## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES/NO
## What kind of change does this PR introduce?
Bug fix, feature, docs update, ...
## What is the current behavior?
Please link any relevant issues here.
## What is the new behavior?
Feel free to include screenshots if it includes visual changes.
## Additional context
Add any other context or screenshots.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added Beta channel section documenting pre-release Supabase CLI
installation for macOS, Windows, Linux, and npm.
* Updated CLI update instructions with beta-specific commands for
Homebrew, Scoop, and npm.
* Enhanced troubleshooting guide with reference to beta channel
documentation.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45734)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: avallete <8771783+avallete@users.noreply.github.com>
## Problem
Recent database report PRs introduced `(value: any)` type annotations in
recharts `tickFormatter` callbacks, pushing the
`@typescript-eslint/no-explicit-any` ESLint ratchet from baseline 1014
to 1017 and blocking all PR merges.
## Fix
Replace `(value: any)` with `(value: number)` in all affected
`tickFormatter` callbacks across the three flagged files. Recharts
always passes a number to tick formatters, so this is a safe and
accurate type.
## How to test
- Run `pnpm lint --filter=studio` and confirm no new
`@typescript-eslint/no-explicit-any` violations appear in the three
changed files
- Check the ESLint ratchet count is back at or below baseline 1014
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Improved type safety for Y‑axis tick formatters across observability
charts (Memory, Swap, Network throughput, Disk IOPS/throughput/usage,
Replication Lag), ensuring tick values are treated as numeric for more
consistent chart rendering and reliability.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45794)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Ali Waseem <waseema393@gmail.com>
This PR syncs the latest troubleshooting guides from the
supabase/troubleshooting repository.
Co-authored-by: github-docs-bot <github-docs-bot@supabase.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
1. Cleaned up older go pages and removed them from the index. Source
code remains in case we ever want to look back or copy tactics.
2. Modified the Dash 2026 dinner page to reflect venue and time
3. Implemented Notion as a destination for the Dash 2026 dinner form
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Published NYC 2026 Executive Dinner page with venue (Manhatta), timing
(cocktails 6:30 PM, dinner 7:00 PM), event image, and RSVP integration.
* **Updates**
* Thank-you page copy updated to confirm RSVP and include event timing.
* RSS feed updated with new article: "Supabase Is Now an Official
ChatGPT App"
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45733)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Four React-19-sensitive patterns that pass on React 18 today but break
under React 19 (verified on the in-flight TanStack Start branch).
Landing on master now so the eventual React 19 upgrade is a no-op for
tests, instead of a separate cleanup pass under upgrade pressure.
Each fix is a strict superset / less-fragile equivalent of the existing
pattern, so master (React 18) stays green.
**Changed:**
- `hooks/misc/useStateTransition.ts` — fire on entry into `newTest` from
any state other than `newTest`, instead of requiring exactly `prevTest →
newTest`. React 18+ auto-batches dispatches across awaits (e.g.
`dispatch SUBMIT` in the handler, `dispatch ERROR` in `onError`),
collapsing `editing → submitting → error` into a single render where the
intermediate `submitting` tick is never observed. Strict superset of the
old check for our reducers — `success`/`error` are only reachable from
`submitting`.
- `Support/CategoryAndSeverityInfo.tsx` — guard `onValueChange` against
Radix Select's spurious `''` emission. When the controlled value
transitions from `undefined` to a defined value whose `SelectItem` isn't
mounted yet (dropdown closed → items haven't registered), Radix's hidden
`BubbleSelect` fires `onValueChange('')` and clobbers the field. No
`SelectItem` can have `value=""` (Radix throws), so any `''` is
guaranteed spurious — drop it before calling `field.onChange`.
([radix-ui/primitives#3381](https://github.com/radix-ui/primitives/issues/3381))
- `EditSecretModal.test.tsx` — `getByLabelText` → `findByLabelText`.
Under React 19's scheduling, the decrypted-value query resolves on a
separate render tick, so form fields appear one tick after the skeleton.
- `LogsPreviewer.test.tsx` — `addEventListener('click', spy)` instead of
`loadOlder.onclick = vi.fn()`. React 19 reassigns `.onclick` on managed
elements as part of its event wiring, clobbering the direct-property
spy.
