## Problem
The Query Performance page loaded all results in a single query with a
fixed limit of 20 rows, giving users no way to browse beyond the first
page. There was also no way to control how many rows were shown at once.
## Fix
adds pagination
## How to test
- Navigate to `/observability/query-performance` in Studio
- scroll to bottom
- should automatically load more results
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
This PR updates @supabase/*-js libraries to version 2.100.0.
**Source**: supabase-js-stable-release
**Changes**:
- Updated @supabase/supabase-js to 2.100.0
- Updated @supabase/auth-js to 2.100.0
- Updated @supabase/realtime-js to 2.100.0
- Updated @supabase/postgest-js to 2.100.0
- Refreshed pnpm-lock.yaml
This PR was created automatically.
Co-authored-by: supabase-workflow-trigger[bot] <266661614+supabase-workflow-trigger[bot]@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update to `humans.txt` to add `Colum Ferry`
## What is the current behavior?
`Colum Ferry` does not exist in `humans.txt`
## What is the new behavior?
`Colum Ferry` exists in `humans.txt`
"Linking.useURL()" has been deprecated in Expo. This updates the example
to use the recommended "useLinkingURL()" hook, which provides the same
functionality for handling initial and subsequent deep links.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
docs update
## What is the current behavior?
The Expo example code uses "Linking.useURL()", which is now marked as
deprecated in Expo SDK 50+ and produces a TypeScript warning.
## What is the new behavior?
The example now uses the recommended "useLinkingURL()" hook from
"expo-linking". This prevents deprecation warnings for developers
adopting this example. The functionality (handling initial and
subsequent deep links) remains exactly the same.
## Additional context
Expo Linking documentation:
https://docs.expo.dev/versions/latest/sdk/linking/
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Add docs for the custom OAuth & OIDC providers
## Notes
- Pricing to be clarified. Until now, we allow 3 providers per project.
- Dashboard instructions will be updated after dashboard is finalized.
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## What kind of change does this PR introduce?
Minor polish
## What is the current behavior?
We have a privacy policy notice that uses `Alert_Shadcn_` with bespoke
links and badge.
## What is the new behavior?
- Reuse `Admonition` and `InlineLink` components
- Use sentence case as per our copywriting guidelines
- Tighten copywriting
| Before | After |
| --- | --- |
| <img width="1024" height="563" alt="Projects Boring Org Supabase"
src="https://github.com/user-attachments/assets/43fd9d4f-21e2-461b-92e3-d75578ae2ddd"
/> | <img width="1024" height="563" alt="Projects Boring Org
Supabase-27BBA2B8-4F90-4FB5-852D-B92B38AF5055"
src="https://github.com/user-attachments/assets/c0c09aae-c110-46cb-86ad-f6df557e1a4f"
/> |
## Additional context
Legal should sign off on this too.
## Context
Adds a "source" param in the new Connect sheet to allow selecting read
replicas - this was present in the old Connect dialog
<img width="962" height="713" alt="image"
src="https://github.com/user-attachments/assets/3c805e41-e8df-431b-83d0-e5f227d68475"
/>
Selecting sources will update the connect steps at the bottom -
connection string, host etc
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
We have users reporting random four oh fours in the dashboard. We can't
reproduce locally, but this is pointing to an next js issue.
The reason is the users were getting appended a double /dashboard route.
it all points to 80852 in next js, double base path. We added app dir
recently as well
https://github.com/vercel/next.js/issues/80852
Adds `chatId` (the chat UUID) to the three assistant PostHog events so
we can count distinct chat sessions in PostHog. This naming is
consistent with how we name the field in Braintrust logs.
Also migrates from the deprecated `useSendEventMutation` hook to
`useTrack` — groups (project/org) are still sent automatically by
`useTrack`.
Closes AI-519
### Summary
This PR adds support for Isle of Man customers to use GB VAT tax IDs.
Isle of Man uses the UK VAT system, so Orb requires country: 'GB' for
validation - but the billing address country is IM.
