379-a133-581c76990cb5" /> | <img width="797" height="314" alt="Screenshot 2026-07-31 at 14 30 48" src="https://github.com/user-attachments/assets/f5f1ace5-b6ef-43db-aebd-e10d31631013" /> | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Improved execution-time chart formatting with clearer millisecond values, thousands separators, and configurable precision. * Chart highlights now support custom value formatting alongside existing number, percentage, and byte formats. * **Bug Fixes** * Non-finite execution-time values now display safely as `0ms`. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ali Waseem
|
9b51678fcf |
Revert "feat: update mgmt api docs (#48282)" (#48545)
## What kind of change does this PR introduce?
Revert
## What is the current behavior?
#48282 auto-updated the mgmt API docs spec files
(`apps/docs/spec/api_v1_openapi.json`,
`apps/docs/spec/api_v2_openapi.json`,
`apps/docs/spec/common-api-sections.json`, and the deparsed transform
files).
## What is the new behavior?
Reverts those spec/transform files back to their state prior to #48282.
This reverts commit
|
||
|
Francesco SansalvadoreandClaude
|
00d12c305c |
Include Migration steps in changelog bodySection (#48496)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature / refactor ## What is the current behavior? The changelog entry parser extracts `## Migration steps` as a separate field (`migrationSteps`), and the `bodySection` stops before it. This requires consumers to handle migration steps separately from the main body content. ## What is the new behavior? The `bodySection` now includes `## Migration steps` as part of the rendered body content. The `migrationSteps` field has been removed from the `ChangelogEntry` type. The `bodySection` extraction now stops at internal-only planning sections (`## Rollout timeline`, `## Comms timeline`) instead of at migration steps, allowing migration steps to be included in the public-facing body. ## Additional context - Updated `parseChangelogEntryFile` to extract `bodySection` through migration steps, excluding only internal planning tables - Updated the `ChangelogEntry` type documentation to clarify that `bodySection` includes migration steps - Added a test case verifying that migration steps are included in the rendered body while internal sections are excluded - This simplifies the API by consolidating public body content into a single field https://claude.ai/code/session_01X5ikaawVPZwMT5C2dWUyJY <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Changelog entries now include all public content following the Body section, including relevant subsections and rollout information. * Migration guidance is included directly within the main changelog body for a clearer reading experience. * Internal notes, communications, and planning details remain excluded from displayed changelog content. * Unmatched internal markers now correctly hide all subsequent content from public changelogs. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude <noreply@anthropic.com> |
||
|
Gildas Garcia
|
b0fa67f412 |
Scoped PAT: fix UX/UI issues (#48538)
Fixes UX/UI issues: - when organization scope is selected: org selector should take the full width - Use org name and project name as the selected values label instead of their ids - There's a wrapping issue in multi-selector when more than one value is selected - There's an hover effect on disabled selects (when account scope selected) - On the review step: use the project/org names instead of their ids |
||
|
supabase-supabase-autofixer[bot]andphamhieu
|
4adef69037 |
feat: update mgmt api docs (#48282)
This PR updates mgmt api docs automatically. Co-authored-by: phamhieu <689843+phamhieu@users.noreply.github.com> |
||
|
Charis
|
50e1eb7436 |
chore(eslint): bump eslint-config-next to v16 for useEffectEvent (#48458)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Chore / build (ESLint config upgrade + lint cleanup). ## What is the current behavior? `eslint-plugin-react-hooks` v5 (pulled in transitively by `eslint-config-next` v15) doesn't recognize stable `useEffectEvent`, so every effect that calls an effect-event handler needs an `eslint-disable react-hooks/exhaustive-deps` to silence a false positive. There are 30 such dead disables across Studio. ## What is the new behavior? Bumps `eslint-config-next` to v16, which pulls in `eslint-plugin-react-hooks` v7 whose `exhaustive-deps` understands `useEffectEvent`, and removes the 30 now-dead disable directives (and their orphaned explanatory comments). Supporting changes: - **Flat-config migration**: v16 is a native flat-config array (v15 was eslintrc), so `eslint-config-supabase` now spreads it directly instead of bridging through `FlatCompat`. - **React Compiler rules off**: v16 enables react-hooks v7's `recommended`, which layers the React Compiler lint rules on top of the two classic rules. These are switched off (derived dynamically from what next enables) to keep this change scoped to the `exhaustive-deps` improvement. - **Plugin-registration fallout** (v16 scopes plugin registration to a file glob rather than registering globally like FlatCompat did): stop re-registering `@typescript-eslint` (shared) and `jsx-a11y` (studio); scope our react / react-hooks / jsx-a11y rule overrides (studio, www) to v16's plugin glob so they don't error on files outside it (e.g. `.cjs`). - **Lint surface preserved**: v16's glob newly includes `.mts`/`.cts` (v15 didn't lint them), which surfaced pre-existing errors in tooling scripts. The shared config keeps the prior surface by leaving `.mts`/`.cts` unlinted; linting them is left as a separate change. - **Ratchet**: rebaselines `@tanstack/query/exhaustive-deps` 9 → 89. v15 forced next's `@babel/eslint-parser` onto `.ts` files, hiding these deps; v16 parses `.ts` with `@typescript-eslint/parser` and correctly surfaces the intentional `connectionString`-excluded-from-`queryKey` pattern. Worth a follow-up to review whether any are real cache-correctness bugs. - Drops three now-dead devDeps from `eslint-config-supabase`: `@eslint/eslintrc`, `@eslint/js`, `@typescript-eslint/eslint-plugin`. Verified locally: `turbo run lint` → 7/7 packages pass with 0 errors; Studio `lint:ratchet` passes; Prettier clean on changed files; typecheck unaffected. ## Additional context <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Refined linting configuration and removed outdated lint suppressions across Studio. * Updated Next.js linting support and refreshed related development configuration. * Expanded lint baseline coverage for query-related code. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jonathan Summers-Muir
|
009528c6ca |
chore: update Lovable homepage logo (#48536)
## Summary - replace the outdated Lovable homepage logo |
||
|
|
27f18f0359 |
Spring Boot Quickstart (#48396)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? docs update ## What is the new behavior? Spring Boot quickstart guide <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added a “Use Supabase with Spring Boot” quickstart guide, including project setup, Session pooler/JPA configuration, sample entity/repository, seed data, and a `GET /instruments` endpoint. - Added “Spring Boot” to the Getting Started “Framework Quickstarts” navigation, shown only when not in JS-only mode. - Added a Spring Boot AI prompt with step-by-step integration instructions. - **Documentation** - Updated MDX linting rules to allow “Spring Boot” and “Spring Data JPA” headings, and to permit “Initializr” spelling. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Jeremias Menichelli <jmenichelli@gmail.com> |
||
|
Andrey A.
