mirror of
https://github.com/supabase/supabase.git
synced 2026-10-09 03:15:06 +03:00
f05ab582da90efd5f4fa64e2dc314d7ae6b92556
36434
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Alaister Young
|
f05ab582da |
chore(studio): wire self-hosted run + e2e env handling for TanStack build
Previous setup ran the studio under `vite preview` and signalled e2e mode via `NODE_ENV=test`. That broke twice on this branch: 1. `NODE_ENV=test` in the shell overrides Vite's default `NODE_ENV=production` for `vite build`, which makes `@vitejs/plugin-react` emit the dev JSX runtime (`jsxDEV`). The production SSR bundle doesn't have `jsxDEV` available, so every SSR request crashed with `TypeError: jsxDEV is not a function`. 2. `vite preview` is a static SPA preview; it can't reuse the `fetch`-handler shape that `apps/studio/api/server.js` exposes to Vercel. Self-hosted prod needs its own HTTP listener for the same handler. Changes: - Swap `NODE_ENV=test` for `MODE=test` end-to-end. `vite build --mode test` keeps `NODE_ENV=production` automatically (per Vite docs), so the React plugin stays on the prod JSX runtime and TanStack Start bakes the right `NODE_ENV` into the SSR bundle. `.env.test` overrides load through the standard `loadEnv(mode, ...)` order, so the developer's `.env.local` no longer leaks `NEXT_PUBLIC_IS_PLATFORM=true` into e2e builds. - Explicitly set `NEXT_PUBLIC_IS_PLATFORM=false` in `generateLocalEnv.js` so `.env.test` (which loads after `.env.local`) wins regardless of what a developer has set locally. - Add `apps/studio/scripts/serve.js`: a small zero-dep Node HTTP adapter that loads env files, serves `dist/client/*` statics with proper cache headers, and forwards everything else to the `fetch`-handler exported by `dist/server/server.js` — the same handler `api/server.js` hands to Vercel. `pnpm start` runs this; `pnpm preview` keeps the old `vite preview` flow as a debug escape-hatch. - Add `dist/**` to studio's turbo outputs so cached builds restore the Vite output (not just the legacy `.next/**`). - Declare `MODE`, `PORT` in turbo env so cache invalidates correctly when switching between test and production builds. |
||
|
Alaister Young
|
c7de8411cf |
Merge remote-tracking branch 'origin/master' into alaister/tanstack-start
Resolve conflicts: - apps/studio/package.json: drop @supabase/postgres-meta (replaced by @supabase/pg-meta on master) while keeping tanstack/tailwind v4 dev deps - pnpm-lock.yaml: take master's and reconcile via pnpm install Bump tanstack deps to latest available (post supply-chain unpublish): - @tanstack/react-devtools ^0.10.2 -> ^0.10.3 - @tanstack/react-hotkeys ^0.9.1 -> ^0.10.0 - @tanstack/react-query / -devtools ^5.0.0 -> ^5.100.10 (studio/docs/ui-library) |
||
|
Danny WhiteandGildas Garcia
|
09fa2b8fc1 |
Clarify alert and collapsible design-system patterns (#45863)
## What kind of change does this PR introduce? Docs update and design-system component taxonomy cleanup ## What is the current behavior? The design-system docs conflate low-level shadcn primitives with product-level alert patterns. Collapsible documentation previews the alert-specific wrapper, and the alert/collapsible relationship is unclear ## What is the new behavior? - Documents Alert and Collapsible as low-level atom components - Moves the alert-styled expandable wrapper into `ui-patterns/expandable-alert` as `ExpandableAlert` - Documents Expandable Alert as a Fragment Component next to Admonition - Updates the Session Timeout modal to import `ExpandableAlert` from `ui-patterns/expandable-alert` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * `CollapsibleAlert` component is now available for alert-styled expandable content. * **Documentation** * Updated component documentation to clarify when to use `Alert`, `Collapsible`, `Admonition`, and `CollapsibleAlert`. * Added comprehensive documentation for `CollapsibleAlert` with usage examples and variant options. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45863) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com> |
||
|
Vaibhav
|
bcffb9d245 |
fix: ai sidebar closing (#45932)
## TL:DR fixes ai assistant panel closing after running queries in logs and analytics ## b4: (thanks to OP) <img width="2102" height="854" alt="Image" src="https://github.com/user-attachments/assets/6a1416d8-67bf-4166-999a-d8743746efda" /> ## after: https://github.com/user-attachments/assets/bec3366b-b4d6-41c8-a287-f8c37a818f71 ## ref: - closes https://github.com/supabase/supabase/issues/45930 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved synchronization between the Logs Explorer editor and the URL/search state: running a query now updates the shared search state (and recent snippets) rather than performing a full route push, and the editor now prioritizes the URL/state value when present to prevent mismatches during navigation or query execution. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45932) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Danny White
|
8935043a1b |
simplify sql editor warning dialog (#45912)
## What kind of change does this PR introduce? Studio UI cleanup. ## What is the current behaviour? The SQL editor query warning modal repeats itself with an admonition, a nested warning panel, and extra confirmation copy. Single-warning cases are harder to scan than they need to be. ## What is the new behaviour? The warning now uses `AlertDialog` and resolves each detected issue into concise title/body copy. Single-warning cases show one short description, while multi-warning cases show a compact list. The existing RLS actions are preserved. ## Testing instructions Manual SQL editor checks: Open the Studio SQL editor, paste each snippet, click **Run**, verify the warning copy, then click **Cancel**. These snippets are only intended to trigger the warning UI, so do not confirm the dangerous ones. Destructive operation warning: ```sql drop table if exists public.codex_warning_destructive; ``` UPDATE without WHERE warning: ```sql update public.codex_warning_table set id = id; ``` Prevent database connections warning: ```sql alter database postgres connection limit 0; ``` Missing RLS warning: ```sql create schema if not exists codex_warning; create table codex_warning.missing_rls (id bigint); ``` Multiple issues warning: ```sql drop table if exists public.codex_warning_destructive; update public.codex_warning_table set id = id; create schema if not exists codex_warning; create table codex_warning.missing_rls_multi (id bigint); ``` ## Additional context | Before | After | | --- | --- | | <img width="1024" height="759" alt="Codex Warning Table Maintenance SQL Editor Hammer Toolshed Supabas-BDBD32C7-FCE8-4623-ACF2-D2554233EBB4" src="https://github.com/user-attachments/assets/aaed16c2-9910-424a-8a3c-f9815139b1bf" /> | <img width="1024" height="759" alt="Codex Warning Table Maintenance SQL Editor Hammer Toolshed Supabas-C8964C98-1CF9-4992-89D6-86C081C884E8" src="https://github.com/user-attachments/assets/d291c559-1e64-4c63-b918-b20b58d9a2a5" /> | | <img width="1024" height="759" alt="Codex Warning Table Maintenance SQL Editor Hammer Toolshed Supabas-C341A032-B5B0-49A2-8EA2-E3E6EEC54E4F" src="https://github.com/user-attachments/assets/667d9d1a-e34b-4411-9f91-4972ee8d1a23" /> | <img width="1024" height="759" alt="Codex Warning Table Maintenance SQL Editor Hammer Toolshed Supabas-FC66ADE9-6AF1-44D2-A6B6-F7B2FC935C0E" src="https://github.com/user-attachments/assets/1348377e-6606-47c0-aa95-128d7f86ed56" /> | | <img width="1024" height="759" alt="Codex Warning Table Maintenance SQL Editor Hammer Toolshed Supabas-43AAD9FA-7FAC-4DCE-A713-00E8FC76B343" src="https://github.com/user-attachments/assets/bdadedc2-f17d-4011-ae67-5248097b3e92" /> | <img width="1024" height="759" alt="Codex Warning Table Maintenance SQL Editor Hammer Toolshed Supabas-279EC81D-31C7-49C7-B4A8-EEEF1738740A" src="https://github.com/user-attachments/assets/0c178fff-ff49-4522-870d-7a3401c6af30" /> | | <img width="1024" height="759" alt="Codex Warning Table Maintenance SQL Editor Hammer Toolshed Supabas-D405AED5-613F-4C78-909E-F718C67CF17E" src="https://github.com/user-attachments/assets/a4399935-3596-471b-854a-c689e2e0df07" /> | <img