chore(repo): sync develop into next by supabase-cli-releaser[bot] · Pull Request #7142 · supabase/cli

supabase-cli-releaser · 2026-10-14T10:16:06Z

Merging develop into next conflicts. This branch starts at the tip of develop (cb2985f); next is at 7dfd9b8.

Conflicting files:

apps/cli-go/pkg/config/templates/Dockerfile
apps/cli/src/commands/db/advisors/advisors.integration.test.ts
apps/cli/src/commands/db/diff/diff.command.ts
apps/cli/src/commands/db/diff/diff.integration.test.ts
apps/cli/src/commands/db/dump/dump.command.ts
apps/cli/src/commands/db/pull/pull.command.ts
apps/cli/src/commands/db/pull/pull.integration.test.ts
apps/cli/src/commands/db/push/push.command.ts
apps/cli/src/commands/db/push/push.integration.test.ts
apps/cli/src/commands/db/remote/commit/commit.command.ts
apps/cli/src/commands/db/reset/reset.command.ts
apps/cli/src/commands/db/reset/reset.integration.test.ts
apps/cli/src/commands/db/schema/declarative/generate/generate.command.ts
apps/cli/src/commands/db/schema/declarative/generate/generate.integration.test.ts
apps/cli/src/commands/db/schema/declarative/sync/sync.command.ts
apps/cli/src/commands/db/start/start.command.ts
apps/cli/src/commands/db/start/start.integration.test.ts
apps/cli/src/commands/db/test/test.integration.test.ts
apps/cli/src/commands/seed/buckets/buckets.integration.test.ts

To resolve:

git fetch origin
git switch sync/develop-into-next
git merge origin/next
# resolve the conflicts, then commit
git push origin sync/develop-into-next

Approve to fast-forward next; do not use the merge button.

…7135) Maps `db start`, `db test`, `db lint`, `db advisors`, `db reset`, `db push` and `seed buckets` to the Management API operations they can call, so scoped PATs can be granted per command. Drift tests keep each declaration in step with what the command does. **Shared model change.** `withCondition` now accepts a database-target condition as well as a flag condition, so a command can gate a block on the target it selects (`--local`, `--db-url`, linked). `FlagCondition` is no longer exported. **Blocks used.** `dbConfig` (lint, advisors, reset, push, `db test`), `linkedProjectCache` (all but `db start` and `db test`), `storageCredentials` (`seed buckets`). `db advisors` adds its own security and performance entries, keyed on `--type`; because `--type` is optional, each operation has an entry for the listed values and one for the flag being absent. **Defaults.** `db lint`, `db advisors`, `db reset`, `db test` and `seed buckets` default to the local target; `db push` defaults to linked. Each handler reads its target from the command line, not from the parsed flag values. **Tests.** Lint, advisors, reset, push and `db test` run the real database-config resolver and the real linked-project cache and check the recorded requests; `--local` runs assert no Management API request. `seed buckets` records the api-keys request (`reveal=true`) and the cache fill. Also covered: `--password` skipping the login role, an advisors 403 stopping before the performance call, and `--linked=false` in lint and seed. The `node:net` mock the real-resolver tests need now lives in one helper, `tests/helpers/refuse-invalid-db-hosts.ts`, and replaces the copies in `db query` and the resolver tests. **Not covered.** - `--linked=false` on push, reset, advisors and `db test`. - A default target declared linked when it is really local would not fail a drift test: a local run records no requests. Also corrects the API routes listed in the `db pull` and `db diff` side-effects docs (`/cli/login-role`, `/config/database/pooler`, `POST /network-bans/retrieve`); they listed paths the code does not call. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

This bumps storage from v1.81.5-r0 to v1.82.0-r0. https://github.com/supabase/slim-services/releases/tag/storage-v1.82.0-r0 Planned after supabase/slim-services published v1.82.0-r0. This branch is rewritten from develop whenever a newer relevant release arrives. Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…ns (#7136) Maps `db dump`, `db pull`, `db remote commit`, `db diff`, `db schema declarative generate` and `db schema declarative sync` to the Management API operations they can call, so scoped PATs can be granted per command. Drift tests keep each declaration in step with what the command does. Stacked on the previous db PR. **Shared changes.** - `dbConfigPoolerFallback` (new block): the pooler retry after a linked dump, declarative export or pull diff fails with an IPv6 error against the direct host. `dbConfig` is now built from a shared entries list with the linked target prepended; its declaration is unchanged. - `dbConfigLinked` (new block): the same calls without the target condition, for commands that reach the linked path some other way. - `withContext` (new builder): records a prompt choice or other non-flag prerequisite on every entry of a fragment. **Defaults.** `db dump`, `db pull` and `db remote commit` default to the linked project; `db diff` defaults to local. `db dump`, `db pull` and `db remote commit` declare `dbConfig`, the fallback block and the linked-project cache. `db diff` declares `dbConfig` and the cache for `--linked`, plus the linked calls for a `--from` or `--to` side set to `linked`, which resolves the project without `--linked`. `generate` declares them for `--linked` and for the target prompt (no target flag, migrations present). `sync` has no target flags, so it declares them for the bootstrap prompt only. **Tests.** Each command runs the real database-config resolver and the real linked-project cache and checks the recorded requests, including `--password` skipping the login role and `--local` making no request. Dump and pull also run the container IPv6 retry (login role, pooler config, login role). `db diff` covers `--from linked`, `--to linked` and both. The `node:net` mock gains a scoped `withReachableDirectHost` helper for the direct-host path. **Not covered.** - `--use-pg-schema` on `db diff` hands off to Go before any TypeScript call; it is declared as having no API effect here. - The generate and sync prompt-path entries and the fallback entries carry a prerequisite, so the exact check skips them; tests assert their request sequences directly. - `dbConfig` and `dbConfigPoolerFallback` cover the same operations under the linked target in dump, pull and remote commit, so a drift test cannot tell a missing `dbConfig` from a present one there. Both are tested on their own. - `db remote commit` has no retry test; it shares pull's code. - `--linked=false` and `--local=false` on these commands rely on the existing handler tests. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

# Conflicts: # apps/cli-go/pkg/config/templates/Dockerfile # apps/cli/src/commands/db/advisors/advisors.integration.test.ts # apps/cli/src/commands/db/diff/diff.command.ts # apps/cli/src/commands/db/diff/diff.integration.test.ts # apps/cli/src/commands/db/dump/dump.command.ts # apps/cli/src/commands/db/pull/pull.command.ts # apps/cli/src/commands/db/pull/pull.integration.test.ts # apps/cli/src/commands/db/push/push.command.ts # apps/cli/src/commands/db/push/push.integration.test.ts # apps/cli/src/commands/db/remote/commit/commit.command.ts # apps/cli/src/commands/db/reset/reset.command.ts # apps/cli/src/commands/db/reset/reset.integration.test.ts # apps/cli/src/commands/db/schema/declarative/generate/generate.command.ts # apps/cli/src/commands/db/schema/declarative/generate/generate.integration.test.ts # apps/cli/src/commands/db/schema/declarative/sync/sync.command.ts # apps/cli/src/commands/db/start/start.command.ts # apps/cli/src/commands/db/start/start.integration.test.ts # apps/cli/src/commands/db/test/test.integration.test.ts # apps/cli/src/commands/seed/buckets/buckets.integration.test.ts

supabase-cli-releaser · 2026-10-14T10:23:46Z

Claude resolved the merge of `next`

Merged develop's command-permission mapping for db dump/pull/diff/push/reset/start and declarative generate/sync into next's command shape, which adds config-key flags through withCliConfigFlags. In the integration tests I kept develop's real-layer permission tests and dropped the proxy layer, which next removed. Two things could not keep both sides: db remote commit is now next's removal tombstone, so its develop permission mapping and tests are gone, and the Go Dockerfile is deleted because next already has an identical copy at its new location.