## To test
### Unit tests
- `pnpm --filter studio test` — all unit tests pass on master (React 18)
### Support form URL prefill (Radix Select guard)
- `/support/new?category=Problem` → category dropdown reads "APIs and
client libraries" on first paint
- `/support/new?category=dashboard_bug` → "Dashboard bug"
(case-insensitive match)
- `/support/new?category=invalid_garbage` → falls back to "Select an
issue" placeholder, no crash
- `/support/new?subject=My%20issue&message=Details%20here` → subject and
message inputs are prefilled
- `/support/new?projectRef=<your-ref>&category=Problem` → both project
selector and category set, library selector appears
- With a prefilled URL, click the category dropdown and pick a different
option — the new value sticks (this is the path that surfaced the Radix
bug, want to confirm we didn't break user selection)
- DevTools console on first load should be clean — no React hydration
mismatch warning
### Support form submit (`useStateTransition` success + error branches)
- Submit a valid support form → green toast "Support request sent"
appears **once**, view swaps to the success screen, one `POST
/platform/feedback/send` in the network panel
- Block `POST /platform/feedback/send` in DevTools → submit → red error
toast appears **once** (not twice — if you see two toasts the relaxed
transition is firing more than it should), form stays editable with all
inputs preserved
- Unblock and submit again → success path runs cleanly
### Sidebar support form (same reducer + `useStateTransition`, separate
component)
- Open the support widget in the side nav (`SupportSidebarForm`)
- Repeat the success and error paths — should behave identically
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed category selector to prevent selected values from being
unexpectedly cleared during form interactions.
* **Tests**
* Improved test reliability for modal field rendering and event handling
assertions.
* **Chores**
* Clarified internal comments for form initialization logic.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45784)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
## TL;DR
Policies created with a `WITH CHECK` clause in sql editor still reopen
with the that section hidden and the checkbox unmarked
this fixes that by restoring the saved check block when editing the
policy
## Before
<img width="667" height="408" alt="image"
src="https://github.com/user-attachments/assets/0a859172-2ab2-444a-968c-49325505786f"
/>
## After
<img width="602" height="462" alt="image"
src="https://github.com/user-attachments/assets/a7f5799a-e073-4b2c-807b-2997ac76edfd"
/>
## ref:
- Closes https://github.com/supabase/supabase/issues/45720
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed the policy editor to properly display and enable the "with
check" section when loading existing policies that contain check
conditions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The Database report in Observability has no view of network traffic.
Inbound/outbound throughput is useful for spotting saturation, large
unexpected egress, or correlating spikes with disk I/O.
Closes
[FE-3193](https://linear.app/supabase/issue/FE-3193/add-network-in-and-out-charts).
## Fix
Add a new \`network-throughput\` chart entry to
\`getReportAttributesV2\` in
[apps/studio/data/reports/database-charts.ts](apps/studio/data/reports/database-charts.ts),
placed right before \`disk-iops\`. Uses the existing
\`network_receive_bytes\` and \`network_transmit_bytes\`
infra-monitoring attributes (series already exist, no backend work
needed). Pattern mirrors the \`disk-throughput\` chart: bytes-per-second
Y-axis, \`stackedAreaLine\` default, same \`syncId\`.
\`showMaxValue\` is \`false\` because there is no provisioned network
max to render as a reference line.
## Test plan
- [ ] Open \`/project/<ref>/observability/database\` and confirm a
"Network throughput" chart renders with two series (Network in / Network
out) and a \`bytes/s\` Y-axis.
- [ ] Switch the date range and confirm the chart respects it
(auto-wired via \`REPORT_ATTRIBUTES.flatMap\`).
- [ ] Use the global refresh button and confirm both series invalidate
with the rest.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a network throughput chart that visualizes inbound and outbound
network throughput metrics with real-time speed data visualization.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45747)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
### Summary
Changed the Supabase email domain in public facing docs `security.txt`
and `security-testing.mdx`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the official security contact email address across security
documentation, testing guidelines, and policy resources to ensure users,
security researchers, and developers have accurate contact information
for reporting vulnerabilities and coordinating responsible disclosure
efforts.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45772)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
On the Database Extensions page, the Version column takes up
disproportionate horizontal space compared to the Description column,
making the table harder to read.
## Fix
Added `w-28` to the Version `TableHead` and its corresponding
`TableCell` in `ExtensionRow`. This constrains the column to a width
appropriate for short version strings and gives the Description column
more room.
## How to test
1. Open a project in Studio and navigate to Database > Extensions.
2. Confirm the Version column is now narrow and the Description column
has proportionally more space.
3. Verify all version strings are still fully visible (e.g. `1.4.8`,
`2.5.2`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Fixed the "Version" column and its cells to a consistent width for
improved table alignment.
* Preserved monospace styling and spacing in version cells for
readability.
* Removed the max-width limit on comment text cells so comments can use
more space while retaining hover tooltips for full text.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45786)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Summary
- Removes the `SupaIcon` component (inline Supabase SVG logo) from
`LogsSidebarMenuV2.tsx`
- Removes the `icon` prop from the Collections and Database operations
sidebar items
- Makes `icon` optional in `LogsSidebarItem` so the span is only
rendered when an icon is provided
Closes FE-3203
## Test plan
- [ ] Navigate to Logs & Analytics in Studio
- [ ] Confirm Collections and Database operations sidebar items no
longer show the Supabase logo
- [ ] Confirm Saved Queries items still show the SQL editor icon
(unaffected)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Updated the logs sidebar component to make icon display optional.
