Merge branch 'master' into claude/festive-goodall

Author: jordienr

.github/workflows/publish_image.yml

@@ -8,6 +8,8 @@ on:
 
 permissions:
   contents: read
+  packages: write
+  id-token: write
 
 jobs:
   settings:

.github/workflows/studio-e2e-test.yml

@@ -43,11 +43,13 @@ jobs:
               - 'e2e/studio/**'
               - 'pnpm-lock.yaml'
               - '.github/workflows/studio-e2e-test.yml'
+
       - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
         if: steps.filter.outputs.studio == 'true'
         name: Install pnpm
         with:
           run_install: false
+
       - name: Use Node.js
         if: steps.filter.outputs.studio == 'true'
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -69,7 +71,6 @@ jobs:
         with:
           # See here for caching with `yarn`, `bun` or other package managers https://github.com/actions/cache/blob/main/examples.md or you can leverage caching with actions/setup-node https://github.com/actions/setup-node
           path: |
-            .turbo/cache
             apps/studio/.next/build
             apps/studio/.next/cache
           # Generate a new cache whenever packages or source files change.
@@ -82,6 +83,14 @@ jobs:
         if: steps.filter.outputs.studio == 'true'
         run: rm -rf supabase && pnpm exec supabase init && mkdir supabase/functions
 
+      - name: Start supabase
+        if: steps.filter.outputs.studio == 'true'
+        run: SKIP_ASSET_UPLOAD=1 pnpm run e2e:setup:cli
+
+      - name: Build studio
+        if: steps.filter.outputs.studio == 'true'
+        run: SKIP_ASSET_UPLOAD=1 NODE_ENV=test NODE_OPTIONS="--max-old-space-size=4096" pnpm run build:studio
+
       - name: 🚀 Run Playwright tests against Vercel Preview
         if: steps.filter.outputs.studio == 'true'
         id: playwright

.github/workflows/ui-tests.yml

@@ -70,6 +70,11 @@ jobs:
     continue-on-error: true
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          sparse-checkout: |
+            packages/ui
+            patches
       - name: Download coverage artifact
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:

apps/design-system/content/docs/components/sheet.mdx

@@ -13,13 +13,11 @@ source:
 <ComponentPreview name="sheet-demo" peekCode wide />
 
 1. **Use for side panels**
-
    - Forms with multiple fields
    - Settings panels
    - Detailed editors
 
 2. **Consider screen size**
-
    - Sheets work well on desktop
    - On mobile, consider full-screen or bottom sheet variants
 

