Files
supabase/apps/studio/routes/__root.tsx
Kody JacksonandIvan Vasilov 6572fad288 fix(studio / ui) - update xss vuln version of tanstack (#51141)
## Problem

When I bumped the pnpm-lock file in an unrelated KB fix (#51132), I
believe that refreshed the build cache (either that, or Vercel started
flagging this issue very recently).

At any rate, builds are now failing b/c of a [vulnerable
Tanstack/react-start
package](https://github.com/TanStack/router/security/advisories/GHSA-qx66-fv34-fjm8),
which this PR attempts to fix.

```
The build blocks vulnerable @tanstack/react-start@1.168.18 due to an XSS security check.
```

<img width="1355" height="397" alt="image"
src="https://github.com/user-attachments/assets/7d0d90fb-009c-4a0b-aadc-b526e0fcce0a"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Updated project maintenance settings and supporting TanStack package
versions.
* Improved error reporting so standard errors include their stack trace,
while other error values are logged directly.
  * No app features were added or removed.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
2026-10-02 00:42:12 +02:00

451 lines
17 KiB
TypeScript

/// <reference types="vite/client" />
import 'react-data-grid/lib/styles.css'
import '@/styles/code.css'
// Vite-only: defines @font-face for the custom fonts. The Next pipeline
// (pages/_app.tsx) loads these via next/font instead, so this import has no
// counterpart there — but dropping it under Vite makes the browser fall back
// to system fonts.
import '@/styles/fonts.css'
import '@/styles/graphiql-base.css'
import '@/styles/grid.css'
import '@/styles/globals.css'
import '@/styles/markdown-preview.css'
import '@/styles/monaco.css'
import '@/styles/react-data-grid-logs.css'
import '@/styles/reactflow.css'
import '@/styles/storage.css'
import '@/styles/stripe.css'
import '@/styles/ui.css'
import 'ui-patterns/ShimmeringLoader/index.css'
import * as Sentry from '@sentry/react'
import { TanStackDevtools } from '@tanstack/react-devtools'
import type { QueryClient } from '@tanstack/react-query'
import { ReactQueryDevtoolsPanel } from '@tanstack/react-query-devtools'
import {
ClientOnly,
createRootRouteWithContext,
HeadContent,
Outlet,
redirect,
Scripts,
type AnyRouter,
type ErrorComponentProps,
} from '@tanstack/react-router'
import { TanStackRouterDevtoolsPanel } from '@tanstack/react-router-devtools'
import {
FeatureFlagProvider,
getFlags,
TelemetryTagManager,
ThemeProvider,
useThemeSandbox,
} from 'common'
import dayjs from 'dayjs'
import customParseFormat from 'dayjs/plugin/customParseFormat'
import duration from 'dayjs/plugin/duration'
import relativeTime from 'dayjs/plugin/relativeTime'
import timezone from 'dayjs/plugin/timezone'
import utc from 'dayjs/plugin/utc'
import { DevToolbar, DevToolbarProvider, DevToolbarTrigger, type ExtraTab } from 'dev-tools'
import {
lazy,
Suspense,
useCallback,
useEffect,
type ComponentProps,
type ErrorInfo,
type ReactNode,
} from 'react'
import { ErrorBoundary } from 'react-error-boundary'
import { TooltipProvider } from 'ui'
import { TimestampInfoProvider } from 'ui-patterns/TimestampInfo'
import { AppearanceSettingsProvider } from '@/components/interfaces/App/AppearanceSettingsProvider'
import { StudioCommandMenu } from '@/components/interfaces/App/CommandMenu'
import { StudioCommandProvider as CommandProvider } from '@/components/interfaces/App/CommandMenu/StudioCommandProvider'
import { FeaturePreviewContextProvider } from '@/components/interfaces/App/FeaturePreview/FeaturePreviewContext'
import { FeaturePreviewModal } from '@/components/interfaces/App/FeaturePreview/FeaturePreviewModal'
import { IndirectTaxDeclarationModal } from '@/components/interfaces/App/IndirectTaxDeclarationModal'
import { MonacoThemeProvider } from '@/components/interfaces/App/MonacoThemeProvider'
import { RouteValidationWrapper } from '@/components/interfaces/App/RouteValidationWrapper'
import { ShellFallback } from '@/components/interfaces/App/ShellFallback'
import { MainScrollContainerProvider } from '@/components/layouts/MainScrollContainerContext'
import { BannerStackProvider } from '@/components/ui/BannerStack/BannerStackProvider'
import { GlobalErrorBoundaryState } from '@/components/ui/ErrorBoundary/GlobalErrorBoundaryState'
import { GlobalShortcuts } from '@/components/ui/GlobalShortcuts/GlobalShortcuts'
import { useCustomContent } from '@/hooks/custom-content/useCustomContent'
import { useSelectedOrganizationQuery } from '@/hooks/misc/useSelectedOrganization'
import { AuthProvider } from '@/lib/auth'
import { configureMonacoLoader } from '@/lib/configure-monaco-loader'
import { API_URL, BASE_PATH, IS_PLATFORM, useDefaultProvider } from '@/lib/constants'
import { TimezoneProvider, useTimezone } from '@/lib/datetime'
import { splitInternalUrl } from '@/lib/internal-url'
// Custom adapter instead of `nuqs/adapters/tanstack-router` — the stock one
// injects a trailing slash before the query on every nuqs write (see module).
