Skip to content

[pull] master from supabase:master#1101

Merged
pull[bot] merged 14 commits into
code:masterfrom
supabase:master
Jul 22, 2026
Merged

[pull] master from supabase:master#1101
pull[bot] merged 14 commits into
code:masterfrom
supabase:master

Conversation

@pull

@pull pull Bot commented Jul 22, 2026

Copy link
Copy Markdown

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

claude Bot and others added 14 commits July 22, 2026 11:19
<!-- ccr-slack-attribution -->
_Requested by **Nicole Kramer** · [Slack
thread](https://supabase.slack.com/archives/C0161K73J1J/p1783431374242039?thread_ts=1783431374.242039&cid=C0161K73J1J)_

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Feature (`apps/www`).

## What is the current behavior?

No public page for Supabase's subprocessor list, and no way for
customers to be notified when it changes.

## What is the new behavior?

A new hidden page at `/legal/customer-resources/subprocessor-list` shows
the current dated subprocessor PDF and lets anyone subscribe with their
name and email to receive an email whenever the list is updated. The
page is `noindex` and not linked from any nav, so it's shareable by
direct URL only for now. Mirrors Wiz's sub-processor-list page.

**How:**

- **Page**
`apps/www/pages/legal/customer-resources/subprocessor-list.tsx` —
pages-router, mirrors the existing Legal Hub pages (`DefaultLayout`,
`NextSeo`, `PageHeader` + breadcrumb, `SectionContainer` prose). Embeds
the PDF (inline preview + download link) and renders the subscribe form.
Marked `NextSeo` noindex/nofollow and intentionally left unlinked.
- A single `CURRENT_PDF` constant (filename + display date) is the only
thing to change when Legal hands over a new dated PDF.
- **Form** `apps/www/components/SubprocessorUpdatesForm.tsx` — mirrors
`SecurityNewsletterForm` (First name, Last name, Email; `ui`
primitives). Carries the framing copy verbatim, with **Subscribe to
updates** bold and Privacy Policy linked to
https://supabase.com/privacy.
- **API route**
`apps/www/app/api-v2/submit-form-subprocessor-updates/route.tsx` — exact
mirror of `submit-form-security-newsletter`; subscribes the user to the
Customer.io "Subprocessor Alerts" subscription (topic 4) via
`cio_subscription_preferences.topics.topic_4: true`.
- **PDF** `apps/www/public/legal/subprocessor-list/June-1-2026.pdf`.

**Updating the list in future:** Drop the new dated PDF into
`apps/www/public/legal/subprocessor-list/` and update the `CURRENT_PDF`
constant. Nothing else changes.

## Additional context

**Notes / to confirm:**

- Customer.io topic id `4` → `topic_4` (per Prashant); not independently
verified against Customer.io.
- Draft: page is intentionally unlinked and noindex until Legal signs
off.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01D9WS2QWQ8Y3o7PqDZabS3F)_

---------

Co-authored-by: Claude <noreply@anthropic.com>
This PR updates @supabase/*-js libraries to version 2.110.8.

**Source**: supabase-js-stable-release

**Changes**:
- Updated @supabase/supabase-js to 2.110.8
- Updated @supabase/auth-js to 2.110.8
- Updated @supabase/realtime-js to 2.110.8
- Updated @supabase/postgest-js to 2.110.8
- Refreshed pnpm-lock.yaml

---

## Release Notes

## v2.110.8

## 2.110.8 (2026-07-21)

### 🩹 Fixes

- **auth:** downgrade aborted/transient fetch failures from
console.error to warn
([#2544](supabase/supabase-js#2544))
- **functions:** clean up cross-signal abort listener on invoke() return
([#2487](supabase/supabase-js#2487))
- **functions:** match response Content-Type case-insensitively
([#2515](supabase/supabase-js#2515))
- **storage:** url-encode object key in CDN purge methods
([#2545](supabase/supabase-js#2545))
- **supabase:** skip Node warning in Deno
([#2541](supabase/supabase-js#2541))

### ❤️ Thank You

- Franco Kaddour @FrancoKaddour
- Katerina Skroumpelou @mandarini
- Pedro Henrique
- Vaibhav @7ttp
## v2.110.7

## 2.110.7 (2026-07-16)

### 🩹 Fixes

- **postgrest:** correct self-reference inference
([#2525](supabase/supabase-js#2525))
- **realtime:** trigger set auth on INITIAL_SESSION event
([#2531](supabase/supabase-js#2531))
- **realtime:** update phoenix to fix presence issue
([#2532](supabase/supabase-js#2532))

### ❤️ Thank You

- Eduardo Gurgel
- Filipe Cabaço @filipecabaco
- Vaibhav @7ttp

This PR was created automatically.

