Makes knip a CI gate for Studio so dead files and unused dependencies
fail the PR instead of piling up. Third PR in the stack, on top of
#49719 (dead code) and #49720 (unused deps), which get Studio to a clean
run.
**Changed:**
- knip `pnpx knip@~5.50.0` → root devDependency `knip@6.32.3`, `pnpm
knip` now runs it. The old `pnpx` form was actually broken: it resolved
knip's `typescript` peer to TS 7 and crashed with
`ts.getDefaultLibFilePath is not a function`. (6.33.0 is newer but
blocked by `minimumReleaseAge`.)
- `knip.jsonc` rewritten for v6 with a `workspaces["apps/studio"]`
block. Framework-convention files (`router.tsx`, `start.ts`,
`routes/**`, `compat/**`, `api/server.js`) are `entry` rather than
`ignore` — an ignored file's imports aren't traced, which is how
`ShellFallback.tsx` (only imported from `routes/__root.tsx`) was being
reported as dead. knip 6's Next.js plugin already covers
`instrumentation*.ts`, `proxy.ts`, `pages/**`; its tanstack-router
plugin only looks under `src/`, hence the manual entries. Narrow
`ignoreIssues` for graphql-codegen output and the `CONSTRAINT_TYPE`
enum; `ignoreDependencies` for the five implicit deps from #49720, each
with a comment; `ignoreBinaries: ["vercel"]`.
- `apps/studio/CLAUDE.md`: one bullet on the gate and where framework
files go.
**Added:**
- `.github/workflows/studio-knip.yml` — path-filtered to
`apps/studio/**` + knip/pnpm config, mirrors `studio-lint-ratchet.yml`'s
setup (no sparse checkout: knip needs every workspace's `package.json`
to resolve the graph). Runs `pnpm knip --workspace apps/studio
--reporter symbols --reporter github-actions` so findings show up as
inline PR annotations. ~5s locally.
Scope notes: the gate is Studio-only — the full-monorepo run still has
~400 dead files in `www`/`docs`/`blocks`, which is a separate effort.
`exclude: ["types", "exports"]` is kept, so unused exports aren't gated
yet, but `enumMembers`/`duplicates` are (they caught real things in
#49719).
## To test
- `pnpm knip --workspace apps/studio` exits 0 on this branch
- The `Studio Dead Code (knip)` workflow runs on this PR and is green
- Sanity-check the gate bites: add a throwaway
`apps/studio/lib/unused.ts`, run `pnpm knip --workspace apps/studio` →
reports it and exits 1
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **CI**
* Added automated dead-code and unused-dependency checks for the Studio
workspace on relevant pushes and pull requests.
* Results appear in workflow summaries and as inline pull request
annotations.
* **Maintenance**
* Improved analysis of framework-convention files and Studio code.
* Standardized the local code-quality check and updated its
configuration support.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
<!-- ccr-slack-attribution -->
_Requested by **Ivan Vasilov** · [Slack
thread](https://supabase.slack.com/archives/C063LNYJJKS/p1787058646458219?thread_ts=1787058646.458219&cid=C063LNYJJKS)_
**Before:** the root `package.json` pins the Supabase CLI at `supabase:
^2.76.10`, and `pnpm-lock.yaml` resolves it to `2.76.14`.
**After:** it pins `supabase: ^2.114.0`.
This bumps the Supabase CLI that `pnpm run e2e:setup:cli` and `pnpm run
setup:cli` shell out to, so local dev and the E2E workflows boot the
local stack with a CLI from this month instead of one from ~38 minor
releases ago.
**How:** a one-line version change to the `supabase` devDependency in
the root `package.json`. Nothing else in the repo changes — no workflow,
config, or test changes.
### ⚠️ This PR is incomplete: `pnpm-lock.yaml` still needs regenerating
`pnpm-lock.yaml` is **not** updated in this PR, so `pnpm install
--frozen-lockfile` will fail until someone runs:
```bash
pnpm install --lockfile-only
```
and pushes the result to this branch. The lockfile could not be
regenerated in the environment this PR was authored in: pnpm re-resolves
`apps/studio`'s `"@std/path": "npm:@jsr/std__path@^1.0.8"` on every
install, and `npm.jsr.io` is not reachable from there
(`ERR_PNPM_FETCH_403`). Treat this PR as needing one extra commit before
it can go green.
### Why `^2.114.0` and not `^2.115.0`
`2.115.0` is the current `latest` on npm, but it was published only
hours ago, and `pnpm-workspace.yaml` sets `minimumReleaseAge: 4320` (3
days) with `supabase` not in `minimumReleaseAgeExclude`. Pinning
`2.115.0` today would fail the repo's own supply-chain check. `2.114.0`
(2026-08-12) is the newest release that satisfies that policy.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Dependency bump. **Speculative** — this is an experiment, not a
confirmed fix.
## What is the current behavior?
The `Selfhosted Studio E2E Tests` workflow has been failing on `master`
at the `Start supabase` step. Recent runs:
- https://github.com/supabase/supabase/actions/runs/32092940311
- https://github.com/supabase/supabase/actions/runs/32131961447
In the Slack thread, Ivan Vasilov suggested trying a newer CLI and
Alaister Young endorsed giving it a go.
## What is the new behavior?
The workflow runs `supabase start` with CLI 2.114.0 instead of 2.76.14.
The question this PR is trying to answer is simply **"does a newer CLI
help this flake?"** It is not a diagnosis and not a claimed fix. If CI
still fails at `Start supabase` on this branch, the bump can be kept or
dropped on its own merits and the investigation continues elsewhere.
## Additional context
**Verification status:** none locally. The bump was not exercised
locally — this repo checkout has no `node_modules` (see the lockfile
note above), so `pnpm typecheck`, `pnpm lint`, and `pnpm test:studio`
were not run, and neither was `supabase start`. CI on this PR is the
only signal.
**Call-site compatibility check.** CLI 2.99/2.100 moved to a new
TypeScript shell with a stricter argument parser: command-specific flags
must now come *after* the subcommand. Both call sites in the root
`package.json` already use that order, so no script changes are needed:
```
supabase stop --all --no-backup --workdir ./e2e/studio
supabase start --exclude studio,mailpit --workdir ./e2e/studio
```
**Changelog entries between 2.76.14 and 2.114.0 that touch `supabase
start` or local config.** Listed so reviewers know what changed in the
range — **not** as a claim about what is failing in CI:
- **2.112.0** — `supabase start` no longer hangs when analytics
migrations fail; the analytics container exits and retries instead of
booting against an unmigrated database
([#6093](https://github.com/supabase/cli/pull/6093)).
