close
Skip to content

fix: atomic parser #5064

Merged
avallete merged 3 commits intosupabase:developfrom
7ttp:fix/atomic-supersedes
Apr 14, 2026
Merged

fix: atomic parser #5064
avallete merged 3 commits intosupabase:developfrom
7ttp:fix/atomic-supersedes

Conversation

@7ttp
Copy link
Copy Markdown
Contributor

@7ttp 7ttp commented Apr 10, 2026 •
edited
Loading

TL;DR

fixes SQL parser incorrectly treating function names containing "atomic" as BEGIN ATOMIC syntax

problem

saw multiple reports that:

The SQL parser treats any occurrence of "atomic" as BEGIN ATOMIC syntax,
even when it's part of a func somewhat like atomic_example()
which causes migrations to fail when a func with "atomic" in its name is followed by another statement

CREATE FUNCTION atomic_example() RETURNS INTEGER AS $$ ... $$;
GRANT EXECUTE ON FUNCTION atomic_example() TO authenticated;
-- ERROR: cannot insert multiple commands into a prepared statement

sol

check that "atomic" is actually part of BEGIN ATOMIC syntax,
not just a substring in an identifier
parser now verifies that both BEGIN and ATOMIC are standalone keywords, not part of function names or other identifiers.

ref:

@7ttp 7ttp requested a review from a team as a code owner April 10, 2026 21:16
@coveralls
Copy link
Copy Markdown

coveralls commented Apr 10, 2026 •
edited
Loading

Coverage Report for CI Build 24411795788

Warning

Build has drifted: This PR's base is out of sync with its target branch, so coverage data may include unrelated changes.
Quick fix: rebase this PR. Learn more →

Coverage decreased (-0.02%) to 63.751%

Details

  • Coverage decreased (-0.02%) from the base build.
  • Patch coverage: No coverable lines changed in this PR.
  • 5 coverage regressions across 1 file.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

5 previously-covered lines in 1 file lost coverage.

File Lines Losing Coverage Coverage
internal/utils/git.go 5 57.14%

Coverage Stats

Coverage Status
Relevant Lines: 15363
Covered Lines: 9794
Line Coverage: 63.75%
Coverage Strength: 7.03 hits per line
💛 - Coveralls

@avallete
Copy link
Copy Markdown
Member

avallete commented Apr 14, 2026

Thank's for the fix !

@avallete avallete enabled auto-merge (squash) April 14, 2026 16:52
@avallete avallete merged commit 3be2887 into supabase:develop Apr 14, 2026
10 checks passed
@supabase-cli-releaser supabase-cli-releaser Bot mentioned this pull request Apr 21, 2026
Merged
avallete added a commit that referenced this pull request Apr 24, 2026
@supabase-cli-releaser @avallete
@fadymak @7ttp @seanoliver @sweatybridge @jgoux @dependabot @myerekapan @kallebysantos @claude
Prod deploy (#5109)
8c9553c 
* fix(pg-delta): declarative-sync-no-declarative-dir-set (#5078)

* feat(declarative): add tests for skipping config updates when PgDelta is enabled

- These tests verify that the configuration remains unchanged when PgDelta is enabled, ensuring the declarative directory is the source of truth.
- Updated the WriteDeclarativeSchemas function to reflect the new behavior regarding PgDelta configuration.

* fix(declarative): DSL change due to upgrade

* feat(auth): add support for configuring passkeys and webauthn (#5077)

* fix: atomic parser  (#5064)

* fix

* test

---------

Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>

* fix(pg-delta): declarative apply error results (#5082)

* fix(pg-delta): declarative apply error results

Improve readability report for decalrative appy errors wrapping

* chore: upgrade pg-delta to alpha 13

* feat(telemetry): attach org/project groups to all CLI events

Only ~19% of CLI events had PostHog group properties ($group_0, $group_1)
because groups were only set during `supabase link`. Commands using
--project-ref without linking sent events invisible to group analytics.

Add EnsureProjectGroupsCached which resolves and caches project metadata
(including org ID) in linked-project.json when a project ref is available.
The cache is checked before every cli_command_executed event, so the API
call only happens once per unique project ref.

Closes GROWTH-761

* fix: address code review feedback

- Guard against log.Fatalln crash: check auth token before calling
  GetSupabase(), and move the API call to cmd/root.go where it belongs
- Don't overwrite existing linked-project.json cache — supabase link
  is the authoritative source, we only fill the gap when no cache exists
- Fire GroupIdentify for org and project after caching, matching the
  link flow so PostHog has group metadata
- Restructure so telemetry package has no API dependencies (pure
  caching + PostHog calls), making tests reliable without gock/mocks

* fix: adds etl to managed schema (#5090)

* chore: sync API types from infrastructure (#5093)

Co-authored-by: supabase-cli-releaser[bot] <246109035+supabase-cli-releaser[bot]@users.noreply.github.com>

* chore(deps): bump the actions-major group across 1 directory with 5 updates (#5088)

Bumps the actions-major group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `3.0.0` | `3.1.1` |
| [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) | `8.1.0` | `8.1.1` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.35.1` | `4.35.2` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `7.0.0` | `7.1.0` |



Updates `actions/create-github-app-token` from 3.0.0 to 3.1.1
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Commits](actions/create-github-app-token@f8d387b...1b10c78)

Updates `peter-evans/create-pull-request` from 8.1.0 to 8.1.1
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](peter-evans/create-pull-request@c0f553f...5f6978f)

Updates `actions/upload-artifact` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@bbbca2d...043fb46)

Updates `github/codeql-action` from 4.35.1 to 4.35.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@c10b806...95e58e9)

Updates `docker/build-push-action` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@d08e5c3...bcafcac)

---
updated-dependencies:
- dependency-name: actions/create-github-app-token
  dependency-version: 3.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: peter-evans/create-pull-request
  dependency-version: 8.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-major
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-major
- dependency-name: github/codeql-action
  dependency-version: 4.35.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-major
- dependency-name: docker/build-push-action
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>

* fix: functions download (#5096)

* fix

* test

---------

Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>

* feat(db): strengthen RLS advisory message for stronger agent compliance

* chore(deps): upgrade pg-delta to alpha.17 (#5110)

Closes: #5094

* chore(deps): bump the actions-major group across 1 directory with 4 updates (#5108)

Bumps the actions-major group with 4 updates in the / directory: [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata), [t1m0thyj/unlock-keyring](https://github.com/t1m0thyj/unlock-keyring), [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) and [actions/setup-node](https://github.com/actions/setup-node).


