Makes knip a CI gate for Studio so dead files and unused dependencies
fail the PR instead of piling up. Third PR in the stack, on top of
#49719 (dead code) and #49720 (unused deps), which get Studio to a clean
run.
**Changed:**
- knip `pnpx knip@~5.50.0` → root devDependency `knip@6.32.3`, `pnpm
knip` now runs it. The old `pnpx` form was actually broken: it resolved
knip's `typescript` peer to TS 7 and crashed with
`ts.getDefaultLibFilePath is not a function`. (6.33.0 is newer but
blocked by `minimumReleaseAge`.)
- `knip.jsonc` rewritten for v6 with a `workspaces["apps/studio"]`
block. Framework-convention files (`router.tsx`, `start.ts`,
`routes/**`, `compat/**`, `api/server.js`) are `entry` rather than
`ignore` — an ignored file's imports aren't traced, which is how
`ShellFallback.tsx` (only imported from `routes/__root.tsx`) was being
reported as dead. knip 6's Next.js plugin already covers
`instrumentation*.ts`, `proxy.ts`, `pages/**`; its tanstack-router
plugin only looks under `src/`, hence the manual entries. Narrow
`ignoreIssues` for graphql-codegen output and the `CONSTRAINT_TYPE`
enum; `ignoreDependencies` for the five implicit deps from #49720, each
with a comment; `ignoreBinaries: ["vercel"]`.
- `apps/studio/CLAUDE.md`: one bullet on the gate and where framework
files go.
**Added:**
- `.github/workflows/studio-knip.yml` — path-filtered to
`apps/studio/**` + knip/pnpm config, mirrors `studio-lint-ratchet.yml`'s
setup (no sparse checkout: knip needs every workspace's `package.json`
to resolve the graph). Runs `pnpm knip --workspace apps/studio
--reporter symbols --reporter github-actions` so findings show up as
inline PR annotations. ~5s locally.
Scope notes: the gate is Studio-only — the full-monorepo run still has
~400 dead files in `www`/`docs`/`blocks`, which is a separate effort.
`exclude: ["types", "exports"]` is kept, so unused exports aren't gated
yet, but `enumMembers`/`duplicates` are (they caught real things in
#49719).
## To test
- `pnpm knip --workspace apps/studio` exits 0 on this branch
- The `Studio Dead Code (knip)` workflow runs on this PR and is green
- Sanity-check the gate bites: add a throwaway
`apps/studio/lib/unused.ts`, run `pnpm knip --workspace apps/studio` →
reports it and exits 1
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **CI**
* Added automated dead-code and unused-dependency checks for the Studio
workspace on relevant pushes and pull requests.
* Results appear in workflow summaries and as inline pull request
annotations.
* **Maintenance**
* Improved analysis of framework-convention files and Studio code.
* Standardized the local code-quality check and updated its
configuration support.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Removes the Studio dependencies knip reports as unused, and declares one
it reports as unlisted. Second PR in the stack (on top of #49719,
followed by #49721 which adds the CI gate).
**Removed:**
- `@ai-sdk/provider`, `@ai-sdk/provider-utils` — zero references
- `eslint-plugin-jsx-a11y` — the `jsx-a11y/*` rules resolve through the
plugin registered by `eslint-config-next` (via
`eslint-config-supabase/next`); verified 259 a11y warnings still fire
after removal
- `common`, `config` from `devDependencies` — duplicates of the
`dependencies` entries
**Added:**
- `@tailwindcss/postcss` as a Studio devDependency —
`apps/studio/postcss.config.cjs` loads it (through
`config/postcss.config`), but only `packages/config` declared it, so
under pnpm's strict isolation it was never resolvable from Studio's own
`node_modules`
**Kept deliberately** (nothing imports them by a specifier knip can
follow, but removing them breaks things — they get `ignoreDependencies`
entries in #49721): `lodash-es` (string-resolved in `vite.config.ts`),
`raw-loader` (loader string in `next.config.ts`), `import-in-the-middle`
/ `require-in-the-middle` (Sentry/OTel runtime hooks, #35030),
`@babel/core` (resolution pin, #45876).
Heads-up on the lockfile: ~500 of the lines are pnpm re-resolving
`apps/www`'s stale auto-installed vitest peer from `vite@6.4.3` →
`8.2.1` (www doesn't depend on vite directly; Studio already runs vitest
on vite 8). Any dependency change triggers it — not specific to this PR.