- **2.112.0** — `supabase start` reuses existing volumes instead of
failing when they already exist
([#6037](https://github.com/supabase/cli/pull/6037)); Kong reloads after
`supabase db reset`
([#6017](https://github.com/supabase/cli/pull/6017)); custom auth email
templates survive `db reset`
([#6065](https://github.com/supabase/cli/pull/6065)); `supabase start`
works on SELinux-enforcing hosts
([#6000](https://github.com/supabase/cli/pull/6000)).
- **2.106.0 — behavior change worth watching.**
`[api].auto_expose_new_tables` now resolves to `false` when unset, and
local start/reset revokes default Data API privileges for newly created
`public` tables, sequences, and functions
([#5524](https://github.com/supabase/cli/pull/5524)). Neither
`supabase/config.toml` nor `e2e/studio/supabase/config.toml` sets this
key, so this default applies. If E2E specs create `public` objects and
then read them through the Data API, they may need explicit `GRANT`s
(the deprecated escape hatch is `auto_expose_new_tables = true`).
- **2.106.0** — when the CLI detects a coding-agent environment, or
`--agent yes` is passed, commands default to JSON output
([#5532](https://github.com/supabase/cli/pull/5532)). `e2e:setup:cli`
already passes `--output json` to `supabase status` explicitly, so this
should be a no-op here.
- **2.100.0** — stricter flag ordering, covered above.
- **2.112.0** — `functions deploy` no longer forwards `NPM_AUTH_TOKEN`
into Docker bundling
([#6005](https://github.com/supabase/cli/pull/6005)). Not used by these
workflows.
- **2.107.0** — pg-delta is the default schema diff engine for `db diff`
/ `db pull` on new projects
([#5511](https://github.com/supabase/cli/pull/5511)).
- Many bundled Docker image bumps across the range (`supabase/postgres`
17.6.1.087 → later patches, `postgres-meta`, `vector` 0.28.1 → 0.53.0,
Studio image), plus `fix(analytics): wait for logflare before starting
vector` (2.84.3) and `fix: use correct docker.sock binding with vector`
(2.84.7).
Full comparison:
https://github.com/supabase/cli/compare/v2.76.14...v2.114.0
---
_Generated by [Claude
Code](https://claude.ai/code/session_0143DrDMGnSSwuHebTPJv7ZY)_
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
Closes DOCS-1278
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Feature. Adds E2E test scaffolding and a CI check for the marketing
site.
## What is the current behavior?
Closes [FE-4047](https://linear.app/supabase/issue/FE-4047).
The marketing site has no E2E coverage. Docs has a suite in `e2e/docs`,
but its
runner, git helpers and axe reporting are private to that package, so a
second
site cannot reuse them.
## What is the new behavior?
* **A www suite scoped to changed content.** Changed `.mdx` files in
`_blog`,
`_events`, `_customers` and `_alternatives` map to the URLs they render.
Pages
with `disable_page_build: true` are skipped because they 404 by design.
Capped
at 20 pages. Enforces `heading-order` and `page-has-heading-one`,
matching docs.
* **`e2e/shared` The docs site is also static with similar needs. This
folder shares the docs logic with www.
* **A CI check that is safe to mark required.** Path scoping lives in a
`Detect changed paths` step rather than a `paths:` trigger, so the check
reports on every pull request instead of being skipped.
`waitForVercelDocsPreview.js` becomes `waitForVercelPreview.js`, shared
by both
workflows.
## How the check behaves
The job always reports a check run, so it is safe to mark required. Path
scoping
happens in a step rather than a `paths:` trigger, which would leave
non-www pull
requests waiting on a check that never reports.
| Case | Behavior |
| --- | --- |
| Fork pull request adds new pages | Passes without testing. The Vercel
wait is gated on `head.repo.full_name == github.repository`, so forks
resolve no preview URL. The job emits a `::warning` and a job summary
containing a ready-to-run `gh workflow run www-e2e.yml` command with the
resolved page paths, so a maintainer can run it against the preview. |
| Vercel preview times out or fails | Passes without testing. The wait
step is `continue-on-error: true`, so a 900s timeout or a failed
deployment leaves the URL unset and the suite skips. Vercel's own
`Vercel – zone-www-dot-com` check already reports the failure. |
| Draft pull request | Job does not run at all, gated at the job level
on `pull_request.draft == false`. `ready_for_review` is in the trigger's
`types`, so marking it ready runs the check. |
| Another app changed, www untouched | Job runs and every step skips.
The `www` filter matches only the four content directories, `e2e/www`,
`e2e/shared`, the lockfile, and this workflow. |
| Only the harness changed | Passes without testing. Scope resolves to
zero pages, and the Vercel wait is additionally gated on `www_app`, so
it does not wait for a preview Vercel skipped. |
| No preview resolves, any reason | Skips rather than falling back to
production. Production does not serve pages the pull request adds, so
testing it would fail a valid change. |
### Not covered
Changes to `apps/www` components and routes do not trigger this check —
only the
four content directories do. A follow-up can check global components
such as the navigation and the footer.
## Manual testing
1. Start the site: `pnpm dev:www`
2. Run `pnpm e2e:www` with no www content changed. It should resolve
zero pages
and skip Playwright, not fail.
3. Touch a post, then run `pnpm e2e:www` again:
`echo "" >> apps/www/_blog/2024-01-01-some-post.mdx`. The resolved
`/blog/...`
path should be listed before Playwright starts.
4. Run against production with no local server:
`PLAYWRIGHT_BASE_URL=https://supabase.com
WWW_E2E_PAGE_PATHS=/blog/postgres-language-server pnpm e2e:www`
5. Point step 4 at a page with a known heading problem. The failure
should name
the rule, the CSS selector and the markup.
6. Confirm docs still passes on the shared runner: `pnpm dev:docs`, then
`pnpm e2e:docs`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added WWW end-to-end testing for affected content pages, including
accessibility checks.
* Added standard and full-site test commands, configurable preview
testing, and failure reports.
* Added shared utilities for page discovery, accessibility scanning, and
test execution.
* **Documentation**
* Documented WWW test setup, coverage, debugging, CI behavior, and
running checks against production or preview environments.
* **Improvements**
* Updated documentation test workflows to better identify affected
changes and handle preview environments.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Closes DOCS-1233
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Test coverage. The docs accessibility check now covers the full WCAG 2.1
A/AA rule set instead of two rules.
**Note:** This PR tests _only_ the main article of changed pages
(meaning, the content itself). A follow-up Linear issue is to address
scanning the pieces outside of that: header, navigation, and interactive
elements.