apps/design-system/content/docs/icons.mdx

@@ -45,14 +45,13 @@ function app() {
 }
 ```
 
-**Default props**: All icons default to `size={24}`. Stroke and fill defaults come from the source SVG's root attributes (e.g. `stroke-width="1"` in the source becomes the component's default `strokeWidth`). Override these props as needed for your use case.
+**Default props**: All icons default to `size={24}`. Stroke and fill defaults come from the source SVG's root attributes (e.g. `stroke-width="1"` on the root `<svg>` becomes the component's default `strokeWidth`). You can override those defaults at the call site, but any `stroke`, `fill`, or `stroke-width` set on individual child paths will still win.
 
 ### Adding new custom icons
 
 Follow these steps to add a new custom icon to the Supabase icon library.
 
 1. **Create SVG file**: Add your SVG file to `packages/icons/src/raw-icons/` with a kebab-case name (e.g., `my-new-icon.svg`). Make sure it follows these requirements:
-
    - Exported at 24×24px with `viewBox="0 0 24 24"`
    - Uses `stroke="currentColor"` for strokes (no hardcoded colors)
    - Uses `stroke-width="1.5"` (deviate based on optical weight if necessary)
@@ -63,7 +62,7 @@ Follow these steps to add a new custom icon to the Supabase icon library.
 
    For **fill-only icons** (e.g. logos that use shapes instead of strokes), add `stroke="none"` to the root `<svg>` element. The build will propagate this so the component never renders an unwanted stroke.
 
-Leave attributes like `stroke-width` as they are. The root SVG's `fill`, `stroke`, `stroke-width`, `stroke-linecap`, and `stroke-linejoin` attributes are automatically propagated as the component's defaults by the build process. The conversion to camel-case for React compatibility (e.g. `strokeWidth`) is also handled automatically.
+Prefer putting shared styling like `fill`, `stroke`, `stroke-width`, `stroke-linecap`, and `stroke-linejoin` on the root `<svg>`. The build propagates those root attributes as the component's defaults, and also converts them to camel-case for React compatibility (e.g. `strokeWidth`). If you put those attributes on individual child paths instead, they become fixed path-level styling and will override props passed to the component.
 
 2. **Build the component**: Run `npm run build:icons` from inside the `packages/icons` directory
 
@@ -133,4 +132,4 @@ Note `stroke="none"` on the root to prevent unwanted strokes, and `fill="current
 
 ### Troubleshooting
 
-If your SVG specifies `stroke-width` attributes, they will override the component's `strokeWidth` prop. Remove stroke attributes from individual paths to let the component control them.
+If your SVG specifies `stroke-width` attributes on individual child paths, they will override the component's `strokeWidth` prop. Keep shared stroke attributes on the root `<svg>` and remove them from individual paths if you want consumers to control stroke weight.

apps/design-system/content/docs/ui-patterns/forms.mdx

@@ -32,7 +32,6 @@ Forms in side panels (Sheets) use `FormItemLayout` with `layout="horizontal"` on
 1. **Always use FormItemLayout**: Use `FormItemLayout` instead of manually composing `FormItem`, `FormLabel`, `FormMessage`, and `FormDescription`.
 
 2. **Layout selection**:
-
    - Use `layout="flex-row-reverse"` for page layouts (horizontal alignment)
    - Use `layout="horizontal"` for side panels with more width
    - Use `layout="vertical"` for side panels with limited width

apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts

@@ -2835,6 +2835,7 @@ export const self_hosting: NavMenuConstant = {
     {
       name: 'How-to Guides',
       items: [
+        { name: 'Configure new API keys', url: '/guides/self-hosting/self-hosted-auth-keys' },
         { name: 'Self-Hosted Functions', url: '/guides/self-hosting/self-hosted-functions' },
         {
           name: 'Add Reverse Proxy with HTTPS',

apps/docs/content/_partials/auth_rate_limits.mdx

@@ -1,14 +1,11 @@
-| Endpoint                                         | Path                                                           | Limited By               | Rate Limit                                                                                                                                                                                                                                                     |
-| ------------------------------------------------ | -------------------------------------------------------------- | ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| All endpoints that send emails                   | `/auth/v1/signup` `/auth/v1/recover` `/auth/v1/user`[^1]       | Sum of combined requests | Defaults to 4 emails per hour as of 14th July 2023. As of 21 Oct 2023, this has been updated to <SharedData data="config">auth.rate_limits.email.inbuilt_smtp_per_hour</SharedData> emails per hour. You can only change this with your own custom SMTP setup. |
-| All endpoints that send One-Time-Passwords (OTP) | `/auth/v1/otp`                                                 | Sum of combined requests | Defaults to <SharedData data="config">auth.rate_limits.otp.requests_per_hour</SharedData> OTPs per hour. Is customizable.                                                                                                                                      |
-| Send OTPs or magic links                         | `/auth/v1/otp`                                                 | Last request of the user | Defaults to <SharedData data="config">auth.rate_limits.otp.period</SharedData> window before a new request is allowed to the same user. Is customizable.                                                                                                       |
-| Signup confirmation request                      | `/auth/v1/signup`                                              | Last request of the user | Defaults to <SharedData data="config">auth.rate_limits.signup_confirmation.period</SharedData> window before a new request is allowed to the same user. Is customizable.                                                                                       |
-| Password Reset Request                           | `/auth/v1/recover`                                             | Last request of the user | Defaults to <SharedData data="config">auth.rate_limits.password_reset.period</SharedData> window before a new request is allowed to the same user. Is customizable.                                                                                            |
-| Verification requests                            | `/auth/v1/verify`                                              | IP Address               | <SharedData data="config">auth.rate_limits.verification.requests_per_hour</SharedData> requests per hour (with bursts up to <SharedData data="config">auth.rate_limits.verification.requests_burst</SharedData> requests)                                      |
-| Token refresh requests                           | `/auth/v1/token`                                               | IP Address               | <SharedData data="config">auth.rate_limits.token_refresh.requests_per_hour</SharedData> requests per hour (with bursts up to <SharedData data="config">auth.rate_limits.token_refresh.requests_burst</SharedData> requests)                                    |