Co-authored-by: supabase-workflow-trigger[bot] <266661614+supabase-workflow-trigger[bot]@users.noreply.github.com>
How to test:
- Editor should load and work in the SQL Editor
- Search for JS bundles `https://cdnjs.cloudflare.com/*` in the preview
to verify that's it's loaded from a CDN
- Check in the local build whether the Monaco editor is loaded from the
base URL (have to do it locally, SQL Editor doesn't work on the
self-hosted Vercel deployment)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Performance**
* Improved delivery of Studio assets through CDN-based URLs in supported
environments.
* Updated the Monaco editor to load assets from the configured CDN when
available, with a local fallback.
* **Reliability**
* Added support for explicitly enabling or disabling CDN asset delivery
across environments.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Context

For the Database Connections page, we run a `useEffect` every second to
re-render the UI so that the timestamps of each process' duration
reflects real time. However, duration should stop counting if live mode
is paused as otherwise it becomes inaccurate then.

Also forces an immediate refetch of the database activities when live
mode is re-enabled

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
  * Improved live activity updates on the Database Connections page.
* Pausing live mode now stops activity timestamp updates and refreshes.
* Resuming live mode immediately reloads the latest activity and updates
the UI to reflect live state.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes the following vulnerabilities:
- https://github.com/supabase/supabase/security/dependabot/3963
- https://github.com/supabase/supabase/security/dependabot/3963
- https://github.com/supabase/supabase/security/dependabot/3964
- https://github.com/supabase/supabase/security/dependabot/3965
- https://github.com/supabase/supabase/security/dependabot/3966
- https://github.com/supabase/supabase/security/dependabot/3927
- https://github.com/supabase/supabase/security/dependabot/3955
- https://github.com/supabase/supabase/security/dependabot/3913
- https://github.com/supabase/supabase/security/dependabot/3972
- https://github.com/supabase/supabase/security/dependabot/3959
- https://github.com/supabase/supabase/security/dependabot/3960
- https://github.com/supabase/supabase/security/dependabot/3916
- https://github.com/supabase/supabase/security/dependabot/3918
- https://github.com/supabase/supabase/security/dependabot/3947
- https://github.com/supabase/supabase/security/dependabot/3948
- https://github.com/supabase/supabase/security/dependabot/3956
- https://github.com/supabase/supabase/security/dependabot/3957
- https://github.com/supabase/supabase/security/dependabot/3958
- https://github.com/supabase/supabase/security/dependabot/3917
- https://github.com/supabase/supabase/security/dependabot/3919
- https://github.com/supabase/supabase/security/dependabot/3970
- https://github.com/supabase/supabase/security/dependabot/3928
- https://github.com/supabase/supabase/security/dependabot/3949
- https://github.com/supabase/supabase/security/dependabot/3950
- https://github.com/supabase/supabase/security/dependabot/3973
- https://github.com/supabase/supabase/security/dependabot/3920
- https://github.com/supabase/supabase/security/dependabot/3951

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Updated the bundled `tar` dependency to a newer patch version for
consistency and security across the workspace.
* Added/adjusted overrides to pin a few transitive dependencies to
specific versions.
* Normalized workspace configuration formatting and made minor
development configuration cleanup (no functional change).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
…s, and July additions (#47971)

## What

Updates the Dart/Flutter reference
(`apps/docs/spec/supabase_dart_v2.yml`) for features shipped in
[`supabase/supabase-flutter`](https://github.com/supabase/supabase-flutter)
in July (through the July 17 storage CDN-cache additions).

Built on the **new reference pipeline** (#47224 / #47994): each method's
section is inherited from the nearest section-header entry in the YAML,
and subcategory overviews are committed partials under
`spec/reference/dart/v2/partials/`. `common-client-libs-sections.json`
is **not** touched.