* Removed icons from sidebar items in the logs navigation to streamline
the interface presentation.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45787)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
Studio builds get skipped in Vercel anyway, but be deliberate in
skipping approval. We don't want forks to be able to have a studio
deployment approved.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Optimized the deployment authorization process to skip unnecessary
status checks, reducing processing overhead and improving deployment
pipeline efficiency.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45781)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Google Search Console flagged 4 "URL not allowed" errors on
`sitemap_www.xml` — malformed URLs like
`https://supabase.comdata/legal/terms/v1` (missing slash, non-existent
path). The generator was globbing `data/**/*.mdx`, picking up the 4
content-source MDX files under `data/legal/` that are imported by
`pages/terms.tsx` and `pages/enterprise-terms.tsx` but are not
themselves routed. With no path replacement mapping `data/...` to a
route and no leading slash, the URL template concatenated to garbage.
The real `/terms` and `/enterprise-terms` URLs come from the
`pages/*.tsx` glob and are unaffected.
## Changes
- Remove `data/**/*.mdx` glob (and its companion `!data/*.mdx` exclude)
from the sitemap generator. `apps/www/data/` has no routed MDX, only
content sources imported into pages.
- Anchor the `pages` prefix replace: `.replace('pages', '')` →
`.replace(/^pages/, '')`. String-form replace is first-occurrence and
would mangle any future filename containing `pages` as a non-prefix
substring (e.g., `_blog/about-pages.mdx` → `/blog/about-`). No current
files trigger this; defensive hardening.
## Testing
Regenerated the sitemap locally and verified:
- [x] `grep -c "supabase.comdata" public/sitemap_www.xml` → `0` (was 4)
- [x] `<loc>https://supabase.com/terms</loc>` and
`<loc>https://supabase.com/enterprise-terms</loc>` still present
- [x] Every `<loc>` matches
`^<loc>https://supabase\.com(/[a-zA-Z0-9].*)?</loc>$` (no malformed URLs
of any kind)
- [x] Total loc count stable across both commits (regression-free for
the anchor change)
Local count is lower than prod (527 vs 906) because
`.next/server/pages/**` partner/expert/feature HTML globs only resolve
after a full build — runs correctly via `postbuild` on Vercel.
After deploy lands, resubmit `sitemap_www.xml` in Google Search Console
to force a re-crawl (otherwise daily-ish). Expect status to flip from "4
errors" to "Success" and Discovered pages: 906 → 902.
## Linear
- fixes GROWTH-837
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Chores**
* Improved sitemap generation to properly index specific content
sections (blog, case studies, customers, events, and alternatives) with
refined route path processing for better search engine discoverability.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45775)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Eliminates the Google Search Console "Missing field 'item' (in
'itemListElement')" critical error on 230 `/docs/guides/*` pages. The
schema was emitting `ListItem`s without an `item` field for intermediate
category nodes that lack a URL in the docs nav. Per [Google's
spec](https://developers.google.com/search/docs/appearance/structured-data/breadcrumb),
`item` is required on every BreadcrumbList position except the last leaf
— so url-less items are filtered out instead.
Also fixes a smaller quality gap surfaced during preview verification:
the `auth` section root in `NavigationMenu.constants.ts` was missing a
`url`, so auth trails were dropping the "Auth" breadcrumb level (`Docs >
Guides > JSON Web Tokens (JWT) > Overview` instead of `Docs > Guides >
Auth > JSON Web Tokens (JWT) > Overview`). Every other section root
already has a `url`; auth was the lone outlier.
## Testing
Tested locally via vitest (`pnpm --filter docs exec vitest run
lib/json-ld.test.ts`):
- [x] All-urls chain: every `itemListElement` has string `item` and
`name`
- [x] Leaf-url-mismatch: leaf uses `pathname` even when the chain leaf
URL differs
- [x] All-url-less chain: returns `null`
- [x] Empty chain: returns `null`
Tested on the preview deploy against 7 representative GSC-flagged paths:
- [x] `/docs/guides/getting-started/ai-prompts` — 4 positions, 0 missing
- [x] `/docs/guides/getting-started/ai-skills` — 4 positions, 0 missing
- [x] `/docs/guides/auth/jwts` — 4 positions, 0 missing (after auth fix:
includes "Auth")
- [x] `/docs/guides/auth/social-login/auth-google` — 4 positions, 0
missing (after auth fix: includes "Auth")
- [x] `/docs/guides/database/postgres-js` — 4 positions, 0 missing
- [x] `/docs/guides/storage/quickstart` — 4 positions, 0 missing
- [x]
`/docs/guides/platform/migrating-within-supabase/dashboard-restore` — 5
positions, 0 missing
Post-merge:
- [ ] validator.schema.org against deployed URL: 0 errors
- [ ] GSC "Validate fix" on the breadcrumb issue (1-2 week re-crawl
window)
## Linear
- fixes GROWTH-835
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved breadcrumb validation to filter incomplete entries and avoid
broken documentation links.