Updates `dependabot/fetch-metadata` from 3.0.0 to 3.1.0
- [Release notes](https://github.com/dependabot/fetch-metadata/releases)
- [Commits](dependabot/fetch-metadata@ffa630c...25dd0e3)

Updates `t1m0thyj/unlock-keyring` from 1.1.0 to 1.2.0
- [Release notes](https://github.com/t1m0thyj/unlock-keyring/releases)
- [Commits](t1m0thyj/unlock-keyring@728cc71...cbcf205)

Updates `goreleaser/goreleaser-action` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](goreleaser/goreleaser-action@ec59f47...e24998b)

Updates `actions/setup-node` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@53b8394...48b55a0)

---
updated-dependencies:
- dependency-name: dependabot/fetch-metadata
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: t1m0thyj/unlock-keyring
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: goreleaser/goreleaser-action
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: actions/setup-node
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>

* fix(docker): bump the docker-minor group across 1 directory with 6 updates (#5079)

* fix(docker): bump the docker-minor group across 1 directory with 6 updates

Bumps the docker-minor group with 6 updates in the /pkg/config/templates directory:

| Package | From | To |
| --- | --- | --- |
| postgrest/postgrest | `v14.8` | `v14.9` |
| supabase/studio | `2026.04.08-sha-205cbe7` | `2026.04.13-sha-e95f1cc` |
| supabase/edge-runtime | `v1.73.3` | `v1.73.5` |
| supabase/realtime | `v2.82.0` | `v2.83.1` |
| supabase/storage-api | `v1.48.28` | `v1.51.0` |
| supabase/logflare | `1.37.1` | `1.38.2` |



Updates `postgrest/postgrest` from v14.8 to v14.9

Updates `supabase/studio` from 2026.04.08-sha-205cbe7 to 2026.04.13-sha-e95f1cc

Updates `supabase/edge-runtime` from v1.73.3 to v1.73.5

Updates `supabase/realtime` from v2.82.0 to v2.83.1

Updates `supabase/storage-api` from v1.48.28 to v1.51.0

Updates `supabase/logflare` from 1.37.1 to 1.38.2

---
updated-dependencies:
- dependency-name: postgrest/postgrest
  dependency-version: v14.9
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/studio
  dependency-version: 2026.04.13-sha-e95f1cc
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/edge-runtime
  dependency-version: v1.73.5
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/realtime
  dependency-version: v2.83.1
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/storage-api
  dependency-version: v1.51.0
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/logflare
  dependency-version: 1.38.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Downgrade postgrest version from 14.9 to 14.8

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>

* chore(workflows): enable install scripts for supabase package in Yarn (#5111)

chore(workflows): enable install scripts for supabase package in Yarn Berry setup

This change sets the YARN_ENABLE_SCRIPTS environment variable to true during the installation of the supabase package, allowing its postinstall script to run as required by Yarn Berry 4.14+. This adjustment ensures the necessary binary is fetched correctly.

* feat: --diff-engine flag on db pull

* fix(docker): bump the docker-minor group in /pkg/config/templates with 6 updates (#5113)

fix(docker): bump the docker-minor group

Bumps the docker-minor group in /pkg/config/templates with 6 updates:

| Package | From | To |
| --- | --- | --- |
| postgrest/postgrest | `v14.8` | `v14.10` |
| supabase/studio | `2026.04.13-sha-e95f1cc` | `2026.04.20-sha-b721a2d` |
| supabase/edge-runtime | `v1.73.5` | `v1.73.13` |
| supabase/realtime | `v2.83.1` | `v2.86.3` |
| supabase/storage-api | `v1.51.0` | `v1.54.1` |
| supabase/logflare | `1.38.2` | `1.39.1` |


Updates `postgrest/postgrest` from v14.8 to v14.10

Updates `supabase/studio` from 2026.04.13-sha-e95f1cc to 2026.04.20-sha-b721a2d

Updates `supabase/edge-runtime` from v1.73.5 to v1.73.13

Updates `supabase/realtime` from v2.83.1 to v2.86.3

Updates `supabase/storage-api` from v1.51.0 to v1.54.1

Updates `supabase/logflare` from 1.38.2 to 1.39.1

---
updated-dependencies:
- dependency-name: postgrest/postgrest
  dependency-version: v14.10
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/studio
  dependency-version: 2026.04.20-sha-b721a2d
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/edge-runtime
  dependency-version: v1.73.13
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/realtime
  dependency-version: v2.86.3
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/storage-api
  dependency-version: v1.54.1
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/logflare
  dependency-version: 1.39.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>

* feat: exposing new api keys to functions (#4946)

Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>

* chore: upgrade pg-delta to alpha.20 in multiple templates

* fix: remove version comparison check for storage image updates (#5118)

fix: honor pinned storage version offline

Remove the version comparison that only pinned storage when the local
version was newer than the default. This prevented `supabase start` from
using an already-downloaded image offline, since Docker would still try
to pull the default newer image.

Fixes CLI-1393.

Co-authored-by: Claude <noreply@anthropic.com>

* fix: improve error handling and output formatting in pg-delta apply process (#5120)

- Updated the `runDeclarativeSync` function to avoid wrapping SQL output with `utils.Bold`, preventing excessive whitespace in multi-line SQL.
- Changed the result accumulation in `migra.ts` from string concatenation to an array for better performance and clarity.
- Enhanced the `ApplyResult` struct to include `ValidationErrors` and `Diagnostics`, allowing for more detailed error reporting.
- Modified the `formatApplyFailure` function to include validation errors and diagnostics in the output, improving user feedback on apply failures.
- Added tests for validation error handling in `apply_test.go` to ensure robustness against various error scenarios.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>
Co-authored-by: fadymak <dev@fadymak.com>
Co-authored-by: Vaibhav <117663341+7ttp@users.noreply.github.com>
Co-authored-by: Sean Oliver <882952+seanoliver@users.noreply.github.com>
Co-authored-by: Han Qiao <sweatybridge@gmail.com>
Co-authored-by: Julien Goux <hi@jgoux.dev>
Co-authored-by: supabase-cli-releaser[bot] <246109035+supabase-cli-releaser[bot]@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Mert YEREKAPAN <mertyerekapan@gmail.com>
Co-authored-by: Mert YEREKAPAN <33198490+myerekapan@users.noreply.github.com>
Co-authored-by: Kalleby Santos <105971119+kallebysantos@users.noreply.github.com>
Co-authored-by: avallete <andrew.valleteau@supabase.io>
Co-authored-by: Claude <noreply@anthropic.com>
avallete added a commit that referenced this pull request Apr 27, 2026
@avallete @supabase-cli-releaser
@fadymak @7ttp @seanoliver @sweatybridge @jgoux @dependabot @myerekapan @kallebysantos @claude
chore: resync develop with main (#5123)
3596a05 
Prod deploy (#5109)

* fix(pg-delta): declarative-sync-no-declarative-dir-set (#5078)

* feat(declarative): add tests for skipping config updates when PgDelta is enabled

- These tests verify that the configuration remains unchanged when PgDelta is enabled, ensuring the declarative directory is the source of truth.
- Updated the WriteDeclarativeSchemas function to reflect the new behavior regarding PgDelta configuration.

* fix(declarative): DSL change due to upgrade

* feat(auth): add support for configuring passkeys and webauthn (#5077)

* fix: atomic parser  (#5064)

* fix

* test

---------



* fix(pg-delta): declarative apply error results (#5082)

* fix(pg-delta): declarative apply error results

Improve readability report for decalrative appy errors wrapping

* chore: upgrade pg-delta to alpha 13

* feat(telemetry): attach org/project groups to all CLI events

Only ~19% of CLI events had PostHog group properties ($group_0, $group_1)
because groups were only set during `supabase link`. Commands using
--project-ref without linking sent events invisible to group analytics.

Add EnsureProjectGroupsCached which resolves and caches project metadata
(including org ID) in linked-project.json when a project ref is available.
The cache is checked before every cli_command_executed event, so the API
call only happens once per unique project ref.