## To test
- `pnpm install --frozen-lockfile` succeeds
- `pnpm dev:studio` — Tailwind styles still apply (the postcss plugin
now resolves from Studio)
- `pnpm lint --filter=studio` still reports `jsx-a11y/*` warnings, no
"Definition for rule not found"
- `pnpm --filter www test` (www's vitest now runs on vite 8)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Studio’s development tooling configuration.
* Removed unused package dependencies and development tools.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
## What kind of change does this PR introduce?
Bug fix. Resolves DEPR-657.
## What is the current behavior?
The Fast database reboot description suggests the action may fail to
recover from some failure modes, which can be read as a risk of the
reboot itself.
## What is the new behavior?
The description clearly explains that the faster option restarts only
the database service, has less downtime than a full project restart, and
leaves other project services running.
| Before | After |
| --- | --- |
| <img width="1460" height="512" alt="CleanShot 2026-08-31 at 09 24
49@2x"
src="https://github.com/user-attachments/assets/2d4a940c-4d66-4753-99d8-9d0d2b4951af"
/> | <img width="1458" height="500" alt="CleanShot 2026-08-31 at 09 31
18@2x"
src="https://github.com/user-attachments/assets/f58aa351-5c8c-4a9a-b31d-b771659defd3"
/> |
## To test
1. Open a project's **Settings > General** page.
2. Under **Project availability**, tab to **Restart project**, then tab
again to the adjacent chevron button.
3. Press Enter and confirm focus moves to **Fast database reboot**.
4. Confirm its description reads: “Restarts only the database service,
with less downtime than a full project restart. Other project services
remain running.”
5. Confirm the project availability descriptions appear as secondary
text beneath their action labels.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Accessibility Improvements**
* Improved keyboard navigation with separate tab stops for restart
actions and restart-type selection.
* Added clearer labeling and focus behavior when choosing a restart
type.
* **UI Improvements**
* Clarified that fast database restarts affect only PostgreSQL while
other services continue running.
* Improved text contrast on the project settings page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Removes Studio code that nothing imports, as reported by knip. First PR
in a stack of three: this one is pure deletions, #49720 removes the
unused dependencies, #49721 upgrades knip and adds the CI gate so this
doesn't accumulate again.
Every file was verified with a repo-wide grep for its basename, exported
symbols, and string/dynamic imports before deletion — none are reachable
via `next/dynamic`, a barrel file, or a config.
**Removed:**
-
`Billing/Usage/UsageWarningAlerts/{CPU,RAM,DiskIOBandwidth}Warnings.tsx`
(whole directory)
- `DataWarehouse/FormFooterChangeBadge.tsx` (whole directory)
- `Database/Replication/ReplicationDiagram/EmptyReplicationDiagram.tsx`
- `Integrations/Vercel/OrganizationPicker.tsx`
- `QueryInsights/QueryInsightsTable/QueryInsightsTableRow.tsx`
- `hooks/misc/useTrackExperimentExposure.ts`
- `data/ai/{parse-client-code,sql-policy}-mutation.ts`,
`data/misc/parse-query-mutation.ts`,
`data/database/table-check-rls-mutation.ts`
-
`data/notifications/notifications-v2-{archive-all-mutation,summary-query}.ts`
+ their two now-unused keys in `notifications/keys.ts` (`listV2` kept)
-
`data/platform-apps/platform-app-{update,signing-key-delete}-mutation.ts`
- `DateTimeFormats.DATE_ONLY` and the unused
`Notebooks.{MarkdownCell,LogCell,ChartConfig}` types
**Changed:**
- `ReportPadding` no longer has a duplicate default export; its 9
default importers (observability pages) now use the named export
Not removed: `CONSTRAINT_TYPE`'s unused members mirror the closed set of
`pg_constraint.contype` values, so they're documentation rather than
dead code — suppressed narrowly in #49721's knip config instead.
## To test
- `pnpm --filter studio run typecheck` and `lint:ratchet` pass
- Observability pages (`/project/[ref]/observability/*`) still render
with padding — they're the only code touched, via the `ReportPadding`
import change
- Notifications popover still loads and marks-as-read (the removed keys
weren't used for invalidation)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Removed Features**
- Removed CPU, memory, and disk usage warning alerts.
- Removed the Vercel organization picker and empty replication diagram.
- Removed query insights row actions and several SQL assistance tools.
- Removed notification summary and archive-all capabilities.