import { NuqsAdapter } from '@/lib/nuqs-tanstack-adapter'
import { ProfileProvider } from '@/lib/profile'
import { Telemetry } from '@/lib/telemetry'
import { ToastErrorTracker } from '@/lib/toast-errors'
import { Toaster } from '@/lib/toaster'
import Error404 from '@/pages/404'
import Error500 from '@/pages/500'
import { matchRedirect } from '@/redirects.shared'
import { AiAssistantStateContextProvider } from '@/state/ai-assistant-state'
dayjs.extend(customParseFormat)
dayjs.extend(utc)
dayjs.extend(timezone)
dayjs.extend(relativeTime)
dayjs.extend(duration)
interface RouterContext {
queryClient: QueryClient
}
const FeatureFlagProviderWithOrgContext = ({
children,
...props
}: ComponentProps<typeof FeatureFlagProvider>) => {
const { data: selectedOrganization } = useSelectedOrganizationQuery({ enabled: IS_PLATFORM })
const cloudProvider = useDefaultProvider()
const getConfigCatFlags = useCallback(
(userEmail?: string) => {
const customAttributes: Record<string, string> = {}
if (cloudProvider) customAttributes.cloud_provider = cloudProvider
if (selectedOrganization?.plan?.id) customAttributes.plan = selectedOrganization.plan.id
return getFlags(userEmail, customAttributes)
},
[cloudProvider, selectedOrganization?.plan?.id]
)
return (
<FeatureFlagProvider
{...props}
getConfigCatFlags={getConfigCatFlags}
organizationSlug={selectedOrganization?.slug ?? undefined}
>
{children}
</FeatureFlagProvider>
)
}
// Bridges the user's stored timezone preference into TimestampInfoProvider so
// dayjs.tz.setDefault runs app-wide (see @/lib/datetime).
const TimestampInfoTimezoneBridge = ({ children }: { children: ReactNode }) => {
const { timezone } = useTimezone()
return <TimestampInfoProvider timezone={timezone}>{children}</TimestampInfoProvider>
}
const IS_NON_PROD_ENV =
process.env.NEXT_PUBLIC_ENVIRONMENT === 'local' ||
process.env.NEXT_PUBLIC_ENVIRONMENT === 'staging'
// Mirrors the `MAINTENANCE_MODE` reads in `next.config.ts` and `vercel.ts`.
// The var is unprefixed, so vite.config.ts inlines it explicitly (see the
// define there) rather than it arriving via the NEXT_PUBLIC_ sweep — that
// keeps the toggle a single build-time env var across all three runtimes.
const IS_MAINTENANCE_MODE = process.env.MAINTENANCE_MODE === 'true'
// Keep dev-only components out of the production bundle.
const IS_DEV_TOOLBAR_ENABLED = IS_NON_PROD_ENV
const ResourceWarningsTab = IS_DEV_TOOLBAR_ENABLED
? lazy(() =>
import('@/components/ui/DevToolbar/ResourceWarningsTab').then((m) => ({
default: m.ResourceWarningsTab,
}))
)
: () => null
const ProjectStatusTab = IS_DEV_TOOLBAR_ENABLED
? lazy(() =>
import('@/components/ui/DevToolbar/ProjectStatusTab').then((m) => ({
default: m.ProjectStatusTab,
}))
)
: () => null
const devToolbarExtraTabs: ExtraTab[] = IS_DEV_TOOLBAR_ENABLED
? [
{
id: 'warnings',
label: 'Warnings',
content: (
<Suspense fallback={null}>
<ResourceWarningsTab />
</Suspense>
),
},
{
id: 'project-status',
label: 'Project Status',
content: (
<Suspense fallback={null}>
<ProjectStatusTab />
</Suspense>
),
},
]
: []
configureMonacoLoader()
// Non-prod (local + hosted staging) uses the white favicon, matching the Next
// build (pages/_app.tsx passes `/favicon/staging` to MetaFaviconsPagesRouter for
// non-prod). Uses the same synchronous NEXT_PUBLIC_ENVIRONMENT signal as
// IS_DEV_TOOLBAR_ENABLED above, so it works at module scope (the `head()` route
// option isn't a React component and can't run the async CLI check _app does).
const FAVICON_ROUTE = IS_NON_PROD_ENV ? '/favicon/staging' : '/favicon'
const THEME_COLOR = '1E1E1E'
const APPLICATION_NAME = 'Supabase Studio'
const APPLE_TOUCH_ICON_SIZES = [
'57x57',
'60x60',
'72x72',
'76x76',
'114x114',
'120x120',
'144x144',
'152x152',
]
// The 128 variant ships as `favicon-128.png` (no dimensions in the filename);
// the rest follow `favicon-<size>.png`.
const FAVICON_PNG_VARIANTS: Array<{ sizes: string; file: string }> = [
{ sizes: '16x16', file: 'favicon-16x16.png' },
{ sizes: '32x32', file: 'favicon-32x32.png' },
{ sizes: '48x48', file: 'favicon-48x48.png' },
{ sizes: '96x96', file: 'favicon-96x96.png' },
{ sizes: '128x128', file: 'favicon-128.png' },
{ sizes: '180x180', file: 'favicon-180x180.png' },
{ sizes: '196x196', file: 'favicon-196x196.png' },
]
function buildRootHead() {
const meta: Array<Record<string, string>> = [
{ charSet: 'utf-8' },
{ name: 'viewport', content: 'initial-scale=1.0, width=device-width' },
{ property: 'og:image', content: `${BASE_PATH}/img/supabase-og.png` },
{ name: 'googlebot', content: 'notranslate' },
{ name: 'application-name', content: APPLICATION_NAME },
{ name: 'msapplication-TileColor', content: `#${THEME_COLOR}` },
{ name: 'msapplication-TileImage', content: `${BASE_PATH}${FAVICON_ROUTE}/mstile-144x144.png` },
{
name: 'msapplication-square70x70logo',
content: `${BASE_PATH}${FAVICON_ROUTE}/mstile-70x70.png`,
},
{
name: 'msapplication-square150x150logo',
content: `${BASE_PATH}${FAVICON_ROUTE}/mstile-150x150.png`,
},
{
name: 'msapplication-wide310x150logo',
content: `${BASE_PATH}${FAVICON_ROUTE}/mstile-310x150.png`,
},
{
name: 'msapplication-square310x310logo',
content: `${BASE_PATH}${FAVICON_ROUTE}/mstile-310x310.png`,
},
{ name: 'theme-color', content: `#${THEME_COLOR}` },
{ title: 'Supabase' },
]
const links: Array<Record<string, string>> = [
// Fonts (Inter, Manrope, Source Code Pro) are all vendored via @font-face in
// styles/fonts.css — no Google Fonts CDN dependency at runtime, matching how
// next/font self-hosts them on the Next build (and keeping self-hosted/offline
// studio working).
...APPLE_TOUCH_ICON_SIZES.map((size) => ({
rel: 'apple-touch-icon-precomposed',
sizes: size,
href: `${BASE_PATH}${FAVICON_ROUTE}/apple-icon-${size}.png`,
})),
...FAVICON_PNG_VARIANTS.map(({ sizes, file }) => ({
rel: 'icon',
type: 'image/png',
sizes,
href: `${BASE_PATH}${FAVICON_ROUTE}/${file}`,
})),
{ rel: 'shortcut icon', href: `${BASE_PATH}${FAVICON_ROUTE}/favicon.ico` },
{ rel: 'icon', type: 'image/x-icon', href: `${BASE_PATH}${FAVICON_ROUTE}/favicon.ico` },
{ rel: 'apple-touch-icon', href: `${BASE_PATH}${FAVICON_ROUTE}/favicon.ico` },
{ rel: 'manifest', href: `${BASE_PATH}${FAVICON_ROUTE}/manifest.json` },
]
if (IS_PLATFORM) {
links.unshift({
rel: 'preconnect',
href: new URL(API_URL).origin,
crossOrigin: 'use-credentials',
})
}
return { meta, links }
}
function DynamicTitle() {
const { appTitle } = useCustomContent(['app:title'])
if (!appTitle) return null
return <title>{appTitle}</title>
}
const errorBoundaryHandler = (error: Error, _info: ErrorInfo) => {
Sentry.withScope(function (scope) {
scope.setTag('globalErrorBoundary', true)
const eventId = Sentry.captureException(error)
// Attach the Sentry event ID to the error object so it can be accessed by the error boundary
if (eventId && error && typeof error === 'object') {
;(error as Error & { sentryId?: string }).sentryId = eventId
}
})
console.error(error.stack)
}
function NotFound() {
return <Error404 />
}
function ErrorBoundaryRoute({ error }: ErrorComponentProps) {
// Mirrors `errorBoundaryHandler` above (used by the in-tree
// `react-error-boundary`) — TanStack's `errorComponent` covers
// errors thrown during route load/render before the in-tree
// boundary mounts, so we report from both layers.