* Restored root link for the Auth navigation section so the Auth menu
item now navigates to /guides/auth.
* **Tests**
* Added comprehensive tests covering breadcrumb generation and edge
cases.
* **Refactor**
* Streamlined breadcrumb JSON‑LD schema generation for clearer output
and maintainability.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45744)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
`apps/www/public/rss.xml` is committed to the repo AND rewritten on
every `pnpm dev`, `pnpm build`, and `pnpm typecheck` run via
`content:build` -> `apps/www/scripts/generateStaticContent.mjs`. Anyone
working in `apps/www` (or running `pnpm typecheck` from the monorepo
root) sees a phantom `M apps/www/public/rss.xml` in `git status` every
session. Easy to accidentally commit, otherwise has to be repeatedly
stashed.
The sibling `changelog-rss.xml` (written by the same script) is already
gitignored. This aligns the main blog rss with the same treatment.
## Changes
- Add `/public/rss.xml` to `apps/www/.gitignore` (alongside the existing
changelog-rss entries; renamed the section header from "Changelog
generated feeds" to "Generated feeds" to reflect what it now covers).
- `git rm --cached apps/www/public/rss.xml` so git stops tracking the
file. The on-disk copy is preserved for local dev.
## Testing
No behavior change — the file is still generated by `content:build` and
served from `public/` at build time.
- [x] `git check-ignore -v apps/www/public/rss.xml` resolves to
`apps/www/.gitignore:36`
- [x] `apps/www/public/rss.xml` still on disk after `git rm --cached`
- [ ] On a fresh clone + `pnpm install + pnpm --filter www build`, the
file regenerates and is served at `/rss.xml` on the resulting build
(Vercel preview will confirm via deploy).
## Linear
- fixes GROWTH-836
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated repository configuration to properly manage auto-generated
files.
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/45745)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
New blog post
## What is the current behavior?
No blog post exists for this topic.
## What is the new behavior?
Adds a new blog post announcing that Supabase is now an official ChatGPT
app. Covers what you can do with the integration (database management,
branching, edge functions, etc.), how to get started, and supported
plans.
## Additional context
N/A
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Documentation
- Published blog post announcing Supabase is now available as an
official ChatGPT app
- Describes 29 integrated tools for SQL operations, schema management,
security, project workflows, branching, edge functions, and
documentation search
- Includes setup guide, plan compatibility information, and video
tutorial
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Ana <ana1337x@users.noreply.github.com>
This PR adds a color palette to the Design system for easier reference.
<img width="1325" height="1200" alt="Screenshot 2026-05-08 at 17 18 51"
src="https://github.com/user-attachments/assets/7de77c15-f6c6-4691-9875-eea72919ff7d"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added an interactive color palette: displays named colors with 12
scale steps; click a swatch to copy its CSS variable and see brief
"Copied!" feedback.
* **Documentation**
* Added a "Color palette" section to the color usage docs with
instructions and an embedded palette for exploring and copying CSS
variables.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Remove unneeded checks and its handled by the shortcut
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved the empty state interface in the Third Party Auth integration
form, enhancing the display and alignment when no integrations are
available.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Updates reference docs based on recent **stable** releases across
supabase-js, supabase-flutter, and supabase-py. Only changes that landed
in a stable tag are documented.
## Changes analyzed
| SDK | Repo | Stable tag range | Notes |
|-----|------|-----------------|-------|
| js | supabase/supabase-js | `v2.105.0` → `v2.105.3` | Bug fixes and
type improvements; no doc-worthy API changes |
| dart | supabase/supabase-flutter | → `supabase_flutter-v2.13.0` |
`anonKey` deprecated → `publishableKey` |
| py | supabase/supabase-py | `v2.29.0` → `v2.30.0` | New: `.select()`
chaining on write builders |
| swift | supabase/supabase-swift | `v2.46.0` | Dependency bumps only |
| kt | supabase-community/supabase-kt | `3.6.0` | Test coverage
improvements only |
| csharp | supabase-community/supabase-csharp | `v1.1.2` | No changes |
> **Note**: The JS `storage.from().exists()` breaking behavior change
and `PostgrestError instanceof` fix were intentionally excluded — they
are only in the `v3.0.0-next` pre-release branch, not in any stable
`v2.x` tag.