Closes GROWTH-761

* fix: address code review feedback

- Guard against log.Fatalln crash: check auth token before calling
  GetSupabase(), and move the API call to cmd/root.go where it belongs
- Don't overwrite existing linked-project.json cache — supabase link
  is the authoritative source, we only fill the gap when no cache exists
- Fire GroupIdentify for org and project after caching, matching the
  link flow so PostHog has group metadata
- Restructure so telemetry package has no API dependencies (pure
  caching + PostHog calls), making tests reliable without gock/mocks

* fix: adds etl to managed schema (#5090)

* chore: sync API types from infrastructure (#5093)



* chore(deps): bump the actions-major group across 1 directory with 5 updates (#5088)

Bumps the actions-major group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `3.0.0` | `3.1.1` |
| [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) | `8.1.0` | `8.1.1` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.35.1` | `4.35.2` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `7.0.0` | `7.1.0` |



Updates `actions/create-github-app-token` from 3.0.0 to 3.1.1
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Commits](actions/create-github-app-token@f8d387b...1b10c78)

Updates `peter-evans/create-pull-request` from 8.1.0 to 8.1.1
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](peter-evans/create-pull-request@c0f553f...5f6978f)

Updates `actions/upload-artifact` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@bbbca2d...043fb46)

Updates `github/codeql-action` from 4.35.1 to 4.35.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@c10b806...95e58e9)

Updates `docker/build-push-action` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@d08e5c3...bcafcac)

---
updated-dependencies:
- dependency-name: actions/create-github-app-token
  dependency-version: 3.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: peter-evans/create-pull-request
  dependency-version: 8.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-major
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-major
- dependency-name: github/codeql-action
  dependency-version: 4.35.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-major
- dependency-name: docker/build-push-action
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
...





* fix: functions download (#5096)

* fix

* test

---------



* feat(db): strengthen RLS advisory message for stronger agent compliance

* chore(deps): upgrade pg-delta to alpha.17 (#5110)

Closes: #5094

* chore(deps): bump the actions-major group across 1 directory with 4 updates (#5108)

Bumps the actions-major group with 4 updates in the / directory: [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata), [t1m0thyj/unlock-keyring](https://github.com/t1m0thyj/unlock-keyring), [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) and [actions/setup-node](https://github.com/actions/setup-node).


Updates `dependabot/fetch-metadata` from 3.0.0 to 3.1.0
- [Release notes](https://github.com/dependabot/fetch-metadata/releases)
- [Commits](dependabot/fetch-metadata@ffa630c...25dd0e3)

Updates `t1m0thyj/unlock-keyring` from 1.1.0 to 1.2.0
- [Release notes](https://github.com/t1m0thyj/unlock-keyring/releases)
- [Commits](t1m0thyj/unlock-keyring@728cc71...cbcf205)

Updates `goreleaser/goreleaser-action` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](goreleaser/goreleaser-action@ec59f47...e24998b)

Updates `actions/setup-node` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@53b8394...48b55a0)

---
updated-dependencies:
- dependency-name: dependabot/fetch-metadata
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: t1m0thyj/unlock-keyring
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: goreleaser/goreleaser-action
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: actions/setup-node
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
...





* fix(docker): bump the docker-minor group across 1 directory with 6 updates (#5079)

* fix(docker): bump the docker-minor group across 1 directory with 6 updates

Bumps the docker-minor group with 6 updates in the /pkg/config/templates directory:

| Package | From | To |
| --- | --- | --- |
| postgrest/postgrest | `v14.8` | `v14.9` |
| supabase/studio | `2026.04.08-sha-205cbe7` | `2026.04.13-sha-e95f1cc` |
| supabase/edge-runtime | `v1.73.3` | `v1.73.5` |
| supabase/realtime | `v2.82.0` | `v2.83.1` |
| supabase/storage-api | `v1.48.28` | `v1.51.0` |
| supabase/logflare | `1.37.1` | `1.38.2` |



Updates `postgrest/postgrest` from v14.8 to v14.9

Updates `supabase/studio` from 2026.04.08-sha-205cbe7 to 2026.04.13-sha-e95f1cc

Updates `supabase/edge-runtime` from v1.73.3 to v1.73.5

Updates `supabase/realtime` from v2.82.0 to v2.83.1

Updates `supabase/storage-api` from v1.48.28 to v1.51.0

Updates `supabase/logflare` from 1.37.1 to 1.38.2

---
updated-dependencies:
- dependency-name: postgrest/postgrest
  dependency-version: v14.9
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/studio
  dependency-version: 2026.04.13-sha-e95f1cc
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/edge-runtime
  dependency-version: v1.73.5
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/realtime
  dependency-version: v2.83.1
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/storage-api
  dependency-version: v1.51.0
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/logflare
  dependency-version: 1.38.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-minor
...



* Downgrade postgrest version from 14.9 to 14.8

---------





* chore(workflows): enable install scripts for supabase package in Yarn (#5111)

chore(workflows): enable install scripts for supabase package in Yarn Berry setup

This change sets the YARN_ENABLE_SCRIPTS environment variable to true during the installation of the supabase package, allowing its postinstall script to run as required by Yarn Berry 4.14+. This adjustment ensures the necessary binary is fetched correctly.

* feat: --diff-engine flag on db pull

* fix(docker): bump the docker-minor group in /pkg/config/templates with 6 updates (#5113)

fix(docker): bump the docker-minor group

Bumps the docker-minor group in /pkg/config/templates with 6 updates:

| Package | From | To |
| --- | --- | --- |
| postgrest/postgrest | `v14.8` | `v14.10` |
| supabase/studio | `2026.04.13-sha-e95f1cc` | `2026.04.20-sha-b721a2d` |
| supabase/edge-runtime | `v1.73.5` | `v1.73.13` |
| supabase/realtime | `v2.83.1` | `v2.86.3` |
| supabase/storage-api | `v1.51.0` | `v1.54.1` |
| supabase/logflare | `1.38.2` | `1.39.1` |


Updates `postgrest/postgrest` from v14.8 to v14.10

Updates `supabase/studio` from 2026.04.13-sha-e95f1cc to 2026.04.20-sha-b721a2d

Updates `supabase/edge-runtime` from v1.73.5 to v1.73.13

Updates `supabase/realtime` from v2.83.1 to v2.86.3

Updates `supabase/storage-api` from v1.51.0 to v1.54.1

Updates `supabase/logflare` from 1.38.2 to 1.39.1

---
updated-dependencies:
- dependency-name: postgrest/postgrest
  dependency-version: v14.10
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/studio
  dependency-version: 2026.04.20-sha-b721a2d
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/edge-runtime
  dependency-version: v1.73.13
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/realtime
  dependency-version: v2.86.3
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/storage-api
  dependency-version: v1.54.1
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/logflare
  dependency-version: 1.39.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-minor
...





* feat: exposing new api keys to functions (#4946)



* chore: upgrade pg-delta to alpha.20 in multiple templates

* fix: remove version comparison check for storage image updates (#5118)

fix: honor pinned storage version offline

Remove the version comparison that only pinned storage when the local
version was newer than the default. This prevented `supabase start` from
using an already-downloaded image offline, since Docker would still try
to pull the default newer image.

Fixes CLI-1393.