- Removed platform app update and signing-key deletion actions.
- Removed the form change-count badge and experiment exposure tracking.
- **Refactor**
- Updated observability reports to use the revised report layout export.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
## What kind of change does this PR introduce?
Bug fix for
[DEPR-658](https://linear.app/supabase/issue/DEPR-658/fix-clipped-v0-and-langchain-logos-in-safari).
## What is the current behavior?
Inline publicity logos reuse the same SVG clip-path ID. Safari can
resolve v0 and LangChain against another logo's clipping rectangle,
causing the artwork to appear cropped or letterboxed.
## What is the new behavior?
Each publicity logo uses a namespaced clip-path ID. A focused regression
test verifies that SVG IDs are unique and every `url(#...)` reference
has a matching definition.
| Figure |
| --- |
| Before |
| <img width="2200" height="388" alt="CleanShot 2026-08-31 at 09 58
44@2x"
src="https://github.com/user-attachments/assets/99ef02e4-e436-4155-880a-6291364ea4cd"
/> |
| After |
| <img width="2196" height="370" alt="CleanShot 2026-08-31 at 09 58
00@2x"
src="https://github.com/user-attachments/assets/d36a9b83-737b-47f1-9f12-a110b3c82f23"
/> |
## To test
1. Open the deploy preview homepage in Safari.
2. Scroll to “Trusted by fast-growing companies worldwide”.
3. Confirm the v0 and LangChain logos are fully visible and the other
publicity logos are unchanged.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix
## What is the current behavior?
When a cell gets moved via `move_cell` operation in
`deriveNotebookDiff`, the `insertedAfter` offset map is not cleared for
that anchor cell. This causes later `insert_cell` operations anchored on
the same (now-moved) cell to apply the stale offset on top of the
correct current-position lookup, resulting in the new cell landing after
the wrong position.
## What is the new behavior?
The offset for an anchor cell is now cleared from `insertedAfter` when
it gets moved, since cells previously inserted after it stay behind at
its old location and should not affect subsequent inserts at its new
position.
A regression test has been added that reproduces the exact ticket
scenario (insert after cell-1, move cell-1 after cell-3, insert after
cell-1 again) and verifies the correct final cell order.
## Additional context
Fixes:
https://linear.app/supabase/issue/FE-4308/insert-anchored-to-a-previously-moved-cell-lands-after-the-wrong-cell
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed notebook cell insertions after moving an anchor cell, ensuring
new inserts appear relative to the anchor’s updated position.
* Preserved the placement of inserts made before the anchor cell was
moved.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
There is no point in trying to wake up a project that is not
`ACTIVE_HEALTHY` as it will always fail.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved project wake-up behavior by limiting automatic wake-ups to
hibernating projects with a healthy active status.
* Prevented unnecessary wake-up attempts for projects in other states.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
As per PR title - just disables the analyze button if the notebook is
empty
<img width="1077" height="323" alt="image"
src="https://github.com/user-attachments/assets/f8da8bd4-eb0c-43ae-85c7-b60c1c7dcfed"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Disabled the Analyze action for empty notebooks.
* Added guidance prompting users to add a cell before starting analysis.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context
Adds a "Save" action for query tabs in the explorer, which opts for 2
options to either add to an existing notebook, or create a new notebook.
Both of these actions just opens the notebook in a new tab with unsaved
changes - the changes will only be persisted in the DB when the user
hits "Save" on the notebook.
For adding to an existing notebook, the snippet will be appended to the
bottom of the notebook - UI will scroll to the bottom after navigating
to the notebook.
<img width="469" height="368" alt="image"
src="https://github.com/user-attachments/assets/19d16940-89e2-4d10-b71e-8d501f749668"
/>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Feature (self-hosted Edge Functions)
## What is the current behavior?
The self-hosted Edge Functions router
(`docker/volumes/functions/main/index.ts`) doesn't tell a function which
slug a request resolved to. As a result, `@supabase/server`'s
`withOAuthProtectedResource` can't derive its canonical resource URL and
falls back to reconstructing it from the request path against the
internal `api-gw` origin, so the advertised OAuth Protected Resource is
/wrong for self-hosted deployments.
## What is the new behavior?
`main/index.ts` now injects `SUPABASE_FUNCTION_SLUG: service_name` per
request (after the `Deno.env.toObject()` snapshot, so nothing in the
container env can shadow it).
Combined with the operator's `SUPABASE_PUBLIC_URL`, the advertised
resource is the correct external
`{SUPABASE_PUBLIC_URL}/functions/v1/{slug}`, not the internal
`http://api-gw:8000`.
Verified on the docker stack: the slug is injected per-function, the
resource origin resolves to `SUPABASE_PUBLIC_URL`, and the `401`
`www-authenticate` carries the right `resource_metadata`.
## Additional context
Fixes AI-1128
Companion to `@supabase/server` [PR
#117](https://github.com/supabase/server/pull/117) and the [CLI slug
injection](https://github.com/supabase/cli/pull/6345)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Edge workers now receive the correct function slug in their runtime
environment, improving per-function request handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
For Multigres (HA) projects you can't connect to read replicas directly
— reads go through a read-only load balancer on the primary's host at
port 5433. Since #44695 stripped the pooler UI, HA projects showed no
source option at all in the Connect dialog and still prompted for the
IPv4 add-on. This surfaces it as a first-class, clearly-labeled
read-only source. In the UI it's labeled `Replica (read-only)` rather
than "load balancer" — the primary goes through the same gateway, so
"load balancer" would be confusing from a product perspective
(internally the `load-balancer` source identifier and
`HIGH_AVAILABILITY_LOAD_BALANCER_PORT` constant keep their names).
<img width="883" height="342" alt="Screenshot 2026-08-24 at 11 32 26 PM"
src="https://github.com/user-attachments/assets/3716f6dd-0325-4b9d-adbc-9ece9244de62"
/>
**Added:**
- Source select for HA projects in the Direct tab: `Primary database` +
`Replica (read-only)` (individual replica rows are filtered out —
they're only reachable via the load balancer)
- Replica (load balancer) connection strings on all 9 connection types:
primary host, port `5433`, with the Multigres-required
`sslmode=require&sslnegotiation=direct` params (JDBC gets the
`sslNegotiation` spelling, .NET gets `SSL Negotiation=Direct`)
- `Read-only` badge on the connection code block + note pointing writes
at the primary
- Programmatic labels for the ConnectSheet select/switch/multi-select
fields (the Source combobox previously had no accessible name)
**Changed:**
- The generated-file step (Node.js/Golang/.NET/Python/SQLAlchemy) is now
source-aware — it previously ignored the Source selection entirely (also
affected read replicas on normal projects) and silently rendered the
primary's connection info
- .NET template now emits `Port=` (Npgsql defaults to 5432 when omitted)
and the install step actually installs Npgsql (pinned 9.0.5 — `SSL
Negotiation` requires 9+)
- SQLAlchemy `DATABASE_URL` merges `sslmode=require` into the string's
existing query params instead of a hardcoded suffix that could drop TLS
- Source option labels normalized to sentence case (`Primary database`,
`Read replica (…)`)
- `MultipleCodeBlock` (ui-patterns) accepts an optional `className`
- HA coercion in `useConnectState` extended: a stale replica
`connectionSource` restored from URL/localStorage falls back to the
primary
**Removed:**
- IPv4 add-on admonition for HA projects (the forced-direct method was
tripping it; the add-on doesn't apply to Multigres)
Out of scope (needs platform work): SQL editor / Data API / other
`DatabaseSelector` surfaces — executing against the load balancer
requires a platform-issued connection string, and the load-balancers API
only returns a REST endpoint today. The `5433` port is a client-side
constant (`HIGH_AVAILABILITY_LOAD_BALANCER_PORT`) until the API exposes
it.
## To test
On an HA (Multigres) project:
- Open Connect → Direct: Source shows exactly `Primary database` and
`Replica (read-only)`; selecting the replica shows
`…@<primary-host>:5433/postgres?sslmode=require&sslnegotiation=direct`,
a `Read-only` badge, and the read-only note
- Cycle all 9 connection types with the replica selected — every snippet
carries port 5433 (`.NET` includes `Port=5433;…;SSL
Negotiation=Direct`), badge/note persist
- No "Enable IPv4 add-on" admonition anywhere in the Direct tab
- Switch tabs / hard-reload: source resets to primary with no stale
badge/string combos
On a normal project:
- Direct tab unchanged: no `Replica (read-only)` option, pooler badges
and IPv4 admonitions behave as before, `.NET` now shows `Port=5432` and
no `SSL Negotiation`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Added read-only load-balancer connection options for high-availability
projects.
- Added .NET and SQLAlchemy connection examples with required SSL
settings.