Scoped to items **not** already covered by #47728 (OAuth server
authorization details, custom providers admin, `explain` format,
realtime `onHeartbeat` and filter examples). Rebased onto `master` now
that #47994 and #47728 have landed.

## New reference entries

**Storage**
- Vector buckets (new **Vector Buckets** section):
create/get/list/delete bucket, index create/get/list/delete/access, and
vector put/get/list/query/delete (`supabase.storage.vectors`)
- Analytics (Iceberg) buckets (new **Analytics Buckets** section):
`createAnalyticsBucket`, `listAnalyticsBuckets`,
`deleteAnalyticsBucket`, and the `analyticsCatalog()` accessor
- `listPaginated` (list files v2), under File Buckets
- `downloadStream()` (streaming file downloads), under File Buckets
- `purgeCache()` (object CDN cache invalidation) and
`purgeBucketCache()` (bucket CDN cache invalidation)

**Auth**
- `signInWithWeb3`
- OAuth server `listGrants` and `revokeGrant` (in the **OAuth Server**
section, `supabase.auth.oauth`)

**Database**
- `stripNulls()` modifier

## Enrichments to existing entries

- Storage: `cacheNonce` on `getPublicUrl` / `createSignedUrl` /
`download`; filter/sort/pagination options on `listBuckets`
- Auth: `channel` on `mfa.challenge()`; `currentPassword` on
`updateUser`; async `getSession()` note and example; `friendlyName` on
`registerPasskey()` and `passkey.startRegistration()`
- Functions: `abortSignal` on `invoke`

## Pipeline plumbing

- New partials: `analytics-buckets.json`, `vector-buckets.json`,
`oauth-server.json`
- `generate-dart-reference.ts`: registers `analytics-buckets`,
`vector-buckets`, and `oauth-server-api` group-header ids in
`HEADER_IDS` so they render as section overviews rather than methods

## Source PRs

supabase-flutter: #1547, #1554, #1557, #1559, #1561, #1563, #1578,
#1579, #1580, #1585, #1588, #1590, #1591, #1593, #1603, #1607, #1608

## Verification

`pnpm codegen:references:dart` builds cleanly: the generator writes 141
method declarations (all ids resolve to a section, no invalid method
names, no slug collisions), and the nav renders the Analytics Buckets,
Vector Buckets, and OAuth Server sections with the expected methods.

## Notes

- Skipped (no reference home / would need product decisions): Iceberg
namespace/table management (the full `IcebergRestCatalog` API, which
lives in a standalone `iceberg-js` package upstream), `dryRun`,
functions exception subtypes, trace-context headers, `persistSession`,
configurable postgrest timeout/retry.
- `storageanalytics-from` maps to Dart's `analyticsCatalog(bucketId)`
(the Iceberg catalog entry point), since Dart has no `analytics.from()`
equivalent.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Expanded Dart docs with Web3 sign-in plus passkey, MFA channel, and
OAuth grant listing/revocation.
* Added storage APIs/examples for listing buckets with options, CDN
cache bypass via `cacheNonce`, and cache/purge support.
* Documented `stripNulls()` database modifier and cursor-based paginated
storage listing.

* **Documentation**
* Updated auth references with optional `currentPassword`,
`friendlyName`, and clarified `currentSession` vs `getSession()`.
* Added `abortSignal` support and examples for
`supabase.functions.invoke()`.

* **Bug Fixes**
* Improved Dart reference generation so analytics/vector bucket sections
aren’t emitted as method declarations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
…8179)

## What is the current behavior?

featured integration image was looking muddy on light mode
<img width="1479" height="792" alt="Screenshot 2026-07-16 at 16 20 29"
src="https://github.com/user-attachments/assets/d51960f9-7c58-47d6-a751-e310f0edb32e"
/>

## What is the new behavior?

dedicated light-mode preview images
<img width="1482" height="785" alt="Screenshot 2026-07-16 at 16 29 48"
src="https://github.com/user-attachments/assets/5c1b9772-8ea2-4b94-aeba-cb095015df8e"
/>

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
  * Added Stripe Sync Engine to the featured integrations list.
  * Added light-theme cover imagery for featured integrations.
* Featured integration cards now display theme-aware images and improved
visual overlays.
* Updated the marketplace grid for improved responsive layouts across
screen sizes.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Make the new "one-click" integrations feature preview opt-in by default
so it appears for all users once we switch `marketplaceIntegrations` to
_true_ and reframe the feature preview copywriting.

<img width="1007" height="694" alt="Screenshot 2026-07-22 at 12 01 08"
src="https://github.com/user-attachments/assets/4b35870c-dcf0-45cc-a1b5-69628e7e10b5"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Added a visual preview image to the integrations layout preview.
  * Renamed the preview to “One-Click Integrations.”
* Made the preview enabled by default when the marketplace feature is
enabled.
* **Style**
* Refreshed the preview text and updated the layout with improved
spacing, border, and rounded corners.
* **Documentation**
* Updated the page header documentation link to the general integrations
guide.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
The prerendered TanStack SPA shell (`_shell.html`) had a visually empty
body, so every cold load showed a blank page until the JS bundle
downloaded and hydrated. This bakes proper fallback states into the
shell as static HTML — none of them rely on JS executing.

**Added:**
- `ShellFallback` component, rendered as the `ClientOnly` fallback
around the root `<Outlet />` — during the shell prerender it serializes
into `_shell.html`, and on the client it unmounts the moment the app
mounts (no hydration mismatch: `ClientOnly` renders the fallback on the
server and first client render)
- Animated `LogoLoader` (Supabase logo outline) centered on screen — the
stroke-dash animation is pure CSS so it runs before any JS executes
- Stuck-load help text that fades in after 7s via CSS `animation-delay`
(clear cookies / reload, contact support@supabase.com — the support
email is gated behind `IS_PLATFORM` so self-hosted builds don't get it)
- `noscript` message for JS-disabled browsers, which also hides the
loader so users don't see an infinite spinner (uses
`dangerouslySetInnerHTML` so React hydration never diffs noscript
children)
- `data-nosnippet` on both text blocks so Google doesn't surface the
boilerplate as the search snippet for dashboard URLs (the one shell
serves every route)

## To test

All on the Vercel preview:

- Open the preview — on a cold load you should catch the animated logo
loader before the app mounts (throttle to "Slow 4G" in devtools if it
flashes by too fast), and it never reappears on client-side navigation
- In devtools, block the JS bundle (Network tab → right-click the
`/assets/index-*.js` request → Block request URL) and reload — the
loader animates on its own, and the help text (clear cookies / contact
support) fades in after ~7s
- Disable JavaScript (devtools command palette → "Disable JavaScript")
and reload — no spinner, just the "requires JavaScript" message
- View page source (or `curl` any preview URL) — the body contains the
logo SVG, the help text, and the noscript block, all with
`data-nosnippet` on the text

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Added a client-aware loading shell for Studio during initialization.
* Shows a branded loader with a help message that appears after a short
delay.
  * Includes platform-specific support contact details when available.
* **Bug Fixes**
* Prevents partial or incomplete content from rendering before the app
is ready.
* Improves consistency for no-JavaScript fallback rendering to avoid
hydration mismatches.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
…#48195)

Inserting a row through the table editor failed on any table with a
`GENERATED ALWAYS AS (...) STORED` column — the row editor sent an
explicit value for the generated column (e.g. `false` for booleans,
since the bool `Select` never hits the empty-string default heuristic
from #46826), which Postgres rejects with `428C9: cannot insert a
non-DEFAULT value into column`.

**Changed:**
- `RowField` now carries `isGenerated` (from pg-meta's `is_generated`,
previously unused by Studio)
- Generated columns are hidden from the row editor form (they're always
computed by the database, so there's nothing to input) but stay in
`rowFields` state so primary-key identifier logic is unaffected
- `generateRowObjectFromFields` skips generated fields, so they're
omitted from both insert and update payloads
- `validateFields` skips generated fields — an error on a hidden field
would be unfixable

**Added:**
- e2e test covering inserting a row into a table with a generated
boolean column
- unit tests for generated-column omission in insert/update payloads and
validation