* fix: improve error handling and output formatting in pg-delta apply process (#5120)

- Updated the `runDeclarativeSync` function to avoid wrapping SQL output with `utils.Bold`, preventing excessive whitespace in multi-line SQL.
- Changed the result accumulation in `migra.ts` from string concatenation to an array for better performance and clarity.
- Enhanced the `ApplyResult` struct to include `ValidationErrors` and `Diagnostics`, allowing for more detailed error reporting.
- Modified the `formatApplyFailure` function to include validation errors and diagnostics in the output, improving user feedback on apply failures.
- Added tests for validation error handling in `apply_test.go` to ensure robustness against various error scenarios.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: supabase-cli-releaser[bot] <246109035+supabase-cli-releaser[bot]@users.noreply.github.com>
Co-authored-by: fadymak <dev@fadymak.com>
Co-authored-by: Vaibhav <117663341+7ttp@users.noreply.github.com>
Co-authored-by: Sean Oliver <882952+seanoliver@users.noreply.github.com>
Co-authored-by: Han Qiao <sweatybridge@gmail.com>
Co-authored-by: Julien Goux <hi@jgoux.dev>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Mert YEREKAPAN <mertyerekapan@gmail.com>
Co-authored-by: Mert YEREKAPAN <33198490+myerekapan@users.noreply.github.com>
Co-authored-by: Kalleby Santos <105971119+kallebysantos@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
This was referenced Apr 27, 2026
Closed
Merged
@BrewTestBot BrewTestBot mentioned this pull request Apr 27, 2026
Merged
avallete added a commit that referenced this pull request Apr 28, 2026
@avallete @supabase-cli-releaser
@fadymak @7ttp @seanoliver @sweatybridge @jgoux @dependabot @myerekapan @kallebysantos @claude
chore: resync develop with main (#5123)
85a93a6 
Prod deploy (#5109)

* fix(pg-delta): declarative-sync-no-declarative-dir-set (#5078)

* feat(declarative): add tests for skipping config updates when PgDelta is enabled

- These tests verify that the configuration remains unchanged when PgDelta is enabled, ensuring the declarative directory is the source of truth.
- Updated the WriteDeclarativeSchemas function to reflect the new behavior regarding PgDelta configuration.

* fix(declarative): DSL change due to upgrade

* feat(auth): add support for configuring passkeys and webauthn (#5077)

* fix: atomic parser  (#5064)

* fix

* test

---------



* fix(pg-delta): declarative apply error results (#5082)

* fix(pg-delta): declarative apply error results

Improve readability report for decalrative appy errors wrapping

* chore: upgrade pg-delta to alpha 13

* feat(telemetry): attach org/project groups to all CLI events

Only ~19% of CLI events had PostHog group properties ($group_0, $group_1)
because groups were only set during `supabase link`. Commands using
--project-ref without linking sent events invisible to group analytics.

Add EnsureProjectGroupsCached which resolves and caches project metadata
(including org ID) in linked-project.json when a project ref is available.
The cache is checked before every cli_command_executed event, so the API
call only happens once per unique project ref.

Closes GROWTH-761

* fix: address code review feedback

- Guard against log.Fatalln crash: check auth token before calling
  GetSupabase(), and move the API call to cmd/root.go where it belongs
- Don't overwrite existing linked-project.json cache — supabase link
  is the authoritative source, we only fill the gap when no cache exists
- Fire GroupIdentify for org and project after caching, matching the
  link flow so PostHog has group metadata
- Restructure so telemetry package has no API dependencies (pure
  caching + PostHog calls), making tests reliable without gock/mocks

* fix: adds etl to managed schema (#5090)

* chore: sync API types from infrastructure (#5093)



* chore(deps): bump the actions-major group across 1 directory with 5 updates (#5088)

Bumps the actions-major group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `3.0.0` | `3.1.1` |
| [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) | `8.1.0` | `8.1.1` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.35.1` | `4.35.2` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `7.0.0` | `7.1.0` |



Updates `actions/create-github-app-token` from 3.0.0 to 3.1.1
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Commits](actions/create-github-app-token@f8d387b...1b10c78)

Updates `peter-evans/create-pull-request` from 8.1.0 to 8.1.1
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](peter-evans/create-pull-request@c0f553f...5f6978f)

Updates `actions/upload-artifact` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@bbbca2d...043fb46)

Updates `github/codeql-action` from 4.35.1 to 4.35.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@c10b806...95e58e9)

Updates `docker/build-push-action` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@d08e5c3...bcafcac)

---
updated-dependencies:
- dependency-name: actions/create-github-app-token
  dependency-version: 3.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: peter-evans/create-pull-request
  dependency-version: 8.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-major
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-major
- dependency-name: github/codeql-action
  dependency-version: 4.35.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-major
- dependency-name: docker/build-push-action
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
...





* fix: functions download (#5096)

* fix

* test

---------



* feat(db): strengthen RLS advisory message for stronger agent compliance

* chore(deps): upgrade pg-delta to alpha.17 (#5110)

Closes: #5094

* chore(deps): bump the actions-major group across 1 directory with 4 updates (#5108)

Bumps the actions-major group with 4 updates in the / directory: [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata), [t1m0thyj/unlock-keyring](https://github.com/t1m0thyj/unlock-keyring), [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) and [actions/setup-node](https://github.com/actions/setup-node).


Updates `dependabot/fetch-metadata` from 3.0.0 to 3.1.0
- [Release notes](https://github.com/dependabot/fetch-metadata/releases)
- [Commits](dependabot/fetch-metadata@ffa630c...25dd0e3)

Updates `t1m0thyj/unlock-keyring` from 1.1.0 to 1.2.0
- [Release notes](https://github.com/t1m0thyj/unlock-keyring/releases)
- [Commits](t1m0thyj/unlock-keyring@728cc71...cbcf205)

Updates `goreleaser/goreleaser-action` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](goreleaser/goreleaser-action@ec59f47...e24998b)

Updates `actions/setup-node` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@53b8394...48b55a0)

---
updated-dependencies:
- dependency-name: dependabot/fetch-metadata
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: t1m0thyj/unlock-keyring
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: goreleaser/goreleaser-action
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: actions/setup-node
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
...





* fix(docker): bump the docker-minor group across 1 directory with 6 updates (#5079)

* fix(docker): bump the docker-minor group across 1 directory with 6 updates

Bumps the docker-minor group with 6 updates in the /pkg/config/templates directory:

| Package | From | To |
| --- | --- | --- |
| postgrest/postgrest | `v14.8` | `v14.9` |
| supabase/studio | `2026.04.08-sha-205cbe7` | `2026.04.13-sha-e95f1cc` |
| supabase/edge-runtime | `v1.73.3` | `v1.73.5` |
| supabase/realtime | `v2.82.0` | `v2.83.1` |
| supabase/storage-api | `v1.48.28` | `v1.51.0` |
| supabase/logflare | `1.37.1` | `1.38.2` |



Updates `postgrest/postgrest` from v14.8 to v14.9

Updates `supabase/studio` from 2026.04.08-sha-205cbe7 to 2026.04.13-sha-e95f1cc

Updates `supabase/edge-runtime` from v1.73.3 to v1.73.5

Updates `supabase/realtime` from v2.82.0 to v2.83.1

Updates `supabase/storage-api` from v1.48.28 to v1.51.0

Updates `supabase/logflare` from 1.37.1 to 1.38.2

---
updated-dependencies:
- dependency-name: postgrest/postgrest
  dependency-version: v14.9
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/studio
  dependency-version: 2026.04.13-sha-e95f1cc
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/edge-runtime
  dependency-version: v1.73.5
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/realtime
  dependency-version: v2.83.1
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/storage-api
  dependency-version: v1.51.0
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/logflare
  dependency-version: 1.38.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-minor
...



* Downgrade postgrest version from 14.9 to 14.8

---------





* chore(workflows): enable install scripts for supabase package in Yarn (#5111)

chore(workflows): enable install scripts for supabase package in Yarn Berry setup

This change sets the YARN_ENABLE_SCRIPTS environment variable to true during the installation of the supabase package, allowing its postinstall script to run as required by Yarn Berry 4.14+. This adjustment ensures the necessary binary is fetched correctly.