- Adds an IM VAT entry to `TAX_IDS` with a new `taxCountryIso2` override
field, so the UI shows "IM VAT" while sending country: 'GB' to Orb
- Introduces `getEffectiveTaxCountry()` to resolve the correct country
code for Orb
- Introduces `resolveStoredTaxId()` to map stored Orb data back to the
correct UI entry, using billing address country to disambiguate IM vs GB
- Updates all three billing forms to use these utilities: Billing
Settings page, Add Payment Method modal and Update Billing Address modal
### Testing
#### Automated tests
I've added unit tests in this PR
#### Manual tests
You can use the following country/city/postal code combinations to test:
- Isle of Man, Douglas, IM1 2LE
- United Kingdom, Crumlin, BT29 4AA
**Billing Settings page**
- Select Isle of Man as billing country → tax ID dropdown shows "Isle of
Man - IM VAT"
- Select United Kingdom as billing country → tax ID dropdown shows
"United Kingdom - UK VAT" / "United Kingdom - GB VAT" (not "IM VAT")
- Select IM VAT, enter a valid GB VAT number, save → check network tab,
Orb receives country: 'GB'
- Reload page for an IM customer with existing tax ID → "IM VAT" is
pre-selected (not "UK VAT")
- Reload page for a GB customer with existing tax ID → "UK VAT" is
pre-selected (no regression)
- Change country from IM to GB → available tax IDs update, IM VAT no
longer shown
**Add Payment Method modal**
- Open modal for an IM customer with existing tax ID → "IM VAT" is
pre-selected
- Check "I'm purchasing as a business", select Isle of Man in Stripe
address → tax ID dropdown shows "IM VAT"
- Check "I'm purchasing as a business", select United Kingdom in Stripe
address → tax ID dropdown shows "UK VAT" / "GB VAT"
- Submit with IM VAT → check network tab, tax ID is saved with country:
'GB'
- Open modal for a GB customer → no regression, "UK VAT" shown as before
**Update Billing Address modal**
Appears for paid orgs missing a billing address
- Open modal for an IM customer with existing tax ID → "IM VAT" is
pre-selected
- Open modal for a GB customer with existing tax ID → "UK VAT" is
pre-selected
- Fill in IM address + IM VAT and save → saves correctly, modal closes
---------
Co-authored-by: Ignacio Dobronich <ignacio@dobronich.com>
## Problem
Some tests rely on hard coded timeouts. That makes them
- brittle if the timeout is not long enough
- take longer than necessary if the timeout is too long
## Solution
- Rely on playwright `expect` retries when possible
- Rely on UI updates when possible
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
show the "enable" button if the `GET /auth/v1/admin/custom-providers`
returns 404 (without a json body). this is temporary as I want to enable
the rollout of this feature now, and there could be projects which
didn't get the latest auth server release(should be completed by next
week).
## What is the current behavior?
We only show a generic error message.
## What is the new behavior?
Show custom provider specific message and add CTA to enable the custom
providers (simply trigger a PATCH config request to trigger auth config
updates)
## Additional context
<img width="1454" height="390" alt="image-IPleA6ze@2x"
src="https://github.com/user-attachments/assets/b0cb4df8-2499-4749-900c-b78543a72800"
/>
This error is shown after 2 retries of the `GET
/auth/v1/admin/custom-providers`, would be nice to have if we show this
error message without retries.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
New blog post for Stripe Projects
## What is the current behavior?
N/A
## What is the new behavior?
Adds a new blog post: "Supabase joins the Stripe Projects Developer
Preview" and adds Gregor Vand and Ana Mogul to authors.json.
---------
Co-authored-by: Ana <ana1337x@users.noreply.github.com>
## Problem
1. Users attempting to install the Supabase CLI globally via `npm
install -g supabase`
2. The Send Email Hook documentation incorrectly references
`user.email_new` instead of the correct field name `user.new_email`
## Solution
1. Added a clear note in the CLI getting started guide warning users
that npm global installation is not supported, directing them to use the
recommended installation methods instead
2. Corrected all three instances of `user.email_new` to `user.new_email`
in the Send Email Hook documentation to match the actual User interface
definition from `@supabase/auth-js`
## Related
- closes#43157
- closes https://github.com/supabase/cli/issues/4496
## Context
Table Editor - hide "Is unique" configuration for a column that's a
primary key - unnecessary to configure a column as unique if it's
already a primary key (redundant index is created)
## Changes involved
- TableEditor side panel: No longer shows is unique option under
configuration popover if column is a PK
- ColumnEditor side panel: Disable is unique + is nullable option if
column is a PK (Added tooltip)
<img width="810" height="151" alt="image"
src="https://github.com/user-attachments/assets/0f877706-1a56-44b7-864e-ba30efbb67f7"
/>
Also chucked in some minor refactors:
- Refactored some `any` types
- Refactored Column to use the latest Checkbox component
## Problem
The edge function logs table at
`/observability/logs/edge-functions-logs` did not show which edge
function was called. Users had to open individual log entries to find
the function name, even though the information is available in the log
data.
## Fix
- Added `request.pathname` to the SQL SELECT query for
`function_edge_logs` so the pathname is returned with each row.
- Added `extractEdgeFunctionName` utility that parses the last path
segment from the pathname (e.g. `/functions/v1/hello-world-1` becomes
`hello-world-1`).
- Updated `FunctionsEdgeColumnRender` to display the function name
between the HTTP method and the log ID columns.
- Added unit tests for `extractEdgeFunctionName` covering normal paths,
null/undefined, non-string values, and pathnames without slashes.
<img width="1472" height="776" alt="CleanShot 2026-03-19 at 13 18 47@2x"
src="https://github.com/user-attachments/assets/e437f7df-7aab-4ea5-b421-95bab3923605"
/>
## How to test
- Navigate to Logs and Analytics, then Edge Functions logs.
- Confirm each row now shows the function name (e.g. `hello-world-1`)
between the HTTP method and the log ID.
- Confirm rows without a pathname (e.g. non-platform or self-hosted)
still render without errors.
- Confirm clicking a row still opens the log detail panel correctly.
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Problem
We want `ui-patterns` to contain only visual components but
https://github.com/supabase/supabase/pull/43577 introduced a component
with logic about navigation
## Solution
Extract the logic part into a hook and use it in the component.
Next step will be to remove this component and use
`<DiscardChangesConfirmationDialog>` directly along the hook where
needed
## How to test
Check that the fixes from #43577 still work:
On staging, for each case:
- Authentication email templates
- Observability reports
- Edge functions creation
- Edge functions edition
Test:
- Modify the template/report/function
- Navigate away using either the sidebar link, the browser back button
or closing the tab
- Cancel navigation in the confirmation dialog
- Navigation should be prevented and you should not loose your changes
Test:
- Modify the template/report/function
- Navigate away using either the sidebar link, the browser back button
or closing the tab
- Confirm navigation in the confirmation dialog
- Navigation should not be prevented and you should have lost your
changes
## Problem
The database observability dashboard flattens critical spikes when
viewing the 7-day window. A spike clearly visible at the 3-hour view
(2-minute resolution) disappears completely at the 7-day view because
the Prometheus query step was 1 hour, averaging each spike into a
60-minute bucket and reducing its apparent magnitude to near zero.
## Fix
Increase the granularity in the 7 day window to prevent spikes from
being flattened.
Data point counts: 7-day view goes from ~168 to ~336 points per series,
more consistent with the existing 12-hour view (~360 points).
## How to test
- Open the observability database dashboard for a project that has had a
recent CPU, RAM, or connection spike
- Select the "Last 3 hours" time window and confirm the spike is visible
- Switch to "Last 7 days" and confirm the same spike is now visible
(previously it would disappear)
- Confirm all other time windows (10m, 30m, 1h, 24h) still load and
display correctly
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
docs update
## What is the current behavior?
Issues described in this [Slack
thread](https://supabase.slack.com/archives/C02BJ2239GA/p1740408115511769)
## What is the new behavior?
- Full Storage Migration: Transfers all buckets and their contents.
- Bucket Configuration & Metadata Retention: Maintains settings like
public access, file size limits, MIME types, and file metadata.
- Conflict Resolution Options: Skip, merge (overwrite), or rename
buckets in the target project.
- Safety Measures: Requires user confirmation before destructive
actions.
- Efficient Processing: Batches files (10 per batch) and supports nested
directories.
- Progress & Reporting: Real-time updates, detailed migration summaries,
and error tracking for failed files.