|
be136df69e | feat(self-hosted): use latest tag in setup.sh plus additional checks (#47848) | ||
|
Eduardo Gurgel
|
c613a9b92e |
chore: update realtime error codes & add troubleshotting page (#48381)
* Update realtime error codes * Add new troubleshooting page for client presence rate error * Fix references from error codes to work with relative paths |
||
|
Joshen Lim
|
fd67a8014f |
Joshen/fe 4018 bug gh branch validation in branch modal fails silently if (#48432)
## Context Realised that if the project has a GH integration, but the user's account is not connected to GH - the branch validation in the "Sync with Git Branch" field will not work. The Edit branch modal also obfuscates the error being returned from the validation API so its not clear what the issue is <img width="500" alt="image" src="https://github.com/user-attachments/assets/739dfe7c-8920-4edf-a751-63d7f6273db4" /> Opting to show an "Authorize" CTA for this scenario so it's clear from the user's POV what to do (Refer to "To test" below for screenshots) ## To test - [ ] Verify that on an account which isn't connect to GH + project with no GH integration - CTA is as per normal ("Configure") which should direct you to the settings -> integrations page (Same for edit branch) <img width="500" alt="image" src="https://github.com/user-attachments/assets/9a010fde-8ab0-43d6-b5c9-ced9fed1426e" /> <img width="500" alt="image" src="https://github.com/user-attachments/assets/d129cccf-7238-4305-913b-0cf78c7dcc26" /> - [ ] Set up a GH integration and check Create / Edit branch - the branch input field should work with proper branch name validation <img width="500" alt="image" src="https://github.com/user-attachments/assets/4d643956-2d11-406b-b198-193f3221b7a9" /> - [ ] Now go to Account settings and remove the GH connection, then check the Create / Edit branch modals - should have the "Authorize" CTA (instead of the input field) <img width="500" alt="image" src="https://github.com/user-attachments/assets/ac152c0d-2e9c-4d89-95bc-36127c0fc8df" /> <img width="500" alt="image" src="https://github.com/user-attachments/assets/d1f50d38-d801-4546-96fd-8cf3b5d0f805" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a “Sync with a GitHub branch” connection entry with an inline authorize flow. * Integrated GitHub authorization awareness into branch create/edit modals so users are guided to authorize or proceed to syncing. * **Bug Fixes** * Unified loading, success, and error handling for GitHub authorization/connection checks across create and edit flows. * Improved Git branch validation messaging to show cleaner error text. * **Accessibility/UX** * Updated modal UI text and added an explicit label for the “Include data” toggle. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Guillaume Faas
|
97a935fb4f |
docs(csharp): update C# reference docs to SDK 1.5 (#48523)
## What Brings the C# client reference in line with `supabase-csharp` 1.5. The reference spec had drifted ~2 years and was missing most of the Auth, MFA, Admin, and Storage surface. ## Changes - **Fix example errors** in the v1 reference spec — corrected the `From<T>()`/`Table<T>()` model example, `ListenType` realtime enum, a mislabeled code fence, and other small mismatches. - **Backfill release notes** from 1.0.1 through 1.5.0, reconstructed by diffing the `Supabase.csproj` dependency pins across git tags and pulling highlights from each sub-package changelog. - **Document the undocumented API surface** (~27 new entries): Auth (anonymous, ID token, SSO, refresh, link/unlink identity, code exchange, reauthenticate, scoped sign-out), the full MFA API, the Admin API via `AdminAuth`, and Storage (`Copy`, signed URLs, signed uploads). - **Fix a latent bug**: the `ResetPasswordForEmail()` entry used a spec id that matched no canonical section, so it never rendered. Renamed to `reset-password-for-email`. ## Notes - All signatures verified against the 1.5 SDK source. - Entries render only when their spec id matches a slot in the shared `common-client-libs-sections.json`; ids were mapped against that set. - Spec YAML is Prettier-clean under the repo config. Closes SDK-1369. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added C# release notes covering versions 1.0.1–1.5.0. * Updated C# client documentation with current initialization patterns and expanded authentication, session, identity, PKCE, MFA, Realtime, Storage, and admin operation examples. * Added Storage examples for file copying, signed URLs, signed uploads, and uploads through signed URLs. * Corrected code samples and clarified scoped sign-out and password-reset guidance. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jeremias Menichelli
|
a76f1f0c9b | feat: Move search functionality to Vercel function (#48443) | ||
|
Andrey A.