* feat: --diff-engine flag on db pull

* fix(docker): bump the docker-minor group in /pkg/config/templates with 6 updates (#5113)

fix(docker): bump the docker-minor group

Bumps the docker-minor group in /pkg/config/templates with 6 updates:

| Package | From | To |
| --- | --- | --- |
| postgrest/postgrest | `v14.8` | `v14.10` |
| supabase/studio | `2026.04.13-sha-e95f1cc` | `2026.04.20-sha-b721a2d` |
| supabase/edge-runtime | `v1.73.5` | `v1.73.13` |
| supabase/realtime | `v2.83.1` | `v2.86.3` |
| supabase/storage-api | `v1.51.0` | `v1.54.1` |
| supabase/logflare | `1.38.2` | `1.39.1` |


Updates `postgrest/postgrest` from v14.8 to v14.10

Updates `supabase/studio` from 2026.04.13-sha-e95f1cc to 2026.04.20-sha-b721a2d

Updates `supabase/edge-runtime` from v1.73.5 to v1.73.13

Updates `supabase/realtime` from v2.83.1 to v2.86.3

Updates `supabase/storage-api` from v1.51.0 to v1.54.1

Updates `supabase/logflare` from 1.38.2 to 1.39.1

---
updated-dependencies:
- dependency-name: postgrest/postgrest
  dependency-version: v14.10
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/studio
  dependency-version: 2026.04.20-sha-b721a2d
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/edge-runtime
  dependency-version: v1.73.13
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/realtime
  dependency-version: v2.86.3
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/storage-api
  dependency-version: v1.54.1
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/logflare
  dependency-version: 1.39.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-minor
...





* feat: exposing new api keys to functions (#4946)



* chore: upgrade pg-delta to alpha.20 in multiple templates

* fix: remove version comparison check for storage image updates (#5118)

fix: honor pinned storage version offline

Remove the version comparison that only pinned storage when the local
version was newer than the default. This prevented `supabase start` from
using an already-downloaded image offline, since Docker would still try
to pull the default newer image.

Fixes CLI-1393.



* fix: improve error handling and output formatting in pg-delta apply process (#5120)

- Updated the `runDeclarativeSync` function to avoid wrapping SQL output with `utils.Bold`, preventing excessive whitespace in multi-line SQL.
- Changed the result accumulation in `migra.ts` from string concatenation to an array for better performance and clarity.
- Enhanced the `ApplyResult` struct to include `ValidationErrors` and `Diagnostics`, allowing for more detailed error reporting.
- Modified the `formatApplyFailure` function to include validation errors and diagnostics in the output, improving user feedback on apply failures.
- Added tests for validation error handling in `apply_test.go` to ensure robustness against various error scenarios.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: supabase-cli-releaser[bot] <246109035+supabase-cli-releaser[bot]@users.noreply.github.com>
Co-authored-by: fadymak <dev@fadymak.com>
Co-authored-by: Vaibhav <117663341+7ttp@users.noreply.github.com>
Co-authored-by: Sean Oliver <882952+seanoliver@users.noreply.github.com>
Co-authored-by: Han Qiao <sweatybridge@gmail.com>
Co-authored-by: Julien Goux <hi@jgoux.dev>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Mert YEREKAPAN <mertyerekapan@gmail.com>
Co-authored-by: Mert YEREKAPAN <33198490+myerekapan@users.noreply.github.com>
Co-authored-by: Kalleby Santos <105971119+kallebysantos@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
avallete added a commit that referenced this pull request Apr 28, 2026
@jgoux @avallete
@dependabot @kallebysantos @claude @rebasecase @joshenlim @supabase-cli-releaser @fadymak @7ttp @seanoliver @sweatybridge @myerekapan
fix: encode auth external url explicitly (#5092)
be971cd 
* refactor: encode auth external url explicitly

* chore(deps): upgrade pg-delta to alpha.17 (#5110)

Closes: #5094

* chore(deps): bump the actions-major group across 1 directory with 4 updates (#5108)

Bumps the actions-major group with 4 updates in the / directory: [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata), [t1m0thyj/unlock-keyring](https://github.com/t1m0thyj/unlock-keyring), [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) and [actions/setup-node](https://github.com/actions/setup-node).


Updates `dependabot/fetch-metadata` from 3.0.0 to 3.1.0
- [Release notes](https://github.com/dependabot/fetch-metadata/releases)
- [Commits](dependabot/fetch-metadata@ffa630c...25dd0e3)

Updates `t1m0thyj/unlock-keyring` from 1.1.0 to 1.2.0
- [Release notes](https://github.com/t1m0thyj/unlock-keyring/releases)
- [Commits](t1m0thyj/unlock-keyring@728cc71...cbcf205)

Updates `goreleaser/goreleaser-action` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](goreleaser/goreleaser-action@ec59f47...e24998b)

Updates `actions/setup-node` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@53b8394...48b55a0)

---
updated-dependencies:
- dependency-name: dependabot/fetch-metadata
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: t1m0thyj/unlock-keyring
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: goreleaser/goreleaser-action
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: actions/setup-node
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>

* fix(docker): bump the docker-minor group across 1 directory with 6 updates (#5079)

* fix(docker): bump the docker-minor group across 1 directory with 6 updates

Bumps the docker-minor group with 6 updates in the /pkg/config/templates directory:

| Package | From | To |
| --- | --- | --- |
| postgrest/postgrest | `v14.8` | `v14.9` |
| supabase/studio | `2026.04.08-sha-205cbe7` | `2026.04.13-sha-e95f1cc` |
| supabase/edge-runtime | `v1.73.3` | `v1.73.5` |
| supabase/realtime | `v2.82.0` | `v2.83.1` |
| supabase/storage-api | `v1.48.28` | `v1.51.0` |
| supabase/logflare | `1.37.1` | `1.38.2` |



Updates `postgrest/postgrest` from v14.8 to v14.9

Updates `supabase/studio` from 2026.04.08-sha-205cbe7 to 2026.04.13-sha-e95f1cc

Updates `supabase/edge-runtime` from v1.73.3 to v1.73.5

Updates `supabase/realtime` from v2.82.0 to v2.83.1

Updates `supabase/storage-api` from v1.48.28 to v1.51.0

Updates `supabase/logflare` from 1.37.1 to 1.38.2

---
updated-dependencies:
- dependency-name: postgrest/postgrest
  dependency-version: v14.9
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/studio
  dependency-version: 2026.04.13-sha-e95f1cc
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/edge-runtime
  dependency-version: v1.73.5
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/realtime
  dependency-version: v2.83.1
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/storage-api
  dependency-version: v1.51.0
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/logflare
  dependency-version: 1.38.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Downgrade postgrest version from 14.9 to 14.8

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>

* chore(workflows): enable install scripts for supabase package in Yarn (#5111)

chore(workflows): enable install scripts for supabase package in Yarn Berry setup

This change sets the YARN_ENABLE_SCRIPTS environment variable to true during the installation of the supabase package, allowing its postinstall script to run as required by Yarn Berry 4.14+. This adjustment ensures the necessary binary is fetched correctly.

