Skip to content

feat: add supabase_typegen package generating typed table definitions - #1635

Draft
spydon wants to merge 36 commits into
feat/typed-table-accessfrom
feat/supabase-gen
Draft

feat: add supabase_typegen package generating typed table definitions#1635
spydon wants to merge 36 commits into
feat/typed-table-accessfrom
feat/supabase-gen

Conversation

@spydon

@spydon spydon commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

What kind of change does this PR introduce?

Feature (draft, layer 2 of the typed table access work, stacked on #1634). Adds a new supabase_typegen package: a standalone code generator that turns a database schema into the typed table definitions introduced in #1634, so users get the fully typed surface without writing any of it by hand.

Linear: SDK-1362

What is the new behavior?

supabase gen types --lang json --local > schema.json
dart run supabase_typegen --input schema.json

reads the language-neutral GeneratorMetadata introspection document (the @supabase/postgrest-typegen contract from supabase/pg-toolbelt#302, which postgres-meta itself consumes after supabase/postgres-meta#1084; --input - reads it from stdin) and emits one Dart file containing, per table:

  • a zero-cost row extension type over the decoded JSON map with typed getters (DateTime parsing, double/num coercion, List casts, Postgres enum mapping),
  • Insert and Update value extension types that implement Map<String, dynamic>, with required parameters derived from NOT NULL-without-default columns and null-aware omission for everything else; explicit SQL NULL writes go through generated set…ToNull copy methods that only exist for nullable, writable columns,
  • a PostgrestTable definition plus TableColumn tokens for compile-time checked filters,
  • Dart enums for Postgres enums with wire-name mapping (toString returns the wire name so enum values work directly in filters).

See packages/supabase_typegen/test/goldens/supabase_schema.dart for what the output looks like for the fixture schema.

Design choices worth reviewing:

  • Introspection source: the GeneratorMetadata contract of @supabase/postgrest-typegen (feat(postgrest-typegen): add package with multi-language code generation pg-toolbelt#302), the same document the TypeScript, Go, Swift, and Python generators consume; structural validation rejects non-matching documents. It comes straight from the database catalog, so the output is exact where API-derived descriptions are lossy: NOT NULL columns with a database default read as non-nullable but stay optional on insert, identity columns are recognized, and GENERATED ALWAYS columns appear in the row type but are excluded from the insert and update types. This is the single introspection source; the parser is a pure function over the JSON document behind the SchemaDescription model.
  • Naming: books emits BooksRow/BooksInsert/BooksUpdate plus a Books namespace class (no English singularization, so names stay predictable). Identifiers are sanitized against Dart reserved words and Map member names with a $ suffix, and collisions are deduplicated.
  • Lint-clean output: the emitted code (checked in as a golden) passes supabase_lints and DCM with zero issues, including the strict extension type rules.

Deliberately deferred: foreign key relationship getters (the fk targets are already parsed into the model) and typed rpc functions.

Additional context

@coderabbitai

coderabbitai Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

  • Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feat/supabase-gen

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

spydon added a commit that referenced this pull request Jul 23, 2026
## What kind of change does this PR introduce?

Feature. Adds an empty skeleton for a new `supabase_typegen` package so
we can publish it to pub.dev and reserve the name.

The full generator implementation lands separately in #1635; this PR
intentionally contains only the minimal publishable placeholder.

## What is the new behavior?

A new `packages/supabase_typegen` package containing:

- a publishable `pubspec.yaml` (version `0.1.0`, no `publish_to: none`)
so the melos release pipeline picks it up,
- a placeholder library, `README`, `CHANGELOG` and `LICENSE`,
- `supabase_lints` wired in via `analysis_options.yaml` (analyzes
clean).

It is wired into:

- the root workspace in `pubspec.yaml`,
- the Dart CI test matrix in `test.yml`,
- the pana release matrix in `release-pana.yml`,
- the SDK compliance parse ignore (`.sdk-parse-ignore`), since it is a
development-time tool rather than SDK client surface.

