Adds a docs guide, "Choosing a server-side package", that explains when
to use `supabase-js`, `@supabase/ssr`, or `@supabase/server` when
working with Supabase from JavaScript on the server. It includes a
decision table and a short code example for each, with one rule up
front: cookie-based sessions in SSR frameworks use `@supabase/ssr`,
per-request header auth in Edge Functions and other backend runtimes
uses `@supabase/server`, and `supabase-js` is the base client both wrap.

The guide is surfaced from the Auth overview page and the sidebar, and
is cross-linked from the `supabase-js` and `@supabase/server` reference
introductions so it is reachable from where developers start. It also
states that the packages coexist and are not replacements for each
other, and keeps combining `@supabase/server` with `@supabase/ssr` as an
advanced section.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **New Features**
- Added a guide explaining how to choose between Supabase server-side
JavaScript packages.
- Added the guide to Auth navigation and the getting-started content
listings.
- Added links to the new guidance throughout relevant JavaScript and
server documentation.
- **Documentation**
- Clarified when to use cookie-based sessions versus header-based
authentication.
- Added package comparisons, usage examples, advanced guidance, and
related next steps.
- Updated spelling support for framework names used in the
documentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Changes to the structure of the <Switch> and <Dialog> elements, which
previously resulted in two nested buttons in the DOM.
Adding the asChild attribute broke the styling of the <Switch>.
Added aria-label and tooltips to the <Switch> component and the
icon-only buttons.

<img width="1909" height="1254" alt="fix_observabilty"
src="https://github.com/user-attachments/assets/4dc99845-c083-455b-beed-1ac58b66dd6f"
/>

## What is the current behavior?

Icon-only buttond do not have explicit accessible names for screen
readers.
Two nested buttons are invalid in HTML and interfere with the operation
of screen readers.

## What is the new behavior?

Iicon-only buttons now have explicit accessible names using visually
hidden text (sr-only), ensuring proper screen reader support.
The DOM structure is now correct.

## Additional context

No visual changes were introduced.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **Bug Fixes**
* Improved accessibility in the query performance filter bar by adding
clear `aria-label` values to the Refresh and Reset report buttons.
* Improved accessibility and usability for cron job table actions by
adding a job-specific “actions” tooltip/label for the dropdown trigger.
* Updated the cron job enable/disable toggle with job-specific
`aria-label`s and refined the confirmation dialog flow to prevent
unintended row interactions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Draft blog post announcing Unified Logs in open beta.

Post: `apps/www/_blog/2026-07-06-unified-logs-open-beta.mdx`

### Before publishing
- [ ] Confirm publish date

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Announced the open beta of Unified Logs, including a single unified,
searchable log stream across multiple services.
* Introduced log-type filtering with counts, shareable filter/search
links, live tailing, and a zoomable timeline for log-volume exploration.
* Added per-request details showing request progression and an option to
view raw JSON, plus support for forwarding logs externally via Log
Drains.
* **Content Updates**
  * Added a new author profile entry.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: kemal <hello@kemal.earth>
Co-authored-by: Shane <o@shaneermitano.com>
Co-authored-by: Ana <30495040+ana1337x@users.noreply.github.com>

…a project is deleted (#47569)

How to test:
1. Have multiple free orgs
2. Open the "create new project" page in those orgs (no need to create a
project), notice the `/members/reached-free-project-limit'` API call
3. Delete any project in any of the orgs you have
4. Go to any of orgs and open the "create new project" page, the request
should be sent again (it was purged from the cache)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved project deletion behavior so free project limit checks are
refreshed across all organizations, reducing the chance of stale
availability data.
* Continued to refresh the deleted project’s details and, when
applicable, the project list and organization details after deletion.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

…48008)

Switches the TanStack build's Vercel skew protection from the `__vdpl`
session cookie to `?dpl=<deployment-id>` query params baked into asset
URLs at build time. Assets stay pinned to the deployment that built
them, while document navigations and API fetches always reach the latest
deployment (with the cookie, a session stayed fully pinned — including
reloads — until the tab closed).