* feat: --diff-engine flag on db pull

* fix(docker): bump the docker-minor group in /pkg/config/templates with 6 updates (#5113)

fix(docker): bump the docker-minor group

Bumps the docker-minor group in /pkg/config/templates with 6 updates:

| Package | From | To |
| --- | --- | --- |
| postgrest/postgrest | `v14.8` | `v14.10` |
| supabase/studio | `2026.04.13-sha-e95f1cc` | `2026.04.20-sha-b721a2d` |
| supabase/edge-runtime | `v1.73.5` | `v1.73.13` |
| supabase/realtime | `v2.83.1` | `v2.86.3` |
| supabase/storage-api | `v1.51.0` | `v1.54.1` |
| supabase/logflare | `1.38.2` | `1.39.1` |


Updates `postgrest/postgrest` from v14.8 to v14.10

Updates `supabase/studio` from 2026.04.13-sha-e95f1cc to 2026.04.20-sha-b721a2d

Updates `supabase/edge-runtime` from v1.73.5 to v1.73.13

Updates `supabase/realtime` from v2.83.1 to v2.86.3

Updates `supabase/storage-api` from v1.51.0 to v1.54.1

Updates `supabase/logflare` from 1.38.2 to 1.39.1

---
updated-dependencies:
- dependency-name: postgrest/postgrest
  dependency-version: v14.10
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/studio
  dependency-version: 2026.04.20-sha-b721a2d
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/edge-runtime
  dependency-version: v1.73.13
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/realtime
  dependency-version: v2.86.3
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/storage-api
  dependency-version: v1.54.1
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/logflare
  dependency-version: 1.39.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>

* feat: exposing new api keys to functions (#4946)

Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>

* chore: upgrade pg-delta to alpha.20 in multiple templates

* fix: remove version comparison check for storage image updates (#5118)

fix: honor pinned storage version offline

Remove the version comparison that only pinned storage when the local
version was newer than the default. This prevented `supabase start` from
using an already-downloaded image offline, since Docker would still try
to pull the default newer image.

Fixes CLI-1393.

Co-authored-by: Claude <noreply@anthropic.com>

* fix: improve error handling and output formatting in pg-delta apply process (#5120)

- Updated the `runDeclarativeSync` function to avoid wrapping SQL output with `utils.Bold`, preventing excessive whitespace in multi-line SQL.
- Changed the result accumulation in `migra.ts` from string concatenation to an array for better performance and clarity.
- Enhanced the `ApplyResult` struct to include `ValidationErrors` and `Diagnostics`, allowing for more detailed error reporting.
- Modified the `formatApplyFailure` function to include validation errors and diagnostics in the output, improving user feedback on apply failures.
- Added tests for validation error handling in `apply_test.go` to ensure robustness against various error scenarios.

* fix(start): guard db_logs vector transform against null regex capture (#5126)

The `db_logs` transform aborts with `expected string, got null` in
`upcase!()` when `parse_regex` matches an event message but the
`level` named group resolves to null. The fallback branch only
covers regex failure (`err != null || parsed == null`), leaving a
third path where the match succeeds but the capture is null. That
path overwrites the would-be fallback with null and crashes on
upcase.

Observed under routine local dev load (Next.js dev server issuing
service-role Postgres queries): 3,000+ aborted transforms in two
minutes, cascading into Vector retry storms and Logflare
`ErlSysMon` message-queue backpressure.

Extend the fallback condition to also fire when `parsed.level` is
null, and guard the assignment in the match branch, so
`error_severity` always has a non-null string before `upcase!`.

Co-authored-by: rebasecase <rebasecase@localhost>

* Update Dockerfile for Studio image 2026-04-27

* chore: resync develop with main (#5123)

Prod deploy (#5109)

* fix(pg-delta): declarative-sync-no-declarative-dir-set (#5078)

* feat(declarative): add tests for skipping config updates when PgDelta is enabled

- These tests verify that the configuration remains unchanged when PgDelta is enabled, ensuring the declarative directory is the source of truth.
- Updated the WriteDeclarativeSchemas function to reflect the new behavior regarding PgDelta configuration.

* fix(declarative): DSL change due to upgrade

* feat(auth): add support for configuring passkeys and webauthn (#5077)

* fix: atomic parser  (#5064)

* fix

* test

---------



* fix(pg-delta): declarative apply error results (#5082)

* fix(pg-delta): declarative apply error results

Improve readability report for decalrative appy errors wrapping

* chore: upgrade pg-delta to alpha 13

* feat(telemetry): attach org/project groups to all CLI events

Only ~19% of CLI events had PostHog group properties ($group_0, $group_1)
because groups were only set during `supabase link`. Commands using
--project-ref without linking sent events invisible to group analytics.

Add EnsureProjectGroupsCached which resolves and caches project metadata
(including org ID) in linked-project.json when a project ref is available.
The cache is checked before every cli_command_executed event, so the API
call only happens once per unique project ref.

Closes GROWTH-761

* fix: address code review feedback

- Guard against log.Fatalln crash: check auth token before calling
  GetSupabase(), and move the API call to cmd/root.go where it belongs
- Don't overwrite existing linked-project.json cache — supabase link
  is the authoritative source, we only fill the gap when no cache exists
- Fire GroupIdentify for org and project after caching, matching the
  link flow so PostHog has group metadata
- Restructure so telemetry package has no API dependencies (pure
  caching + PostHog calls), making tests reliable without gock/mocks

* fix: adds etl to managed schema (#5090)

* chore: sync API types from infrastructure (#5093)



* chore(deps): bump the actions-major group across 1 directory with 5 updates (#5088)

Bumps the actions-major group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `3.0.0` | `3.1.1` |
| [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) | `8.1.0` | `8.1.1` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.35.1` | `4.35.2` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `7.0.0` | `7.1.0` |



Updates `actions/create-github-app-token` from 3.0.0 to 3.1.1
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Commits](actions/create-github-app-token@f8d387b...1b10c78)

Updates `peter-evans/create-pull-request` from 8.1.0 to 8.1.1
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](peter-evans/create-pull-request@c0f553f...5f6978f)

Updates `actions/upload-artifact` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@bbbca2d...043fb46)

Updates `github/codeql-action` from 4.35.1 to 4.35.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@c10b806...95e58e9)

Updates `docker/build-push-action` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@d08e5c3...bcafcac)

---
updated-dependencies:
- dependency-name: actions/create-github-app-token
  dependency-version: 3.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: peter-evans/create-pull-request
  dependency-version: 8.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-major
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-major
- dependency-name: github/codeql-action
  dependency-version: 4.35.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-major
- dependency-name: docker/build-push-action
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
...





* fix: functions download (#5096)

* fix

* test

---------



* feat(db): strengthen RLS advisory message for stronger agent compliance

* chore(deps): upgrade pg-delta to alpha.17 (#5110)

Closes: #5094

* chore(deps): bump the actions-major group across 1 directory with 4 updates (#5108)

Bumps the actions-major group with 4 updates in the / directory: [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata), [t1m0thyj/unlock-keyring](https://github.com/t1m0thyj/unlock-keyring), [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) and [actions/setup-node](https://github.com/actions/setup-node).


Updates `dependabot/fetch-metadata` from 3.0.0 to 3.1.0
- [Release notes](https://github.com/dependabot/fetch-metadata/releases)
- [Commits](dependabot/fetch-metadata@ffa630c...25dd0e3)

Updates `t1m0thyj/unlock-keyring` from 1.1.0 to 1.2.0
- [Release notes](https://github.com/t1m0thyj/unlock-keyring/releases)
- [Commits](t1m0thyj/unlock-keyring@728cc71...cbcf205)

Updates `goreleaser/goreleaser-action` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](goreleaser/goreleaser-action@ec59f47...e24998b)

Updates `actions/setup-node` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@53b8394...48b55a0)

---
updated-dependencies:
- dependency-name: dependabot/fetch-metadata
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: t1m0thyj/unlock-keyring
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: goreleaser/goreleaser-action
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
- dependency-name: actions/setup-node
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-major
...