## What is the current behavior?
The `@a11y` test in `e2e/docs` runs two axe rules against each in-scope
page, `heading-order` and `page-has-heading-one`. Both already pass
everywhere, so the check only guards a result we have. Nothing else in
WCAG A/AA is checked.
## What is the new behavior?
The same test runs the full WCAG 2.1 A/AA rule set.
- **Existing debt does not block PRs.** Only the two heading rules fail.
Everything else reports.
- **The check stays fast.** It scans the article only and skips nine
rules that cannot fire there. Scan time drops from 2405ms to 981ms.
- **Findings belong to us.** Legacy mode excludes cross-origin frames.
YouTube embeds were counting against us, 11 of 15 violations on one
page.
- **A pass carries meaning.** A 404 reports as a load failure, not an
a11y bug. A page scanned before it hydrates warns instead of quietly
reporting clean.
## How the findings appear
The test is named `has no blocking accessibility violations`, so a
failure listed by CI is always something to fix. It is not named for the
full rule set, because a green check would then claim more than the
check verifies.
| | Rules | Where you see it |
| --- | --- | --- |
| Blocking | `heading-order`, `page-has-heading-one` | Test failure, so
the runner reports it on the PR |
| Reported | Everything else in WCAG A/AA | `::warning` annotation on
the run |
An annotation looks like this, on a run that still passes:
```
::warning title=Accessibility::/docs/guides/database/functions has 1 non-blocking accessibility finding(s): frame-title (4)
```
The full axe result for each page is attached to the report as
`axe-results.json`.
## Matching the Studio ratchet
This follows the ESLint ratchet in `apps/studio`. That pattern warns on
pre-existing debt rather than blocking on it, surfaces findings as
annotations rather than PR comments, and promotes a rule to an error
once its violations reach zero.
The mechanism here is `ENFORCED_RULES` in `utils/axe-helpers.ts`. The
two heading rules are on it because the heading-hierarchy work drove
them to zero site-wide.
The intent is to migrate rules into that list one at a time. Pick a
rule, fix its violations, then move it into `ENFORCED_RULES` so it
cannot come back. An exhaustive scan of the site groups the current
backlog by root cause to sequence that work, and two fixes cover 99.1%
of it.
Studio keeps per-file baseline counts, which this does not. A whole-rule
list is coarser, and it works here because docs violations reach zero
across the site rather than per file.
## Manual testing
Install the browser once, then run each step from the repo root. Every
command scans production, so you do not need a local docs server.
```bash
pnpm -C e2e/docs exec playwright install chromium
```
1. Confirm a reported finding does not fail the check.
```bash
DOCS_E2E_PAGE_PATHS=/docs/guides/database/functions
PLAYWRIGHT_BASE_URL=https://supabase.com pnpm e2e:docs:a11y
```
Expect `1 passed`, and the `::warning` annotation above in the output.
2. Confirm the scan finds that violation. Same page, now failing on
every rule.
```bash
A11Y_ENFORCE_ALL=1 DOCS_E2E_PAGE_PATHS=/docs/guides/database/functions
PLAYWRIGHT_BASE_URL=https://supabase.com pnpm e2e:docs:a11y
```
Expect `1 failed`, reporting `frame-title (serious, 4 node(s))`. Steps 1
and 2 together are the point of this PR.
3. Confirm the skipped rules stay skipped.
```bash
A11Y_ENFORCE_ALL=1
DOCS_E2E_PAGE_PATHS=/docs/guides/getting-started/quickstarts/nextjs
PLAYWRIGHT_BASE_URL=https://supabase.com pnpm e2e:docs:a11y
```
Expect `button-name (critical, 2 node(s))` and `label (critical, 2
node(s))`, and no `color-contrast`.
4. Confirm a page that does not load reports a load failure.
```bash
DOCS_E2E_PAGE_PATHS=/docs/guides/does-not-exist-xyz
PLAYWRIGHT_BASE_URL=https://supabase.com pnpm e2e:docs:a11y
```
Expect `Expected a successful response for
/docs/guides/does-not-exist-xyz, got 404`, and no axe assertion.
5. Confirm the link checker still passes alongside the a11y test.
```bash
DOCS_E2E_PAGE_PATHS=/docs/guides/auth/passwords
PLAYWRIGHT_BASE_URL=https://supabase.com pnpm e2e:docs
```
Expect `3 passed`.
## Known gaps
- `/docs/reference/*` is not scanned. Those routes render client-side
into tens of thousands of elements, where axe exceeds its timeout and
results depend on whether the scan caught the page mid-render.
- Shared chrome is outside the article scope, so nav, sidebar, footer,
menus, and drawers are not covered.
- axe catches roughly 30-40% of WCAG issues. Keyboard navigation, focus
management, and screen reader behavior still need manual testing.
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Closes DOCS-1203
## Problem
The docs E2E workflow only ever tested one hardcoded page: the Next.js
quickstart. All other docs content had no E2E coverage.
## Solution
This PR expands the initial scaffolding to generalize the Next.js
quickstart tests, page runs and checks local links, to all pages
affecting Docs content:
- Add `resolveDocsScope` (`e2e/docs/utils/resolve-docs-scope.ts`) to map
changed guide and troubleshooting `.mdx` files to their `/docs/...` page
paths, and to expand changed `_partials` to every page that includes
them (including transitively, through partials nested inside other
partials). Federated guide sections (`graphql`,
`database/extensions/wrappers`, `ai/python`, `deployment/terraform`,
`deployment/ci`) and reference docs stay out of scope, and resolution is
capped at 20 pages to keep runtime bounded.
- Replace the single `quickstarts.spec.ts` test with a generic
`docs-pages.spec.ts` that loads whatever pages are resolved, asserting
each renders with an `<h1>` and that its docs-owned links resolve.
- Add `run-e2e-docs.ts` so `pnpm e2e:docs` resolves scope locally (from
commits since `origin/master`, plus staged/unstaged changes) and skips
Playwright entirely when nothing in scope changed.
- Update `.github/workflows/docs-e2e.yml` to widen the trigger paths to
all guides/troubleshooting/partials, resolve scope in a dedicated step,
skip the rest of the job when scope is empty, and accept a `page_paths`
input for manual `workflow_dispatch` runs.
- Rewrite `e2e/docs/README.md` to document the new scoping behavior, the
override envs (`DOCS_E2E_PAGE_PATHS`, `DOCS_E2E_BASE_REF`), and how CI
uses the suite.
- `pnpm e2e:docs:all` is also added to run tests on every page locally.
Good for scoping issues but should not be included in CI.