## Additional context

The README and CHANGELOG flag `0.1.0` as a name-reserving placeholder;
the generator implementation will replace it in a later release.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a new `supabase_typegen` package placeholder (v0.1.0) to
generate typed Dart table definitions from Supabase schemas.
* **Documentation**
* Added initial README and changelog entries documenting current
placeholder status and reserved pub.dev name.
* **CI / Chores**
* Updated release and test workflows to run checks for
`supabase_typegen` when relevant, including coverage carryforward.
* Excluded `supabase_typegen` from SDK public API scanning
(development-time generator).
* **Legal**
  * Added the MIT license for the new package.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
@spydon
spydon force-pushed the feat/typed-table-access branch from 17d12c1 to 6a64143 Compare July 23, 2026 11:48
@spydon
spydon force-pushed the feat/supabase-gen branch from 07cdee7 to c795ded Compare July 23, 2026 11:53
Vinzent03 pushed a commit that referenced this pull request Jul 28, 2026
## What kind of change does this PR introduce?

Feature. Adds an empty skeleton for a new `supabase_typegen` package so
we can publish it to pub.dev and reserve the name.

The full generator implementation lands separately in #1635; this PR
intentionally contains only the minimal publishable placeholder.

## What is the new behavior?

A new `packages/supabase_typegen` package containing:

- a publishable `pubspec.yaml` (version `0.1.0`, no `publish_to: none`)
so the melos release pipeline picks it up,
- a placeholder library, `README`, `CHANGELOG` and `LICENSE`,
- `supabase_lints` wired in via `analysis_options.yaml` (analyzes
clean).

It is wired into:

- the root workspace in `pubspec.yaml`,
- the Dart CI test matrix in `test.yml`,
- the pana release matrix in `release-pana.yml`,
- the SDK compliance parse ignore (`.sdk-parse-ignore`), since it is a
development-time tool rather than SDK client surface.

## Additional context

The README and CHANGELOG flag `0.1.0` as a name-reserving placeholder;
the generator implementation will replace it in a later release.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a new `supabase_typegen` package placeholder (v0.1.0) to
generate typed Dart table definitions from Supabase schemas.
* **Documentation**
* Added initial README and changelog entries documenting current
placeholder status and reserved pub.dev name.
* **CI / Chores**
* Updated release and test workflows to run checks for
`supabase_typegen` when relevant, including coverage carryforward.
* Excluded `supabase_typegen` from SDK public API scanning
(development-time generator).
* **Legal**
  * Added the MIT license for the new package.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Enables `public_member_api_docs` for `supabase_realtime` (149
violations per the ticket's original measurement, 140 after the two
ignores were narrowed).
- Documents the full public surface: `RealtimeClient`,
`RealtimeChannel`, the enums and constants in
`constants.dart`/`realtime_constants.dart`, the Postgres type conversion
helpers in `transformers.dart`, and the data classes in `types.dart`
(payloads, filters, config).
- Deletes the two file-level `ignore_for_file: public_member_api_docs`
comments in `realtime_presence.dart` and `types.dart` (the
`sort_constructors_first` half was already removed by #1767), which is
the concrete trigger for
[SDK-1449](https://linear.app/supabase/issue/SDK-1449/enable-public-member-api-docs-and-document-the-public-api).

## Context
Note on `@internal`: the `public_member_api_docs` lint exempts a whole
class/enum annotated `@internal`, but not an individual member annotated
`@internal` inside an otherwise-public class — those still needed real
docs, which is most of what this PR adds.

## Test plan
- [x] `dart analyze` reports no issues
- [x] `dart format .` produces no diff
- [x] `dart test` passes (252 tests)
- [x] Dependent package `supabase` still analyzes cleanly (no signature
changes, doc-only diff)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **Documentation**
- Expanded and clarified API documentation across realtime channels,
clients, constants, presence, data types, and PostgreSQL
transformations.
- Improved guidance for connection states, subscriptions, heartbeat
handling, events, serialization, and timeout settings.
  - Removed outdated documentation exceptions and improved consistency.

- **Refactor**
- Improved protection for channel and presence state through controlled,
read-only access.
- Channel parameters and presence snapshots are now safely unmodifiable,
preventing unintended changes.
  - No changes to realtime operation behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
spydon and others added 10 commits August 26, 2026 16:56
## What

Bumps the pinned `supabase/sdk` reusable workflow ref from `v1.2.0` to
`v1.3.0`, in both `validate-capabilities.yml` and `sync-compliance.yml`.