**Removed:**
- `pinDeploymentForSession` (the `__vdpl` cookie) from `router.tsx`,
plus the cookie clearing in the refresh toast and the
`vite:preloadError` backstop
- `credentials: 'omit'` on the deployment-commit check — its only
purpose was escaping the cookie pin, and API fetches are now inherently
unpinned

**Added:**
- `skewProtectionDpl` plugin + `experimental.renderBuiltUrl` in
`vite.config.ts`, active only when `VERCEL_SKEW_PROTECTION_ENABLED=1`.
Full coverage needs three mechanisms (Vite has no single hook for this —
see
[vitejs/vite#13834](vitejs/vite#13834 (reply in thread))):
1. `renderBuiltUrl` — CSS `url()`s, images, workers, and
`__vite__mapDeps` preload lists
2. a `generateBundle` (`order: 'post'`) rewrite of chunk-to-chunk
`import`/`from` specifiers, which Rolldown emits as bare relative paths
that `renderBuiltUrl` never sees — with sourcemaps recombined per chunk
(`magic-string` + `@jridgewell/remapping` devDeps) so Sentry columns
stay exact
3. a post-`buildApp` patch of the prerendered `_shell.html`
(script/preload tags + embedded router manifest come from TanStack, not
Vite's asset pipeline); without it the entry graph double-downloads
because preload and import URLs differ

## To test

- Built with fake `VERCEL_SKEW_PROTECTION_ENABLED=1
VERCEL_DEPLOYMENT_ID=dpl_TESTPIN123abc`: every chunk import specifier
(static + dynamic), `__vite__mapDeps` entry, CSS font URL, and
`_shell.html` asset URL carries `?dpl=`; zero unpinned `/assets/`
references remain
- Sourcemap accuracy verified by tracing a minified position through the
recombined map: resolves to the exact original file/line/column
(`use-check-latest-deploy.tsx:62:8`)
- Built without the env vars: output contains no `dpl=` anywhere
(self-hosted/e2e builds unaffected)
- `smoke:tanstack` passes on both builds; `tsc --noEmit` and eslint
clean
- On the preview: load the dashboard, check Network tab — chunk/CSS
requests should carry `?dpl=` matching the deployment; hard reload
should hit the latest deployment (no pin on document requests)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Improvements**
* Improved deployment consistency by pinning generated asset and module
URLs to the current deployment (using `?dpl=`).
* Simplified refresh and preload-error recovery to reduce reload-loop
risk.
* Kept API request behavior aligned with the updated deployment
routing/pinning approach.
  * Preserved correct routing across deployment configurations.
* **Developer Experience**
* Added build-time tooling to rewrite pinned URLs for client assets
while maintaining source map integrity.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>

…rash (#48009)

## Problem

In a database report, dragging over a chart to open logs had two bugs.
Clicking a bar instead of dragging produced a zero-width selection (its
=== ite), so the logs view showed no results. Separately, the logs
datepicker crashed with "Invalid time value" because the chart put raw
epoch-ms values into the its/ite URL params, which get parsed with new
Date(string) and yield an Invalid Date that react-day-picker cannot
format.

## Fix

The chart now emits ISO timestamps in the logs URL so its/ite match the
format every other logs consumer already uses, and the datepicker guards
against unparseable values from any source (such as old bookmarked
links). A single click now expands the highlight to the clicked bucket,
from the bar's start to the next bar's start, so the selection, popover,
and logs range all cover the bar the user picked.

## How to test

1. Open a database report with a chart (for example Postgres, project
logs).
2. Drag across the chart, choose "Open in Postgres Logs", then open the
timepicker. Expected: it opens without crashing and shows the selected
range.
3. Go back and single-click one bar instead of dragging. Expected: that
bar's bucket is selected and "Open in Postgres Logs" loads logs for a
real, non-empty range.
4. Run the chart tests, expected all pass: pnpm --filter studio exec
vitest --run components/ui/Charts


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Prevented invalid log date inputs from creating invalid date
selections.
* Improved chart “open logs” links by normalizing the selected time
bounds (now consistently sent as ISO timestamps).
* Refined chart highlight behavior for click-to-advance and more
accurate left/right range selection, supporting both numeric and string
coordinate values.
* Updated the chart highlight dropdown display for clearer formatting of
numeric vs non-numeric dates.
* **Tests**
* Added Vitest coverage for chart highlight click, drag, and left/right
ordering scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->