width="1024" height="759" alt="Codex Warning Table Maintenance SQL Editor Hammer Toolshed Supabas-725FBCE6-5606-4BC3-B13F-6210DBADF6F2" src="https://github.com/user-attachments/assets/0dcd08fc-cfb4-4d67-b167-eb6eaa768764" /> | | <img width="1024" height="759" alt="Codex Warning Table Maintenance SQL Editor Hammer Toolshed Supabas-EA6563AF-DE7E-4AB8-9164-AC66164CA581" src="https://github.com/user-attachments/assets/ef56fe0f-0243-4ff3-a2b2-ee8b3fe2330a" /> | <img width="1024" height="759" alt="Codex Warning Table Maintenance SQL Editor Hammer Toolshed Supabas-EC85EFB1-715E-4841-BBCA-51F88B539595" src="https://github.com/user-attachments/assets/5be05527-920d-4f23-92eb-c7cd0bbff13e" /> | <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Prevented unintended modal dismissal and duplicate handling when confirming. * **Refactor** * Redesigned SQL editor warning modal with structured, consolidated warnings, adaptive title/confirmation copy, and centralized handling of missing-RLS table names. * Added conditional "Run and enable RLS" confirmation when available. * **Tests** * Updated end-to-end tests to match the new modal headings and body text. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45912) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Danny White
|
3e50212ad7 |
fix storage policy warning spacing (#45910)
## What kind of change does this PR introduce? Bug fix. ## What is the current behavior? The Storage public bucket warning confirmation modal can render `SELECTpolicy` without a space. The source relied on implicit JSX whitespace after an inline `<code>` element, and that whitespace can be normalised away when React renders the sentence. ## What is the new behavior? The modal now renders an explicit JSX space after the `SELECT` code element, so the sentence reads `SELECT policy`. | Before | After | | --- | --- | | <img width="860" height="666" alt="CleanShot 2026-05-14 at 14 31 36@2x-2B492E39-5CB4-4D4D-A409-0F0AF268E108" src="https://github.com/user-attachments/assets/683cc8c7-c112-411e-9569-de3be2a1d906" /> | <img width="858" height="668" alt="CleanShot 2026-05-14 at 15 08 08@2x" src="https://github.com/user-attachments/assets/e9a28bb0-9977-4da9-aecb-d4fa56dff368" /> | ## Additional context Testing instructions: 1. Open the staging link. 2. Open the SQL Editor and run: ```sql insert into storage.buckets (id, name, public) values ('public-warning-repro', 'public-warning-repro', true) on conflict (id) do update set public = true; drop policy if exists "public warning broad select repro" on storage.objects; create policy "public warning broad select repro" on storage.objects for select to anon, authenticated using (bucket_id = 'public-warning-repro'); ``` 3. Navigate to Storage > `public-warning-repro`. 4. Click `Remove policy` on the warning banner. 5. Confirm the modal says `This will drop the SELECT policy...`, not `SELECTpolicy`. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Improved wording and inline code styling in the public bucket destructive confirmation modal for clearer, more readable messaging; visual presentation updated without changing behavior or confirmation logic. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45910) <!-- review_stack_entry_end --> <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45910) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Sonu Yadav
|
1f28a37569 | fix(self-hosted): allow configuring supavisor tenant db_host via env var (#41273) | ||
|
Sean Oliver
|
856b2badf7 |
feat(telemetry): mirror signup_timestamp to PostHog person property (#45951)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature — tiny telemetry addition. +7/-1 in one file. ## What is the current behavior? [PR #45946](https://github.com/supabase/supabase/pull/45946) added `org_count` as a PostHog person property to unblock targeting on org membership. But `org_count` is set on every authenticated session (the `Telemetry` component fires identify whenever `user.id` + `organizations` resolve), not just at signup completion. That means flag filters like `person.org_count == 1` match two populations: - Brand-new dashboard signups currently in their first org (intended) - Returning users who happen to have one org and just signed in (not intended) For the upcoming `dataApiRevokeOnCreateDefault` experiment, this contaminates the activation comparison because the "returning single-org" group can't activate (they already did, months ago), diluting the measured effect. ## What is the new behavior? Adds `signup_timestamp: user.created_at` to the existing `posthogClient.identify` call in `useTelemetryIdentify`. Since gotrue's `user.created_at` is immutable, the value stays constant across sign-ins — no need for `$set_once` semantics, no race with anonymous activity, no cohort refresh lag. Flag targeting can now combine `person.org_count == 1 AND person.signup_timestamp >= <experiment_start_date>` to cleanly scope to brand-new signups. ## Testing No new unit tests added — the existing `useTelemetryIdentify` function has no test file, the change is one additional field on an existing call, and the property's correctness is verifiable end-to-end (sign up → check PostHog person record). Adding to the test ticket [GROWTH-854](https://linear.app/supabase/issue/GROWTH-854) for coverage along with the broader posthog-client wrapper tests. ## Additional context Ref: [GROWTH-853](https://linear.app/supabase/issue/GROWTH-853) This is the follow-up gate before the 5% rollout of `dataApiRevokeOnCreateDefault` — without this, the experiment would mix brand-new signups with legacy single-org users on sign-in. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Enhanced telemetry and analytics data collection for signed-in users by improving user identification tracking and adding signup timestamp information for better analytics insights. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45951) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Sean Oliver
|
4c77ab5fef |
feat(telemetry): mirror org_count to PostHog person property (#45946)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature + two follow-on fixes — small, scoped to telemetry / experiment plumbing. ## What is the current behavior? PostHog feature flags evaluated in Studio only have access to the `gotrue_id` person property (set in `useTelemetryIdentify`) and the `organization`/`project` group associations from pageviews. Flags can't target users by org membership without a behavioral cohort, which refreshes on a ~hourly schedule and lags behind real-time signup state. This is blocking the rollout of the `dataApiRevokeOnCreateDefault` experiment ahead of the May 30 default-privileges breaking change — we need to target brand-new dashboard signups with no prior org membership, and there's no person property to filter on. ## What is the new behavior? Three changes, scoped tightly to make experiment targeting reliable for brand-new signups: ### 1. Mirror `org_count` to a PostHog person property (`apps/studio/lib/telemetry.tsx`) The Studio `Telemetry` component now mirrors the user's current org-list length to a PostHog person property `org_count` via `posthog.identify(user.id, { org_count })`. The effect: - Subscribes to `useOrganizationsQuery` (shares the same React Query cache as `useSelectedOrganizationQuery`, so no extra network requests). - Dedupes via a ref keyed on `{ userId, orgCount }` so we only call identify when the value actually changes — handles user-switch (logout/login as different user with same count) correctly. - Generic enough to be useful beyond this experiment — analytics segmentation by org membership, future flags that depend on multi-org behavior, etc. ### 2. Merge pre-init identify properties (`packages/common/posthog-client.ts`) The previous `pendingIdentification` slot was a single-write buffer — calling `posthogClient.identify()` before the PostHog SDK initialized would overwrite any prior queued identify. Latent until this PR added a second identify caller (`org_count`), which exposed the last-write-wins behavior on first-visitor-before-consent flows. Now merges properties across pre-init calls for the same user so both `{ gotrue_id }` and `{ org_count }` land on the person record when the SDK flushes. Caught during Codex review. ### 3. Gate the exposure event on `org_count` being present (`apps/studio/hooks/misc/useDataApiRevokeOnCreateDefault.ts`) `useTrackDefaultPrivilegesExposure` previously fired on the first non-undefined value of the `dataApiRevokeOnCreateDefault` flag. For brand-new signups, this races the `org_count` identify: the initial `/flags/` response (before targeting can match) returns the untargeted variant, the exposure locks it in via `hasTracked`, then our identify fires and a subsequent `/flags/` refresh updates the flag — but the exposure has already recorded the wrong variant. Fix: gate the exposure on `org_count` being present on the SDK person, subscribing via `onFeatureFlags` so we pick up the post-identify `/flags/` response. Adds `posthogClient.getPersonProperty` as the local-state reader. Without this, the experiment would have a ~5-15% noise floor on cohort assignment for new signups. ## Verification End-to-end verified locally against the staging PostHog project (34343): - Local Studio's PostHog SDK has `$stored_person_properties: { gotrue_id: <uuid>, org_count: 1 }` after sign-in. - Both `$set` events landed server-side within ~300ms of each other, and the staging person record now shows `org_count = 1.0` with `gotrue_id` preserved. - Targeting query `person.properties.org_count == 1` works end-to-end against staging. ## Additional context Ref: [GROWTH-853](https://linear.app/supabase/issue/GROWTH-853) Targeting plan for the flag once shipped: `person.org_count == 1` plus a behavioral filter on recent `sign_up` event, at 5% rollout. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Telemetry now records and syncs the user's organization count as an analytics person property and avoids redundant identifications when unchanged. * Analytics client now merges queued identification properties made before initialization and exposes a method to read stored person properties. * **Bug Fixes** * Tracking now waits for organization-count readiness before firing certain exposure events to prevent missing data. * **Tests** * Added/updated tests to cover person-property behavior and gating logic. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45946) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
d79a276824 |
studio: ColumnTypeRef cascade + FK type comparison fixes (2/7) (#45903)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Refactor + bug fixes (part of the SafeSql migration stack — PR 2 of 7, stacks on top of #45897). ## What is the current behavior? - `pgMeta.columns.create` and the table-editor SQL builder take column type as a string with array suffix and schema baked in (e.g. `'private.test_enum'`, `'int4[]'`). - The studio table-editor SQL emits the legacy schema-embedded `format` string for enums in non-public schemas, while the pg-meta columns SQL already returns the new shape (bare `format` + separate `format_schema`). The two queries disagree on how to represent the same column, surfacing as a false-positive type mismatch in the FK selector when both ends are an enum from a non-public schema. - The FK selector compares column types by `format` alone — same-named enums in different schemas appear equal, and arrays vs. scalars of the same base type pass the family check. - `displayColumnType` renders arrays as the raw `_typname` pg-meta emits (e.g. `_int4` instead of `int4[]`). ## What is the new behavior? **pg-meta** - Introduce `ColumnTypeRef` (`{ schema?, name, isArray? }`) for column type input, replacing the legacy string-with-array-suffix format. `pgMeta.columns.create` and the table-editor SQL builder consume the new shape. - Add `format_schema` to the column zod schema; pg-meta SQL emits the type's schema for the table editor's ColumnType dropdown. - `pgMeta.columns.create` returns a `SafeSqlFragment`. - Studio table-editor SQL now emits bare `format` + `format_schema`, matching pg-meta's columns SQL. **Studio** - `SafePostgresColumn`/`SafePostgresTable` extend the new `PG*` types (master dropped postgres-meta). - Pipe `ColumnTypeRef` through `SidePanelEditor` → `ColumnEditor` → `TableEditor`, along with the column-create mutation, table retrieve/list queries, and the `TableList`/`ColumnList` surfaces. - `displayColumnType` helper renders arrays as `type[]` (or `schema.type[]`) and handles non-implicit schemas. - FK selector now carries `sourceIsArray`/`targetIsArray` and compares the full `(format, format_schema, isArray)` triple. Family checks for numeric/text/uuid skip when either side is an array (FKs across array boundaries are never compatible). - Type-mismatch and type-notice alerts pass `isArray` to the display helper. - Bundle `Policies.utils` + `Policies.types` + `sql-policy-mutation`, `PolicyEditorModal`, and `SchemaGraph` here because `SidePanelEditor` consumes `acceptGeneratedPolicy`/`AcceptedGeneratedPolicy` — splitting requires temporary overloads with no architectural payoff. ## Additional context Part of the SafeSql migration stack. Stacks on top of #45897. ### Manual test checklist Surfaces touched by this PR — please exercise each: **Table editor** - [x] Create a new table with a mix of column types (scalar, array, enum, foreign key) - [x] Add a column to an existing table; verify the type dropdown lists scalars + arrays separately and shows schema-qualified names for non-public enums - [x] Edit an existing column's type (scalar ↔ array, switch between enums in different schemas) and save - [x] Verify enum types from a non-public schema (e.g. `private.my_enum`) display as `private.my_enum` in the column list **Foreign key selector** - [x] Open the FK selector for a column and pick a target column with a matching type — no mismatch warning - [x] Pick a target column whose type differs only by schema (two same-named enums in different schemas) — should show a type-mismatch alert - [x] Pick a target column where one side is an array and the other is a scalar of the same base type — should show a type-mismatch alert (no auto-cast across array boundary) - [x] When FK target sets the column type, verify `format_schema` and `isArray` are preserved on the source column - [x] Type-mismatch and type-notice alert messages render array types as `type[]` (not `_type`) **Column list / table list** - [x] Schema-qualified type names display correctly for columns whose type lives in a non-public schema - [x] Array columns display as `type[]` (or `schema.type[]`) **Policies (bundled due to import dependency)** - [x] Open the Policies page; create/edit/delete a row-level policy via the modal - [x] Generate a policy via the AI assistant and accept it through `SidePanelEditor` — verify the accepted policy lands in the editor correctly **Schema visualizer** - [x] Open the Schemas → Schema Visualizer page; verify it renders without type errors and shows tables/relationships <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Support for column types in non-public schemas and richer column type presentation (includes schema and array info). * Stronger SQL safety around policies and constraints; draft policy SQL is now promoted explicitly on save. * Improved foreign-key type validation and compatibility checks using enhanced type metadata. * **Tests** * Updated snapshots and tests to reflect new column metadata and SQL fragment handling. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45903) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
oniani1
|
29bfa7b75b |
fix(studio): encode special characters in project securing policies links (#45849)
Closes #45847. ## Summary `ProjectNeedsSecuringView.tsx` built the `View policies` href on the first-time security gate by interpolating `table.schema` and `table.name` directly into the URL. A table or schema containing `&`, `=`, `+`, or `#` corrupted the destination and routed the user to the wrong policies filter on what is meant to be a guided onboarding flow. Extracts the URL into `getTablePoliciesHref` in `ProjectNeedsSecuring.utils.ts` with `encodeURIComponent` wraps, and replaces the inline interpolation. Same pattern as #45385. ## Test plan Added `ProjectNeedsSecuring.utils.test.ts` covering `getTablePoliciesHref` (plain values, special chars in name, special chars in schema, both, undefined inputs) and pulling in the previously-untested `getTableKey`, `formatRlsDescription`, `sortTables`, and `buildSecurityPromptMarkdown` utilities. Ten tests total. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Added comprehensive test coverage for security utilities, including URL construction, formatting, sorting, and markdown report generation. * **Refactor** * Extracted URL building logic into a centralized utility function for improved consistency and maintainability. [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45849) <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
oniani1
|
461c1c1783 |
fix(studio): encode special characters in trigger/function cross-link search params (#45851)
Closes #45850. ## Summary `TriggerList`, `EventTriggerList`, and `FunctionList` built cross-links between the database triggers and functions pages by interpolating user-controlled identifiers directly into the URL query string. A function or schema name containing `&`, `=`, `+`, or `#` corrupted the destination filter and routed users to the wrong row. Adds `getDatabaseFunctionsHref` to `TriggerList.utils` (used by both `TriggerList` and `EventTriggerList`) and a new `getDatabaseTriggersHref` in `FunctionList.utils`, both with `encodeURIComponent` wraps. Replaces the three inline interpolations. `FunctionList` only has a single search param (no schema) because the link filters by function name only, so its helper takes one less argument. Same pattern as #45385. ## Test plan Added `TriggerList.utils.test.ts` covering `getDatabaseFunctionsHref` (plain, special chars in name, special chars in schema, both, undefined inputs) and `FunctionList.utils.test.ts` covering `getDatabaseTriggersHref` (plain, special chars in name, plus signs and spaces, undefined inputs). Nine tests total. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Improved database navigation links for functions and triggers by standardizing link generation through centralized utility functions. This ensures consistent URL encoding and parameter handling across the application. * **Tests** * Added comprehensive test coverage for database navigation link utilities, including edge cases with special characters and empty parameters. [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45851) <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
oniani1
|
39f1358f08 |
fix(studio): encode special characters in table editor policy links (#45846)
Closes #45845. ## Summary `GridHeaderActions.tsx` interpolated `table.name` and `table.schema` directly into the policies URL at two `<Link href>` builders. A table or schema containing `&`, `=`, `+`, or `#` corrupted the destination and routed users to the wrong policies filter. Extracts the URL into `getTablePoliciesUrl` in `TableEntity.utils.ts` with `encodeURIComponent` wraps, and replaces both inline interpolations. Same pattern as #45385 (Linter shortcut links). ## Test plan Added four `getTablePoliciesUrl` cases in `TableEntity.utils.test.ts`: plain values, special chars in name, special chars in schema, special chars in both. Existing seven tests in the same file still pass. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Improved Row-Level Security (RLS) policy URL handling in the table editor using a shared utility function for consistent URL building and proper parameter encoding. * **Tests** * Added test coverage for RLS policy URL generation with various parameter combinations and special character handling. [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45846) <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordi EnricandClaude Sonnet 4.6
|
2035b2fb7b |
feat(logs): gate CH/otel toggle in log explorer behind feature flag (#45944)
## Problem
The CH/otel queries toggle in log explorer was only shown on staging and
local environments, controlled by the hardcoded `IS_STAGING_OR_LOCAL`
check. This made it impossible to enable for specific users or teams in
production via a feature flag.
## Fix
Replaced the `IS_STAGING_OR_LOCAL` check with
`useFlag('showChToggleInLogExplorer')` from `common`, so the toggle
visibility is controlled by the PostHog feature flag instead of the
environment.
## How to test
1. Open log explorer on a project.
2. Without the `showChToggleInLogExplorer` flag enabled, confirm the
CH/otel toggle is not visible.
3. Enable the `showChToggleInLogExplorer` flag in PostHog for your user.
4. Reload log explorer and confirm the CH/otel toggle appears.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated internal feature gating mechanism for the OTEL toggle in Logs
settings from environment-based to flag-based configuration.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45944)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
|
||
|
Charis
|
453c31da16 |
refactor(common): drop ConfigCat proxy probe in favor of waitForReady (#45939)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Refactor / performance. ## What is the current behavior? `packages/common/configcat.ts` does a two-step setup: a probe `fetch` to the ConfigCat proxy URL, followed by SDK client initialization with the proxy as `baseUrl` (or against the direct ConfigCat CDN if the probe fails). On the happy path this fires **two** network requests for the same JSON config on cold start — the probe, then the SDK's own initial AutoPoll fetch. ## What is the new behavior? The probe is removed. We initialize the proxy client directly and inspect the `ClientCacheState` returned by `waitForReady()`. On `NoFlagData` (proxy unreachable, no cache) we `dispose()` the proxy client and fall back to the direct SDK key client. Cold-start fetches drop from 2 to 1 when the proxy is healthy. Worst-case fallback delay is bounded by `maxInitWaitTimeSeconds` (5s default), comparable to today's probe timeout on a broken proxy. The unused exported \`fetchHandler\` is removed (no external importers — verified via grep). Tests in \`configcat.test.ts\` are updated to mock \`waitForReady\`/\`dispose\` and a new test covers the proxy-failure fallback path. ## Additional context Resolves FE-3174 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved ConfigCat client initialization with robust fallback handling when proxy is unavailable. * **Chores** * Removed `fetchHandler` export from ConfigCat module. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45939) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jordi EnricandClaude Sonnet 4.6
|
5a067d0937 |
feat(unified-logs): show feature preview for flag or team/enterprise plan (#45937)
## Problem The unified logs feature preview was only shown to users with the \`unifiedLogs\` LaunchDarkly flag enabled AND who were either on an enterprise plan or on staging/local. Team plan users were excluded, and the staging escape hatch added noise. ## Fix Updated the eligibility check to use an OR condition: show the feature preview if the \`unifiedLogs\` flag is on OR the org is on a team or enterprise plan. Also added \`team\` to the \`useIsEnterpriseOrSupabaseOrg\` hook and removed the \`IS_STAGING_OR_LOCAL\` bypass. ## How to test - Log in as a user on a team plan and verify the "New Logs interface" option appears in the Feature Previews modal - Log in as a user on an enterprise plan and verify the same - Log in as a user on a free or pro plan without the \`unifiedLogs\` flag enabled and verify the option does not appear - Enable the \`unifiedLogs\` LaunchDarkly flag for a free/pro user and verify the option appears <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Unified logs preview is now more accessible for enterprise and Supabase organizations without requiring additional staging conditions. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45937) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
Andrey A.
|
36d1f2c0ec | feat(self-hosted): do not require openssl or node for new auth (#45941) | ||
|
Chris ChinchillaandCemal Kılıç
|
8b01d388b9 |
docs: Remove leftover auth-ui components (#45931)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated authentication guide for Kotlin Compose Multiplatform with revised dependency configuration. * Enhanced user-management example README with improved project structure, deployment steps, and resources. * **Chores** * Refactored example applications to use custom authentication forms instead of pre-built Auth UI components. * Removed unused authentication UI dependencies from multiple example projects. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45931) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Cemal Kılıç <cemalkilic@users.noreply.github.com> |
||
|
Prashant Sridharan
|
5f32b3ec6b |
Added PGConf Vancouver back into the go pages (#45943)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Accidentally deleted a couple of go pages. Adding them back. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Introduced contest registration and confirmation pages for PGConf Dev 2026, designed as time-limited features with automatic removal scheduled for May 31, 2026. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45943) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Chris Chinchilla
|
2024855c8d | docs: Update old Deno usage (#45934) | ||
|
Joshen Lim
|
ebfec0df36 |
Improve click targets on property actions (#45936)
## Context When opening the logs detail panel, some of the fields can be clicked to add them as a filter. However the existing UX is that the clickable part is just the text which makes it target small <img width="233" height="127" alt="image" src="https://github.com/user-attachments/assets/1d876bcc-05cf-464c-bdbe-907229be0586" /> Am opting the following: - Make the whole row clickable - Make all rows clickable with the main action being "Copy {column}" - Only filterable columns will have the option to "Add as filter" ### After <img width="483" height="153" alt="image" src="https://github.com/user-attachments/assets/9d6e5479-fdbb-4609-839c-2bb7ad571b57" /> <img width="473" height="152" alt="image" src="https://github.com/user-attachments/assets/f22197df-fa59-4e01-be00-2557260374f8" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Row actions now consistently wrap rows and show a filter icon next to the label when a resolved filter is available; copy menu displays "Copy {label}". * **Style** * Standardized icon sizes and adjusted dropdown/row spacing; simplified text wrap/truncate behavior for field values; minor status text color refinement. * **Bug Fixes** * Dropdown row-action rendering made more robust to ensure menu wrappers render reliably. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45936) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
ec21e68eee |
studio(logs): use safe sql escaping for new logs queries (#45887)
<!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Introduced a safe SQL fragment system and helpers to build composable, validated log queries and aggregations. * **Refactor** * Rewrote unified log query builders and inspection flows to use the new safe fragments and identifier/literal validators. * **Bug Fixes** * Improved validation and error handling for filter keys and literal escaping to prevent malformed or injectable queries. * **Tests** * Added tests covering identifier quoting, value escaping, and rejection of invalid filter inputs. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45887) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
c104beabb6 |
fix(docs,www): redirect feature status page to /features (#43224)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Redirect + link cleanup: deprecating the docs feature status page in favour of the marketing features page. ## What is the current behavior? supabase.com/docs/guides/getting-started/features is a standalone docs page with a flat feature status table. The existing /docs/features short URL redirects to this docs page. A self-hosted troubleshooting article links to the old docs page. ## What is the new behavior? /docs/guides/getting-started/features and /docs/features both permanently redirect to /features (supabase.com/features) The self-hosted troubleshooting article now links to /features The features.mdx file is left in place; the redirect intercepts all traffic before it renders ## Additional context N/A <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Reorganized navigation menu and documentation link paths * Updated feature-related links across guides and troubleshooting sections * Added redirect rules to maintain backward compatibility with previous URLs <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Ana Mogul <ana1337x@users.noreply.github.com> Co-authored-by: Chris Chinchilla <chris.ward@supabase.io> |
||
|
Joshen Lim
|
eb915e99f8 |
Joshen/debug 76 fix sticky hover state on log rows (#45933)
## Context The original problem was that some log rows remain in the hover state after the cursor moves away I was just cleaning up some of the styles and noticed that it doesn't seem to happen anymore so thinking this might have fixed it haha 😅 ## Changes involved - Remove `group-hover` background color change behaviour in `TableCell` in `ui` - `TableRow` should handle the background color instead, hence the changes in `UnifiedLogs.utils` too - Remove unnecessary `renderLiveRows` in `DataTableInfinite` -> the prop isn't being passed anywhere ## To test - [ ] The sticky hover state happens when you hover over the rows very quickly, so just make sure there's no "stale" hover state in any row eg: <img width="400" alt="image" src="https://github.com/user-attachments/assets/b4a91bc6-d269-4ee6-b222-b0476b9feffa" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Standardized hover styling for log rows and table cells to use direct hover rules for more consistent visual feedback. * Adjusted table cell hover/transition behavior to simplify styling while preserving layout and checkbox spacing. * Streamlined the data table API by removing the custom live-row rendering override. * Made the resizable panel’s minimum size dynamic based on dock position. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45933) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Vaibhav
|
b56ba64d2e |
fix: tooltip dates (#45922)
## TL;DR fixes one day off observability tooltip ## before: <img width="227" height="159" alt="image" src="https://github.com/user-attachments/assets/6cc8653f-2304-4d63-bf53-af01425c0d96" /> ## after: <img width="288" height="200" alt="image" src="https://github.com/user-attachments/assets/9aa35e63-2fbc-42aa-82c8-1a3b158e6f40" /> ## ref: - closes https://github.com/supabase/supabase/issues/45921 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved chart tooltip date label formatting: tooltips now detect ISO-like date strings and format them consistently, while preserving previous formatting for other values. This change ensures correct, readable dates in both bar and line chart tooltips within reports. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45922) <!-- review_stack_entry_end --> <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45922) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Andrey A.
|
51c1de7c18 | fix(self-hosted): use curl -f in analytics healthcheck (#45929) | ||
|
Ali Waseem
|
5195415de1 |
chore(privacy): update privacy terms (#45900)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Minor updates to add customer.io <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added a comprehensive privacy policy page with detailed privacy notices, including sections on data collection, sharing, user controls, cookies, retention, security, and regional disclosures. * Updated existing privacy policy with refreshed information, expanded marketing and advertising purposes, and clarified third-party service provider details. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45900) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
ea03214d3d |
Support dock position (#45919)
## Context Added an option to change dock position when a row is selected in unified logs Just note that this involves the `LogsListPanel` - i'm not too sure how this will look like tbh as I don't have any logs in my unified logs UI that match the criteria to render the `LogsListPanel` (e.g there could be a scenario where we have 3 panes side by side) <img width="1452" height="955" alt="image" src="https://github.com/user-attachments/assets/21c1a576-7f63-463f-88bf-04c05691995b" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **New Features** * Users can now toggle the service flow panel dock position between bottom and right alignment * Dock preference is automatically saved and persists across sessions * **Bug Fixes** * Improved logs data validation in the logs list panel for more reliable rendering <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45919) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
cf49bc74ef |
Update copy for adding filter from log details (#45918)
## Context
Just updates the copy for adding filters from the log details in unified
logs. "Include" was vague so opting for something more clearer, "Add as
filter for {column}"
### Before
<img width="199" height="130" alt="image"
src="https://github.com/user-attachments/assets/b5e0231c-99de-42a3-9cf2-66e0d9558379"
/>
### After
<img width="262" height="140" alt="image"
src="https://github.com/user-attachments/assets/8e8e3889-443c-4566-b118-7a13eb60f3b1"
/>
<img width="235" height="146" alt="image"
src="https://github.com/user-attachments/assets/e23b15ff-dd35-4e47-9d17-a82c8b898534"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved data table filter dropdown UI with clearer action labels and
properly sized icons for checkbox and input filter types.
* Expanded filter dropdown menu width for better visual clarity and
usability.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45918)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
|
||
|
Joshen Lim
|
98ecf8001e |
Use font mono for unified log rows (#45917)
## Context Opting to use `font-mono` and `tracking-tight` for all the data within the unified logs table to improve readability ### Before <img width="1451" height="956" alt="image" src="https://github.com/user-attachments/assets/8c3f51b8-40bb-4e84-b1b3-af4d69e92224" /> ### After <img width="1450" height="959" alt="image" src="https://github.com/user-attachments/assets/5cb64864-fdf8-4c97-8caf-a440aa405b3d" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Refined the visual styling of the Unified Logs table columns for improved readability, including updated typography and letter spacing for the Date, Method, Pathname, and Event message columns. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45917) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
1b3a88a323 |
Opt to use Code2 icon instead of BookHeart for unified logs postgrest rows (#45916)
## Context We use the `Code2` icon for the Data API integration, so opting to use the same icon for Postgrest in unified logs for consistency <img width="538" height="176" alt="image" src="https://github.com/user-attachments/assets/cd98d781-be60-4d09-9dcb-6f064c58f446" /> ### Before <img width="422" height="87" alt="image" src="https://github.com/user-attachments/assets/4c7024ad-b5a7-48aa-8f27-46bb8cd94b57" /> ### After <img width="434" height="89" alt="image" src="https://github.com/user-attachments/assets/4bc18b10-53ee-4c57-89e3-52f45cc8fc07" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **UI Improvements** * Updated the icon representation for PostgreSQL REST API logs to enhance visual clarity and user recognition. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45916) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
597ad2ba56 |
Fix width of unified logs table to fit viewport, which fixes centering of load more button (#45914)
## Context Load more button in unified logs was off center because the `table` element was exceeded the viewport width. The fix needed was hence to adjust the width of the `table` to only take up the remaining width of the viewport which then fixes the positioning of the load more button. ### Before <img width="1446" height="204" alt="image" src="https://github.com/user-attachments/assets/fcd99e18-ede8-4454-b612-91b4384fb3e1" /> ### After <img width="1450" height="274" alt="image" src="https://github.com/user-attachments/assets/d5f56383-bdb0-4418-a36f-242e72fe3a5b" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Updated table container styling and layout properties for improved rendering. * Enhanced table header cell structure with improved styling attributes. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45914) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
8ee2f90d65 |
Target hover background color change for unified log rows to the cell (#45915)
## Context The `TableCell` component from `ui` has a `group-hover:bg-surface-200` class name ([ref](https://github.com/supabase/supabase/blob/master/packages/ui/src/components/shadcn/ui/table.tsx#L152)), hence the original class names in `UnifiedLog.utils.ts` which targets only the table row's background color on hover doesn't work. Hence fix is to target the `td` element on row hover to apply the background color change Although separately, i'm wondering whether it makes more sense for the hover bg color change to be applied on the `tr` instead of `td` ### Before <img width="1182" height="61" alt="image" src="https://github.com/user-attachments/assets/78939525-7832-4c4f-8985-e856715a731b" /> ### After <img width="1211" height="79" alt="image" src="https://github.com/user-attachments/assets/5726063d-d06a-439c-90d8-a27407a94a05" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Style** * Enhanced hover interactions for warning and error log rows with improved dark mode styling consistency. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45915) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Joshen Lim
|
59c550ac49 |
Improve loading state for unified logs (#45913)
## Context Improves loading state for unified logs ### Before <img width="1451" height="957" alt="image" src="https://github.com/user-attachments/assets/97280982-1358-4234-bcf4-d3e6590040b9" /> ### After <img width="1451" height="956" alt="image" src="https://github.com/user-attachments/assets/b28eb3a8-e7eb-4fc9-bd0d-d0c8d40933ec" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **UI Improvements** * Organization slug field now displays as read-only. * Data table loading states now show skeleton rows with shimmer effect instead of spinner. * Empty state displays simplified "No results found" message. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45913) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Raminder SinghandJoshen Lim
|
897043952a |
feat: add edge function secret installation method (#45826)
Adds a new method of installation detection for partners like Doppler. Doppler creates edge function secrets with specific names (`DOPPLER_CONFIG`, `DOPPLER_ENVIRONMENT`, and `DOPPLER_PROJECT`). This method allows the dashboard to check for the presence of such a secret to show the installation status. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Support for edge-function-secret-based OAuth identification and verification. * Installation checks adapt to the selected installation method and only fetch required credentials when needed. * Integration detection can validate installations via API key prefixes or matching edge-function secret names. * **Chores** * Shared helper utilities and types exported to streamline installation checks and mappings. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45826) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Jordi Enric
|
19e0b36650 | feat(logs): migrate unified logs queries to OTEL endpoint DEBUG-71 (#45642) | ||
|
K-Dog (Kevin)
|
2efaf8e5c1 |
chore(upcoming invoice): min amount / no plan fee (#45877)
Prep work for new platform plan <img width="733" height="120" alt="Screenshot 2026-05-13 at 8 25 29 PM" src="https://github.com/user-attachments/assets/5667bb86-e317-44f7-86ac-07a8c5cc1994" /> |
||
|
Danny White
|
fd01c665e2 |
feat(studio): move Stripe Projects to connect interstitial (#45862)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature update. Resolves DEPR-553. ## What is the current behavior? Stripe Projects login still uses the older `APIAuthorizationLayout` surface, so it does not match the newer shared connect interstitial pattern used by organisation invites and CLI login. ## What is the new behavior? Moves `/partners/stripe/projects/login` onto the shared `InterstitialLayout` while preserving the existing `ar_id` account request lookup, confirmation mutation, wrong-account sign-out path, and missing-parameter redirect. The temporary reviewer mocks have been removed after approval. ## Testing instructions Automated checks run locally: - `pnpm --dir apps/studio exec prettier --write pages/partners/stripe/projects/login.tsx components/layouts/InterstitialLayout.tsx` - `pnpm --dir apps/studio exec eslint pages/partners/stripe/projects/login.tsx components/layouts/InterstitialLayout.tsx` - `git diff --check` `pnpm --dir apps/studio exec tsc --noEmit` was also run earlier on this branch, but still fails on existing unrelated issues in `components/interfaces/Integrations/Landing/useAvailableIntegrations.tsx` and `packages/common/marketplace-client.ts`. Manual Stripe Projects testing requires a real account request. Opening `/partners/stripe/projects/login` without an `ar_id` redirects to `/404` by design. If you need the real flow: 1. Use the Stripe staging provider. In the Stripe CLI flow, run `export DEV_MODE=true` so the provider is `Supabase_Staging_Env`. 2. From a local project directory, run `stripe projects init` and complete the Stripe setup flow. 3. Run `stripe projects add Supabase_Staging_Env`. 4. When the browser opens the Supabase authorization URL, keep the generated path and query string exactly as-is, including `ar_id`, but replace only the origin with this PR preview deployment origin. Note: the staging Stripe Projects flow can still incur real Stripe costs; use the staging provider and coordinate refunds with team billing if needed. ## Additional context This is a deliberately small stacked slice toward the broader shared connect interstitial work. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **User Interface** * Redesigned Stripe authorization login page with improved layout and visual state management * Enhanced account row component to support flexible action buttons and styling * Added clearer messaging and UI states for authorization scenarios (pending, success, errors, and account mismatches) <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45862) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
AnaandAna
|
2acceffdc8 |
blog(www): add Saxon Fletcher as author on branching post (#45884)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? - Adds Saxon Fletcher as a co-author on the branching without Git blog post - Adds Saxon Fletcher entry to Authors.json ## What is the current behavior? The blog post lists joshenlim and qiao as authors only. ## What is the new behavior? - Saxon Fletcher is added as a third author on the post - Saxon Fletcher's author profile is added to Authors.json with GitHub username SaxonF ## Additional context N/A <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Blog post frontmatter updated to credit an additional contributor. * Added a new author profile to the site’s author data. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45884) <!-- review_stack_entry_end --> <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45884) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Ana <ana1337x@users.noreply.github.com> |
||
|
Raminder SinghandSaxon Fletcher
|
5a41d0155e |
chore: integration UI refinement (#45507)
This PR: * Refactors integrations page implementation to make it simpler and easier to understand. * Integration category pages from marketplace db show category name and description. * Shows featured integrations coming from the marketplace db at the top of the page. * Hides empty categories: https://linear.app/supabase/issue/INT-113/hide-empty-categories-on-dashboard-integrations-page Below design related fixes will be done in a separate PR: https://github.com/supabase/supabase/pull/45856. So this PR is ready to merge with current fixes. <details> ~~Design fixes needed after consulting with the design team:~~ - [ ] ~~Do not use inverted colors on images for featured integrations. This leads to inconsistent images for the featured marketplace listings. E.g. Grafana listing shown in the featured listings:~~ <img width="463" height="260" alt="image" src="https://github.com/user-attachments/assets/76816807-667f-44b0-b68c-5e1ca342be1f" /> ~~vs shown on it's own page:~~ <img width="909" height="667" alt="image" src="https://github.com/user-attachments/assets/00efda48-3e4e-4b05-87ad-cbbce9047c94" /> - [ ] ~~The images on featured marketplace integrations should not be truncated as seen in the first image above.~~ - [ ] ~~The **Install integration** button feels floating far out on the right.~~ - [ ] ~~The description under the title is too long and truncated. Requested by Doppler here: https://supabase.slack.com/archives/C0AL11JG5MG/p1778009104728819?thread_ts=1777654129.027269&cid=C0AL11JG5MG~~ - [ ] ~~The content section doesn't render bulleted lists correctly.~~ </details> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Dedicated "Featured Integrations" section on the integrations page. * Integrations can be marked as featured to appear in the featured section. * **Improvements** * Sidebar shows only categories that contain integrations. * Integration image handling improved for featured cards. * Updated loading placeholders for integrations to provide a smoother loading experience. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45507) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Saxon Fletcher <saxonafletcher@gmail.com> |
||
|
Prashant Sridharan
|
095b618297 |
Updated dinner details for NYC Exec Dinner (#45901)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Updated dinner date and time for NYC dinner go page <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Updates** * Executive Dinner now shows the date (June 10, 2026) and revised times: cocktails at 6:30 PM, dinner at 7:00 PM. * **New Features** * RSVP form adds optional Job Title and Phone Number fields; company placeholder set to “ACME, Inc.” * **UI** * Event details now display a dedicated Date block and show Location after the date. * **Integrations** * RSVP integrations updated to include the new fields. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45901) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
2d2cc95caa |
studio: add SafeSql foundation utilities (1/7) (#45897)
## Summary First in a stack of seven PRs migrating the remaining `executeSql` call sites to `SafeSqlFragment`. This PR lands pure additions — shared types and helpers that later PRs import. - `apps/studio/lib/postgres-types.ts` — `SafePostgresColumn` / `SafePostgresTable` wrappers over `PGColumn` / `PGTable` that brand `check` as `SafeSqlFragment` and add the optional `format_schema` field - `apps/studio/lib/sql.ts` — `trimSafeSqlFragment` overload set that preserves the brand through `.trim()` - `apps/studio/lib/type-helpers.ts` — refine `DeepReadonly` so primitives pass through unchanged - `apps/studio/components/ui/SafeSqlInput.tsx` — `<Input>` wrapper that emits `SafeSqlFragment` via `rawSql` No consumers in this PR. The next PRs in the stack pick these up. ## Stack This is PR 1 of 7. The full sequence: 1. **This PR** — Foundation utilities 2. `charis/safe-sql-last/2` — pg-meta columns + ColumnTypeRef cascade 3. `charis/safe-sql-last/3` — pg-meta non-column SafeSql (functions/policies/triggers) 4. `charis/safe-sql-last/4` — Studio reports / query performance / privileges 5. `charis/safe-sql-last/6` — Stragglers + remaining tests 6. `charis/safe-sql-last/7` — Flip `executeSql` signature from `string` to `SafeSqlFragment` ## Test plan - [x] `pnpm typecheck` passes for the Studio target on this branch - [x] No runtime behavior changes — only type-level additions and a new unused component <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **New Features** * Introduced SafeSqlInput component providing secure and validated SQL query input handling with built-in constraints and error prevention. * **Refactor** * Enhanced internal type definitions and utilities for Postgres metadata handling and SQL operations to improve code reliability and maintainability. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45897) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Taryn King
|
0dd23ba5a6 | docs: clarify path to database password reset in dashboard (#45853) | ||
|
Vaibhav
|
9b86b6ca25 |
test: cron coverage (#45895)
adds coverage for: - https://github.com/supabase/supabase/pull/45848 which solved/closed: https://github.com/supabase/supabase/issues/45860 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Enhanced test coverage for parsing SQL commands with lowercase statements to ensure robust handling of case-insensitive input. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45895) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
d4079083fc |
chore(studio): drop @supabase/postgres-meta in favor of @supabase/pg-meta (#45844)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Refactor / dependency cleanup. ## What is the current behavior? `apps/studio` lists both `@supabase/pg-meta` (workspace package) as a runtime dep and `@supabase/postgres-meta` (external npm package, `^0.64.4`) as a devDependency. The external package is used only for type imports across 44 files — there is no runtime usage and no codegen pipeline that needs it. ## What is the new behavior? Every `Postgres*` type import (`PostgresTable`, `PostgresColumn`, `PostgresPolicy`, `PostgresTrigger`, `PostgresView`, `PostgresMaterializedView`, `PostgresForeignTable`, `PostgresSchema`, `PostgresPublication`, `PostgresRelationship`, `PostgresPrimaryKey`) is replaced with its `PG*` counterpart from `@supabase/pg-meta`, and the external dep is removed from \`apps/studio/package.json\`. Top-level type re-exports were added to \`packages/pg-meta/src/index.ts\` so consumers can import directly from the package root. Two latent issues surfaced by the stricter pg-meta types are also fixed: - \`data/foreign-tables/foreign-tables-query.ts\` was casting foreign-table results as \`PostgresView[]\`; corrected to \`PGForeignTable[]\`. - \`pg-meta\`'s \`PGTrigger\` Zod schema declared \`orientation\`/\`activation\` as \`z.string()\`, inconsistent with pg-meta's own \`getDatabaseTriggerUpdateSQL\` helper that requires the narrow literal unions; tightened to \`z.enum\`. ## Additional context <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated internal TypeScript type definitions across the codebase to use the latest type system from `@supabase/pg-meta`. * Removed `@supabase/postgres-meta` dependency. * Enhanced type validation for database triggers and schemas to enforce stricter constraints. [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45844) <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ali Waseem
|
6383150c3e |
fix(tests): flaky unit tests (#45852)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? - Typing each character by hand leads to slowness with multiple render cycles in CI - Update timeouts <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Improved test reliability and stability for the Support form page. Enhanced test synchronization and timing for UI interactions including form field prefilling, organization and project selection, category and severity assignment, form submission, error notifications, dashboard logging toggles, and attachment uploads. These enhancements strengthen test quality and help prevent regression issues in form functionality. [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45852) <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Vaibhav
|
fe769bfe7e |
fix: escape quotes (#45848)
## TL;DR - closes https://github.com/supabase/supabase/issues/45860 - closes https://github.com/supabase/supabase/issues/45544 & supersedes https://github.com/supabase/supabase/pull/45543 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added explicit allowed facet fields and validation to prevent invalid facet usage. * **Bug Fixes** * Improved filter handling by coercing values to strings and properly escaping single quotes for array, scalar, and LIKE filters (including facet search), reducing query errors and injection risks. * Enhanced parsing of scheduled-job SQL commands to tolerate varied casing/whitespace and strip leading SELECT before processing. [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45848) <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ali WaseemandDanny White
|
712cf7e60b |
feat(storage): add keyboard shortcuts for storage screens (#45837)
## Summary
Adds keyboard shortcuts to the Storage section, mirroring the
conventions already established for Auth Users and Database pages:
- **Storage navigation chords** (`S, F` / `S, A` / `S, V` / `S, 3`)
active only inside `StorageLayout`.
- **Files (bucket list) page** shortcuts for search, create, refresh,
reset filters, reset sort.
- **Storage Explorer** shortcuts for upload, new folder, view toggle,
refresh, search, multi-select download/move/delete, and an Escape
ladder.
- `ShortcutTooltip` wired into the relevant buttons so users can
discover keybinds on hover.
- Reload spinner is now driven by a shared store flag, so it shows
whether you click the button or fire the shortcut.
## Test plan
### Storage navigation chords
Active anywhere under `/project/<ref>/storage/*`.
| Keybind | Action |
|---------|--------|
| `S` then `F` | Go to Files |
| `S` then `A` | Go to Analytics buckets (platform + feature-flagged) |
| `S` then `V` | Go to Vector buckets (platform + feature-flagged) |
| `S` then `3` | Go to S3 settings (platform only) |
### Files (bucket list) page
At `/project/<ref>/storage/files`.
| Keybind | Action | Notes |
|---------|--------|-------|
| `Shift+F` | Focus search ("Search buckets") | Selects existing text |
| `Shift+N` | Create new bucket | Opens the create-bucket modal |
| `F` then `C` | Reset filters | Clears the search string |
| `Shift+R` | Refresh buckets | Refetches the bucket list |
| `S` then `C` | Reset bucket sort | Only fires when sort ≠ default
(Created at) |
### Storage Explorer (inside a bucket)
At `/project/<ref>/storage/files/buckets/<bucketId>`.
| Keybind | Action | Notes |
|---------|--------|-------|
| `Shift+F` | Focus search ("Search files") | Opens the search input if
hidden, then focuses |
| `Shift+R` | Refresh | Refetches all opened folders; spinner reflects
state |
| `I` then `F` | Upload files | Disabled w/o ` STORAGE_WRITE ` or at
bucket root with no folder |
| `I` then `N` | Create folder | Same permission gates as Upload |
| `V` then `C` | View as columns | |
| `V` then `L` | View as list | |
| `Shift+D` | Download selected | Only fires when ≥1 item selected;
single vs many handled |
| `Shift+M` | Move selected | Only fires when ≥1 item selected AND `
STORAGE_WRITE ` granted |
| `Mod+Backspace` | Delete selected | Only fires when ≥1 item selected
(` Mod ` = ⌘ on macOS / ` Ctrl ` on Win/Linux) |
| `Escape` | Clear selection | If ≥1 item selected |
| `Escape` | Close file preview | If no selection and preview pane open
|
| `Escape` | Close search | If no selection, no preview, and search is
open |
### Tips while testing
- [x] Chords (two-key sequences): press the first key, release, then
press the second key within ~1s
- [x] Hover any wired button (search, Refresh, Upload, Create folder,
View, Download, Move, Delete, the bucket Create button, sidebar items)
to see the keybind in a tooltip
- [x] Most actions also appear under "Shortcuts" in `Cmd+P`
- [x] Chords starting with a plain letter (` S, F ` / ` I, F ` / ` V, C
` / ` F, C ` / ` S, C `) won't fire while typing in an input — click out
first
- [x] `Escape` does fire from inside the search field (closes the
search)
- [x] `Cmd+/` opens the full shortcuts reference
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Keyboard shortcuts added across Storage: buckets (refresh, clear sort,
create, search), explorer (upload, create folder, refresh, download,
move, delete, clear search), and navigation shortcuts for
Files/Analytics/Vectors/S3.
* **UI**
* Shortcut keytips/tooltips added to relevant buttons and menu items for
discoverability.
* **Documentation/Tests**
* Shortcut reference sheet labels updated and covered by a new test.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45837)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com>
|
||
|
kemal.earth
|
8ca04989c8 |
fix(studio): reports table footer overflow (#45885)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? A small bug that was causing the overflow of chart table footers to break on smaller viewports. Now fixed along with cell horizontal spacing. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Enhanced table layouts in the Reports section by enabling horizontal scrolling for API Routes and Cache Misses tables, ensuring all data is visible on various screen sizes. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45885) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Alan Daniel
|
e492477ad4 |
feat(marketing): add anti-spam protections to /go forms (DEBR-280) (#45842)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature — anti-spam protection for all `/go` lead-gen forms. ## What is the current behavior? The shared `MarketingForm` used by every `/go` page has no spam protection: no honeypot, no captcha, no timing check, no dedupe. The Datadog NYC exec dinner form was getting probed with spam submissions ([DEBR-280](https://linear.app/supabase/issue/DEBR-280/reduce-spammy-submissions-on-exec-dinner-form)). ## What is the new behavior? Three layered defenses added to the shared `MarketingForm` + `submitFormAction` so every `/go` form is covered: 1. **Honeypot** — hidden `website` input (off-screen, `aria-hidden`, `tabIndex={-1}`). Server returns a fake success when filled so bots don't probe variations. The field is stripped from the payload before CRM fan-out. 2. **Minimum render-time check** — server rejects submissions that come back in under 3s with a fake success. 3. **Per-session email/form dedupe** — `sessionStorage` keyed by `formGuid`/`database_id` + email blocks double-submits; the success state is shown without re-hitting HubSpot/Customer.io/Notion. ## Additional context No new env vars or services required. Honeypot rejections are logged via \`console.warn\` for monitoring. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Enhanced anti-spam protections (honeypot and minimum render time) to block bots. * Prevents accidental duplicate submissions within the same browser session. * Avoids creating duplicate contact/record entries when an existing email is found in storage. * **Other Improvements** * Cleaner event/context data sent to analytics for more accurate tracking. [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45842) <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
