feat: add supabase_typegen package generating typed table definitions - #1635
Draft
spydon wants to merge 36 commits into
Draft
feat: add supabase_typegen package generating typed table definitions#1635spydon wants to merge 36 commits into
spydon wants to merge 36 commits into
Conversation
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
spydon
added a commit
that referenced
this pull request
Jul 23, 2026
## What kind of change does this PR introduce? Feature. Adds an empty skeleton for a new `supabase_typegen` package so we can publish it to pub.dev and reserve the name. The full generator implementation lands separately in #1635; this PR intentionally contains only the minimal publishable placeholder. ## What is the new behavior? A new `packages/supabase_typegen` package containing: - a publishable `pubspec.yaml` (version `0.1.0`, no `publish_to: none`) so the melos release pipeline picks it up, - a placeholder library, `README`, `CHANGELOG` and `LICENSE`, - `supabase_lints` wired in via `analysis_options.yaml` (analyzes clean). It is wired into: - the root workspace in `pubspec.yaml`, - the Dart CI test matrix in `test.yml`, - the pana release matrix in `release-pana.yml`, - the SDK compliance parse ignore (`.sdk-parse-ignore`), since it is a development-time tool rather than SDK client surface. ## Additional context The README and CHANGELOG flag `0.1.0` as a name-reserving placeholder; the generator implementation will replace it in a later release. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a new `supabase_typegen` package placeholder (v0.1.0) to generate typed Dart table definitions from Supabase schemas. * **Documentation** * Added initial README and changelog entries documenting current placeholder status and reserved pub.dev name. * **CI / Chores** * Updated release and test workflows to run checks for `supabase_typegen` when relevant, including coverage carryforward. * Excluded `supabase_typegen` from SDK public API scanning (development-time generator). * **Legal** * Added the MIT license for the new package. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
spydon
force-pushed
the
feat/typed-table-access
branch
from
July 23, 2026 11:48
17d12c1 to
6a64143
Compare
spydon
force-pushed
the
feat/supabase-gen
branch
from
July 23, 2026 11:53
07cdee7 to
c795ded
Compare
Vinzent03
pushed a commit
that referenced
this pull request
Jul 28, 2026
## What kind of change does this PR introduce? Feature. Adds an empty skeleton for a new `supabase_typegen` package so we can publish it to pub.dev and reserve the name. The full generator implementation lands separately in #1635; this PR intentionally contains only the minimal publishable placeholder. ## What is the new behavior? A new `packages/supabase_typegen` package containing: - a publishable `pubspec.yaml` (version `0.1.0`, no `publish_to: none`) so the melos release pipeline picks it up, - a placeholder library, `README`, `CHANGELOG` and `LICENSE`, - `supabase_lints` wired in via `analysis_options.yaml` (analyzes clean). It is wired into: - the root workspace in `pubspec.yaml`, - the Dart CI test matrix in `test.yml`, - the pana release matrix in `release-pana.yml`, - the SDK compliance parse ignore (`.sdk-parse-ignore`), since it is a development-time tool rather than SDK client surface. ## Additional context The README and CHANGELOG flag `0.1.0` as a name-reserving placeholder; the generator implementation will replace it in a later release. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a new `supabase_typegen` package placeholder (v0.1.0) to generate typed Dart table definitions from Supabase schemas. * **Documentation** * Added initial README and changelog entries documenting current placeholder status and reserved pub.dev name. * **CI / Chores** * Updated release and test workflows to run checks for `supabase_typegen` when relevant, including coverage carryforward. * Excluded `supabase_typegen` from SDK public API scanning (development-time generator). * **Legal** * Added the MIT license for the new package. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
…of the OpenAPI description
4 tasks
…zed Postgres types
… to run the generator
## Summary - Enables `public_member_api_docs` for `supabase_realtime` (149 violations per the ticket's original measurement, 140 after the two ignores were narrowed). - Documents the full public surface: `RealtimeClient`, `RealtimeChannel`, the enums and constants in `constants.dart`/`realtime_constants.dart`, the Postgres type conversion helpers in `transformers.dart`, and the data classes in `types.dart` (payloads, filters, config). - Deletes the two file-level `ignore_for_file: public_member_api_docs` comments in `realtime_presence.dart` and `types.dart` (the `sort_constructors_first` half was already removed by #1767), which is the concrete trigger for [SDK-1449](https://linear.app/supabase/issue/SDK-1449/enable-public-member-api-docs-and-document-the-public-api). ## Context Note on `@internal`: the `public_member_api_docs` lint exempts a whole class/enum annotated `@internal`, but not an individual member annotated `@internal` inside an otherwise-public class — those still needed real docs, which is most of what this PR adds. ## Test plan - [x] `dart analyze` reports no issues - [x] `dart format .