useEffect(() => {
Sentry.withScope((scope) => {
scope.setTag('routerErrorComponent', true)
const eventId = Sentry.captureException(error)
if (eventId && error && typeof error === 'object') {
;(error as Error & { sentryId?: string }).sentryId = eventId
}
})
console.error(error instanceof Error ? error.stack : error)
}, [error])
return <Error500 />
}
export const Route = createRootRouteWithContext<RouterContext>()({
head: buildRootHead,
// Mirrors the redirect rules in `next.config.ts` / `vercel.ts`. Vercel's
// edge layer already handles these for the platform deploy; this is the
// self-hosted (Node-server) fallback and the client-side safety net.
beforeLoad: ({ location }) => {
const match = matchRedirect({
pathname: location.pathname,
search: location.search as Record<string, string | string[] | undefined>,
isPlatform: IS_PLATFORM,
maintenanceMode: IS_MAINTENANCE_MODE,
hash: location.hash,
})
if (!match) return
// `to`/`search`/`hash`, never `href`: the router treats `href` as an
// opaque (external) target, and preloading a Link whose beforeLoad
// throws `redirect({ href })` recurses forever — the preload retry
// rebuilds the origin location and re-runs this beforeLoad
// (https://github.com/TanStack/router/issues/7141). `to` is also
// basepath-relative, so no manual BASE_PATH prefix. The explicit
// `search`/`hash` fallbacks clear the incoming values rather than
// inherit them — `preserveQueryAndHash` already merged what carries over.
const { to, search, hash } = splitInternalUrl(match.destination)
throw redirect<AnyRouter, string>({
to,
search: search ?? {},
hash: hash ?? '',
statusCode: match.permanent ? 308 : 307,
})
},
component: RootComponent,
shellComponent: RootDocument,
notFoundComponent: NotFound,
errorComponent: ErrorBoundaryRoute,
})
function RootComponent() {
useThemeSandbox()
return (
<ErrorBoundary FallbackComponent={GlobalErrorBoundaryState} onError={errorBoundaryHandler}>
<NuqsAdapter>
<AuthProvider>
<FeatureFlagProviderWithOrgContext API_URL={API_URL} enabled={IS_PLATFORM}>
<ProfileProvider>
<TimezoneProvider>
<TimestampInfoTimezoneBridge>
<DynamicTitle />
<TooltipProvider>
<RouteValidationWrapper>
<ThemeProvider>
<DevToolbarProvider apiUrl={API_URL}>
<AiAssistantStateContextProvider>
<CommandProvider>
<BannerStackProvider>
<FeaturePreviewContextProvider>
<MainScrollContainerProvider>
<ClientOnly fallback={<ShellFallback />}>
<Outlet />
</ClientOnly>
</MainScrollContainerProvider>
<GlobalShortcuts />
<StudioCommandMenu />
<FeaturePreviewModal />
<IndirectTaxDeclarationModal />
</FeaturePreviewContextProvider>
</BannerStackProvider>
<Toaster />
<ToastErrorTracker />
<MonacoThemeProvider />
<AppearanceSettingsProvider />
</CommandProvider>
</AiAssistantStateContextProvider>
<DevToolbar extraTabs={devToolbarExtraTabs} />
<DevToolbarTrigger />
</DevToolbarProvider>
</ThemeProvider>
</RouteValidationWrapper>
</TooltipProvider>
<Telemetry />
</TimestampInfoTimezoneBridge>
</TimezoneProvider>
</ProfileProvider>
</FeatureFlagProviderWithOrgContext>
</AuthProvider>
</NuqsAdapter>
<TelemetryTagManager />
</ErrorBoundary>
)
}
function RootDocument({ children }: Readonly<{ children: ReactNode }>) {
return (
// suppressHydrationWarning is for next-themes: it writes data-theme and
// color-scheme onto <html> from localStorage pre-hydration, which the
// prerendered shell can't know. Scoped to this element only.
<html lang="en" suppressHydrationWarning>
<head>
<HeadContent />
</head>
<body>
{children}
<TanStackDevtools
config={{ position: 'bottom-right' }}
plugins={[
{
name: 'TanStack Router',
render: <TanStackRouterDevtoolsPanel />,
},
{
name: 'TanStack Query',
render: <ReactQueryDevtoolsPanel />,
},
]}
/>
<Scripts />
</body>
</html>
)
}