|
6a99952af5 | docs(self-hosted): update nav and minor corrections (#48499) | ||
|
|
ca94d842a7 |
design demo: security page content additions (content-only) (#48403)
## Summary - Adds four missing content cards to the existing `security.mdx` using the same `Section` component and grid already on the page — no new UI components or features - Cards added: **GDPR & European Compliance**, **Data Residency**, **Data Processing Agreement**, **Shared Responsibility** - Also fixes the HIPAA shared responsibility link path (`/deployment/` not `/platform/`) Worth validating still. ## What this is A content-only drop-in that addresses some gaps ## What's out of scope here - No sticky nav, tables, plan comparison grids, or new components - No DPA request automation — just a plain link to `/legal/dpa` - No plan-gating claims (removed — accuracy unconfirmed) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Reorganized the security page into clearer, grouped sections (Compliance, Data, Configuration, and Misc) for easier navigation. * Expanded compliance coverage with HIPAA, ISO 27001, GDPR & European compliance, and updated shared responsibility details. * Added new content for data residency and a Data Processing Agreement section. * Reordered configuration items (multi-factor authentication, role-based access, vulnerability management, DDoS) and moved payment processing into the Misc section. * Updated icons and card layout visuals throughout the page. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Nik Richers <nrichers@gmail.com> |
||
|
Pamela Chia
|
c4c58ef3e3 |
feat: remove pandadoc dpa request flow (#48525)
Terms of Service v3 (effective August 1, 2026, #48482) incorporates the Data Processing Addendum by reference, so customers no longer sign a separate DPA. Legal confirmed the PandaDoc signing flow can go; previously signed DPAs remain binding. This removes the frontend flow only. I'll remove the platform endpoint (`POST /platform/organizations/{slug}/documents/dpa`) separately once the PandaDoc contract conversation wraps. **Changed:** - **Dashboard DPA card no longer requests PandaDoc documents**: the Request DPA button and confirm modal are replaced with a View DPA link to the canonical legal page, with evergreen copy explaining the DPA is part of the Terms. Tracked via the same `document_view_button_clicked` event the other document cards use. - **Legacy `/legal/dpa` page retired**: the page told users to request a signed DPA from the dashboard, which no longer exists. It now permanently redirects to `/legal/customer-resources/data-processing-addendum` (the follow-up already flagged in #48483), and the footer link is removed. The `dpa_pdf_opened` and `dpa_request_button_clicked` events are removed with their last call sites. The latest privacy version links the canonical page directly; archived v1/v2 keep their original `/legal/dpa` link, served by the redirect. - **Orphaned DPA PDFs removed**: the four dated `Supabase+DPA+*.pdf` files under `/downloads/docs` had zero remaining references once the signing flow is gone. No redirect: nothing links these URLs, so they 404. - **Subscription tracking**: the subprocessor updates form now fires `www_subprocessor_updates_subscribed` on successful submit, so we can measure uptake of the notification list that replaces per-customer DPA emails. ## To test Verified on the Vercel previews (Playwright): - [x] Studio: `/org/_/documents` shows the DPA card with the incorporation copy and a working View DPA link (href = canonical page); no Request DPA button, no PandaDoc mention; TIA/SOC2/ISO27001/HIPAA cards unaffected - [x] www: `/legal/dpa` permanently redirects to `/legal/customer-resources/data-processing-addendum`; footer no longer shows DPA; zero console errors - [x] www: subscribing on the subprocessor page succeeds (200 from the form route, profile created with topic_4) and fires `www_subprocessor_updates_subscribed` (201 from the telemetry endpoint); test profile unsubscribed afterwards - [x] www: `/downloads/docs/Supabase+DPA+260601.pdf` returns 404 with no redirect; DPA card copy verified without the effective date ## Linear - fixes GROWTH-1068 |
||
|
Pamela Chia
|
4ae0c08967 |
feat: tos v3 update banner + publish subprocessor list (#48524)
Terms of Service v3 (effective August 1, 2026, #48482) incorporates the Data Processing Addendum by reference, and Legal asked for an in-app notice announcing the change. The subprocessor list page that the new Terms, DPA, and notice all point at was merged as an intentionally hidden draft (#48100) and never un-hidden. **Changed:** - **Dashboard ToS-update banner**: re-enables `BannerTOSUpdate` with the v3 copy provided by Legal (DPA incorporation, subprocessor list location, fees provisions). New expiry (August 29) and a new localStorage key, since anyone who dismissed the May v2 banner would otherwise never see this one. - **Subprocessor list page published**: removes `noindex,nofollow` and links the page from the Legal Hub index, so the page customers are told to subscribe on is actually discoverable. - **Studio e2e fixture updated**: the global Playwright fixture suppressed the banner via the old localStorage key; with the gate live again it would have rendered the banner into every e2e run. It now sets the new key. ## To test Verified on the Vercel previews : - [x] Studio: banner renders on dashboard load with the Notice badge and new copy; Learn more dialog shows the three changes with correct hrefs (DPA page, subprocessor list, /terms); Understood dismisses and persists across reload via `terms-of-service-update-2026-08-01` - [x] www: `/legal` lists Subprocessor List under Customer Legal Resources; `/legal/customer-resources/subprocessor-list` serves `robots` meta `index,follow` and renders the download button + subscribe form; zero console errors on all tested pages ## Linear - fixes GROWTH-1067 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a publicly accessible Subprocessor List to the legal resources. * Updated the Terms of Service notice to reflect the August 1, 2026 update, including data processing, subprocessors, fraud prevention, and consumer provisions. * **Documentation** * Made the Subprocessor List discoverable through standard search indexing and the legal resources page. * Extended the Terms of Service banner availability through August 29, 2026. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
39715b4d2f | Fix buildAPIPermissionScopeMap tests | ||
|
fadymak
|
e6b8725571 |
feat(account): require a user to name their TOTP authenticator (#48493)