## Manual testing
Walk through the following steps to verify this works:
- [x] `pnpm e2e:docs` from repo root resolves the expected pages for a
local guide edit and can run against local dev
**Note:** Challenges with testing on local in part because of the long
lag for first page load. Recommendation to use a hosted URL is added to
docs.
- [x] Editing a shared `_partials` file resolves to every page that
includes it (including through nested partials)
- [x] `pnpm e2e:docs` exits cleanly with no Playwright run when no
in-scope files changed
- [x] `git diff --name-only ... | pnpm -C e2e/docs resolve-docs-scope`
prints the expected page list for a sample diff
- [x] Workflow run on a PR that only touches `e2e/docs`/workflow files
skips the Playwright steps
- [x] Manual `workflow_dispatch` run with `page_paths` set tests only
those pages
- [x] Run `pnpm e2e:docs:all` to run the suite on all docs content,
which takes awhile
## Next steps
After this PR merges, we have the scaffolding to add more fun tests like
a11y 😁
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added scoped Docs E2E runs that target eligible doc pages based on
changes, plus manual page-targeted runs and an “all eligible pages”
mode.
* Introduced `DOCS_E2E_PAGE_PATHS` (and updated base ref/base URL
behavior) to control which pages are tested.
* **Bug Fixes**
* Automatically skips Playwright setup when no relevant pages are in
scope; Playwright reporting now uploads only on failure.
* **Documentation**
* Updated the Docs E2E README with new run/CI behavior, troubleshooting
notes, and commands to inspect the resolved page list.
* **Tests**
* Added a Docs-owned pages E2E suite; removed the Next.js quickstart E2E
spec.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Fixes the TanStack Studio app failing to load locally, and adds a CI
guard so the same class of bug can't come back.
`packages/ui-patterns/src/admonition.tsx` is a back-compat shim
containing `export * from './Admonition'`. On a case-insensitive
filesystem (macOS, Windows) the resolver tries `./Admonition.tsx` before
the directory index — and that's the same file. The shim re-exported
itself and exported nothing, so every consumer of
`ui-patterns/admonition` blew up with `does not provide an export named
'Admonition'`, plus knock-on Vite dep-optimizer errors about missing
chunks.
It works on Linux, so typecheck, lint, build and tests all pass on CI.
This only reproduces on dev machines.
**Changed:**
- `admonition.tsx` now points at `./Admonition/index` explicitly, so the
specifier can't resolve back to itself
**Added:**
- `scripts/check-case-hazards.mjs` — dependency-free, two textual checks
so they fire on Linux CI:
- **Self-resolving imports**: for `dir/X.tsx`, flags any extension-less
relative specifier resolving to `dir/X` case-insensitively
- **Case-colliding paths**: tracked paths (files and directory prefixes)
equal when lowercased, which can't coexist in a case-insensitive
checkout
- `pnpm test:case-hazards`, plus a step in `typecheck.yml` after
`setup-node` but before `pnpm install` — no deps needed, fails fast
Scoped check 1 to genuine self-imports rather than all case-insensitive
file/directory ambiguity. The broader rule lights up ~45 legitimate
routing pairs (`_app.tsx` + `_app/`, `changelog.tsx` + `changelog/`) and
would get switched off within a week. This version has zero false
positives on master today.
## Follow-up (not in this PR)
The underlying duplication is still there: `src/admonition.tsx` and
`src/Admonition/` both exist, and the ~14 internal `'../Admonition'`
imports inside the package resolve through the shim on macOS but through
the directory on Linux. Two resolution paths for one module is exactly
what produced this.
Real fix is to collapse it. Current counts: **246** files import
`ui-patterns/admonition`, **0** import `ui-patterns/Admonition`. So
either rename the directory to lowercase and delete the shim (zero
import churn, but one lowercase dir among ~50 PascalCase siblings), or
codemod the 246 imports to PascalCase to match the package convention.
I'd lean to the codemod, on a day it won't conflict with in-flight
branches.
## To test
- `pnpm test:case-hazards` on master → passes, ~16.5k files checked
- Revert `admonition.tsx` to `export * from './Admonition'` and re-run →
fails with the offending file and the suggested fix
- Confirm the fixed form `'./Admonition/index'` is *not* flagged
- With the fix in place: `rm -rf apps/studio/node_modules/.vite`, then
`STUDIO_FRAMEWORK=tanstack pnpm dev:studio` → app loads, no
`Pre-transform error` and no missing-export error in the console
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved detection of file-path casing issues that could cause
failures on case-insensitive systems.
* Corrected a module re-export to ensure the intended UI component is
exposed consistently.
* **Tests**
* Added a dedicated case-sensitivity hazard check.
* Integrated the check into the type-check workflow for earlier issue
detection.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Closes DOCS-1210
Closes DOCS-1209
#48226 needs to merge first for CI failure
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Test coverage and several small bug fixes discovered during
implementation.
## What is the current behavior?
Nothing verified that `pnpm run dev:docs` keeps working without private
credentials.
We value this command working, especially for community contributors.
However, this issue can go undetected by employees at Supabase since
many of us have credentials in place. We do not want this to go a week
before finding and fixing like in the previous instance.
## What is the new behavior?
- **New Playwright test suite**:
`e2e/docs/local-smoke/no-credentials.spec.ts` boots the docs dev server
with zero GitHub App/Supabase secrets and checks 5 routes covering each
known failure point.
- **CI**: a new `local-dev-smoke` job in `docs-tests.yml` runs this
suite with no credentials configured.
## Additional bugs resolved
Setting up this test exposed other issues that are fixed in this PR:
- **Troubleshooting.utils.ts crash** — Unguarded Supabase call pattern,
crashing every troubleshooting article. Added the same guard as previous
fixes.
- **Missing manifest.json** — middleware.ts statically imports
public/markdown/manifest.json, which is gitignored and only generated by
a build step that's skipped in local dev. On a fresh checkout it doesn't
exist, so middleware fails to compile and takes down every page. Fixed
by committing a placeholder [] (real builds still regenerate the full
file).
- **Phantom @code-hike/mdx import** — apps/docs/app/layout.tsx imported
@code-hike/mdx/styles.css, but only apps/www actually declares that
dependency. Worked by accident whenever both apps were installed
together; broke in CI's docs-only install. Turned out to be dead code
(nothing in docs actually uses code-hike), so fixed by deleting the
unused imports rather than adding the dependency.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* Added a credential-free “local smoke” end-to-end test suite for key
documentation routes.
* **Bug Fixes**
* Improved troubleshooting behavior when required external service
credentials are missing.
* Updated federated “wrappers” documentation pages to gracefully show a
fallback message when external content can’t be fetched.
* **Tests**
* Added a dedicated local-smoke Playwright runner and enhanced CI
path-based triggering and reporting (failure-focused artifacts).