## Documentation updates
### `apps/docs/spec/supabase_dart_v2.yml`
- Rename `anonKey` parameter → `publishableKey` in
`Supabase.initialize()` to match the deprecation in
[supabase-flutter#1360](https://github.com/supabase/supabase-flutter/pull/1360)
(landed in `supabase_flutter-v2.13.0`)
- Update Flutter example to use `publishableKey:` named argument
- Note that `anonKey` is still accepted but deprecated
### `apps/docs/spec/supabase_py_v2.yml`
- Add `.select()` chaining examples to `insert()`, `update()`,
`upsert()`, and `delete()` write builders, newly supported in
[supabase-py v2.30.0](https://github.com/supabase/supabase-py/pull/1383)
- Add notes to each write method mentioning select chaining capability
---
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Documentation**
* Dart SDK: Updated client initialization to use `publishableKey`
parameter; deprecated `anonKey` remains supported for backward
compatibility.
* Python SDK: Added examples demonstrating how to chain `.select()` with
write operations (`insert()`, `update()`, `upsert()`, `delete()`) to
retrieve specific columns from modified rows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added diagnostic logging to banner components for internal monitoring
purposes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add a second notice banner (because we need the first one to show the
current ToS update). Scoped to ap-southeast-1 and sa-east-1.
Haven't linked to the StatusPage maintenance entry yet as it's not up;
the placeholder link is just to the generic StatusPage.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a second notice banner that alerts users to upcoming maintenance
for affected databases in specific regions; it appears conditionally
(based on affected projects) and can be dismissed—dismissal prevents it
from reappearing.
* The existing “Updated Terms of Service” notice remains unchanged and
continues to display on non–sign-in routes until acknowledged.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Feature
## What is the current behavior?
The /events page only loads events from the Notion "Developer Events"
database and the Luma Community API. MDX files under `apps/www/_events/`
(including webinars like agency-webinar, sentry, datadog, figma-make)
are not surfaced on the listing, and past events could still appear
until the moment they ended because the filter compared against `now()`
rather than the current day.
Addresses
[DEBR-85](https://linear.app/supabase/issue/DEBR-85/events-page-powered-by-notion-page).
## What is the new behavior?
- New `getMdxEvents()` reads `apps/www/_events/*.mdx`, parses
frontmatter with `gray-matter`, and returns today-and-future events as
`SupabaseEvent`s.
- `/events` now merges Notion + mdx + Luma events.
- Past events are hidden across all sources by comparing against the
start of today (UTC) instead of `now()`, so events running today stay
visible throughout the day.
## Additional context
Links on mdx events point at the main_cta URL when it's an external
\`http(s)\` URL, otherwise fall back to the built \`/events/{slug}\`
page so on-demand recordings remain reachable.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Events can be sourced from MDX files and merged into site event
listings.
* Luma supports multiple calendars (community and hackathon) for richer
feeds.
* **Improvements**
* Events now exclude anything before the start of the current UTC day.
* Added a “Community Event” category filter and included it in counts.
* Event title typography adjusted for improved readability.
* “Hosted by” text now only shows when hosts exist; host fallbacks
standardized.
* **Chores**
* Build env updated to include hackathon API key.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Renames the docs page title, sidebar label, description, and body text
from **"Supabase Agent Plugin"** to **"Supabase Plugin for AI coding
Agents"** across `plugins.mdx`, `ai-skills.mdx`, `mcp.mdx`, and the
navigation constants
More context in this [Slack
thread](https://supabase.slack.com/archives/C0254JUR2DU/p1778165488699219)
Close
[AI-710](https://linear.app/supabase/issue/AI-710/rename-supabase-agent-plugin-docs-title)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Renamed the AI tool throughout docs and navigation to "Supabase Plugin
for AI Coding Agents" (previously "Supabase Agent Plugin").
* Updated getting-started and plugin pages, installation guidance, and
sidebar labels to use the new name while preserving existing links and
instructions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
## Context
Adding an "Ask Assistant" CTA in the RLS tester if the query executed
returns an error
<img width="618" height="375" alt="image"
src="https://github.com/user-attachments/assets/8b0a5069-3ec5-44aa-aa0b-f1cd8041960d"
/>
Which will open the Assistant panel with the following prompt (attaches
the query as well)
<img width="427" height="281" alt="image"
src="https://github.com/user-attachments/assets/16debd7b-9447-4b84-bef5-05debd0062ee"
/>
Theres a chance that the error might be just from the query and not
related to the policy hence the last sentence in the prompt
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Integrated AI assistant into the RLS tester so users can open the
assistant prefilled with a debug prompt and relevant SQL to troubleshoot
policy issues.
* Added an "Ask Assistant" action on execution error messages to quickly
start guided debugging.
* Streamlined error display to prioritize parse errors, then client-code
parse errors, then execution errors for clearer diagnostics.
* **Chores**
* Added telemetry source identifier for the RLS tester to track
assistant usage.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Resolves FE-2985
As per PR title
- Add project region info in project settings page for convenience
<img width="722" height="375" alt="image"
src="https://github.com/user-attachments/assets/b32e80ed-42bd-4b12-b9b4-a3e696646335"
/>
- Add project region info in vector buckets empty state
<img width="1110" height="215" alt="image"
src="https://github.com/user-attachments/assets/60bfde97-c3e3-4c10-8b86-98ecd0437ad5"
/>
- Make DB region copyable by clicking in instance config chart on home
page
<img width="419" height="298" alt="image"
src="https://github.com/user-attachments/assets/269b9517-d0eb-42b9-9648-386c59d53842"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Project region is now shown as a read-only field with a descriptive
region label in Settings.