* fix(docker): bump the docker-minor group across 1 directory with 6 updates (#5079)

* fix(docker): bump the docker-minor group across 1 directory with 6 updates

Bumps the docker-minor group with 6 updates in the /pkg/config/templates directory:

| Package | From | To |
| --- | --- | --- |
| postgrest/postgrest | `v14.8` | `v14.9` |
| supabase/studio | `2026.04.08-sha-205cbe7` | `2026.04.13-sha-e95f1cc` |
| supabase/edge-runtime | `v1.73.3` | `v1.73.5` |
| supabase/realtime | `v2.82.0` | `v2.83.1` |
| supabase/storage-api | `v1.48.28` | `v1.51.0` |
| supabase/logflare | `1.37.1` | `1.38.2` |



Updates `postgrest/postgrest` from v14.8 to v14.9

Updates `supabase/studio` from 2026.04.08-sha-205cbe7 to 2026.04.13-sha-e95f1cc

Updates `supabase/edge-runtime` from v1.73.3 to v1.73.5

Updates `supabase/realtime` from v2.82.0 to v2.83.1

Updates `supabase/storage-api` from v1.48.28 to v1.51.0

Updates `supabase/logflare` from 1.37.1 to 1.38.2

---
updated-dependencies:
- dependency-name: postgrest/postgrest
  dependency-version: v14.9
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/studio
  dependency-version: 2026.04.13-sha-e95f1cc
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/edge-runtime
  dependency-version: v1.73.5
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/realtime
  dependency-version: v2.83.1
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/storage-api
  dependency-version: v1.51.0
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/logflare
  dependency-version: 1.38.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-minor
...



* Downgrade postgrest version from 14.9 to 14.8

---------





* chore(workflows): enable install scripts for supabase package in Yarn (#5111)

chore(workflows): enable install scripts for supabase package in Yarn Berry setup

This change sets the YARN_ENABLE_SCRIPTS environment variable to true during the installation of the supabase package, allowing its postinstall script to run as required by Yarn Berry 4.14+. This adjustment ensures the necessary binary is fetched correctly.

* feat: --diff-engine flag on db pull

* fix(docker): bump the docker-minor group in /pkg/config/templates with 6 updates (#5113)

fix(docker): bump the docker-minor group

Bumps the docker-minor group in /pkg/config/templates with 6 updates:

| Package | From | To |
| --- | --- | --- |
| postgrest/postgrest | `v14.8` | `v14.10` |
| supabase/studio | `2026.04.13-sha-e95f1cc` | `2026.04.20-sha-b721a2d` |
| supabase/edge-runtime | `v1.73.5` | `v1.73.13` |
| supabase/realtime | `v2.83.1` | `v2.86.3` |
| supabase/storage-api | `v1.51.0` | `v1.54.1` |
| supabase/logflare | `1.38.2` | `1.39.1` |


Updates `postgrest/postgrest` from v14.8 to v14.10

Updates `supabase/studio` from 2026.04.13-sha-e95f1cc to 2026.04.20-sha-b721a2d

Updates `supabase/edge-runtime` from v1.73.5 to v1.73.13

Updates `supabase/realtime` from v2.83.1 to v2.86.3

Updates `supabase/storage-api` from v1.51.0 to v1.54.1

Updates `supabase/logflare` from 1.38.2 to 1.39.1

---
updated-dependencies:
- dependency-name: postgrest/postgrest
  dependency-version: v14.10
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/studio
  dependency-version: 2026.04.20-sha-b721a2d
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/edge-runtime
  dependency-version: v1.73.13
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/realtime
  dependency-version: v2.86.3
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/storage-api
  dependency-version: v1.54.1
  dependency-type: direct:production
  dependency-group: docker-minor
- dependency-name: supabase/logflare
  dependency-version: 1.39.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-minor
...





* feat: exposing new api keys to functions (#4946)



* chore: upgrade pg-delta to alpha.20 in multiple templates

* fix: remove version comparison check for storage image updates (#5118)

fix: honor pinned storage version offline

Remove the version comparison that only pinned storage when the local
version was newer than the default. This prevented `supabase start` from
using an already-downloaded image offline, since Docker would still try
to pull the default newer image.

Fixes CLI-1393.



* fix: improve error handling and output formatting in pg-delta apply process (#5120)

- Updated the `runDeclarativeSync` function to avoid wrapping SQL output with `utils.Bold`, preventing excessive whitespace in multi-line SQL.
- Changed the result accumulation in `migra.ts` from string concatenation to an array for better performance and clarity.
- Enhanced the `ApplyResult` struct to include `ValidationErrors` and `Diagnostics`, allowing for more detailed error reporting.
- Modified the `formatApplyFailure` function to include validation errors and diagnostics in the output, improving user feedback on apply failures.
- Added tests for validation error handling in `apply_test.go` to ensure robustness against various error scenarios.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: supabase-cli-releaser[bot] <246109035+supabase-cli-releaser[bot]@users.noreply.github.com>
Co-authored-by: fadymak <dev@fadymak.com>
Co-authored-by: Vaibhav <117663341+7ttp@users.noreply.github.com>
Co-authored-by: Sean Oliver <882952+seanoliver@users.noreply.github.com>
Co-authored-by: Han Qiao <sweatybridge@gmail.com>
Co-authored-by: Julien Goux <hi@jgoux.dev>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Mert YEREKAPAN <mertyerekapan@gmail.com>
Co-authored-by: Mert YEREKAPAN <33198490+myerekapan@users.noreply.github.com>
Co-authored-by: Kalleby Santos <105971119+kallebysantos@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>

* Revert "Update Dockerfile for Studio image 2026-04-27" (#5132)

* Revert "Revert "Update Dockerfile for Studio image 2026-04-27"" (#5134)

Revert "Revert "Update Dockerfile for Studio image 2026-04-27" (#5132)"

This reverts commit 9251eaf.

* fix(windows): json unmarshal errors in telemetry and pg-delta declarative sync (#5128)

* fix(windows): json unmarshal errors in telemetry and pg-delta declarative sync

Three Windows-only failures, all surfacing as JSON parse errors:

1. telemetry: any field-level unmarshal error (e.g. session_last_active
   stored as a number) now recreates state instead of propagating, since
   identity fields aren't worth surfacing an error for.
2. pg-delta declarative sync: containerRef now normalises Windows path
   separators with filepath.ToSlash so paths like
   supabase\.temp\pgdelta\catalog-baseline.json resolve correctly inside
   the Linux edge-runtime container.
3. pg-delta export/diff: parse callers (DeclarativeExportPgDeltaRef,
   ExportCatalogPgDelta, pgcache.exportCatalog) now surface stderr when
   stdout is empty, instead of failing later with "unexpected end of
   JSON input". DiffPgDeltaRef intentionally still accepts empty stdout
   as a legitimate "no schema changes" result.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: only run test on windows and fix lint

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Kalleby Santos <105971119+kallebysantos@users.noreply.github.com>
Co-authored-by: avallete <andrew.valleteau@supabase.io>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: It's Me! <192345912+rebasecase@users.noreply.github.com>
Co-authored-by: rebasecase <rebasecase@localhost>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
Co-authored-by: supabase-cli-releaser[bot] <246109035+supabase-cli-releaser[bot]@users.noreply.github.com>
Co-authored-by: fadymak <dev@fadymak.com>
Co-authored-by: Vaibhav <117663341+7ttp@users.noreply.github.com>
Co-authored-by: Sean Oliver <882952+seanoliver@users.noreply.github.com>
Co-authored-by: Han Qiao <sweatybridge@gmail.com>
Co-authored-by: Mert YEREKAPAN <mertyerekapan@gmail.com>
Co-authored-by: Mert YEREKAPAN <33198490+myerekapan@users.noreply.github.com>
@fyoosh fyoosh mentioned this pull request Apr 30, 2026
Merged
3 tasks
fyoosh added a commit to librito-io/web that referenced this pull request Apr 30, 2026
@fyoosh @claude
ci(migrations): bump CLI pin to 2.95.4 + drop now-unneeded parser wor…
b00b946 
…karound (#43)

Two changes that belong together because the second is only safe given the first:

1. **Bump `.github/workflows/migration-smoke.yml` pin from `2.90.0` to `2.95.4`.** PR #42's squash-merge carried only the first commit on its branch (the original 2.90.0 ship) and dropped the in-branch bump to 2.95.4, leaving the CI pin at 2.90.0 while the local Homebrew install and the laptop running `supabase db push` had already moved to 2.95.4. This commit reconciles the three contexts; CLI parser behaviour is now uniform across local / CI / prod.