File	Resolution
`apps/cli/src/commands/db/schema/declarative/sync/sync.command.ts`	Kept develop's permission imports and next's withCliConfigFlags import. The file already used both.
`apps/cli/src/commands/db/schema/declarative/generate/generate.command.ts`	Kept develop's permission imports (including PermissionFragment) together with next's withCliConfigFlags/CliConfigKeys imports.
`apps/cli/src/commands/db/diff/diff.command.ts`	Merged the import blocks so develop's withPermissions declaration and next's CliConfigKeys-based --use-pg-delta flag both compile.
`apps/cli/src/commands/db/dump/dump.command.ts`	Merged the import blocks so develop's permission mapping and next's CliConfigKeys password flag and withCliConfigFlags are both kept.
`apps/cli/src/commands/db/pull/pull.command.ts`	Merged the import blocks so develop's permission mapping (with pooler fallback) and next's config-key flags are both kept.
`apps/cli/src/commands/db/push/push.command.ts`	Merged the import blocks so develop's permission mapping and next's config-key flags for --include-seed and --password are both kept.
`apps/cli/src/commands/db/reset/reset.command.ts`	Merged the import blocks so develop's permission mapping and next's config-key flags for --no-seed and --sql-paths are both kept.
`apps/cli/src/commands/db/start/start.command.ts`	Kept both develop's withPermissions import and next's withCliConfigFlags import.
`apps/cli/src/commands/db/remote/commit/commit.command.ts`	Took next's removed-command tombstone. Develop's handler-based body and its withPermissions declaration are dropped because the command now only fails with a removal message.
`apps/cli/src/commands/db/schema/declarative/generate/generate.integration.test.ts`	Kept develop's realLayers resolver switch and the projectHttp return value. Dropped `proxy`/`proxyCalls`, which next removed.
`apps/cli/src/commands/db/pull/pull.integration.test.ts`	Kept develop's projectHost override and the db pull permission tests, and renamed that describe block. Removed every db remote commit test, because next deleted that handler.
`apps/cli/src/commands/db/diff/diff.integration.test.ts`	Kept develop's mockCommandSettings projectHost override for real layers and dropped the removed `proxy` layer.
`apps/cli/src/commands/db/push/push.integration.test.ts`	Kept both develop's permission-helper imports and next's configValuesLayer/flagInput imports.
`apps/cli/src/commands/db/reset/reset.integration.test.ts`	Kept develop's permission-helper imports and projectHttp, plus next's configValuesLayer import and seedFlagInputs.
`apps/cli/src/commands/db/start/start.integration.test.ts`	Kept both the assertPermissionDrift import and the configValuesLayer import.
`apps/cli/src/commands/db/test/test.integration.test.ts`	Kept both develop's permission-helper imports and next's cliConfigValuesTestLayer import.
`apps/cli/src/commands/db/advisors/advisors.integration.test.ts`	Used next's test name (without "Go") and kept develop's `api` destructuring, which its permission-drift assertion needs.
`apps/cli/src/commands/seed/buckets/buckets.integration.test.ts`	Kept both develop's permission-helper imports and next's cliConfigValuesTestLayer import.
`apps/cli/tests/helpers/permission-pending-commands.ts`	Added "db remote commit" next to "db remote changes", so the permission-completeness test accepts the tombstone without a permission declaration.
`apps/cli/src/command-internal/db-config.layer.ts`	Updated a doc comment that still listed db remote commit among the commands using the pooler-fallback retry.

Deleted: apps/cli-go/pkg/config/templates/Dockerfile.

Decisions for @supabase/cli. Confirm them, or push a change to this branch:

db remote commit: develop mapped its permissions and added permission tests, but next turned the command into a removal tombstone. Which wins? Chose: Next's tombstone. Develop's permission declaration and its db remote commit tests are dropped, and the path is added to PENDING_COMMANDS like the other tombstone, db remote changes.
Develop updated image tags in apps/cli-go/pkg/config/templates/Dockerfile, but next deleted apps/cli-go. Keep or delete? Chose: Delete it. Next's apps/cli/src/shared/services/Dockerfile already has the same content, including develop's storage v1.82.0 bump, so nothing is lost.

Quick checks. The merged tree passes check:all and unit tests.

Approve to fast-forward next once checks pass (workflow run).

github-actions

🤖 AI Review

Verified both findings against the checked-out code and trusted conventions. Confirmed the db dump documentation nit. Refuted the artifact synchronization finding because the Go workspace and its Dockerfile mirror are absent from this branch.

Findings

Severity	Location	Category	Sources	Claim
⚪ NIT	`apps/cli/src/commands/db/dump/SIDE_EFFECTS.md:27`	`documentation`	claude	The API Routes table omits GET /v1/projects/{ref}/config/database/pooler and GET /v1/projects/{ref}. Its footer also incorrectly attributes every call to DbConfigResolver, although LinkedProjectCache performs the project GET.

Refuted findings (kept for transparency, not posted as review comments)

apps/cli/src/shared/services/Dockerfile:38 (artifact-consistency): The Storage version bump omits the Go Dockerfile mirror, breaking the documented requirement that both templates remain byte-identical.
Refuted: The checked-out Git tree contains only apps/cli, apps/cli-e2e and apps/docs; git ls-files apps/cli-go returns no files. There is no Go Dockerfile mirror to synchronize. The remaining TypeScript Dockerfile pin matches packages/stack/src/Artifacts.ts:270-274, and render-service-dockerfile.ts:159-177 checks and updates only that TypeScript template.