* Region identifiers are clickable to copy to clipboard, with a “Click
to copy” tooltip and success toast.
* Storage/empty-state messaging updated to show clearer, region-specific
text and tooltip details.
* Replica creation time now uses an enhanced timestamp display.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Feature and design-system update. Resolves DEPR-551.
This is a narrower redo of #45302 after the revert in #45535.
## What is the current behaviour?
The reverted implementation made Admonition more flexible, but it also
changed Studio callsites, touched shared Alert styling, renamed the
design-system Tailwind config, and changed Docs-facing content/API
assumptions in a way that broke production docs static generation.
## What is the new behaviour?
Admonition now supports description-only content, children-only content,
optional `title`, legacy `label`, and `type="success"` without touching
`apps/docs/content/**` or shared Alert styling.
`title` wins over `label` when both are provided. The runtime component
props stay backwards-compatible for existing MDX and Studio usage, while
`AdmonitionStrictProps` captures the stricter new-usage contract for
tests and future callsites.
The design-system docs and registry include description-only and success
examples, and the Admonition tests cover the rendering paths that broke
production previously.
| After |
| --- |
| <img width="1668" height="1768" alt="CleanShot 2026-05-06 at 17 35
13@2x"
src="https://github.com/user-attachments/assets/1c00ea7f-e3ca-45eb-8af9-3536b657c341"
/> |
## Additional context
These things that were in #45302 have been left out (unless checked):
- [ ] Studio callsite rewrites from title/label to description
- [ ] Shared Alert text-colour changes
- [ ] Design-system Tailwind config rename
- [ ] Design-system global CSS changes
- [ ] Any docs content migration or label deprecation
- [ ] Any production docs workaround
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added success admonition variant with dedicated styling and icon.
* Introduced description-only admonition example.
* **Documentation**
* Expanded admonition guidance on title vs description usage and best
practices.
* Added example sections showcasing description-only and success
variants.
* **Tests**
* Added comprehensive tests covering admonition variants and
rendering/precedence behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Addresses some issues found with the RLS editor from recent changes
- Creating a "SELECT" or "INSERT" policy via templates wasn't working
(might have been [this
PR](https://github.com/supabase/supabase/pull/45560)) that introduced
the bug)
- SELECT -> SQL error as we were incorrectly adding a with check
statement in the query
- INSERT -> UI issue, there's a bit of complexity as we're using 1 code
editor for `using` and `check` statements
- Badge color for "UPDATE" based templates is off
<img width="446" height="114" alt="image"
src="https://github.com/user-attachments/assets/66fd0c1a-c20c-406d-983e-2c02680bb235"
/>
- Renaming a policy, the initial alter query statement shouldn't be
using the new name
<img width="596" height="288" alt="image"
src="https://github.com/user-attachments/assets/0b6822d5-e5f5-440e-8942-8e19bd7bf4c3"
/>
## To test
- [ ] Verify that you can create a policy for all templates in the Auth
policies page + Realtime policies page (as long as no SQL error - some
templates are using tables as examples that might not exist in the DB)
- [ ] Likewise, verify that you can manually create + update policies as
well
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Updated UPDATE template badge styling to a darker blue color scheme
with reduced opacity.
* **Bug Fixes**
* Fixed policy name display logic to correctly show the selected
policy's existing name during renaming operations.
* Improved SQL fragment loading and check expression handling for INSERT
command policy templates.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Missed another case here - RLS tester when retrieving policies
associated with query needs to consider policies with the `ALL`
operation
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added comprehensive tests for Row-Level Security policy filtering,
covering schema/table matching, role handling (including
public/service-role cases), command/operation semantics, and combined
filter behavior.
* **Refactor**
* Centralized and clarified RLS policy filtering logic used by the
tester for improved maintainability and consistency.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Swap the project-creation revoke from custom `db_sql` over to the new
`data_api_revoke_default_privileges` API field. Same behaviour, just
delegated to the platform so non-studio flows (branches, CLI, terraform)
can apply the same revoke logic — addresses
[FE-3145](https://linear.app/supabase/issue/FE-3145/swap-frontend-to-use-revoke-default-privileges-flag).
Backend support landed in supabase/platform#32158 and
supabase/platform#32493 (FUP that decoupled the flag from
`data_api_use_api_schema`).