* **Chores**
* Refined docs workflow path filters and adjusted docs markdown
manifest/ignore rules for generated content.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Makes the self-hosted Docker image buildable with the TanStack/Vite
build alongside the existing Next one. The Dockerfile's new
`STUDIO_FRAMEWORK` build arg (default: `next`) selects which framework
lands in the image — the same variable `scripts/dispatch.js` keys on
everywhere else, so `--build-arg STUDIO_FRAMEWORK=tanstack` is the
docker spelling of the existing switch. Both flavors assemble a
normalized `/srv` tree, so a single production stage serves either with
the same CMD (`node apps/studio/server.js`), port 3000, and healthcheck.
Unlike Next's self-contained standalone output, the Vite SSR bundle
externalizes studio's dependencies and resolves them from `node_modules`
at request time, so the tanstack runtime tree is a prod-only `pnpm
deploy` plus the built `dist/`. The boot smoke test runs a second time
against that pruned tree, so a runtime import that's missing from
`dependencies` fails the image build instead of 500ing the deployed
container — which is exactly how this PR caught four packages
misclassified as devDependencies (`braintrust` +
`@smithy/property-provider` via the AI routes, `libpg-query` via the
parse-query API route, `@radix-ui/react-use-escape-keydown` via the
Queues panel; split into its own commit).
**Changed:**
- `apps/studio/Dockerfile`: `ARG STUDIO_FRAMEWORK` selects `build-next`
/ `build-tanstack` stages via `FROM build-${STUDIO_FRAMEWORK}`; both
normalize into one production layout
- `apps/studio/package.json`: moved the four runtime-imported packages
from devDependencies to dependencies (versions unchanged)
- `apps/studio/vite.config.ts`: pinned `preview.host` to `127.0.0.1` —
the prerender step boots `vite preview` and crawls its resolved URL, and
the default `localhost` host lets the server bind the IPv6 loopback
while the crawler fetches `127.0.0.1`, which ECONNREFUSEDs the whole
build inside BuildKit containers
- `.github/workflows/studio-docker-build.yml`: builds the tanstack image
as a second step (reuses the first build's layer cache; job name
unchanged)
**Added:**
- `build:studio:docker:tanstack` root script
Note: the tanstack image is ~2.0GB vs ~1.2GB for Next (externalized
`node_modules`); shrinking it via file tracing is a follow-up. Nothing
self-hosters pull changes until a tanstack-built image is published —
this makes it buildable and CI-checked.
## To test
- `pnpm build:studio:docker` then run the image against a stack —
behavior unchanged (healthcheck `/api/platform/profile` 200, `/` 307s to
`/project/default`)
- `pnpm build:studio:docker:tanstack` then run that image with the same
env — same healthcheck, redirect, and data endpoints (projects, pg-meta)
respond 200; browser loads Project Overview / Table Editor with no
requests leaving the container
- Both verified locally against the CLI stack (`host.docker.internal`
env, container reports `healthy`)
- Vercel + e2e checks on this PR exercise the `preview.host` change on
their runners
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Added TanStack-based Studio build support with a framework-selectable
Docker image.
- Added a local build command for the TanStack Studio Docker image.
- **Build & Deployment**
- Updated the Studio Docker build workflow to also publish a
TanStack-tagged Studio image when relevant.
- **Bug Fixes**
- Improved `vite preview` behavior in containers by binding to IPv4
loopback.
- Standardized the Studio container runtime port to `3000`.
- **Chores**
- Updated Studio runtime packages to support the TanStack build.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Closes DOCS-1197
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## Problem
We do not have any E2E testing established.
## Solution
This PR creates an ultra-lean starting place for Docs Playwright:
- A CI/CD step that skips on draft and relies on Preview for testing
- One simple broken link check for one page
The goal:
- Playwright is implemented where we want it, with an architecture we
want, with set-up steps we can build from
The anti-goal of this PR:
- We have meaningful tests running
## CI/CD steps
<img width="1191" height="72" alt="Screenshot 2026-07-21 at 10 17 06 AM"
src="https://github.com/user-attachments/assets/eeb2454c-d864-4574-a050-ce39bb3f083f"
/>
1. Checkout a thin slice of the repo (`apps/docs`, `packages`,
`patches`).
2. Wait for the Vercel **docs** preview for that commit SHA.
3. Use that preview URL as `PLAYWRIGHT_BASE_URL`.
4. Install Node deps and Chromium.
5. Run `pnpm run e2e:docs` (`--grep @quickstart`).
6. If anything fails, upload the HTML report + traces.
Manual runs skip the Vercel wait and default to `https://supabase.com`
(or whatever URL you enter), then run the full suite (`pnpm run e2e`).
## What the test checks
Because this PR is scaffolding, it is doing something very basic:
1. Opens `/docs/guides/getting-started/quickstarts/nextjs` only if a
connected file was edited in CI/CD step
2. Asserts the page loaded and the H1 is visible.
3. Collects docs-owned `/docs/**` links from
`#sb-docs-guide-main-article`.
4. HTTP-checks each link (no full navigation) and soft-fails so every
broken link is reported.
Config keeps it cheap: Chromium only, 1 worker, 2 CI retries, failure
screenshots/traces.
## Docs vs Studio/Dashboard
The setup of Docs Playwright differs from Studio.
| | Docs E2E | Studio E2E |
|---|---|---|
| Location |`e2e/docs/` | `e2e/studio/` |
| What it tests | One published docs page + its links | Many Studio UI
flows (tables, auth, storage, …) |
| Where the app runs | Already-deployed **Vercel preview** | Built and
started **on the runner** |
| Backend needed | None | Local Supabase via Docker |
| Path filtering | Native `on.pull_request.paths` (skip whole workflow)
| `dorny/paths-filter` after checkout (workflow starts, heavy steps
gated) |
| Parallelism | 1 worker, no shards | Matrix of frameworks × 2 shards |
| Retries | 2 in CI | 5 in CI |
| Reports | HTML report on failure | Blob reports per shard → merge → PR
comment |
| Draft handling | Explicit draft skip | No draft skip today |
| Manual broader run | Yes (`workflow_dispatch`) | No |
The big conceptual difference: **Studio owns the environment** (build
Studio, start Supabase, hit `localhost`). **Docs borrows Vercel’s
preview** and only asks “does this page and its docs links work on the
deployed site?”