Stats

Claude findings: 1 · Codex findings: 1 · Confirmed: 1 · Refuted: 1 · Uncertain: 0

Models: claude-opus-5-5 + gpt-6.1-sol · Trigger: manual · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.

github-actions · 2026-10-14T10:28:58Z

+| Method | Path                                       | Auth   | When                                                         |
+| ------ | ------------------------------------------ | ------ | ------------------------------------------------------------ |
+| POST   | `/v1/projects/{ref}/cli/login-role`        | Bearer | `--linked` with no `DB_PASSWORD` (mint a temp postgres role) |
+| POST   | `/v1/projects/{ref}/network-bans/retrieve` | Bearer | `--linked` pooler temp-role retry (list bans)                |
+| DELETE | `/v1/projects/{ref}/network-bans`          | Bearer | `--linked` pooler temp-role retry (clear self ban)           |

 (All via the shared `DbConfigResolver` `--linked` path.)


⚪ NIT · documentation · source: claude

The API Routes table omits GET /v1/projects/{ref}/config/database/pooler and GET /v1/projects/{ref}. Its footer also incorrectly attributes every call to DbConfigResolver, although LinkedProjectCache performs the project GET.

Evidence: SIDE_EFFECTS.md:27-33 lists only login-role and network-ban calls. dump.command.ts:137-139 declares dbConfig, dbConfigPoolerFallback and linkedProjectCache. dump.handler.ts:424-439 invokes pooler fallback, and :491-494 invokes the post-run cache. telemetry/linked-project-cache.layer.ts:101-107 performs the project GET. dump.integration.test.ts:1394-1397 explicitly expects both omitted routes.

Suggested fix: Add both GET routes with their fallback and cache-fill conditions, and revise the footer to distinguish DbConfigResolver calls from LinkedProjectCache.

This incomplete API Routes table in db dump's SIDE_EFFECTS.md comes from develop's documentation, not from the merge, so it is out of scope for this sync.

supabase-cli-releaser · 2026-10-14T10:35:03Z

Claude repair round

The db resolver now forwards any --password set on its flags, not only an empty one, so develop's new permission tests no longer mint a login role when a password is given. The new pull IPv6-retry test now pins the migra engine, because next made pg-delta the default and pg-delta skips the pg_dump seed.

0 findings fixed, 1 declined (workflow run).

Prashansa-K and others added 3 commits October 14, 2026 09:35

supabase-cli-releaser Bot added the do not merge Approve to apply; do not merge. label Oct 14, 2026

supabase-cli-releaser Bot requested review from a team and supabase-oss as code owners October 14, 2026 10:16

github-actions Bot reviewed Oct 14, 2026

View reviewed changes

chore(repo): repair the develop-into-next sync

c9956c3

jgoux mentioned this pull request Oct 14, 2026

ci(release): approve green, reviewed develop-into-next syncs as supabase-oss #7124

Merged

3 tasks done

avallete approved these changes Oct 14, 2026

View reviewed changes

supabase-cli-releaser Bot merged commit c9956c3 into next Oct 14, 2026
44 of 45 checks passed

supabase-cli-releaser Bot deleted the sync/develop-into-next branch October 14, 2026 15:19

Navigation Menu

Repository navigation

chore(repo): sync develop into next - #7142

chore(repo): sync develop into next#7142
supabase-cli-releaser[bot] merged 5 commits into
nextfrom
sync/develop-into-next

supabase-cli-releaser Bot commented Oct 14, 2026

Uh oh!

supabase-cli-releaser Bot commented Oct 14, 2026

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot Oct 14, 2026

Uh oh!

supabase-cli-releaser Bot Oct 14, 2026

Uh oh!

supabase-cli-releaser Bot commented Oct 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

supabase-cli-releaser Bot commented Oct 14, 2026

Uh oh!

supabase-cli-releaser Bot commented Oct 14, 2026

Claude resolved the merge of next

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

🤖 AI Review

Findings

Stats

Uh oh!

github-actions Bot Oct 14, 2026

Choose a reason for hiding this comment

Uh oh!

supabase-cli-releaser Bot Oct 14, 2026

Choose a reason for hiding this comment

Uh oh!

supabase-cli-releaser Bot commented Oct 14, 2026

Claude repair round

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Claude resolved the merge of `next`