Currently it's an autogenerated name. We want users to explicitly enter a name for their authenticator so that: - They can remember that they took the action of registering an authenticator - They can see a meaningful name during sign-in if they have multiple TOTP authenticators <img width="536" height="269" alt="Screenshot 2026-07-30 at 16 05 10" src="https://github.com/user-attachments/assets/e43de27f-b4ca-4d4f-969a-578267eeebe4" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **Bug Fixes** * Improved TOTP enrollment: confirmation is no longer enabled unless an authenticator app name is provided (validated beyond whitespace). * **UI Improvements** * Updated the authenticator app name label/description, added an example placeholder, and auto-focused the field when the confirmation step appears. * Refined the on-screen guidance for suggested authenticator apps (e.g., Google Authenticator or 1Password). <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
0e92a9574c |
Joshen/fe 3932 support branching conversations (#48519)
## Context Adds support for branching off from an Assistant's Response - which creates a new chat with all the previous messages including from where we're branching off from <img width="204" height="97" alt="image" src="https://github.com/user-attachments/assets/0b171ae6-f2b4-4b58-87fa-0010ad45f777" /> Branched conversations will have an indication of where it was branched off from <img width="404" height="427" alt="image" src="https://github.com/user-attachments/assets/bed8502f-3f83-4f76-bc00-feac86fa57a6" /> ## Other changes - Also added support for copying an Assistant's Response <img width="190" height="115" alt="image" src="https://github.com/user-attachments/assets/5e4aa0b8-eb6e-485f-80c0-3028b95720f7" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Branch conversations from assistant messages into a new chat. * View the originating conversation and navigate back to it. * Copy assistant message content with visual confirmation. * Access branching and copying actions from message controls. * **UI Updates** * Added “Branched from” indicators for branched conversations. * Updated the assistant disclaimer text to “The Assistant.” <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Alaister YoungandAlaister Young
|
fc5e03f9e3 |
[FE-4019] fix(studio): direct-only connection strings with SSL params for Multigres (#48433)
Multigres (high-availability) projects only accept TLS connections with direct SSL negotiation, and they don't support connection pooling at all — neither Supavisor nor the dedicated PgBouncer pooler exists for them. Studio previously showed pooler connection strings that would fail with "server closed the connection unexpectedly". This PR makes every connection-string surface direct-only for HA projects and appends `?sslmode=require&sslnegotiation=direct` to the examples. Non-HA projects are unchanged. Addresses [FE-4019](https://linear.app/supabase/issue/FE-4019/append-ssl-params-to-multigres-connection-string-examples-in-ui) **Changed:** - `buildConnectionStringPooler` gets an HA branch that collapses every slot in the bag to the direct connection string with the SSL params appended (mirroring the existing CLI branch, which also has no pooler) — dedicated slots come back `undefined` and `ipv4SupportedForDedicatedPooler` is forced off. Since HA never reaches the pooler layout anymore, the earlier per-URI SSL-append logic on pooler strings is removed - `useConnectState` coerces `connectionMethod` to `direct` and `useSharedPooler` to `false` for HA projects. The Connect sheet restores the last-used method from localStorage shared across projects, so a "Transaction pooler" selection made on a regular project could otherwise leak pooler-flavored notices, badges, and telemetry into an HA project - Prisma and Drizzle ORM tabs get an HA branch: `DATABASE_URL`/`DIRECT_URL` both use the direct connection, no `?pgbouncer=true` appended, with a comment explaining Multigres doesn't support pooling. The 5-arm nested ternaries in both files are flattened into `getEnvCode` helpers that switch on a shared `resolveOrmConnectionScenario` helper (`OrmConnection.utils.ts`), so the deployment-mode/HA branching lives in one tested place and each file keeps only its own formatting - The PgBouncer and Supavisor config queries are disabled (`enabled: !isHighAvailability`) in the Connect sheet — those endpoints serve pooler config that doesn't exist on Multigres - `parseConnectionParams` keeps the URI's query string in a new `search` field so formats rebuilt from parsed parts can carry it - psql switches from the `-h/-p/-d/-U` flag form to the quoted-URI form when query params are present (flags can't express them; psql still prompts for the password) - JDBC appends the params using pgJDBC's casing (`sslNegotiation`, supported since 42.7.4) - Prisma's `?pgbouncer=true` appends are query-aware (join with `&` when the URI already has a query string) via a new `appendConnectionStringParams` helper - The project home "Direct connection string" copy item also appends the params for HA projects **Added:** - Unit tests for the HA collapse behavior (all slots direct, dedicated config and IPv4 add-on ignored, no SSL params on non-HA output), the `useConnectState` coercion, the psql/JDBC builders (moved from `content.tsx` into `ConnectionString.utils.ts` so they're testable), and `resolveOrmConnectionScenario` (every deployment-mode/HA/pooler branch) **Known gaps (left out deliberately):** - The grid ExportDialog psql/pg_dump commands, the .NET `appsettings.json` (Npgsql only supports direct negotiation from v9 via `SSL Negotiation=Direct`), and the SQLAlchemy keyword-style `.env` are flag/keyword forms that can't carry the URI params — these would still fail against Multigres and need a follow-up - Settings > Database's Connection Pooling section and the pooler logs page have no HA gating yet — they'd still render pooler config UI for a Multigres project and should be hidden in a follow-up ## To test On a **Multigres (HA) project** (staging only supports `us-east-1` for Multigres): - Open the Connect sheet → Direct tab: there's no connection-method picker, and the connection string is the direct one ending with `?sslmode=require&sslnegotiation=direct` for the URI, PHP, and psql (quoted-URI form) types; JDBC includes `&sslmode=require&sslNegotiation=direct` - ORM tab → Prisma: both `DATABASE_URL` and `DIRECT_URL` are the direct connection string with the SSL params, no `pgbouncer=true`, with a "Multigres does not support connection pooling" comment. Drizzle likewise shows the direct string only - Framework tabs (e.g. Next.js): every `DATABASE_URL` carries the direct string with the params exactly once - Open the network tab: no requests to `/config/pgbouncer` or `/config/supavisor` while using the Connect sheet - To check the localStorage coercion: on a **regular** project pick "Transaction pooler" in the Connect sheet, then open the sheet on the Multigres project — no pooler badge/notices, string is still direct - Copy the URI, substitute your password, and `psql "<string>"` — it should connect - Project home → Copy dropdown → "Direct connection string" includes the params On a **regular (non-Multigres) project** — confirm nothing changed: - Connect sheet: direct/session/transaction strings for all connection types (URI, psql flag form, JDBC, PHP) look the same as before, no SSL params appended - Prisma/Drizzle tabs render identically (`?pgbouncer=true` still appended with `?`, dedicated-pooler alternatives still shown per IPv4 add-on state) - Project home copy dropdown is unchanged <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Enhanced connection-string generation for high-availability projects, including required SSL settings for direct connections. * Preserved URI query parameters in PostgreSQL, `psql`, JDBC, and generated environment configurations. * Improved ORM environment templates with clearer handling for pooler and high-availability connection scenarios. * **Bug Fixes** * High-availability projects now consistently use direct connections instead of pooler options. * Connection strings and generated templates update correctly when availability settings change. * **Tests** * Expanded coverage for query parameters, high-availability behavior, and connection scenarios. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Joshen Lim
|
78957bcd68 |
Replace disable pipelines cta with enable pipelines if pipelines not enabled yet (#48518)
## Context Addresses 2 issues found for the Replication UI - "Disable Pipelines" CTA was still being shown despite Pipelines not being enabled yet - Opting to show the "Enable Pipelines" CTA instead in this case, which will open the `EnablePipelinesModal` <img width="269" height="162" alt="image" src="https://github.com/user-attachments/assets/41e5ec7d-11b1-4008-ae9d-64def00329eb" /> - Fixes "Disable Pipelines" being incorrectly disabled <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added options to enable or disable Pipelines directly from the replication destinations menu. * Added an enablement modal with messaging and upgrade actions based on available access. * Added support for opening the Pipelines modal through external controls. * **Bug Fixes** * Corrected action disabled states and destination-removal guidance. * Improved error handling when disabling Pipelines, including a reliable fallback message. * Refined modal and dialog layout spacing for a more consistent presentation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Danny White
|
4381e1290c |
fix(studio): replace form-group green focus shadows with focus-ring (#48221)
## What kind of change does this PR introduce? Bug fix / a11y cleanup ([DEPR-629](https://linear.app/supabase/issue/DEPR-629)). ## What is the current behavior? `apps/studio/styles/globals.css` still styles `.form-group` / `.form-control` inputs with a legacy soft green focus glow (`box-shadow: … rgba(62, 207, 142, …)` plus `ring-current`). That can fight modern focus rings if those classes are ever present. ## What is the new behavior? Those legacy focus rules are removed. Matching inputs use `@apply focus-ring` instead. | Before | After | | --- | --- | | <img width="882" height="246" alt="CleanShot 2026-07-31 at 13 28 42@2x" src="https://github.com/user-attachments/assets/3aa00e2f-918f-4e72-9db0-4ad75864cc58" /> | <img width="864" height="244" alt="CleanShot 2026-07-31 at 13 28 57@2x" src="https://github.com/user-attachments/assets/4a96439d-16de-4ebb-ab07-2ae7cbf46c0b" /> | ## To test These CSS selectors are legacy. Easiest before/after is a one-line probe in the browser. 1. Open the **Studio preview** for this PR (and, for comparison, production Studio or `master`). 2. Go to any project (any page is fine). 3. Open DevTools → Console and paste: ```js document.body.insertAdjacentHTML( 'beforeend', `<div class="form-group" style="position:fixed;right:16px;bottom:16px;z-index:9999;padding:12px;background:var(--background);border:1px solid var(--border);border-radius:8px"> <label style="display:block;margin-bottom:8px">Legacy form-group probe</label> <input type="text" value="Tab to me" /> </div>` ) ``` 4. Click the injected input (or Tab to it). | | Focus look | | --- | --- | | **Before** (production / `master`) | Soft **green** halo | | **After** (this PR) | Shared **`focus-ring`** only (no green glow, no double stack) | Optional smoke (no visual change expected): **Project Settings → General → Project name** — Tab into the field; normal shared focus ring still works. ## Additional context - Related: #41575, DEPR-628 |
||
|
Danny White
|
d1e7c403ac |
fix(ui): align Admonition titles and docs link hover with prose (#48428)
## What kind of change does this PR introduce? UI bug fix. ## What is the current behavior? After the recent Admonition a11y refactor: - Titled Admonitions in MDX (blog and docs) could pick up large prose top margin on the title, or (after follow-ups) end up with a title much smaller than the body because the title was a `div` at `text-sm` while body `<p>`s took prose ~15px - Docs MDX links (including inside Admonitions) had a weak hover: prose only shifted underline colour Prior issues: - A couple of guide callouts bolded link text via `[**…**](…)` - Some funky Admonition formatting as called out in comments below ## What is the new behavior? - `AlertTitle` is a `<p>` with `!mt-0 mb-0.5 font-medium` (not an `h5` / bare `div`), so it does not break heading hierarchy and matches admonition body font-size under prose - Admonition uses `AlertTitle` again (though with `<p>` as explained above) and wraps MDX `children` in `AlertDescription` (same as `description`) - `Alert` / `AlertTitle` / `AlertDescription` get `data-slot` attributes; description keeps string→`<p>` wrapping, Studio density, plus `text-balance` - Docs link hover: typography `a:hover` and `MdxAnchor` now move text + decoration toward foreground (InlineLink-like), without stealing brand link colour via `text-inherit` - Content: remove accidental bold on oauth-scopes and multi-factor-authentication guide links | Before | After | | --- | --- | | <img width="1360" height="378" alt="CleanShot 2026-07-29 at 16 44 48@2x" src="https://github.com/user-attachments/assets/1aa98cb4-e691-428e-b7e2-a78afcdf518d" /> | <img width="1350" height="362" alt="CleanShot 2026-07-29 at 16 44 08@2x" src="https://github.com/user-attachments/assets/63c9c7df-c1c7-49c4-8fdb-0411ae251a71" /> | | <img width="1518" height="448" alt="CleanShot 2026-07-29 at 16 46 18@2x" src="https://github.com/user-attachments/assets/d618e138-fcd7-4a44-b16d-cb0ac5ba6b0e" /> | <img width="1524" height="424" alt="CleanShot 2026-07-29 at 16 46 30@2x" src="https://github.com/user-attachments/assets/dbc7710e-42c6-483c-b367-19b2ff3a6475" /> | | <img width="1524" height="598" alt="CleanShot 