## Docs architecture justification
The docs architecture is deliberately lightweight because docs are
**static, published content served by Vercel**, not an interactive app
with a backend. That single fact justifies every difference:
- **Borrow the Vercel preview instead of building on the runner.** The
preview is already the exact artifact users will see, and Vercel builds
it for free on every PR. Rebuilding docs on the runner would duplicate
that work and risk testing something different from what ships. Studio,
by contrast, needs a running app plus a local Supabase, so it *has* to
own its environment.
- **No backend.** Docs pages don't need a database or auth to render, so
there's nothing to spin up. This is what keeps the job cheap enough to
run per-PR.
- **Native `paths` filtering.** Since the job is cheap and
self-contained, an all-or-nothing skip at the workflow level is
sufficient—no need for `dorny/paths-filter` to gate expensive setup
steps mid-run like Studio does.
- **Low parallelism and modest retries.** One page and its links is a
tiny surface, so 1 worker is plenty and there's no sharding to
coordinate. Retries exist only to absorb transient network flakiness
against a live URL, hence 2 rather than Studio's 5 (which also cushions
a heavier, stateful environment).
- **Non-blocking + draft skip + manual dispatch.** As initial
scaffolding checking link health on a deployed site, it should inform
rather than gate merges, avoid burning minutes on drafts, and still be
runnable on demand against production.
In short: **Studio owns its environment because it must; docs borrows
Vercel's preview because it can.** The scope is intentionally minimal
today.
## Testing
1. Break a docs-owned link in the Next.js quickstart.
1. Follow README instructions to set up and run e2e docs test.
1. Confirm the suite fails.
1. Restore the broken link and re-run.
1. Confirm the suite **passes** (`1 passed`).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary
- **New Features**
- Added a GitHub Actions workflow to run Playwright docs end-to-end
tests on PRs and via manual dispatch (with optional base URL), including
docs-preview waiting and concurrency cancellation.
- **Documentation**
- Added `e2e/docs` README with setup, how to run the suite (including
UI/debug and single-spec), and how base URL selection works.
- **Tests**
- Added a quickstarts E2E spec that validates the page and soft-checks
docs-owned links resolve.
- **Chores**
- Added shared Playwright configuration/package scripts and an
`e2e/docs` `.gitignore` for test outputs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Chore / dependency tooling update.
## What is the current behavior?
The repo is pinned to pnpm 10.24.0. Closes
https://linear.app/supabase/issue/FE-3673/migrate-the-repo-to-use-pnpm-v11.
## What is the new behavior?
The repo is pinned to pnpm 11.13.1, pnpm v11 workspace settings are
migrated to `allowBuilds`, and the Studio Dockerfile installs pnpm
11.13.1.
## Additional context
Validated with `CI=true mise exec node@22 -- pnpm install
--frozen-lockfile`, `mise exec node@22 -- pnpm run typecheck`, and `mise
exec node@22 -- pnpm run lint`; full Prettier check still fails on
existing generated docs/router files outside this migration.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated tooling requirements (pnpm **11.13.1**, Node **>=22.13**) and
aligned container build tooling accordingly.
* Adjusted package manager behavior (scoped registry override, update
notifications disabled) and workspace build/engine validation settings.
* **Maintenance**
* Updated `clean` scripts across apps/packages to remove only
build/cache artifacts (no longer delete installed dependencies).
* Reduced Turbo `clean` task output to **errors-only** for cleaner logs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
With `STUDIO_FRAMEWORK=tanstack`, `pnpm dev:studio-local` ran Studio in
platform mode against the management API instead of the local CLI stack
(`/` redirected to `/org` instead of `/project/default`). Vite selects
env files by *mode* while the Next dev server selects them via
`NODE_ENV=test`, so the tanstack dev server never loaded `.env.test` and
the developer's `.env.local` (`NEXT_PUBLIC_IS_PLATFORM="true"`) won. The
shell `NODE_ENV=test` also gets inlined into the dev client bundle by
Vite, flipping `API_URL` to the vitest-only MSW host.
`vite dev --mode test` isn't a viable fix: TanStack Start's dev-server
plugin treats mode `test` as "running under vitest" and skips installing
its SSR middleware, so every route 404s. Instead, dev keeps mode
`development` and overlays the env cascade named by `MODE` on top.
**Changed:**
- `dev:studio-local` now also sets `MODE=test` (the same knob
`build:tanstack` / `e2e:setup:selfhosted` already use)
- `vite.config.ts` dev server: loads the `MODE`-named env cascade for
the `NEXT_PUBLIC_*` client defines and seeds it into `process.env` for
SSR, without clobbering shell-provided values (matching `serve.js`
semantics, and safe against TanStack's own load-env plugin since
`loadEnv` gives existing `process.env` priority)
- `vite.config.ts` dev server: remaps a shell `NODE_ENV=test` to
`development` so it can't be baked into the client bundle (mirrors `next
dev` behavior)
Platform-mode `pnpm dev:studio` sets no `MODE`, so the overlay is a
no-op there. Build (`--mode test`), `serve.js`, and vitest (separate
`vitest.config`) paths are unchanged.
## To test
- `supabase` CLI installed, then: `STUDIO_FRAMEWORK=tanstack pnpm
dev:studio-local`
- Visit http://localhost:8082 — it should redirect to `/project/default`
(not `/org`) and the Default Project page should load with data from the
local stack (network requests go to `localhost:8082/api/platform/...`,
no `api.supabase.(com|green)` calls)
- `pnpm dev:studio` (platform mode, tanstack) still behaves as before —
redirects to `/org`
- Next path regression check: plain `pnpm dev:studio-local` (no
`STUDIO_FRAMEWORK`) still works
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved local Studio development and test-mode environment handling.
* Prevented test settings from being incorrectly embedded in the client
application.
* Ensured environment values are loaded consistently across development
and test scenarios.
* **Chores**
* Updated the local Studio development command to explicitly use test
mode.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Upgrades the monorepo to TypeScript 7.0.2, released 2026-07-08. `tsc` is
now the native Go compiler
([announcement](https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/))
— full turbo typecheck drops from ~56s to ~19s locally.
TS 7.0 ships **without a programmatic API** (it lands in 7.1), so this
uses Microsoft's recommended side-by-side setup: the `typescript` name
resolves to `@typescript/typescript6` (the 6.0 API republished) for API
consumers — typescript-eslint and Next.js build typechecking — while
`@typescript/native` (the real `typescript@7.0.2`) owns the `tsc` bin
that typecheck scripts run. Exactly one version of each is in the
lockfile; nothing imports the native package as a library. When 7.1 +
tool support lands we can collapse back to a single `typescript` dep in
the catalog.
**Changed:**
- `pnpm-workspace.yaml`: catalog aliases for `typescript` /
`@typescript/native`
- 17 package.json files: `@typescript/native` added beside each
`typescript` dep so every package's `tsc` is the native binary
- `apps/studio/tsconfig.json`: exclude `dist/` (gitignored build output)
from typechecking
**Fixed** (real type errors TS 6 under-reported):
- `packages/ui-patterns` CodeBlock: `borderLeft: null` → `undefined`
(`CSSProperties` doesn't accept null)
- `apps/www` CodeBlock: removed a JSX `@ts-ignore` comment that tsgo
doesn't honor and fixed what it masked (untyped `.js` theme objects,
possibly-undefined highlighter children)
⚠️ **Merge timing:** the new packages are inside pnpm's 3-day
`minimumReleaseAge` window until ~July 11. Installs from the committed
lockfile are unaffected (resolution is skipped), but anything that
forces a re-resolution before then will fail — hold off merging until
the window passes.
Note for editors: the compat package has no `lib/tsserver.js`, so VS
Code's "Use Workspace Version" won't work — use the bundled TS or the
TypeScript Native Preview extension.
## To test
- `pnpm install && pnpm typecheck` — all 15 tasks green, and
`./node_modules/.bin/tsc --version` prints 7.0.2
- `pnpm lint --filter=studio` — typescript-eslint still parses (resolves
the 6.0 API)
- `pnpm build --filter=design-system` (or any Next app) — Next's
tsconfig validation and build typecheck still work
- CodeBlock rendering on www (syntax highlighting, line highlights
with/without border) — the two fixes are behavior-neutral but worth an
eyeball
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Improvements / New Features**
* Enhanced TypeScript tooling support across the workspace for smoother
development builds and checks.
* **Bug Fixes**
* Code blocks render more reliably when content is empty or missing.
* Highlighted code line styling applies more consistently.
* **Maintenance**
* Studio TypeScript builds now avoid including generated output (such as
`dist`) during compilation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
## Problem
Because some tests were taking too much time before with the studio
supabase default instance, we used to do a reset of its config on CI.
This makes local testing more cumbersome as you have to manually reset
it without forgetting to create a `functions` directory.
## Solution
- prepare the existing e2e supabase config in `e2e/studio` to ensure
functions work (create the directory)
- use the `workdir` option of the supabase CLI so that it uses the
`e2e/studio` specific config
- remove the now unnecessary reset done on CI
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved the reliability of the end-to-end setup flow by simplifying
cleanup steps and avoiding an extra reset during shutdown.
* **Chores**
* Updated workflow and script behavior to better support automated test
runs without changing the user experience.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Stack 1/6** of the TanStack Start migration (#46424), split into
reviewable, independently-mergeable PRs.
> [!IMPORTANT]
> **Next stays the default and only active framework after this PR.**
This wires up the Vite/TanStack-Start build pipeline behind the
`STUDIO_FRAMEWORK` flag, but there are no TanStack routes yet — so the
TanStack build isn't functional or tested until later PRs in the stack.
Nothing about the Next build, dev, or deploy changes behaviourally here.
## What's in this PR
- **Dispatch:** `dev`/`build`/`start` now go through
`scripts/dispatch.js`, which runs the Next variant unless
`STUDIO_FRAMEWORK=tanstack`. The original commands are preserved as
`dev:next`/`build:next`/`start:next`.
- **Build pipeline:** `vite.config.ts`, `serve.js`, `smoke-server.mjs`,
vite/tanstack deps, `turbo.jsonc`.
- **`tsconfig.json`:** `jsx: react-jsx`, `moduleResolution: Bundler`,
`target: ES2022`. Because `include` is `**/*.ts(x)`, this re-typechecks
the whole app, so the companion adaptations below land with it.
- **Shared adaptations (companions to the tsconfig change):**
`BufferSource` casts, `packages/ui` unused-`React` import removals, etc.
- **Routing/middleware plumbing:** `next.config.ts` +
`redirects.shared.ts` (redirect rules now shared with `vercel.ts`),
`proxy.ts`/`start.ts` middleware + `hosted-api-allowlist.ts`.
## Verification
Run locally off `master`: frozen install ✓, `studio` typecheck ✓, **Next
build ✓** (compiles + generates all routes), lint ratchet ✓ ("some rules
improved"), prettier ✓.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a hosted API endpoint allowlist to return 404 for non-supported
`/api/*` routes.
* Introduced a TanStack route-migration checklist and expanded TanStack
Start routing support.
* **Improvements**
* Enhanced deployment refresh/detection by tightening cookie handling
for “latest deployment” updates.
* Centralized redirect/maintenance-mode rules for consistent platform vs
self-hosted behavior.
* Improved production serving with a dedicated static + proxy server and
a post-build smoke test.
* **Dependencies**
* Updated TanStack-related packages and React Table/query tooling
versions.
* **Documentation / Chores**
* Updated formatting and tooling config; added shared build environment
parsing utilities.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated build tools and development dependencies across the project
* Upgraded Vue framework and related tooling to latest versions
* Updated TanStack React Start dependency
* Refined dependency resolution settings to improve build stability and
performance
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
The Supabase CLI sometimes fails to start because the postgres port is
already used:
> failed to start docker container: Error response from daemon: failed
to set up container networking: driver failed programming external
connectivity on endpoint supabase_db_supabase
(10587f26e7287c8086fd27db12be7aac4afe1f3fc521c9d7a8dfe109993c995d):
failed to bind host port for 0.0.0.0:54322:172.18.0.2:5432/tcp: address
already in use
## Solution
None yet, debugging
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Enhanced end-to-end test workflow with added pre-start and failure
diagnostics for better observability and troubleshooting of test runs.
* Updated the e2e setup CLI script to skip certain local services by
default and clarify script formatting for maintainability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated core SDK dependencies to latest compatible versions for
improved system stability and security.
* Enhanced workspace dependency configuration management by expanding
and reorganizing package constraints to optimize compatibility across
all modules and reduce potential build conflicts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request migrates all SCSS stylesheets in the `apps/studio` and
`apps/docs` projects to CSS, updates import paths accordingly, and
consolidates PostCSS configuration to use a shared config. The migration
includes renaming files, updating import statements, converting SCSS
comments to CSS comments, and removing redundant or legacy configuration
files. The changes improve maintainability and consistency across the
codebase.
**Migration from SCSS to CSS:**
* All SCSS stylesheets in `apps/studio/styles` and `apps/docs/styles`
have been renamed to `.css`, and their contents updated by converting
SCSS comments (`// ...`) to CSS comments (`/* ... */`). All relevant
import statements in the app entry points have been updated to reference
the new `.css` files.
**PostCSS configuration consolidation:**
* The separate `postcss.config.cjs` files in `apps/design-system`,
`apps/learn`, and `apps/studio` now all import from a shared
`config/postcss.config`, ensuring consistent PostCSS setup across
projects. The legacy `postcss.config.js` in `apps/studio` has been
removed.
**Code and style consistency improvements:**
* All instances of the SCSS-specific `#{!important}` in Tailwind
`@apply` rules have been replaced with the standard CSS `!important`
syntax.
* Minor fixes and comment updates were made throughout the stylesheets
to improve readability and maintainability, such as moving or clarifying
TODOs and notes.
These changes streamline the styling approach, reduce build complexity,
and make it easier to maintain and scale the design system and
documentation styles.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Consolidated PostCSS configuration across apps
* Migrated many stylesheet imports from SCSS to CSS
* Standardized CSS comment and @apply syntax for consistency
* **Chores**
* Removed SCSS (sass) dev dependency
* Added autoprefixer and tailwindcss/nesting to PostCSS plugins
* Removed SCSS module type declarations (cleaned up typings)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request introduces improvements to the project's build and
cache management processes. The main changes focus on enhancing the
cleaning of build artifacts and optimizing Turbo's caching behavior.
**Build and cache improvements:**
* Updated the `clean` script in `package.json` to also remove the
`.turbo/cache` directory, ensuring a more thorough cleanup of build
artifacts.
* Added a `cacheMaxAge` setting of 14 days to `turbo.jsonc`, which
controls how long Turbo's cache is retained, helping to balance cache
efficiency and disk usage.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Optimized build system caching configuration with extended cache
validity period (14 days) to improve build performance through longer
retention of build artifacts and reduced unnecessary recompilation.
* Enhanced cleanup procedures for build artifacts, cached files, and
temporary data to maintain a consistent and clean build environment.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Next.js 16.2
• Up to ~60% faster rendering
• Up to ~400% faster 𝚗𝚎𝚡𝚝 𝚍𝚎𝚟 startup
• Server Function 𝚍𝚎𝚟 logging
• Redesigned error page
• Better hydration errors
• 𝙴𝚛𝚛𝚘𝚛.𝚌𝚊𝚞𝚜𝚎 display in error overlay
https://nextjs.org/blog/next-16-2
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated core build/dev tooling versions for more predictable installs
(analyzer and Turbo bumped).
* Relaxed workspace release gating by reducing minimum release age and
narrowing the list of tooling exclusions, streamlining staged upgrades.
* No runtime or public API changes; configuration and tooling-only
updates.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request refactors the Turbo build configuration by moving each
app's build settings from the root `turbo.json` file into their own
dedicated `turbo.jsonc` files within each app's directory. The root
configuration is simplified to only include generic tasks, improving
maintainability and clarity.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Turbo to v2.9.3 to improve build performance and stability.
* Reorganized and added per-app build pipeline configurations to
streamline builds and caching across the workspace.
* Removed a Tailwind container-queries plugin from one app's styling
setup.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This PR fixes some prettier issues:
- Bump and unify all prettier versions to 3.7.3 across teh whole repo
- Bump the SQL prettier plugin
- When running `test:prettier`, check `mdx` files also
- Run the new prettier format on all files
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
## Problem
Since the upgrade to NextJS 16.1.6, many e2e tests run fails with
timeout, probably when building or starting the studio
## Solution
- [x] Add dedicated steps for supabase setup and NextJS build to ease
debugging
- [x] Fix flakyness
## Problem
The docker build for studio fails because pnpm patches are not included
## Solution
- bump pnpm version in Dockefile to match the one used by the repo
- bump turbo version in Dockerfile to use one that handles pnpm patches
- add a script to test the build locally
- add a github action to validate the build on each PR
This PR removes the `payload` `cms` app that was added for the marketing
blog posts. We never started using it, it just adds additional work in
keeping the dependencies updated.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed the CMS application and associated infrastructure, including
configuration files, build scripts, and environment management.
* Simplified project build configuration and removed CMS-related
dependencies from deployment workflows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This PR renames all `SUPABASE_PUBLISHABLE_OR_ANON_KEY` env vars into
`SUPABASE_PUBLISHABLE_KEY` to make the new API keys default. This is in
coordination with the rest of the docs.
I've also cleaned up the `blocks/vue` package from unused files.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Breaking Changes**
* Public environment variable names renamed from PUBLISHABLE_OR_ANON_KEY
→ PUBLISHABLE_KEY across all framework integrations; update your
environment configs.
* **Documentation**
* All framework guides, .env examples and registry docs updated to use
the new variable names.
* **Chores**
* Cleaned up UI registry/templates: some example Vue registry items and
autogenerated registry artifacts were removed or simplified.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Sorted all imports in all packages, `cms`, `design-system` and
`ui-library` apps by running `pnpm format` on them.
All changes in this PR are done by the script.
This PR switches the sort imports plugin to
@ianvs/prettier-plugin-sort-imports which is more reliable and merges
imports from the same file (the old one reported them as error).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated import-sorting tooling and related configuration to improve
consistency of import ordering and formatting across the codebase,
simplifying rules and adjusting behavior for private/internal paths to
produce more predictable diffs and clearer code style in development.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
* Add prettier plugin for sorting imports.
* Migrate the prettier config to a js file. Make the sort imports conditional which will work only in code editors.
* Remove unneeded commands for running prettier.
* Fix the regex to be more specific.
* Another fix for the import regex.
* Hide favorite and share actions for self-hosted version.
* Rename the query on save only on platform.
* Simplify useCheckOpenAiKeyQuery.
* Rename with AI now depends if the OPENAI_API_KEY is set.
* Minor fixes.
* Fix the tests to use .skip for skipping tests. Remove extra port params.
* Make the test for favourites work only on platform variant.
* updated commands and expose ai key locally
* added tests for AI assistant
* added OPEN_API_KEY for e2e test suite
* updated log drain options
* updated README
* Use the "eslint" command instead of built-in next lint since it's getting obsolete.
* Bump all deps to support eslint 9+.
* Convert the rules in eslint-config-supabase to be flat-config compatible.
* Migrate all apps to use the new eslint config rules.
* Fix all errors found in the new setup.
* Fix the no default exports ignores.
* Scan all files for linting in studio.
* Fix all lint errors.
* Make the reportUnusedDisableDirectives a warning.
* Deduplicate @babel/core.
* Remove explicit dependency of import-in-the-middle (it's imported in sentry deps).
* Add an API route for api-keys/temporary.
* Refresh the token if on self-hosted.
* Readd import-in-the-middle.
* Bump supabase to 2.50.3 which contains fixes for storage upload.
Jeremias Menichelli