**Changed:**
- `apps/studio/data/projects/project-create-mutation.ts` — accepts
`dataApiRevokeDefaultPrivileges` and forwards it as
`data_api_revoke_default_privileges`
- `apps/studio/pages/new/[slug].tsx` — drops the inline
`buildDefaultPrivilegesSql('revoke')` injection in `dbSql`, passes the
flag instead
-
`apps/studio/pages/integrations/vercel/[slug]/deploy-button/new-project.tsx`
— same swap on the Vercel deploy-button flow
- `packages/api-types/types/platform.d.ts` — adds the new field to
`CreateProjectBody`
**Preserved:**
- The `dataApiRevokeOnCreateDefault` PostHog flag still gates the
default checkbox state and telemetry — only the SQL application changes
- `data_api_use_api_schema: false` stays as-is — projects keep `public`
+ `graphql_public` exposed, no project-shape change
## To test
- Project creation form (`/new/<org>`):
- With PostHog flag off: "Automatically expose new tables" defaults to
checked → request body has `data_api_revoke_default_privileges: false`
- Manually uncheck the box → request body has
`data_api_revoke_default_privileges: true`, project ends up with revoked
default grants on `public`
- With "Enable Data API" off → `data_api_revoke_default_privileges:
false` (no point revoking when nothing's exposed)
- Vercel deploy-button flow
(`/integrations/vercel/<slug>/deploy-button`):
- Same checkbox behaviour as above
- Migration SQL from the GitHub repo still runs as `db_sql` separately
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for a dedicated `dataApiRevokeDefaultPrivileges` option
during project creation.
* **Refactor**
* Simplified Data API privilege configuration by using a dedicated
parameter instead of SQL-based management across project creation flows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
<img width="1289" height="863" alt="image"
src="https://github.com/user-attachments/assets/d661f107-b358-4894-8531-80441d60ab91"
/>
GitHub integration is now available on the free plan and so we'd like to
start promoting code-first workflows as much as possible. One way to do
that is to set the tone straight away by asking a user to connecting
their GitHub repository to a project as part of project creation.
This PR:
- decouples GitHub connection and repo selection into a separate
component we can make use of in integration settings and project
creation.
- Adds new GitHub fields to project creation form and sends them off to
project creation endpoint
- Pre-fills project name based on repo selection
To test locally:
- Ensure you have GitHub integration set up locally (using ngrok etc)
- Ensure you are on the connected platform branch
- Open create a new project page
- Connect GitHub as part of the creation form and select a repo
- Create the project and wait for status to be healthy
- Check project settings integrations page and ensure repo is connected
Note:
- this requires changes on the management api end to accept new GitHub
fields
- it might make sense to pull out GitHub connection/authorization from
GitHub repository selection but in the current state they are tied
together.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* GitHub repository selection now available during project creation with
integrated authorization flow
* GitHub connection status and compute availability indicators now
displayed on project dashboard
* Project name auto-populates from selected GitHub repository name when
available
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com>
Refactors our help sidebar within Studio to include the actual support
form itself when contact is selected. This PR also cleans up the initial
state of the sidebar and the options within.
## To test:
- Open an org and click the help icon top right
- Click contact support
- Submit a support ticket
- Click done to return to support sidebar state
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Support form V3 and support sidebar with status button; direct-email
helper and URL prefill
* Success screen supports onFinish callback and customizable finish
label
* AI Assistant and Help options accept optional click callbacks;
resource items gain keyboard/accessibility support
* **Refactor**
* Help panel split into home/support views with back navigation
* Support components accept flexible align/className props and
layout/styling tweaks
* Initial URL params loader added for support form
* **Tests**
* New/updated tests for support flows, success screen, and help options
interactions
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com>
## What kind of change does this PR introduce?
UI chore.
## What is the current behavior?
The Keyboard shortcuts sheet renders shortcut definitions from the
static registry, so contextual Database navigation shortcuts appear in
the sheet even when `DatabaseLayout` is not active. This makes the
Navigation section noisy as more product-specific navigation shortcuts
are added.
## What is the new behavior?
The shortcuts sheet now reads the mounted, enabled shortcut set at
runtime. Global navigation remains under Navigation when it is the only
navigation scope, and splits into _**Global** Navigation_ plus
_**Database** Navigation_ when contextual database shortcuts are active.
This also replaces the one-off `DatabaseNavShortcuts` component with a
reusable `ProductMenuShortcuts` registrar so future product layouts can
register scoped navigation shortcuts from their product menu model.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added keyboard shortcut support for product menu navigation items with
router integration
* **Improvements**
* Keyboard shortcuts are now organized into logical groups (Global
Navigation and Database Navigation)
* Shortcut reference dynamically displays only active shortcuts instead
of static definitions
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Ali Waseem <waseema393@gmail.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Refactor + feature
## What is the current behavior?
The AWS Activate offer page used a one-off `HubSpotFormEmbed` component
(an iframe-style HubSpot script embed) living under
`apps/www/_go/lead-gen/components/`. It was single-destination (HubSpot
only) and not reusable. Closes
[DEBR-266](https://linear.app/supabase/issue/DEBR-266).
## What is the new behavior?
Adds a reusable `MarketingForm` component to the `marketing` package
that fans out submissions to HubSpot, Customer.io, and Notion in
parallel via the existing `submitFormAction` server action. The go-page
`FormSection` is now a thin adapter on top of `MarketingForm`, and
`aws-activate-offer.tsx` uses `MarketingForm` directly. The legacy
`HubSpotFormEmbed` is deleted.
## Additional context
- `MarketingForm` is exported from `marketing` so it can be used outside
go pages.
- Customer.io / Notion fan-out for AWS Activate is wired but not yet
configured — drop in `crm.customerio` / `crm.notion` blocks once
[DEBR-265](https://linear.app/supabase/issue/DEBR-265) lands.
- The original HubSpot embed had conditional field formatting which the
new form does not replicate; verify HubSpot field internal names
(`firstname`, `lastname`, `email`, `company`, `aws_account_id`) match
the target form before merging.
- Requires `HUBSPOT_PORTAL_ID` env to point at portal `19953346` (was
previously hardcoded in the embed).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* New reusable marketing form with responsive two-column layout,
validation, error display, success UI or redirect, optional
title/description and markdown disclaimer.
* Added URL and checkbox field types plus conditional field visibility.
* HubSpot embed accepts typed props and improves script loading with
retry and clearer error logging.
* **Refactor**
* Forms consolidated into a shared marketing module; form sections now
delegate to the shared form component.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This PR bumps `next` in `www` app to fix a vulnerability.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated framework to the latest patch version, incorporating bug fixes
and performance improvements from recent releases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix — copy + visibility logic on the org Usage page.
## What is the current behavior?
On `/org/<slug>/usage` during a grace period, customers see two banners
that read as contradictory:
1. *"Organization plan has exceeded its quota — grace period until
{date}."*
2. *"You have not exceeded your Pro Plan quota in this billing cycle."*
<img width="1680" height="372" alt="image"
src="https://github.com/user-attachments/assets/13826260-55dd-4b55-a3dc-5afc51e6436e"
/>
Both are individually correct. The first is sticky from the previous
cycle's overage (`org.restriction_status`); the second is a live scan
over the current cycle. Neither anchors to which cycle it's talking
about, so together they read like the dashboard contradicting itself.
Surfaced by support off SU-368527 and SU-368395.
## What is the new behavior?
- Top chrome banner copy: *"Organization exceeded its quota in the
previous billing cycle / You have a grace period until {date} to bring
usage back under quota."*
- Inline `<Restriction />` grace-period alert switches from "is over its
quota" to "went over its quota in the previous billing cycle." Same
temporal anchor.
- The "…in this billing cycle" summary line in `<TotalUsage>` is hidden
whenever `restriction_status` is set. Mirrors the precedence rule
`<Restriction />` already applies internally — backend status flag wins
over the live cycle scan.
<img width="1678" height="937" alt="CleanShot 2026-05-06 at 12 58 02"
src="https://github.com/user-attachments/assets/df55eaed-1029-4f39-bea0-df77bcc5151e"
/>
## Additional context
Left the `gracePeriodOver` copy alone on purpose — it doesn't make a
current-overage claim, so there's nothing to contradict, and adding
"previous cycle" would muddy which cycle "previous" refers to.
**Verified**
- Lint and typecheck pass on `apps/studio`.
**Before merge**
- [ ] Load a grace-period org locally: confirm new copy on top banner
and inline `<Restriction />`, and that the "not exceeded in this billing
cycle" line is gone.
- [ ] Copy review with support — happy to workshop wording.
GROWTH-823
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Updated grace period alert messaging to clarify organization quota
status
* Refined date formatting in billing restriction notifications
* Modified usage display to conditionally hide certain information when
account restrictions are active
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Bumped Next.js versions used by docs and the workspace.
* Adjusted workspace dependency exclusion list to add Next-related
entries and remove a prior exclusion.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Expanded blog docs to show broader Web Request/Response runtime
compatibility, explicitly including Edge Functions, Vercel Functions,
and Cloudflare Workers.
* Added runtime-specific examples and dependency declaration guidance.
* Updated FAQ to clarify framework support (beyond Hono) and to broaden
wording around agentic coding tools receiving full API context.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<img width="1244" height="1146" alt="CleanShot 2026-05-07 at 17 07 32"
src="https://github.com/user-attachments/assets/475cce46-a066-4a8b-a0e0-82261e1e4e73"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Improvements**
* Public key display in JWT key details now shows a pretty-printed JWKS
(JSON Web Key Set) with updated JWKS-oriented labeling.
* The key textarea is wrapped in a positioned container for improved
layout and readability.
* **New Features**
* Added an overlaid Copy button labeled “Copy JWKS” to copy the
displayed JWKS directly from the key details view.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Chris Chinchilla