2026-07-29 at 16 47 15@2x" src="https://github.com/user-attachments/assets/c9c07f37-4e2b-40fa-bc90-c86a17e5ea32" /> | <img width="1530" height="584" alt="CleanShot 2026-07-29 at 16 47 39@2x" src="https://github.com/user-attachments/assets/806735f0-fa44-42e6-bd5a-127899d0bfc2" /> | ## To test **Docs** 1. [Functions quickstart](https://docs-git-fix-admonition-alert-title-prose-supabase.vercel.app/docs/guides/functions/quickstart): titled tip near the top. Title and body should be the same size, no giant gap above the title 2. [BYO MCP](https://docs-git-fix-admonition-alert-title-prose-supabase.vercel.app/docs/guides/ai-tools/byo-mcp): tip with links. Hover a link (text + underline should both go foreground) 3. [OAuth scopes](https://docs-git-fix-admonition-alert-title-prose-supabase.vercel.app/docs/guides/integrations/build-a-supabase-oauth-integration/oauth-scopes): note link is not bold 4. [Multi-factor authentication](https://docs-git-fix-admonition-alert-title-prose-supabase.vercel.app/docs/guides/platform/multi-factor-authentication): same, note link not bold **Blog** 5. [CLI v2 config as code](https://zone-www-dot-com-git-fix-admonition-alert-title-prose-supabase.vercel.app/blog/cli-v2-config-as-code): titled Admonitions. Title size matches body, no huge top margin **Other** 6. [Design system: Admonition](https://design-system-git-fix-admonition-alert-title-prose-supabase.vercel.app/design-system/docs/fragments/admonition): component reference 7. Studio (e.g. project Edge Functions secrets): Admonitions should stay compact `text-sm` outside prose. Preview: [studio-staging](https://studio-staging-git-fix-admonition-alert-title-prose-supabase.vercel.app) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * None * **Style** * Improved link decoration consistency (underline/hover) across internal and external documentation content, with safer external link handling. * **Bug Fixes** * Refined alert/admonition rendering for clearer title/description semantics and better spacing/text wrapping. * Updated documentation image rendering to avoid forwarding whitespace-only children and adjusted chart image layout. * **Tests** * Expanded assertions for alert/admonition structure and styling. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Danny White
|
0e5c073b46 |
fix(docs): unblock prerender by closing Image JSX without blank lines (#48465)
## What kind of change does this PR introduce? Bug fix ## What is the current behavior? Docs production builds can fail during prerender with: `TypeError: Cannot read properties of undefined (reading 'children')` Seen on `/guides/ai/going-to-prod` (and the same pattern exists on several other guides). Root cause: blank lines inside MDX JSX such as `<Image ...>` make the MDX parser treat the element as closed early, which corrupts the AST. Separately, `apps/docs/components/Image.tsx` forwarded accidental `children` (and could overwrite `src`) onto `next/image`. ## What is the new behavior? - Remove blank lines before the closing `/>` on the affected guide MDX files so the JSX stays one element. - Make the docs `Image` wrapper drop `children` and keep `src` from props only, so a bad MDX tree is less likely to crash the build. ## Additional context Split out of #48428 so that PR stays focused on Admonition/Alert typography. ### To test 1. Check out this branch and run the docs app locally (`apps/docs`), or wait for the Vercel docs preview on this PR. 2. Confirm these pages render without a prerender / `children` crash: - [/docs/guides/ai/going-to-prod](https://docs-git-fix-docs-image-mdx-blank-lines-supabase.vercel.app/docs/guides/ai/going-to-prod) - [/docs/guides/ai/engineering-for-scale](https://docs-git-fix-docs-image-mdx-blank-lines-supabase.vercel.app/docs/guides/ai/engineering-for-scale) - [/docs/guides/ai/choosing-compute-addon](https://docs-git-fix-docs-image-mdx-blank-lines-supabase.vercel.app/docs/guides/ai/choosing-compute-addon) - [/docs/guides/ai/vector-indexes/hnsw-indexes](https://docs-git-fix-docs-image-mdx-blank-lines-supabase.vercel.app/docs/guides/ai/vector-indexes/hnsw-indexes) - [/docs/guides/database/orioledb](https://docs-git-fix-docs-image-mdx-blank-lines-supabase.vercel.app/docs/guides/database/orioledb) - [/docs/guides/database/connecting-to-postgres](https://docs-git-fix-docs-image-mdx-blank-lines-supabase.vercel.app/docs/guides/database/connecting-to-postgres) - [/docs/guides/telemetry/reports](https://docs-git-fix-docs-image-mdx-blank-lines-supabase.vercel.app/docs/guides/telemetry/reports) 3. Spot-check that the guide images still show at the expected size (no broken/missing images from the `Image` wrapper change). 4. Confirm Docs CI / Vercel docs build passes on this PR (this was the failure mode on master-ish builds). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added zoomable behavior to the Disk Size chart, with optimized light and dark theme images. * **Bug Fixes** * Improved image rendering in documentation pages by handling captions, styling, and MDX content more reliably. * Corrected image markup formatting across multiple guides to ensure content parses and displays correctly. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
99599a843d |
docs(cli): address review feedback on getting-started update tabs (#48504)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update — follow-up to #48426, addressing review feedback on the npm panel of "Updating the Supabase CLI". ## What is the current behavior? - Lead-in text doesn't match the short imperative style of the other platform tabs ([review comment](https://github.com/supabase/supabase/pull/48426#discussion_r3678295762), [review comment](https://github.com/supabase/supabase/pull/48426#discussion_r3678299519)) - Beta instructions use `npm update supabase@beta`, which stays within the semver range in `package.json` and can't move a stable install to the `beta` dist-tag ([review comment](https://github.com/supabase/supabase/pull/48426#discussion_r3671400751)) ## What is the new behavior? - Lead-ins rewritten to match the other tabs: "Update the CLI with npm:" - Beta command changed to `npm install supabase@beta --save-dev`, which works for both updating an existing beta install and switching channels ## Additional context Prettier passes locally; MDX lint couldn't run locally (`node-pty` build issue), so relying on CI. 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Streamlined the Supabase CLI upgrade instructions for npm installs. * Clarified the stable update command and updated the beta-channel guidance to use the beta install command for switching. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Miranda Limonczenko <miranda.limonczenko@supabase.io> |
||
|
Danny White
|
3b06c6c7cc |
fix(docs): unify docs card hover and retire IconPanel (#48379)