## Why

`supabase/sdk` was restructured into a `packages/` monorepo layout
([supabase/sdk#93](supabase/sdk#93)), moving
`scripts/capability-matrix` to `packages/capability-matrix` and
`scripts/dart_symbol_extractor` to `packages/dart-symbol-extractor`.

Pinning there is not fully hermetic: the pinned workflow body comes from
the tag, but the composite actions it calls are referenced `@main` and
check out `supabase/sdk` at `main`. So on `v1.2.0` we get a
post-restructure checkout combined with a workflow body that still
hardcodes `_sdk-spec/scripts/...`. That only works today because
`supabase/sdk` carries transitional `scripts/` → `packages/` symlinks,
which are there purely for pinned callers like this one and are meant to
be deleted.

Bumping to `v1.3.0` puts the workflow body and the checked-out layout
back in agreement, and lets those symlinks be removed upstream.

## Risk

Low. Between `v1.2.0` and `v1.3.0` the reusable workflows changed
**only** in these `scripts/` → `packages/` paths. No input was added,
removed, renamed, or given a new default, so this is a pure ref bump
with no call-site changes needed.

Worth confirming the compliance check job goes green here before merge,
since that is the actual thing being verified.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Updated automated compliance and capability validation workflows to
use the latest validation standards.
  * Improved consistency and reliability of ongoing project checks.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Bumps the pinned supabase/sdk reusable workflows from v1.3.0 to v1.5.0
(`75cf587c486f80c2d2afe57ec909ee2520c098b9`).

v1.4.0 (supabase/sdk#107) resolves the compliance tooling, composite
actions, and capability spec from the single supabase/sdk commit this
pin points at (`job.workflow_sha`), instead of referencing the actions
remotely at `@main` while the workflow itself is SHA-pinned. This
removes the tooling/spec version skew that broke supabase-go CI after
the `packages/` restructure in supabase/sdk, and makes the SHA pin here
fully effective: the action code executed can no longer drift from the
pinned workflow.

v1.5.0 additionally includes supabase/sdk#109, which fixes an unquoted
colon that made the compliance composite action manifests invalid YAML,
so this is the first release where the workflow-SHA resolution from #107
actually runs.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
  * Updated SDK compliance checks to the latest workflow version.
* Applied the update across compliance synchronization and capability
validation workflows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
…hods (#1779)

## What kind of change does this PR introduce?

Bug fix.

## What is the current behavior?

`maybeSingle()` only avoids the `application/vnd.pgrst.object+json`
Accept header for GET requests. For every other method, for example
`.insert(...).select().maybeSingle()` or an update, the header is still
sent, so a request matching zero rows makes PostgREST answer with a real
406 that shows up in the project's API logs. The client then swallows
that 406 by string-matching `Results contain 0 rows` in the error
details.

This is the remaining half of #560, which the previous workaround
explicitly called out as unfixed:


https://github.com/supabase/supabase-flutter/blob/effc37d524ae7b9fa793b325c4179dc18966000c/packages/postgrest/lib/src/postgrest_transform_builder.dart#L209-L210

## What is the new behavior?

`maybeSingle()` no longer overrides the Accept header at all. The result
is fetched as a plain JSON list for every request method and the
at-most-one-row constraint is enforced client-side: one row resolves to
that row, zero rows resolve to `null`, and more than one row throws a
406 `PostgrestApiException` with error code `PGRST116`, mirroring
PostgREST's own error. No 406 ever reaches the server, so nothing
pollutes the API logs.

This matches how supabase-js fixed the same problem
(supabase/postgrest-js#361), and it allows removing the brittle
`_handleMaybeSingleError` fallback that string-matched error details.

The synthesized multiple-rows error now also carries `errorCode:
'PGRST116'`, which the previous client-side error left unset.

## Additional context

The mock tests in `maybe_single_test.dart` simulated the old
server-generated 406 responses and were rewritten to cover the new
behavior: no Accept override for reads or writes, zero rows with
`count()` resolving to `null` data and count 0, a client-side 406 on a
multi-row write, and a genuine server error surfacing unchanged.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
  * Improved `maybeSingle()` handling across read and write operations.
* Zero-row results now resolve to `null` without triggering an
unnecessary 406 response.
  * Multi-row results correctly return a `PGRST116` error.
* Genuine API errors, including 403 responses, are now surfaced
unchanged.
  * Existing `Accept` headers are preserved.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
…commas (#1781)

## What

`toArray` in `supabase_realtime` decoded a Postgres array literal by
trying `json.decode` on the body and, when that threw, splitting the
string on every comma. Both paths carried a `TODO` and a `WARNING:
splitting on comma does not cover all edge cases`, and the edge cases
turn into wrong data in realtime payloads:

| Literal Postgres sends | Before | After |
| --- | --- | --- |
| `{"a,b",c}` | `['"a', ' b"', 'c']` (three elements) | `['a,b', 'c']` |
| `{NULL,a}` on `text[]` | `['NULL', 'a']` | `[null, 'a']` |
| `{"",a}` | `['""', 'a']` | `['', 'a']` |
| `{{1,2},{3,4}}` on `int4[]` | `[null, null, null, null]` | `[[1, 2],
[3, 4]]` |

A `text[]` column whose values contain commas is the common case here:
subscribers got extra elements with stray quote characters in them, and
nothing signalled that the value had been mangled.

This replaces both paths with a parser for the literal itself: comma
separated elements, optional double quotes where `\` escapes the next
character, whitespace around unquoted elements dropped, an unquoted
`NULL` as the null element (a quoted `"NULL"` stays the four character
string), and nested arrays keeping their shape. A literal that doesn't
parse now returns the raw string instead of data that looks structured
but isn't.

`{}`, `{1,2,3}` and quoted ranges like `{"[2021-01-01,2021-12-31)"}`
behave exactly as before — the existing tests cover those and are
unchanged.

## Note on parity with supabase-js

`realtime-js` still has the same `JSON.parse`-then-split logic
(`src/lib/transformers.ts`), including the same TODO and warning
comments, so after this change the Dart client parses these literals
where the JS client does not. I went with correctness here since the
current behaviour silently returns wrong values, but happy to align
differently if you'd rather keep the two in lockstep, and I can open the
matching issue on `realtime-js`.

## Tests

Added a `toArray with quoting` group in
`packages/supabase_realtime/test/transformers_test.dart` covering quoted
commas, `NULL` vs `"NULL"`, empty string elements, nested arrays,
escaped quotes and backslashes, quoted braces, whitespace handling, and
malformed literals.

`dart test -j 1 --exclude-tags integration` in
`packages/supabase_realtime` passes (239 tests), and `dart analyze
packages/supabase_realtime` is clean.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved PostgreSQL array parsing for quoted values, escaped
characters, whitespace, nested arrays, empty strings, and `NULL` values.
* Added support for explicit dimension prefixes and PostgreSQL `box`
array delimiters.
* Malformed array literals, including invalid unquoted elements, are now
safely returned unchanged instead of being incorrectly parsed.

* **Tests**
* Added coverage for multidimensional arrays, quoting, escaping,
whitespace, embedded braces, dimension prefixes, `box` values, and
malformed input.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Lukas Klingsbo <lukas.klingsbo@gmail.com>
Bumps the codeql-action group with 2 updates:
[github/codeql-action/init](https://github.com/github/codeql-action) and
[github/codeql-action/analyze](https://github.com/github/codeql-action).

Updates `github/codeql-action/init` from 4.37.8 to 4.37.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/init's
releases</a>.</em></p>
<blockquote>
<h2>v4.37.9</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.37.9 - 26 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li>
</ul>
<h2>4.37.8 - 21 Aug 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.7 - 13 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
<h2>4.37.6 - 04 Aug 2026</h2>
<ul>
<li>Changed the default filepath for the new remote file address format
that was introduced in CodeQL Action 4.37.0 / 3.37.0 to
<code>.github/codeql-config.yml</code> to align it with the suggested
path that is used elsewhere. <a
href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<h2>4.37.5 - 03 Aug 2026</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>4.37.4 - 29 Jul 2026</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>4.37.3 - 22 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.2 - 21 Jul 2026</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that
was introduced in CodeQL Action 4.37.0 is now enabled by default. In
addition to the format described there, the <code>remote=</code> prefix
can now be used to explicitly indicate that the input refers to a remote
file. All previous input formats continue to be accepted as well. <a
href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured
private registries</a> in Default Setup to retrieve CodeQL configuration
files from remote repositories that require authentication. This will
allow customers to store their CodeQL configuration in a single
repository that can then be referenced by Default Setup workflows in
other repositories. We expect to roll this and other, related changes
out to everyone in July. <a
href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/cdf488f595d80d6e07e03d4674febd5ab45fa938"><code>cdf488f</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4107">#4107</a>
from github/update-v4.37.9-920ba7cd1</li>
<li><a
href="https://github.com/github/codeql-action/commit/7243f38558d187dde99730d224bb47aa26a95306"><code>7243f38</code></a>
Update changelog for v4.37.9</li>
<li><a
href="https://github.com/github/codeql-action/commit/920ba7cd1596037e042122c00381eb16b397d68e"><code>920ba7c</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4106">#4106</a>
from github/update-bundle/codeql-bundle-v2.26.4</li>
<li><a
href="https://github.com/github/codeql-action/commit/ecfa6e16817b8f490bc9a59baa391baf4fa3e3c2"><code>ecfa6e1</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/adcdf4a70d247343cf9c29e0f7a6658b51c3a2b1"><code>adcdf4a</code></a>
Update default bundle to codeql-bundle-v2.26.4</li>
<li><a
href="https://github.com/github/codeql-action/commit/486fec2a3ea2626afcd8c7e9208b4f515078dd7e"><code>486fec2</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4099">#4099</a>
from github/update-supported-enterprise-server-versions</li>
<li><a
href="https://github.com/github/codeql-action/commit/134624c67b20869c2aaa36dafa726375b78a5d76"><code>134624c</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4101">#4101</a>
from github/dependabot/npm_and_yarn/npm-minor-457d82...</li>
<li><a
href="https://github.com/github/codeql-action/commit/ff43db8f982a368288f117354fb8d046e937124c"><code>ff43db8</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4103">#4103</a>
from github/mergeback/v4.37.8-to-main-db488dde</li>
<li><a
href="https://github.com/github/codeql-action/commit/4605e03a74cf891614c4d76f82384a16c1c11816"><code>4605e03</code></a>
Rebuild</li>
<li><a
href="https://github.com/github/codeql-action/commit/099c869cad6bf3b88657154d4ae47ffed27e632d"><code>099c869</code></a>
Update changelog and version after v4.37.8</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28...cdf488f595d80d6e07e03d4674febd5ab45fa938">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/analyze` from 4.37.8 to 4.37.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's
releases</a>.</em></p>
<blockquote>
<h2>v4.37.9</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.37.9 - 26 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li>
</ul>
<h2>4.37.8 - 21 Aug 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.7 - 13 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
<h2>4.37.6 - 04 Aug 2026</h2>
<ul>
<li>Changed the default filepath for the new remote file address format
that was introduced in CodeQL Action 4.37.0 / 3.37.0 to
<code>.github/codeql-config.yml</code> to align it with the suggested
path that is used elsewhere. <a
href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<h2>4.37.5 - 03 Aug 2026</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>4.37.4 - 29 Jul 2026</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>4.37.3 - 22 Jul 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.2 - 21 Jul 2026</h2>
<ul>
<li>The new address format for the <code>config-file</code> input that
was introduced in CodeQL Action 4.37.0 is now enabled by default. In
addition to the format described there, the <code>remote=</code> prefix
can now be used to explicitly indicate that the input refers to a remote
file. All previous input formats continue to be accepted as well. <a
href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li>
<li>The CodeQL Action can now make use of <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured
private registries</a> in Default Setup to retrieve CodeQL configuration
files from remote repositories that require authentication. This will
allow customers to store their CodeQL configuration in a single
repository that can then be referenced by Default Setup workflows in
other repositories. We expect to roll this and other, related changes
out to everyone in July. <a
href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li>
</ul>
<h2>4.37.1 - 16 Jul 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.20.6 and earlier. These versions of
CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise
Server 3.16, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li>
</ul>
<h2>4.37.0 - 08 Jul 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/cdf488f595d80d6e07e03d4674febd5ab45fa938"><code>cdf488f</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4107">#4107</a>
from github/update-v4.37.9-920ba7cd1</li>
<li><a
href="https://github.com/github/codeql-action/commit/7243f38558d187dde99730d224bb47aa26a95306"><code>7243f38</code></a>
Update changelog for v4.37.9</li>
<li><a
href="https://github.com/github/codeql-action/commit/920ba7cd1596037e042122c00381eb16b397d68e"><code>920ba7c</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4106">#4106</a>
from github/update-bundle/codeql-bundle-v2.26.4</li>
<li><a
href="https://github.com/github/codeql-action/commit/ecfa6e16817b8f490bc9a59baa391baf4fa3e3c2"><code>ecfa6e1</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/adcdf4a70d247343cf9c29e0f7a6658b51c3a2b1"><code>adcdf4a</code></a>
Update default bundle to codeql-bundle-v2.26.4</li>
<li><a
href="https://github.com/github/codeql-action/commit/486fec2a3ea2626afcd8c7e9208b4f515078dd7e"><code>486fec2</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4099">#4099</a>
from github/update-supported-enterprise-server-versions</li>
<li><a
href="https://github.com/github/codeql-action/commit/134624c67b20869c2aaa36dafa726375b78a5d76"><code>134624c</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4101">#4101</a>
from github/dependabot/npm_and_yarn/npm-minor-457d82...</li>
<li><a
href="https://github.com/github/codeql-action/commit/ff43db8f982a368288f117354fb8d046e937124c"><code>ff43db8</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4103">#4103</a>
from github/mergeback/v4.37.8-to-main-db488dde</li>
<li><a
href="https://github.com/github/codeql-action/commit/4605e03a74cf891614c4d76f82384a16c1c11816"><code>4605e03</code></a>
Rebuild</li>
<li><a
href="https://github.com/github/codeql-action/commit/099c869cad6bf3b88657154d4ae47ffed27e632d"><code>099c869</code></a>
Update changelog and version after v4.37.8</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28...cdf488f595d80d6e07e03d4674febd5ab45fa938">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
New capability IDs from https://github.com/supabase/sdk were added as
`not_implemented`.

Triage each one: set the real status and add symbols/notes before
merging.- `auth.sign_in.concurrent_pkce_flows`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
…trix (#1787)

## What

The capability-ID sync in #1786 added
`auth.sign_in.concurrent_pkce_flows` to `sdk-compliance.yaml` with the
default `not_implemented` status. The capability is already implemented,
so this marks it `implemented` and gives it the symbols that describe
it.

## Why it is already implemented

The canonical capability asks for each PKCE code verifier to live in its
own bounded, per-flow slot keyed by a generated flow id, with the code
exchange accepting an optional flow id to select the right verifier.
That is what `PKCEVerifierStore` does, landed in #1662 and refactored in
#1744:

- Each flow gets its own storage slot, pending ids are tracked in an
index entry, and starting another flow past
`AuthConstants.pkceMaxConcurrentFlows` (5) evicts the oldest.
- `AuthClient.exchangeCodeForSession` takes an optional `flowId` and
validates it before building a storage key.
- `AuthClient.appendPkceFlowIdToRedirects` and
`AuthClientOptions.appendPkceFlowIdToRedirects` put the id on the
callback URL, and `getOAuthSignInUrl` / `getLinkIdentityUrl` return it
as `OAuthResponse.flowId`.

## Changes

`AuthClient.appendPkceFlowIdToRedirects`,
`AuthClientOptions.appendPkceFlowIdToRedirects` and
`OAuthResponse.flowId` move from
`auth.sign_in.exchange_code_for_session` to the new capability, which is
where they belong now that it exists. `exchange_code_for_session` keeps
`AuthClient.exchangeCodeForSession`.

No note is added, since the implementation matches expected parity.

## Verification

The supabase/sdk compliance tooling was run locally against this branch:

```
validate-compliance  OK — compliance file is valid.
check-api-symbols    All new public API symbols are covered in the capability matrix.
check-drift          No capability matrix drift detected.
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added support for handling multiple concurrent PKCE authentication
flows.
* **Bug Fixes**
* Updated sign-in capability reporting to accurately associate PKCE flow
support with concurrent authentication flows.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
…1783)

Bumps every supabase/sdk reusable workflow pin to the
`capability-matrix-v1.6.0` tag (commit
a494be6719174adbca0313de1ee187407e2dca95).

supabase/sdk stopped cutting root `vX.Y.Z` release tags
(supabase/sdk#112); the compliance workflows and their tooling are now
versioned through `capability-matrix-vX.Y.Z` tags instead. This is the
one-time repin onto the new tag family; Dependabot follows the
`capability-matrix-v*` prefix from here on.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Updated automated compliance and capability validation workflows to
use the latest approved validation rules.
  * Improved alignment with current SDK capability requirements.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What

Replace the deprecated `app-id` input of
`actions/create-github-app-token` with `client-id` in the three
workflows that still used it:

- `release-prepare.yml`
- `release-publish.yml`
- `sync-compliance.yml` (forwarded as the `client-id` secret to the
reusable workflow, which already accepts it at the pinned `v1.5.0`)

All three now use the existing `vars.GH_APP_CLIENT_ID` repository
variable, the same pattern `release-tag.yml` already uses. The `APP_ID`
secret is no longer referenced anywhere.

## Why

Every `Generate token` step logged, twice (once for the main step, once
for the post step):