` produces no diff - [x] `dart test` passes (252 tests) - [x] Dependent package `supabase` still analyzes cleanly (no signature changes, doc-only diff) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Expanded and clarified API documentation across realtime channels, clients, constants, presence, data types, and PostgreSQL transformations. - Improved guidance for connection states, subscriptions, heartbeat handling, events, serialization, and timeout settings. - Removed outdated documentation exceptions and improved consistency. - **Refactor** - Improved protection for channel and presence state through controlled, read-only access. - Channel parameters and presence snapshots are now safely unmodifiable, preventing unintended changes. - No changes to realtime operation behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
3 tasks
## What Bumps the pinned `supabase/sdk` reusable workflow ref from `v1.2.0` to `v1.3.0`, in both `validate-capabilities.yml` and `sync-compliance.yml`. ## Why `supabase/sdk` was restructured into a `packages/` monorepo layout ([supabase/sdk#93](supabase/sdk#93)), moving `scripts/capability-matrix` to `packages/capability-matrix` and `scripts/dart_symbol_extractor` to `packages/dart-symbol-extractor`. Pinning there is not fully hermetic: the pinned workflow body comes from the tag, but the composite actions it calls are referenced `@main` and check out `supabase/sdk` at `main`. So on `v1.2.0` we get a post-restructure checkout combined with a workflow body that still hardcodes `_sdk-spec/scripts/...`. That only works today because `supabase/sdk` carries transitional `scripts/` → `packages/` symlinks, which are there purely for pinned callers like this one and are meant to be deleted. Bumping to `v1.3.0` puts the workflow body and the checked-out layout back in agreement, and lets those symlinks be removed upstream. ## Risk Low. Between `v1.2.0` and `v1.3.0` the reusable workflows changed **only** in these `scripts/` → `packages/` paths. No input was added, removed, renamed, or given a new default, so this is a pure ref bump with no call-site changes needed. Worth confirming the compliance check job goes green here before merge, since that is the actual thing being verified. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated automated compliance and capability validation workflows to use the latest validation standards. * Improved consistency and reliability of ongoing project checks. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Bumps the pinned supabase/sdk reusable workflows from v1.3.0 to v1.5.0 (`75cf587c486f80c2d2afe57ec909ee2520c098b9`). v1.4.0 (supabase/sdk#107) resolves the compliance tooling, composite actions, and capability spec from the single supabase/sdk commit this pin points at (`job.workflow_sha`), instead of referencing the actions remotely at `@main` while the workflow itself is SHA-pinned. This removes the tooling/spec version skew that broke supabase-go CI after the `packages/` restructure in supabase/sdk, and makes the SHA pin here fully effective: the action code executed can no longer drift from the pinned workflow. v1.5.0 additionally includes supabase/sdk#109, which fixes an unquoted colon that made the compliance composite action manifests invalid YAML, so this is the first release where the workflow-SHA resolution from #107 actually runs. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated SDK compliance checks to the latest workflow version. * Applied the update across compliance synchronization and capability validation workflows. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
…hods (#1779) ## What kind of change does this PR introduce? Bug fix. ## What is the current behavior? `maybeSingle()` only avoids the `application/vnd.pgrst.object+json` Accept header for GET requests. For every other method, for example `.insert(...).select().maybeSingle()` or an update, the header is still sent, so a request matching zero rows makes PostgREST answer with a real 406 that shows up in the project's API logs. The client then swallows that 406 by string-matching `Results contain 0 rows` in the error details. This is the remaining half of #560, which the previous workaround explicitly called out as unfixed: https://github.com/supabase/supabase-flutter/blob/effc37d524ae7b9fa793b325c4179dc18966000c/packages/postgrest/lib/src/postgrest_transform_builder.dart#L209-L210 ## What is the new behavior? `maybeSingle()` no longer overrides the Accept header at all. The result is fetched as a plain JSON list for every request method and the at-most-one-row constraint is enforced client-side: one row resolves to that row, zero rows resolve to `null`, and more than one row throws a 406 `PostgrestApiException` with error code `PGRST116`, mirroring PostgREST's own error. No 406 ever reaches the server, so nothing pollutes the API logs. This matches how supabase-js fixed the same problem (supabase/postgrest-js#361), and it allows removing the brittle `_handleMaybeSingleError` fallback that string-matched error details. The synthesized multiple-rows error now also carries `errorCode: 'PGRST116'`, which the previous client-side error left unset. ## Additional context The mock tests in `maybe_single_test.dart` simulated the old server-generated 406 responses and were rewritten to cover the new behavior: no Accept override for reads or writes, zero rows with `count()` resolving to `null` data and count 0, a client-side 406 on a multi-row write, and a genuine server error surfacing unchanged. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved `maybeSingle()` handling across read and write operations. * Zero-row results now resolve to `null` without triggering an unnecessary 406 response. * Multi-row results correctly return a `PGRST116` error. * Genuine API errors, including 403 responses, are now surfaced unchanged. * Existing `Accept` headers are preserved. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
…commas (#1781) ## What `toArray` in `supabase_realtime` decoded a Postgres array literal by trying `json.decode` on the body and, when that threw, splitting the string on every comma. Both paths carried a `TODO` and a `WARNING: splitting on comma does not cover all edge cases`, and the edge cases turn into wrong data in realtime payloads: | Literal Postgres sends | Before | After | | --- | --- | --- | | `{"a,b",c}` | `['"a', ' b"', 'c']` (three elements) | `['a,b', 'c']` | | `{NULL,a}` on `text[]` | `['NULL', 'a']` | `[null, 'a']` | | `{"",a}` | `['""', 'a']` | `['', 'a']` | | `{{1,2},{3,4}}` on `int4[]` | `[null, null, null, null]` | `[[1, 2], [3, 4]]` | A `text[]` column whose values contain commas is the common case here: subscribers got extra elements with stray quote characters in them, and nothing signalled that the value had been mangled. This replaces both paths with a parser for the literal itself: comma separated elements, optional double quotes where `\` escapes the next character, whitespace around unquoted elements dropped, an unquoted `NULL` as the null element (a quoted `"NULL"` stays the four character string), and nested arrays keeping their shape. A literal that doesn't parse now returns the raw string instead of data that looks structured but isn't. `{}`, `{1,2,3}` and quoted ranges like `{"[2021-01-01,2021-12-31)"}` behave exactly as before — the existing tests cover those and are unchanged. ## Note on parity with supabase-js `realtime-js` still has the same `JSON.parse`-then-split logic (`src/lib/transformers.ts`), including the same TODO and warning comments, so after this change the Dart client parses these literals where the JS client does not. I went with correctness here since the current behaviour silently returns wrong values, but happy to align differently if you'd rather keep the two in lockstep, and I can open the matching issue on `realtime-js`. ## Tests Added a `toArray with quoting` group in `packages/supabase_realtime/test/transformers_test.dart` covering quoted commas, `NULL` vs `"NULL"`, empty string elements, nested arrays, escaped quotes and backslashes, quoted braces, whitespace handling, and malformed literals. `dart test -j 1 --exclude-tags integration` in `packages/supabase_realtime` passes (239 tests), and `dart analyze packages/supabase_realtime` is clean. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved PostgreSQL array parsing for quoted values, escaped characters, whitespace, nested arrays, empty strings, and `NULL` values. * Added support for explicit dimension prefixes and PostgreSQL `box` array delimiters. * Malformed array literals, including invalid unquoted elements, are now safely returned unchanged instead of being incorrectly parsed. * **Tests** * Added coverage for multidimensional arrays, quoting, escaping, whitespace, embedded braces, dimension prefixes, `box` values, and malformed input. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Lukas Klingsbo <lukas.klingsbo@gmail.com>
Bumps the codeql-action group with 2 updates: [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.37.8 to 4.37.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/init's releases</a>.</em></p> <blockquote> <h2>v4.37.9</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/cdf488f595d80d6e07e03d4674febd5ab45fa938"><code>cdf488f</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4107">#4107</a> from github/update-v4.37.9-920ba7cd1</li> <li><a href="https://github.com/github/codeql-action/commit/7243f38558d187dde99730d224bb47aa26a95306"><code>7243f38</code></a> Update changelog for v4.37.9</li> <li><a href="https://github.com/github/codeql-action/commit/920ba7cd1596037e042122c00381eb16b397d68e"><code>920ba7c</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4106">#4106</a> from github/update-bundle/codeql-bundle-v2.26.4</li> <li><a href="https://github.com/github/codeql-action/commit/ecfa6e16817b8f490bc9a59baa391baf4fa3e3c2"><code>ecfa6e1</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/adcdf4a70d247343cf9c29e0f7a6658b51c3a2b1"><code>adcdf4a</code></a> Update default bundle to codeql-bundle-v2.26.4</li> <li><a href="https://github.com/github/codeql-action/commit/486fec2a3ea2626afcd8c7e9208b4f515078dd7e"><code>486fec2</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4099">#4099</a> from github/update-supported-enterprise-server-versions</li> <li><a href="https://github.com/github/codeql-action/commit/134624c67b20869c2aaa36dafa726375b78a5d76"><code>134624c</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4101">#4101</a> from github/dependabot/npm_and_yarn/npm-minor-457d82...</li> <li><a href="https://github.com/github/codeql-action/commit/ff43db8f982a368288f117354fb8d046e937124c"><code>ff43db8</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4103">#4103</a> from github/mergeback/v4.37.8-to-main-db488dde</li> <li><a href="https://github.com/github/codeql-action/commit/4605e03a74cf891614c4d76f82384a16c1c11816"><code>4605e03</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/099c869cad6bf3b88657154d4ae47ffed27e632d"><code>099c869</code></a> Update changelog and version after v4.37.8</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28...cdf488f595d80d6e07e03d4674febd5ab45fa938">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/analyze` from 4.37.8 to 4.37.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's releases</a>.</em></p> <blockquote> <h2>v4.37.9</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/cdf488f595d80d6e07e03d4674febd5ab45fa938"><code>cdf488f</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4107">#4107</a> from github/update-v4.37.9-920ba7cd1</li> <li><a href="https://github.com/github/codeql-action/commit/7243f38558d187dde99730d224bb47aa26a95306"><code>7243f38</code></a> Update changelog for v4.37.9</li> <li><a href="https://github.com/github/codeql-action/commit/920ba7cd1596037e042122c00381eb16b397d68e"><code>920ba7c</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4106">#4106</a> from github/update-bundle/codeql-bundle-v2.26.4</li> <li><a href="https://github.com/github/codeql-action/commit/ecfa6e16817b8f490bc9a59baa391baf4fa3e3c2"><code>ecfa6e1</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/adcdf4a70d247343cf9c29e0f7a6658b51c3a2b1"><code>adcdf4a</code></a> Update default bundle to codeql-bundle-v2.26.4</li> <li><a href="https://github.com/github/codeql-action/commit/486fec2a3ea2626afcd8c7e9208b4f515078dd7e"><code>486fec2</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4099">#4099</a> from github/update-supported-enterprise-server-versions</li> <li><a href="https://github.com/github/codeql-action/commit/134624c67b20869c2aaa36dafa726375b78a5d76"><code>134624c</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4101">#4101</a> from github/dependabot/npm_and_yarn/npm-minor-457d82...</li> <li><a href="https://github.com/github/codeql-action/commit/ff43db8f982a368288f117354fb8d046e937124c"><code>ff43db8</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4103">#4103</a> from github/mergeback/v4.37.8-to-main-db488dde</li> <li><a href="https://github.com/github/codeql-action/commit/4605e03a74cf891614c4d76f82384a16c1c11816"><code>4605e03</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/099c869cad6bf3b88657154d4ae47ffed27e632d"><code>099c869</code></a> Update changelog and version after v4.37.8</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28...cdf488f595d80d6e07e03d4674febd5ab45fa938">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
New capability IDs from https://github.com/supabase/sdk were added as `not_implemented`. Triage each one: set the real status and add symbols/notes before merging.- `auth.sign_in.concurrent_pkce_flows` Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
…trix (#1787) ## What The capability-ID sync in #1786 added `auth.sign_in.concurrent_pkce_flows` to `sdk-compliance.yaml` with the default `not_implemented` status. The capability is already implemented, so this marks it `implemented` and gives it the symbols that describe it. ## Why it is already implemented The canonical capability asks for each PKCE code verifier to live in its own bounded, per-flow slot keyed by a generated flow id, with the code exchange accepting an optional flow id to select the right verifier. That is what `PKCEVerifierStore` does, landed in #1662 and refactored in #1744: - Each flow gets its own storage slot, pending ids are tracked in an index entry, and starting another flow past `AuthConstants.pkceMaxConcurrentFlows` (5) evicts the oldest. - `AuthClient.exchangeCodeForSession` takes an optional `flowId` and validates it before building a storage key. - `AuthClient.appendPkceFlowIdToRedirects` and `AuthClientOptions.appendPkceFlowIdToRedirects` put the id on the callback URL, and `getOAuthSignInUrl` / `getLinkIdentityUrl` return it as `OAuthResponse.flowId`. ## Changes `AuthClient.appendPkceFlowIdToRedirects`, `AuthClientOptions.appendPkceFlowIdToRedirects` and `OAuthResponse.flowId` move from `auth.sign_in.exchange_code_for_session` to the new capability, which is where they belong now that it exists. `exchange_code_for_session` keeps `AuthClient.exchangeCodeForSession`. No note is added, since the implementation matches expected parity. ## Verification The supabase/sdk compliance tooling was run locally against this branch: ``` validate-compliance OK — compliance file is valid. check-api-symbols All new public API symbols are covered in the capability matrix. check-drift No capability matrix drift detected. ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for handling multiple concurrent PKCE authentication flows. * **Bug Fixes** * Updated sign-in capability reporting to accurately associate PKCE flow support with concurrent authentication flows. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
…1783) Bumps every supabase/sdk reusable workflow pin to the `capability-matrix-v1.6.0` tag (commit a494be6719174adbca0313de1ee187407e2dca95). supabase/sdk stopped cutting root `vX.Y.Z` release tags (supabase/sdk#112); the compliance workflows and their tooling are now versioned through `capability-matrix-vX.Y.Z` tags instead. This is the one-time repin onto the new tag family; Dependabot follows the `capability-matrix-v*` prefix from here on. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated automated compliance and capability validation workflows to use the latest approved validation rules. * Improved alignment with current SDK capability requirements. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What
Replace the deprecated `app-id` input of
`actions/create-github-app-token` with `client-id` in the three
workflows that still used it:
- `release-prepare.yml`
- `release-publish.yml`
- `sync-compliance.yml` (forwarded as the `client-id` secret to the
reusable workflow, which already accepts it at the pinned `v1.5.0`)
All three now use the existing `vars.GH_APP_CLIENT_ID` repository
variable, the same pattern `release-tag.yml` already uses. The `APP_ID`
secret is no longer referenced anywhere.
## Why
Every `Generate token` step logged, twice (once for the main step, once
for the post step):
```
##[warning]Input 'app-id' has been deprecated with message: Use 'client-id' instead.
```
The action declares `deprecationMessage` on `app-id`, so the warning
fires whenever the key is present in `with`. Internally it does
`core.getInput("client-id") || core.getInput("app-id")` and passes the
result straight through as the JWT issuer, so the two inputs are
interchangeable apart from the warning.
## Test plan
- No behaviour change to token generation; `secrets.PRIVATE_KEY` is
untouched and `GH_APP_CLIENT_ID` is the client ID of the same app.
- Note that `release-tag.yml` has not had a non-skipped run since it
switched to `client-id`, so the first release cycle after this merges is
the real exercise of the variable.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated release preparation, publishing, and compliance
synchronization workflows to use the configured GitHub App client
identifier.
* Improved workflow configuration consistency across automated release
processes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What `PostgrestFilterBuilder.isFilter` takes a `bool?`, so it covers `is.null`, `is.true` and `is.false`, but not PostgREST's fourth `is` value, `unknown`. Rather than replacing the `bool?` with an enum (a breaking change), this adds a dedicated method for the rarely used state, as suggested in #1609 (comment): ```dart await supabase.from('users').select().isUnknown('confirmed'); ``` ## Changes - `PostgrestFilterBuilder.isUnknown(String column)` appends `is.unknown`, with a cross-reference from the `isFilter` docs. - Test asserting the generated query parameter is `is.unknown` and that PostgREST accepts the filter. - Registered the new symbol under `database.using_filters.is` in `sdk-compliance.yaml`. ## Notes `isUnknown` was deliberately not added to `SupabaseStreamFilterBuilder`. Realtime validates filter values by casting them to the column type server-side, and `unknown` is not castable to boolean, so exposing it there could not be verified to work. On a boolean column `is unknown` is also equivalent to `is null`, which streams already support. Closes #1609 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added an `isUnknown` filter for querying rows where a SQL boolean value is `UNKNOWN`. * Updated filter guidance to clarify when to use this option. * **Documentation** * Updated compliance documentation to include the new filter capability. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
… and column writability Tables and foreign tables stay fully writable. Views follow the is_insert_enabled and is_update_enabled flags of the GeneratorMetadata contract, falling back to is_updatable for documents that predate the flags, and materialized views are never writable. Columns the database reports as not updatable, such as computed view columns, are read-only like generated columns.
…ostgrest-typegen introspection The fixture is now produced by seeding a disposable Postgres 15 with test/fixtures/seed.sql and running tool/regenerate_fixture.ts, which introspects with the released @supabase/postgrest-typegen 0.2.0 and applies its sortGeneratorMetadata ordering pass, exactly like postgres-meta 0.99.0 does. The document now carries the version field, primaryKeys, type_schema on columns, the full cross-schema types list, and semantically sorted collections. The seed adds an automatically updatable view with a computed column, a materialized view, and a join view that is insertable only through an INSTEAD OF INSERT trigger.
…e_schema The contract carries type_schema on every column, so enum types are resolved by schema-qualified name instead of bare-name matching with a schema preference. Removes the README limitation about same-named enums across schemas.
Drops the ordinal_position re-sort so columns flow through in the order sortGeneratorMetadata produces (name order within a table), matching every other postgrest-typegen generator and keeping output insensitive to column declaration order.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What kind of change does this PR introduce?
Feature (draft, layer 2 of the typed table access work, stacked on #1634). Adds a new
supabase_typegenpackage: a standalone code generator that turns a database schema into the typed table definitions introduced in #1634, so users get the fully typed surface without writing any of it by hand.Linear: SDK-1362
What is the new behavior?
supabase gen types --lang json --local > schema.json dart run supabase_typegen --input schema.jsonreads the language-neutral
GeneratorMetadataintrospection document (the@supabase/postgrest-typegencontract from supabase/pg-toolbelt#302, which postgres-meta itself consumes after supabase/postgres-meta#1084;--input -reads it from stdin) and emits one Dart file containing, per table:DateTimeparsing,double/numcoercion,Listcasts, Postgres enum mapping),InsertandUpdatevalue extension types that implementMap<String, dynamic>, with required parameters derived fromNOT NULL-without-default columns and null-aware omission for everything else; explicit SQL NULL writes go through generatedset…ToNullcopy methods that only exist for nullable, writable columns,PostgrestTabledefinition plusTableColumntokens for compile-time checked filters,toStringreturns the wire name so enum values work directly in filters).See
packages/supabase_typegen/test/goldens/supabase_schema.dartfor what the output looks like for the fixture schema.Design choices worth reviewing:
GeneratorMetadatacontract of@supabase/postgrest-typegen(feat(postgrest-typegen): add package with multi-language code generation pg-toolbelt#302), the same document the TypeScript, Go, Swift, and Python generators consume; structural validation rejects non-matching documents. It comes straight from the database catalog, so the output is exact where API-derived descriptions are lossy:NOT NULLcolumns with a database default read as non-nullable but stay optional on insert, identity columns are recognized, andGENERATED ALWAYScolumns appear in the row type but are excluded from the insert and update types. This is the single introspection source; the parser is a pure function over the JSON document behind theSchemaDescriptionmodel.booksemitsBooksRow/BooksInsert/BooksUpdateplus aBooksnamespace class (no English singularization, so names stay predictable). Identifiers are sanitized against Dart reserved words andMapmember names with a$suffix, and collisions are deduplicated.supabase_lintsand DCM with zero issues, including the strict extension type rules.Deliberately deferred: foreign key relationship getters (the fk targets are already parsed into the model) and typed rpc functions.
Additional context
supabase gen types --lang jsonand--lang dart..sdk-parse-ignoresince it is a development-time tool, not SDK client surface; the symbol, drift and schema checks pass locally against the base branch.supabase_typegenis added to the CI dart test matrix; tests are fully mocked/fixture-based (introspection unit tests over a checked-in metadata fixture, a whitespace-insensitive golden comparison with atool/regenerate_goldens.dartrefresh script, and behavior tests that run the generated golden code against a mock HTTP client to verify wire formats end to end).publish_to: noneuntil the API settles.