## To test

1. Create a table with a generated column:
   ```sql
   create table t (
     id bigint generated by default as identity primary key,
     base_price int,
     discounted_price int,
     is_discounted boolean generated always as (
       base_price is distinct from discounted_price
     ) stored
   );
   ```
2. Table Editor → `t` → Insert row — `is_discounted` should not appear
in the form
3. Fill the other fields and save — the insert should succeed and the
grid should show the computed value
4. Edit an existing row and save — should still work (generated column
untouched)
5. Sanity-check a normal table with identity/default columns — clearing
a default field on insert should still fall back to the default (#46826
behavior)

Addresses
[FE-3909](https://linear.app/supabase/issue/FE-3909/studio-insert-form-fails-on-generated-boolean-columns)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
  * Added support for generated columns in the table editor.
* Generated columns are automatically computed and excluded from insert
and update forms.
* Generated values now appear correctly in the table after saving a row.

* **Bug Fixes**
  * Prevented validation errors for non-editable generated fields.
  * Ensured generated columns are excluded from submitted row data.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
## What kind of change does this PR introduce?

Bug fix

## What is the current behavior?

Table editor sort (and filter) column pickers show `USER-DEFINED` for
extension types such as PostGIS `geography`, because they use `dataType`
from pg-meta.

| Before |
| --- |
| <img width="549" height="196" alt="CleanShot 2026-07-22 at 11 32 44"
src="https://github.com/user-attachments/assets/9ba2dec8-f5a3-479f-81c8-2dd133f6d419"
/> |

## What is the new behavior?

Those pickers use the same display helper as column headers
(`getColumnFormat`), so labels match the header (e.g. `geography`,
`int4[]`).

## Test plan

In SQL Editor:

```sql
create extension if not exists postgis with schema extensions;

create table public.geography_sort_repro (
  id bigint generated always as identity primary key,
  location extensions.geography(point, 4326),
  tags text[]
);
```

Then open `geography_sort_repro` in the Table Editor → Sort → pick
`location` / `tags`. Confirm labels are `geography` and `text[]` (not
`USER-DEFINED` / `_text`). Same check in the Filter column picker.

Cleanup: `drop table public.geography_sort_repro;`

## Additional context

`data_type` is intentionally coarse for non-`pg_catalog` types in
pg-meta; `format` already carries the real type name. Arrays need
`getColumnFormat` so `_int4` becomes `int4[]`.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved column type labels in filter and sort menus by displaying the
appropriate format instead of raw data types.
* Preserved existing JSON-field restrictions and tooltips while
improving the clarity of displayed column information.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Hides the "Multigres" term from user-facing surfaces — it's the tech
powering High Availability projects, but "High Availability" is the only
term users should see for now (per Slack discussion with Saxon/Ivan).

**Changed:**
- High Availability badge hover card (project overview) no longer says
"Driven by Multigres"
- Project creation HA toggle description drops the Multigres name +
multigres.com link, keeps the informational copy
- All schema dropdowns now hide the `multigres` schema on HA projects,
by wiring in the previously-unused `filterSchemasForHighAvailability`
helper:
- `SchemaSelector` (shared — Table Editor, Functions, Indexes, Triggers,
Schema Visualizer, etc.)
  - `ExposedSchemaSelector` (API settings → exposed schemas)
- `EnableExtensionModal`, `CreateIndexSidePanel`, `ForeignKeySelector`,
`WrapperTableEditor`, Integrations install sheet `AdvancedSettings`
  - SQL editor schema autocomplete (`useAddDefinitions`)
- Schema list computations in the touched components are now memoized
(incl. stabilizing `SchemaSelector`'s `excludedSchemas` default so the
memo actually holds)

**Added:**
- Unit tests for `filterSchemasForHighAvailability` /
`resolveHighAvailability`
- MSW component test for `SchemaSelector` asserting `multigres` is
hidden on HA projects and still shown on non-HA projects

The filter is HA-gated on purpose: a self-hosted/non-HA user with their
own schema named `multigres` still sees it. The flag-gated Multigres
option in Logs is intentionally untouched — that exposure is kept for
the Multigres team's debugging (separate track).

## To test

- On an HA project (`high_availability: true`): hover the High
Availability badge on project overview — no "Multigres" mention; open
schema dropdowns in Table Editor / Database pages / SQL editor
autocomplete — no `multigres` schema
- Project creation with HA entitlement: toggle description has no
Multigres wording/link
- On a non-HA project: schema dropdowns behave as before

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Improvements**
* Made schema dropdowns and related selectors high-availability aware
across extensions, indexes, integrations, SQL editing, API exposed
schemas, and relationship editors.
* Updated project high-availability UI text and badge hover description
to remove outdated branding and clarify horizontally scalable Postgres
architecture.
* **Tests**
* Added coverage to ensure the schema “multigres” option is hidden/shown
correctly based on high availability, and validated high-availability
value handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

UI / design-system consistency (accessibility).

## What is the current behavior?

Keyboard focus rings are inconsistent across Studio and `packages/ui`:

- Custom Button uses thick `outline` with per-variant colours (brand /
grey / destructive / warning)
- Form controls use muted grey rings (`ring-background-control`)
- Tabs / NavMenu / Radio use soft brand `ring-ring`
- Studio `.inset-focus` uses dark green `outline-brand-600`

Related: [DEPR-354](https://linear.app/supabase/issue/DEPR-354).

## What is the new behavior?

One shared focus recipe, exposed as Tailwind `@utility` classes in
`packages/config/css/utilities.css`:

| Utility | Use when |
| --- | --- |
| `focus-ring` | Buttons, inputs, most controls (offset ring) |
| `focus-inset` | Dense/flush surfaces such as interactive table rows
(renamed from `inset-focus`) |

```txt
# focus-ring
outline-hidden
focus-visible:ring-2
focus-visible:ring-ring
focus-visible:ring-offset-2
focus-visible:ring-offset-background
```

Applied on Button, shadcn form controls, Menu/NavMenu, Command palette
trigger, Studio table rows, and related call sites. Documented in the
design-system accessibility docs. Variants do not change focus ring
colour.

When the ring must appear on a different element than the focused one
(e.g. Menu + ProductMenu `Link` via `group-focus-visible`, or InputGroup
via `:has()`), keep an explicit ring stack. The utilities bake in
`:focus-visible` on the same element.

## Additional context

**Out of scope**

- Full `packages/ui` / Studio / www sweep
- Legacy Studio form-group green box-shadow cleanup
- ESLint rule for bare `outline-none`

## Test plan

Prefer Safari (“hard mode” for `tabIndex`). Expect one soft brand ring
everywhere: not grey, not solid green outline.

### Design system

- [ ]
[Accessibility](https://design-system-git-dnywh-choreimprove-tab-focus-styles-supabase.vercel.app/design-system/docs/accessibility):
recipe docs match what you see
- [ ]
[Button](https://design-system-git-dnywh-choreimprove-tab-focus-styles-supabase.vercel.app/design-system/docs/components/button):
Tab primary / default / danger; same ring colour
- [ ] [Table → Row-level
navigation](https://design-system-git-dnywh-choreimprove-tab-focus-styles-supabase.vercel.app/design-system/docs/components/table#row-level-navigation):
Tab an interactive row; inset outline (`focus-inset`) sits inside the
row

### Studio

- [ ] **Org home → table view** (`/organizations/_` or org projects):
switch to the table layout, Tab onto a project row; inset outline sits
inside the row (list/card view uses CardButton, not `focus-inset`)
- [ ] **Project sidebar** (Database, Auth, Storage, …): Tab the main
product nav links; ring follows the focused item (not the nested section
menus like Tables / Roles)
- [ ] **Storage → Files**: Tab a bucket row; same inset outline as org
table rows
- [ ] **Project Settings → General** (or Compute and Disk): Tab through
inputs, checkboxes, switches, selects; same offset ring, no ring on
mouse click
- [ ] **Header ⌘K** (desktop width): Tab to the search control after
Feedback; same soft brand `focus-ring` (was a thicker
`ring-border-strong` before)
- [ ] **Table Editor or SQL Editor tabs**: focus a tab, Tab to × if
active; close shows a ring
- [ ] **Light + dark**: ring stays visible against both backgrounds
@pull pull Bot locked and limited conversation to collaborators Jul 22, 2026
@pull pull Bot added the ⤵️ pull label Jul 22, 2026
@pull
pull Bot merged commit c8aca8d into code:master Jul 22, 2026
2 of 20 checks passed
@github-actions github-actions Bot added the documentation Improvements or additions to documentation label Jul 23, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

⤵️ pull documentation Improvements or additions to documentation

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants