$ the-wire · showcase
Storage sidecars follow renamed files, command menu stops preloading
By RepoJournal · Filed · About Supabase · Composed from the cited sources · methodology
A storage metadata loss on filesystems without native xattrs and a command menu that mounted itself on close lead today's fixes, alongside shared code blocks in the docs and a branded error type for MCP tool calls.
fix(storage): move xattr sidecars with renamed files (#339) supabase/slim-services
Storage v1.84.1 stages each upload at .<uuid>.tmp, sets metadata there, then renames it into place; native xattrs follow the inode, but the sidecar fallback is keyed by path, so on filesystems without xattrs the published object lost its content type, cache control and part etags. The fix wraps node:fs/promises rename so the sidecar moves with its file, written before the rename.
fix(ui-patterns): only initiate the command menu when it opens supabase/supabase
Closing the command menu called setOpen(false), and setOpen always ran init(), which mounted the lazy CommandMenu: the first close fired off fetches for api keys, project settings, projects, secrets, auth/storage config and integrations. It reproduces on master, triggered by a shallow routeChangeComplete when switching schema in the Table Editor on Next or the load-time onResolved on TanStack.
feat(docs): extracts code block component (#51661) supabase/supabase
The docs code block moves out of apps/docs into ui-patterns/CodeBlock as separate imports, so other surfaces stop rendering code their own way. KB code blocks now show line numbers, matching docs.
feat: mark client-caused tool errors as ToolCallerError supabase/mcp
@supabase/mcp-server-supabase now exports ToolCallerError and isToolCallerError(error), and the guard checks a Symbol.for('supabase.mcp.callerError') brand instead of instanceof, so it holds across two installed copies of the package and across its CJS and ESM builds. Platform imports both from the package root rather than keeping its own copy of the classification.
docs: call Edge Functions from Postgres with the secret key (#51990) supabase/supabase
Three guides gave conflicting advice on how Postgres authenticates when it calls an Edge Function; the docs now call them with the secret key on apikey, auth: 'secret' and verify_jwt = false, which is what pg_net calls, cron jobs and the Dashboard's Add secret key forms already did.
fix(release): wait for the upstream image before polling identity services supabase/slim-services
Elsewhere in slim-services: the PHX_HTTP_IP patch now applies with zero fuzz from the v2.138.6 floor through v2.147.1 after upstream v2.146.0 changed the config/runtime.exs line its first hunk used as context, three flaky release failure sources were removed, and the poller no longer re-dispatches storage builds for tagged versions whose upstream image was never published.