2. **Drop the DO-block REVOKE+GRANT wrappers from migrations 20260430000002 and 20260430000004**, restoring the bare-statement form. Header comments rewritten as a historical note (the CLI bug, the substring "atomic" trigger, the fix in v2.91.1 `supabase/cli#5064`, why the wrapper is no longer needed, why the >= 2.91.1 pin is now load-bearing).

## Why the workaround is dead weight

The workaround was added in PR #41 against a CLI v2.90 parser bug that hit production via PR #40. The audit (`docs/audits/2026-04-29-server-helpers.md` issue P7) hypothesised an "inconsistent" parser trigger and treated the DO-block as defence-in-depth.

Investigation against `supabase/cli#5064` shows the trigger was actually **deterministic**: the SQL splitter treated any occurrence of the substring `atomic` inside an identifier as the start of a `BEGIN ATOMIC ... END;` block, then bundled subsequent statements into a single prepared-statement Parse message and tripped Postgres SQLSTATE 42601. Our `claim_pairing_atomic` function name is the trigger; the "inconsistency" was actually whether a multi-statement file was present, which only became true after branch-review added REVOKE statements to the originally single-GRANT file.

Verification at CLI 2.95.4 against current main migrations: `supabase db reset --local` run 5x consecutively after unwrapping both DO blocks. All 5 runs applied 38/38 migrations cleanly with no 42601. Combined with the explicit upstream fix in v2.91.1, this is conclusive — the workaround has zero remaining value at the pinned CLI version.

## Why combine with the pin bump

The DO-block drop is only safe at CLI >= 2.91.1. Shipping the unwrap without also pinning >= 2.91.1 would re-open the production-failure path the moment a contributor on a stale CLI runs the migrations. Pinning the bumped version in the same commit makes the dependency unambiguous and keeps `git log` clean: one diff, one rationale.

## Test plan

- [x] `supabase db reset --local` at CLI 2.95.4 — 5/5 clean runs after unwrap, no 42601.
- [x] YAML lint of workflow file (`python3 -c "import yaml; yaml.safe_load(...)"`).
- [ ] CI run on this PR will exercise the bumped pin against the unwrapped migrations against the current full migration history.

## CLI version downgrade hazard

If a contributor downgrades local CLI below 2.91.1 (or a future workflow refactor accidentally bumps the pin DOWN), migrations 02 and 04 will start failing again with 42601. The header comments call this out explicitly, and CLAUDE.md "Build Commands" now says "pin must stay >= v2.91.1". Worth a future hook that asserts CLI >= 2.91.1 at `supabase` invocation time, but out of scope here.

Refs: supabase/cli#5064, PR #41 (workaround), PR #42 (initial CI gate)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
fyoosh added a commit to librito-io/web that referenced this pull request Apr 30, 2026
@fyoosh @claude
feat(sync): batch soft-delete via soft_delete_highlights RPC (#44)
835590a 
Replaces the per-row `Promise.all(UPDATE)` loop in `processSync()` with
a single Postgres function call. Same-batch deletes now collapse to one
round-trip regardless of count.

## The problem

The previous shape fired N round-trip UPDATEs per sync, where N = count
of highlights the device flagged as deleted. The validator caps N at
500 deletes per book × 50 books = 25,000 statements per request worst
case. Realistic per-sync N is much smaller (tens), but at the project's
1k concurrent user scaling target (CLAUDE.md "Scaling Target") even a
modest N saturates the connection pool: 10 deletes × 1k concurrent
users = 10,000 concurrent UPDATEs in flight. Free-tier Supabase pool
exhausts; paid-tier degrades. This is the architectural class of
trade-off the scaling target is designed to reject — the design must
survive 2-10x scale without rewrite.

## The fix

Single function `public.soft_delete_highlights(p_user_id, p_now,
p_rows jsonb)` that takes the delete set as JSONB and runs ONE UPDATE
joined against `jsonb_array_elements(p_rows)`. Mirrors the existing
RPC patterns: `claim_pairing_atomic` (PR #40) and
`increment_transfer_attempt` (transfer.ts).

Function attributes:
  - SECURITY INVOKER — caller (service_role) carries the privilege,
    not the function definer. Matches repo convention for RPCs that
    don't need to escalate.
  - SET search_path = public — hardens against search_path injection
    (same pattern as the audit's harden_handle_new_user_search_path
    migration).
  - REVOKE-from-PUBLIC/anon/authenticated, GRANT-to-service_role —
    repo standard for RPCs only the device API path should reach.
  - Returns ROW_COUNT — currently unused, but cheap to expose for
    future observability and lets the test suite assert behaviour.

The pre-RPC semantics are preserved: rows already in the soft-deleted
state (deleted_at IS NOT NULL) are skipped via the same predicate the
old loop used. No resurrection of server-side deletes.

## Why no DO-block wrapper on the GRANT

CLI is pinned >= 2.95.4 (PR #43) and the supabase/cli#5064 "atomic
substring" parser bug was fixed in v2.91.1. The migration's REVOKE+
GRANT block is bare statements; CI gate proves it parses. Function
name `soft_delete_highlights` doesn't even contain the "atomic"
substring, so it would have parsed cleanly at v2.90 too — but the
pin floor is the load-bearing guarantee, not the function name.

## Test plan

- [x] `npx vitest run` — 267/267 pass. New test group
  `processSync soft-delete RPC batching` adds 4 tests:
    - exactly one RPC call per sync regardless of book/delete count,
      AND zero `.from("highlights").update(...)` calls (proves the
      loop is gone, not just shadowed)
    - RPC args match `{ p_user_id, p_now, p_rows: [...] }` shape
    - no RPC fires when payload has no deletes
    - error response from RPC propagates as `Failed to soft-delete
      highlights: …`
- [x] `npm run check` — 0 errors (14 pre-existing rune warnings,
  unrelated to this change)
- [x] `supabase db reset --local` at CLI 2.95.4 — 39 migrations apply
  clean including 20260430000005
- [ ] EXPLAIN ANALYZE against a seeded user with 100 deletes — left
  for ops verification on a stage env; behaviour is asserted by
  test #1 above

## Mock instrumentation

`tests/helpers.ts` gains `_rpcCalls` and `_updateCalls` arrays so
tests can assert call count + payload shape. Mirrors the existing
`_upsertCalls` instrumentation. No behavioural change to existing
tests; the new arrays are additive.

Refs: docs/audits/2026-04-29-server-helpers.md issue P1, audit PR 3

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@avallete avallete avallete approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

3 participants

@7ttp @coveralls @avallete