- Added clear read-only labels and notices explaining write
restrictions.
- **Bug Fixes**
- Suppressed IPv4 add-on notices for high-availability connections.
- Improved connection-source selection and restored-setting handling.
- Improved connection form identification and accessibility.
- **Style**
- Added customizable styling support for multi-code-block displays.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
## What kind of change does this PR introduce?
Docs update.
## What is the new behavior?
The branching docs now state consistently that every branch, preview or
persistent, is created as a clone of the base project, starting with
that project's schema, Edge Functions, and configuration. Data and
storage objects are not cloned by default.
## Additional context
This documents new branch-creation behavior. Two automated reviewers
flagged the clone wording and argued for a migration-replay description;
that reflects the previous implementation, so their findings don't apply
here and the clone framing stands.
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Jeremias Menichelli <jmenichelli@gmail.com>
## What
The worker detail page at `/project/[ref]/workers/[name]`, reading `GET
/v2/projects/{ref}/workers/{name}`. Base: #49194.
## How to test
Only on the **Mockamaster** project in staging — it is the one project
in the alpha allow-list.
1. Staging dashboard → Mockamaster → **Workers** → click
`dashboard-test`
2. Overview: instances read 1 declared / 1 live / 1 ready / 0 stale, no
error alerts
3. Settings: Deno 2, `denoland/deno:latest`, 2 GB · 1 vCPU, private, US
West (locked)
4. **How to call** in the header → the snippets name the real worker URL
No write actions. Delete (FE-4190) is deliberately out.
Closes FE-4189
Closes FE-4197
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added worker detail pages with overview, requests, logs, builds, and
settings tabs.
* Added worker metadata, runtime details, invocation examples, and local
development commands.
* Added worker log streams with refresh, row selection, loading, empty,
and error states.
* Added worker-specific log formatting and clearer instance status
information.
* **Documentation**
* Updated migration tracking to mark the worker route as complete.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Agent-readiness scanners and agent fetchers look for an OpenAPI spec at
conventional same-origin paths, but the Management API spec is only
served on api.supabase.com and linked from the /.well-known/api-catalog
linkset, which scanners do not read. I added a rewrite so
supabase.com/openapi.json proxies the spec from its source of truth at
api.supabase.com/api/v1-json, using the same fall-through proxy
mechanism as /humans.txt and /evals.
**Note:** no cache or CORS headers on purpose: no consumer needs them
today, and the upstream response's set-cookie header defeats edge
caching regardless. I rejected a checked-in copy of the spec in favor of
proxying live (staleness). The /.well-known/api-catalog linkset already
points at the spec (PR #44880) and is untouched here; this PR only adds
the conventional same-origin path.
**Merge order:** merge only after supabase/platform#37571 deploys. The
spec currently ships `servers: []`, so OpenAPI consumers resolve
relative paths against the fetch origin; without the platform fix this
proxy would point spec-compliant clients at supabase.com/v1/*.
## To test
Tested on Vercel preview:
- [x] `curl -s https://<preview-url>/openapi.json | head -c 40` returns
`{"openapi":"3.0.0"`
- [x] `curl -sI https://<preview-url>/openapi.json` returns 200 with
`content-type: application/json`
- [x] `curl -sI https://<preview-url>/humans.txt` returns 200 (control:
rewrite fall-through chain intact)
## Linear
- fixes GROWTH-1138
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added access to the OpenAPI specification at `/openapi.json`.
* Requests are automatically routed to the API specification endpoint.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Aleksi Immonen <aleksi@supabase.io>
## What kind of change does this PR introduce?
UI clarity improvement for the current pipeline creation sheet.
## What is the current behavior?
All destination types appear under a generic Pipelines heading, with
release-stage badges repeated beside each option.
## What is the new behavior?
Destination types are grouped under Public Alpha, Early Access, and
Deprecated headings. The selected value stays compact, while its
release-stage guidance remains below the field.
| Before | After |
| --- | --- |
| <img width="1280" height="750" alt="CleanShot 2026-08-28 at 15 45
29@2x"
src="https://github.com/user-attachments/assets/5be32928-21fa-4911-bc68-3376c068703f"
/> | <img width="1280" height="888" alt="CleanShot 2026-08-28 at 15 44
49@2x"
src="https://github.com/user-attachments/assets/2046d174-dd4f-41f1-98da-3d8d48af8a1c"
/> |
## To test
1. Open a project, then go to Database → Replication and select Add
destination.
2. Open the Type selector.
3. Confirm available destinations are grouped by Public Alpha, Early
Access, and Deprecated.
4. Select BigQuery and confirm the field still explains that it is in
public alpha.
5. Edit an existing destination and confirm the Type selector remains
disabled.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **UI Improvements**
* Destination options are now organized into clear release-stage groups:
Public Alpha, Early Access, and Deprecated.
* Added group headings and separators to make destination selection
easier to scan.
* Removed individual stage badges from destination labels for a cleaner,
more consistent layout.
* **Tests**
* Updated coverage to verify grouping and visibility across supported
destination types.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Feature improvement for BigQuery pipeline creation and editing.
## What is the current behavior?
Users must paste the complete service-account JSON into a text area.
## What is the new behavior?
Users can paste, upload, or drag and drop a service-account JSON file.
Imported credentials remain editable, and unreadable or oversized files
show an inline form error.
## To test
1. Open a project, then go to Database → Replication and select Add
destination.
2. Select BigQuery.
3. Under Service account key, select Upload JSON file and choose a
service-account `.json` file.
4. Confirm its contents appear in the editable text area.
5. Drag and drop a JSON file onto the same field and confirm it replaces
the contents.
6. Confirm pasting credentials manually still works.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for uploading BigQuery service account key JSON files.
* Added drag-and-drop support for service account key files.
* Updated guidance to clarify that keys can be pasted or uploaded.
* Constrained the service account key field to 5,000 characters.
* **Bug Fixes**
* Added clear validation when keys exceed the character limit.
* Improved handling of unreadable files while preserving the existing
key.
* Improved editing of imported service account key content.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
UI copy improvement for the current pipeline creation sheet.
## What is the current behavior?
Several pipeline fields use ambiguous labels or omit useful guidance.
Validation messages also use inconsistent punctuation.
## What is the new behavior?
- Explains how the pipeline name is used
- Clarifies invalidated replication slot behaviour
- Explains that BigQuery maximum staleness is optional
- Makes pipeline validation messages consistent
## To test
1. Open a project, then go to Database → Replication and select Add
destination.
2. Confirm Name explains that it identifies the pipeline in Supabase.
3. Expand Advanced settings and confirm Invalidated slot behaviour uses
Block startup and Recreate slot.
4. Select BigQuery and confirm Maximum staleness explains that leaving
it blank gives the freshest results.
5. Submit incomplete destination settings and confirm validation
messages end with full stops.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Replication slot behavior options now use clearer labels: “Block
startup” and “Recreate slot.”
* Added guidance explaining that the pipeline name identifies the
pipeline in Supabase.
* Improved the BigQuery maximum-staleness description and display.
* **Bug Fixes**
* Standardized replication destination validation messages with
consistent punctuation.
* Clarified the ClickHouse HTTPS validation message.
* Updated validation tests to reflect the improved error messages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Extract shared selectTriggerVariants CVA so SelectTrigger and
ComboboxTrigger stay in sync. Button now renders ComboboxTrigger for
default-variant combobox patterns without Studio callsite changes.
## Context
As per PR title - this behaviour currently exists in the SQL Editor so
just bringing it over to the Explorer, applies to both QueryTab and
QueryCell since they use the same QueryEditor component
"Run" button also updates to "Run selected" for clarity when a specific
portion of the code editor is selected
<img width="1387" height="958" alt="image"
src="https://github.com/user-attachments/assets/7e652951-3c07-4f8d-851b-bb9219d0c1f2"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Run only the selected SQL when text is highlighted in the query
editor.
* Run the full query when no text is selected.
* Updated the run button label and tooltip to reflect the action.
* **Bug Fixes**
* Improved query execution for empty or collapsed selections.
* Corrected selection state when reopening the query editor.
* **Tests**
* Added coverage for selected-text, full-query, and editor reopening
scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What kind of change does this PR introduce?
Feature (shared UI primitive).
## What is the current behavior?
No shared stepped wizard shell in Studio. Upcoming create-pipeline work
needs a reusable step container with header, progress, and
primary/secondary actions.
## What is the new behavior?
Adds `SteppedFlow` and `SteppedFlowHeader` with unit tests: step list,
current step content, next/back, optional first-step cancel, and header
actions slot.
No product callsite yet. Safe to merge on its own; the create-pipeline
wizard PR will consume it.
## To test
Code review + vitest:
```sh
cd apps/studio && pnpm exec vitest run components/ui/SteppedFlow/SteppedFlow.test.tsx
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a reusable stepped-flow interface with progress indicators and
step-specific content.
* Supports optional headers, actions, loading and disabled states,
forms, and configurable button types.
* Added navigation controls for moving forward, going back, cancelling,
and completing the flow.
* Supports customizable final actions.
* **Tests**
* Added coverage for navigation, cancellation, headers, optional
actions, final actions, and disabled states.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Content update to /pricing.
## What is the current behavior?
- The Enterprise plan card lists "BYO Cloud supported" as a feature.
- The Platform Security and Compliance comparison table has a separate
"BYO cloud" row (Enterprise-only), alongside an existing "AWS
PrivateLink" row.
## What is the new behavior?
- Enterprise plan card bullet changed to "Supports AWS PrivateLink".
- Removed the "BYO cloud" row entirely from the Platform Security and
Compliance comparison table (the AWS PrivateLink row already covers
this).
## Additional context
Data-only change in `packages/shared-data/plans.ts` and
`packages/shared-data/pricing.ts`. No component logic changed.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Updates**
* Enterprise plan details now highlight AWS PrivateLink support.
* Removed the BYO Cloud feature from the security feature listings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Wendie Cheung <wendie.cheung@supabase.io>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
## What kind of change does this PR introduce?
Content: slug update for an already-live customer story.
## What is the current behavior?
The Lingo.dev customer story (originally added in #49595) lives at
`/customers/lingo-dev`.
## What is the new behavior?
- Renames `apps/www/_customers/lingo-dev.mdx` to
`apps/www/_customers/lingodotdev.mdx`.
- Updates the `url` in `apps/www/data/CustomerStories.ts` to
`/customers/lingodotdev`.
- Adds a permanent redirect from `/customers/lingo-dev` to
`/customers/lingodotdev` in `apps/www/lib/redirects.js`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a customer story highlighting Lingo.dev’s localization workflow,
platform usage, security practices, results, and future plans.
* **Bug Fixes**
* Updated the customer story link to its new URL.
* Added a permanent redirect so existing links to the previous URL
continue to work.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Wendie Cheung <wendie.cheung@supabase.io>
| Before | After |
|--|--|
| <img width="1227" height="656" alt="Screenshot 2026-08-27 at 17 30 58"
src="https://github.com/user-attachments/assets/2c523708-d816-41c0-a401-a9502bb2d8e2"
/> | <img width="1227" height="654" alt="Screenshot 2026-08-27 at 17 29
45"
src="https://github.com/user-attachments/assets/0169faa3-5bf9-43c3-ad71-1b2343e95053"
/> |
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **UI Improvements**
* Restructured the edge function details header for a cleaner layout.
* Improved placement and behavior of breadcrumbs and actions, including
Docs, Download, and Test.
* Preserved existing navigation, download, testing, URL copying, and
timestamp functionality.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update — Postgres upgrade guide for the 15.19 / 17.11 minor
release.
## What is the current behavior?
The upgrade guide's caveats are tagged for 15.18 / 17.10.
## What is the new behavior?
- Retarget the ltree-reindex and custom-operator caveats: `15.18 or
17.10` → `15.19 or 17.11`.
- Replace the ltree detection query with an operator-class-based one
that also catches expression indexes and excludes `INCLUDE`d columns.
- Add a `btree_gist` caveat: `float4`/`float8` gist indexes that may
contain `NaN` need a `REINDEX` (upstream fixed NaN handling in
15.19/17.11).
- Note the separate ltree >~14,653-label overflow case
(encoding-independent).
- Use schema-qualified names in `REINDEX INDEX CONCURRENTLY` and note it
cannot run inside a transaction block.
Detection queries validated on real 15.19 and 17.11.
## Additional context
Refs: PSQL-1245. A pgcrypto (CVE-2026-14663) caveat is intentionally not
included here.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated upgrade guidance for PostgreSQL 15.19 and 17.11.
* Documented schema-qualified ltree index names and transaction-block
restrictions for reindexing.
* Improved the ltree overflow query to account for partial-index
predicates when identifying values exceeding approximately 14,653
labels.
* Added guidance for identifying and concurrently rebuilding affected
`btree_gist` floating-point indexes containing `NaN` values.
* Updated supported-version guidance for custom operator selectivity
estimators.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Danny White