-| Create or Verify an MFA challenge                | `/auth/v1/factors/:id/challenge` `/auth/v1/factors/:id/verify` | IP Address               | <SharedData data="config">auth.rate_limits.mfa.requests_per_hour</SharedData> requests per hour (with bursts up to <SharedData data="config">auth.rate_limits.verification.mfa</SharedData> requests)                                                          |
-| Anonymous sign-ins                               | `/auth/v1/signup`[^2]                                          | IP Address               | <SharedData data="config">auth.rate_limits.anonymous_signin.requests_per_hour</SharedData> requests per hour (with bursts up to <SharedData data="config">auth.rate_limits.anonymous_signin.requests_burst</SharedData> requests)                              |
-
-[^1]: The rate limit is only applied on `/auth/v1/user` if this endpoint is called to update the user's email address.
-[^2]: The rate limit is only applied on `/auth/v1/signup` if this endpoint is called without passing in an email or phone number in the request body.
+| Operation                          | Path                                                           | Limited By                            | Customizable     | Limit                                                                                                                                                                                                                                                                                                                                                  |
+| ---------------------------------- | -------------------------------------------------------------- | ------------------------------------- | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Endpoints that trigger email sends | `/auth/v1/signup` `/auth/v1/recover` `/auth/v1/user`           | Sum of combined requests project-wide | Custom SMTP Only | <SharedData data="config">auth.rate_limits.email.inbuilt_smtp_per_hour</SharedData> emails per hour with the built-in email provider. You can only change this with a custom SMTP setup. The rate limit is only applied on `/auth/v1/user` if this endpoint is called to update the user's email address.                                              |
+| Send One-Time-Passwords (OTP)      | `/auth/v1/otp`                                                 | Sum of combined requests project-wide | Yes              | Defaults to <SharedData data="config">auth.rate_limits.otp.requests_per_hour</SharedData> OTPs per hour.                                                                                                                                                                                                                                               |
+| Send OTPs or magic links           | `/auth/v1/otp`                                                 | Last request of the user              | Yes              | Defaults to <SharedData data="config">auth.rate_limits.otp.period</SharedData> window before a new request is allowed to the same user.                                                                                                                                                                                                                |
+| Signup confirmation request        | `/auth/v1/signup`                                              | Last request of the user              | Yes              | Defaults to <SharedData data="config">auth.rate_limits.signup_confirmation.period</SharedData> window before a new request is allowed to the same user.                                                                                                                                                                                                |
+| Password Reset Request             | `/auth/v1/recover`                                             | Last request of the user              | Yes              | Defaults to <SharedData data="config">auth.rate_limits.password_reset.period</SharedData> window before a new request is allowed to the same user.                                                                                                                                                                                                     |
+| Verification requests              | `/auth/v1/verify`                                              | IP Address                            | No               | <SharedData data="config">auth.rate_limits.verification.requests_per_hour</SharedData> requests per hour (with bursts up to <SharedData data="config">auth.rate_limits.verification.requests_burst</SharedData> requests)                                                                                                                              |
+| Token refresh requests             | `/auth/v1/token`                                               | IP Address                            | No               | <SharedData data="config">auth.rate_limits.token_refresh.requests_per_hour</SharedData> requests per hour (with bursts up to <SharedData data="config">auth.rate_limits.token_refresh.requests_burst</SharedData> requests)                                                                                                                            |
+| Create or Verify an MFA challenge  | `/auth/v1/factors/:id/challenge` `/auth/v1/factors/:id/verify` | IP Address                            | No               | <SharedData data="config">auth.rate_limits.mfa.requests_per_hour</SharedData> requests per hour (with bursts up to <SharedData data="config">auth.rate_limits.verification.mfa</SharedData> requests)                                                                                                                                                  |
+| Anonymous sign-ins                 | `/auth/v1/signup`                                              | IP Address                            | No               | <SharedData data="config">auth.rate_limits.anonymous_signin.requests_per_hour</SharedData> requests per hour (with bursts up to <SharedData data="config">auth.rate_limits.anonymous_signin.requests_burst</SharedData> requests). Rate limit only applies if this endpoint is called without passing in an email or phone number in the request body. |

apps/docs/content/_partials/billing/pricing/pricing_edge_functions.mdx

@@ -1,5 +1,5 @@
-<Price price="2" /> per 1 million invocations. You are only charged for usage exceeding your subscription
-plan's quota.
+<Price price="2" /> per 1 million invocations. You are only charged for usage exceeding your
+subscription plan's quota.
 
 | Plan       | Quota     | Over-Usage                                    |
 | ---------- | --------- | --------------------------------------------- |

apps/docs/content/_partials/billing/pricing/pricing_mau_sso.mdx

@@ -1,6 +1,6 @@
 ## Pricing
 
-<Price price="0.015" /> per SSO MAU. You are only charged for usage exceeding your subscription plan's
-quota.
+<Price price="0.015" /> per SSO MAU. You are only charged for usage exceeding your subscription
+plan's quota.
 
 For a detailed breakdown of how charges are calculated, refer to [Manage Monthly Active SSO Users usage](/docs/guides/platform/manage-your-usage/monthly-active-users-sso).