---------
Co-authored-by: Illia Basalaiev <illiab@IMB3.local>
## Context
If you've got a queued operation on a table, then switch tables, the
dashboard stalls for a few seconds before finally rendering the selected
table.
This was caused by an infinite loop in a useEffect calling
`reapplyOptimisticUpdates` due to `dataUpdatedAt` being in the
dependency array (which comes from react query)
Removing `dataUpdatedAt` would resolve the issue, but then it won't
solve the following comment in the code:
`// This ensures pending changes remain visible when switching tabs or
after data refresh`
## Changes involved
Opting to refactor the logic for rendering data in the Grid instead
- Avoid manipulating the data directly from the query client
- Manual changes to the query client are hard to track when debugging
- Ideally the data in the query client are exactly what is coming from
the API
- Instead just compute the row data if there's operations applied, and
render that in the grid
```
const baseRows = data?.rows ?? EMPTY_ARR
const rows = formatGridDataWithOperationValues({ operations, rows:
baseRows })
```
- Simplifies operations logic + data in react query remains as the
source of truth
- This also improves perceived performance, as previously we'd need to
invalidate the query client if we're removing any operation.
- A lot more apparent with the undo operation introduced
[here](https://github.com/supabase/supabase/pull/43957)
- Whereas now, we'll just revert back to whatever's in the query client
(and still do the invalidation behind the scenes) so things feel faster
Upgrades `ai` from v5 to v6 and all related packages.
**Package bumps:**
- `ai`: `5.0.52` → `^6.0.116`
- `@ai-sdk/openai`: `2.0.32` → `^3.0.41`
- `@ai-sdk/react`: `2.0.52` → `^3.0.118`
- `@ai-sdk/provider`: `^2.0.0` → `^3.0.8`
- `@ai-sdk/provider-utils`: `^3.0.0` → `^4.0.19`
- `@ai-sdk/amazon-bedrock`: `^3.0.0` → `^4.0.81`
- `@ai-sdk/mcp`: N/A → `^1.0.25`
- `openai`: bumped to `^4.104.0`
- `braintrust`: `3.0.x` → `^3.4.0`
**Breaking change migrations:**
- `generateObject` removed in v6 — migrated 5 API routes to
`generateText` with `Output.object({ schema })`, returning
`result.output`
- `convertToModelMessages` is now async — added `await`
- MCP import path changed: `experimental_createMCPClient` from `ai` →
`createMCPClient` from `@ai-sdk/mcp`
- `openai()` defaults to Responses API — added `store: false` to
provider options for ZDR org compatibility
**Streaming fix:**
Added `Content-Encoding: none` header to `pipeUIMessageStreamToResponse`
calls. Without it, proxy middleware buffers the entire SSE response
before flushing, causing the full reply to appear at once.
**Zero Data Retention fix:**
In recent AI SDK versions, `openai()` default to Responses API instead
of the legacy chat completions API. This produces a 404 from OpenAI with
message `"Items are not persisted for Zero Data Retention organizations.
Remove this item from your input and try again."` The Responses API is
OpenAI's [recommended
endpoint](https://developers.openai.com/api/docs/guides/migrate-to-responses).
This PR adds `store: false` as mentioned in
https://github.com/vercel/ai/issues/10060 to avoid incompatible
persistence attempts.
**References:**
- https://ai-sdk.dev/docs/migration-guides/migration-guide-6-0
-
https://ai-sdk.dev/docs/troubleshooting/streaming-not-working-when-proxied
- https://github.com/vercel/ai/issues/10060
Closes AI-514
Related AI-509
## Context
Shifting more dashboard queries into pg-meta so that we centralize all
manually written queries in one place
Having them in packages/pg-meta also allows us to write tests for them
## To test
Just needs a smoke test on
- Table Editor
- Fetching entities
- Viewing definition
- SQL Editor
- View ongoing queries
- Abort queries
- Integrations
- Queues
- Database
- Migrations
-Triggers (Updating)
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Refactor
## What is the current behavior?
The `/incident-banner` endpoint is implemented using the Pages Router.
## What is the new behavior?
The `/incident-banner` endpoint is moved to the App Router, enabling
caching of the upstream fetch. This does not turn on the querying from
the frontend yet, making that a separate PR so we can revert easily if
needed.
## Additional context