## What kind of change does this PR introduce?
Bug fix / docs UI polish.
## What is the current behavior?
- Many docs `GlassPanel`s use `background={false}`, so hover only tweaks
the border and reads as having no hover state
- Compact icon+label grids still use `IconPanel`, which has a broken
`-z-10` hover fill and overlaps with the newer `IconLink` pattern
- Description card grids jump to 3-up too early on medium widths
## What is the new behavior?
**GlassPanel**
- Removes the `background` prop; cards always use the filled surface
with stronger border hover
- Tightens icon→description gap (`gap-6` → `gap-3`)
- Decorative icons/logos use empty `alt` so screen readers don’t hear
the title twice
**Icon tiles**
- Retires `IconPanel` from docs and deletes it from `ui-patterns`
- Uses `IconLink` / `IconLinkList` for compact navigation tiles (auth
providers, social login, etc.)
- Adds `IconLinkButton` for SMS provider pickers (same chrome, opens a
dialog)
- Adds focus styles, list labelling, and dialog-trigger ARIA where
needed
**Layout / content**
- Migrate-to-Supabase description cards on resources use `GlassPanel`
(not slim icon tiles)
- Grid spans use `md:… xl:…` so cards stay 2-up until ~1280px
- Fixes migrate links to `/guides/platform/migrating-to-supabase/…` and
SSR quickstarts to `creating-a-client` with framework query params
- Moves the Extensions list `key` onto the outer `Link`
| Before | After |
| --- | --- |
| <img width="1185" height="1323" alt="Resources Supabase Docs"
src="https://github.com/user-attachments/assets/1677bf65-d3a3-4202-8c70-e758f7c3bcce"
/> | <img width="1185" height="1323" alt="Resources Supabase Docs"
src="https://github.com/user-attachments/assets/51760f0f-62b6-4010-9841-de26039f37b4"
/> |
## Additional context
Homepage compact sections already use `IconLinkList` from #48317; this
PR finishes that pattern for remaining docs `IconPanel` callsites and
cleans up GlassPanel hover.
`www/customers` only drops the removed `background` prop; those cards
already use the filled surface via `logo`.
## Test plan
- [ ] `/guides/getting-started`: GlassPanels show filled surface and
clearer border hover
- [ ] `/guides/resources`: migrate cards are GlassPanels with working
`/platform/…` links; 2-up until xl
- [ ] `/guides/auth/social-login` and auth providers partial: IconLink
tiles hover/focus correctly
- [ ] `/guides/auth/phone-login`: SMS provider buttons open dialogs;
keyboard focus works
- [ ] Docs homepage: migrate / self-host IconLinkLists unchanged in
behaviour
- [ ] `/guides/auth/server-side`: Next.js / SvelteKit cards resolve on
docs preview
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Improved Layouts**
* Made “GlassPanel” card grids more responsive and consistent; refined
card and success badge spacing for a cleaner presentation.
* **Updated Documentation**
* Refreshed multiple guide and resource pages (including quickstarts and
migration content) with standardized card layouts and updated link
destinations.
* **Component Updates**
* Standardized “GlassPanel” styling (background toggle removed) and
simplified icon-based panels; added an `IconLinkButton` for action
tiles; updated authentication provider grids to use the shared tile UI.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
|
||
|
Danny WhiteandJoshen Lim
|
5edcaef74c |
chore: show organization invite errors inline (#48470)
## What kind of change does this PR introduce? Bug fix and design-system documentation update. ## What is the current behavior? Invite acceptance failures only appear in a transient toast. ## What is the new behavior? Invite failures remain visible beside the actions. The design-system guidance now distinguishes field, action, state, and toast feedback. | Before | After | | --- | --- | | <img width="759" height="619" alt="Join Organization Supabase" src="https://github.com/user-attachments/assets/ed8e974c-5da3-477a-81da-628d3f847131" /> | <img width="741" height="768" alt="Join Organization Supabase" src="https://github.com/user-attachments/assets/4c3f6bcd-4ed9-40b2-8280-e8c8a44ecbd6" /> | ## To test With local Studio running at `http://localhost:8082`: 1. Open `apps/studio/components/interfaces/OrganizationInvite/OrganizationInvite.utils.ts`. 2. At line 37, immediately inside `getOrganizationInviteStatus`, add: ```tsx return 'ready' ``` This deliberately bypasses invite lookup and account checks for the visual test. 3. Open `apps/studio/components/interfaces/OrganizationInvite/OrganizationInvite.tsx`. 4. At line 30, change: ```tsx const [joinError, setJoinError] = useState<string>() ``` to: ```tsx const [joinError, setJoinError] = useState<string>('Invite token can only be accepted via an SSO account') ``` 5. Open `http://localhost:8082/join?token=test&slug=test` while signed in. 6. Confirm the card says **Join an organization** and shows the error below **Decline**, separated from the actions by a divider. 7. Revert both temporary edits before committing anything. ## Additional context First PR in a five-PR stack. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added a new connect interstitial example showcasing an inline action-error state with clear retry guidance. - **Bug Fixes** - Invitation acceptance failures now show inline destructive feedback under “Accept invite,” keeping the button enabled for retry (and removing prior toast-based failure behavior). - Updated the invalid-invitation title to “Invalid invitation.” - Changed the “Decline” link destination to `/organizations`. - **Documentation** - Expanded Sonner toast “When to use” guidance. - Refined form and connect interstitial action-feedback patterns (inline vs toast usage). - **Tests** - Updated and added coverage for the inline error rendering and “Invalid invitation” text. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Danny WhiteandJoshen Lim
|
205527c716 |
feat(studio): tune up replication page layout and empty state (#48265)
## What kind of change does this PR introduce? UI polish for Database → Replication: empty state, page layout, diagram containment, filter actions, and destination sheet copy. ## What is the current behavior? - Empty destinations use a custom dashed box with generic copy. - The diagram is full-bleed with `border-y`. - Page chrome still uses legacy Scaffold wrappers and a long header description that duplicates the empty state. - Filter-row “Add destination” is a default button ahead of secondary actions; Usage always shows. - Local ETL warning sits on the page list. - Destination sheet title/helper/access copy is more verbose; Type helper sits beside the label. ## What is the new behavior? - Empty state uses `EmptyStatePresentational` with clearer CTA copy; toolbar “Add destination” is primary at the end of the filter row; empty-state CTA stays default. - Usage only appears when there is at least one Pipelines destination. - Page uses `PageHeader` / `PageContainer` / `PageSection`, with a short header: “Read replicas and analytics pipelines”. - Diagram sits in a rounded bordered frame inside the page container (same treatment as project overview). - Local ETL warning shows in the add-destination sheet for Pipelines types only, without blocking the form; Type + warning scroll with the sheet body. - Type helper sits under the dropdown as one flowing paragraph (“Cannot be changed after creation…” plus shortened stage notice). - Sheet title is “Add destination”; close only fires on dismiss; Lucide icons (e.g. Snowflake) use consistent stroke width. | Before | After | | --- | --- | | <img width="1479" height="930" alt="Replication Database Chisel Toolshed Supabase" src="https://github.com/user-attachments/assets/a3caf0ba-ed1a-4659-bdef-f66b67e85be4" /> | <img width="1479" height="930" alt="Replication Database Chisel Toolshed Supabase" src="https://github.com/user-attachments/assets/d5a82641-a316-4577-9480-959346994c40" /> | | <img width="1479" height="930" alt="Replication Database Chisel Toolshed Supabase" src="https://github.com/user-attachments/assets/4f956e26-b8d4-4653-a60e-ceca7ec1e070" /> | <img width="1479" height="930" alt="Replication Database Chisel Toolshed Supabase" src="https://github.com/user-attachments/assets/a72461ab-dea9-48a6-ab88-852a12ac80a5" /> | ### Test plan - [x] Open **Database → Replication** with no replicas/destinations: empty state, primary filter-row Add destination, default empty-state Add destination, no Usage button. - [x] Confirm header→diagram and diagram→filter spacing feel even; filter→empty state/table stays tight (`space-y-4`). - [x] Confirm diagram is contained (rounded border), not full-bleed. - [x] Add a Pipelines destination (or use a project that has one): Usage appears; table still works; search “no results” still works. - [ ] Open **Add destination**: title “Add destination”; Type helper under the dropdown; Read Replica has no local warning; Pipelines type shows local warning without hiding fields (when ETL isn’t set up locally). - [ ] Without Pipelines access: request-access panel shows “alpha” copy and “Request alpha access”. - [ ] Spot-check dark/light themes. --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Danny White
|
3a1b1e391d |
chore(design-system): match studio font stack (#48477)
## What kind of change does this PR introduce? Chore ## What is the current behavior? Design system still uses the old CustomFont family, so documented components no longer match Studio, www, and docs after the Inter / Manrope rollout. ## What is the new behavior? Design system uses the same font stack as the other apps: - Inter for body (`--font-sans`) - Manrope for headings (`--font-heading`) - Source Code Pro for mono Also adopts the Inter-optimised type scale and base weight (`450`) used in Studio. ## Additional context Based on Francesco's unshipped `chore/update-fonts` draft (design-system slice only). Related shipped work: #47306, #47227. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Updated the design system with refreshed typography using Inter and Manrope, with Source Code Pro for code. * Refined theme typography and spacing tokens, including a more complete text scale, updated font weights, and container sizing. * Improved heading styling and ensured `code`/`pre`/`kbd`/`samp` use consistent monospace treatment. * Adjusted default border styling and improved font loading/fallback behavior for more consistent rendering. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Andrey A.
|
4466cc4e45 | fix(self-hosted): override dns ttl in kong config to avoid wrong routing (#47846) | ||
|
Andrey A.
|
18bad2e61c | chore(self-hosted): remove em-dashes (#48498) | ||
|
Andrey A.
|
3e02ce74b8 | fix(self-hosted): pin rustfs to beta.11 and fix s3 tests (#48500) | ||
|
Gildas Garcia
|
7b8eb48bb9 | Fix build | ||
|
Gildas Garcia
|
4d88aa7bb0 | Fix tests | ||
|
Gildas Garcia
|
2e3a696d44 | Fix form accessibility | ||
|
Thomas
|
63a74d488f | chore(billing): rework texts on aws marketplace onboarding page (#47735) |