```
##[warning]Input 'app-id' has been deprecated with message: Use 'client-id' instead.
```

The action declares `deprecationMessage` on `app-id`, so the warning
fires whenever the key is present in `with`. Internally it does
`core.getInput("client-id") || core.getInput("app-id")` and passes the
result straight through as the JWT issuer, so the two inputs are
interchangeable apart from the warning.

## Test plan

- No behaviour change to token generation; `secrets.PRIVATE_KEY` is
untouched and `GH_APP_CLIENT_ID` is the client ID of the same app.
- Note that `release-tag.yml` has not had a non-skipped run since it
switched to `client-id`, so the first release cycle after this merges is
the real exercise of the variable.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Updated release preparation, publishing, and compliance
synchronization workflows to use the configured GitHub App client
identifier.
* Improved workflow configuration consistency across automated release
processes.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
spydon added 6 commits August 31, 2026 13:48
## What

`PostgrestFilterBuilder.isFilter` takes a `bool?`, so it covers
`is.null`, `is.true` and `is.false`, but not PostgREST's fourth `is`
value, `unknown`.

Rather than replacing the `bool?` with an enum (a breaking change), this
adds a dedicated method for the rarely used state, as suggested in
#1609 (comment):

```dart
await supabase.from('users').select().isUnknown('confirmed');
```

## Changes

- `PostgrestFilterBuilder.isUnknown(String column)` appends
`is.unknown`, with a cross-reference from the `isFilter` docs.
- Test asserting the generated query parameter is `is.unknown` and that
PostgREST accepts the filter.
- Registered the new symbol under `database.using_filters.is` in
`sdk-compliance.yaml`.

## Notes

`isUnknown` was deliberately not added to `SupabaseStreamFilterBuilder`.
Realtime validates filter values by casting them to the column type
server-side, and `unknown` is not castable to boolean, so exposing it
there could not be verified to work. On a boolean column `is unknown` is
also equivalent to `is null`, which streams already support.

Closes #1609

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added an `isUnknown` filter for querying rows where a SQL boolean
value is `UNKNOWN`.
  * Updated filter guidance to clarify when to use this option.

* **Documentation**
* Updated compliance documentation to include the new filter capability.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
… and column writability

Tables and foreign tables stay fully writable. Views follow the
is_insert_enabled and is_update_enabled flags of the GeneratorMetadata
contract, falling back to is_updatable for documents that predate the
flags, and materialized views are never writable. Columns the database
reports as not updatable, such as computed view columns, are read-only
like generated columns.
…ostgrest-typegen introspection

The fixture is now produced by seeding a disposable Postgres 15 with
test/fixtures/seed.sql and running tool/regenerate_fixture.ts, which
introspects with the released @supabase/postgrest-typegen 0.2.0 and
applies its sortGeneratorMetadata ordering pass, exactly like
postgres-meta 0.99.0 does. The document now carries the version field,
primaryKeys, type_schema on columns, the full cross-schema types list,
and semantically sorted collections. The seed adds an automatically
updatable view with a computed column, a materialized view, and a join
view that is insertable only through an INSTEAD OF INSERT trigger.
…e_schema

The contract carries type_schema on every column, so enum types are resolved by schema-qualified name instead of bare-name matching with a schema preference. Removes the README limitation about same-named enums across schemas.
Drops the ordinal_position re-sort so columns flow through in the order sortGeneratorMetadata produces (name order within a table), matching every other postgrest-typegen generator and keeping output insensitive to column declaration order.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants