[pull] master from supabase:master

apps/docs/app/guides/database/database-advisors/page.tsx

@@ -25,7 +25,7 @@ const meta = {
 }
 
 const generateMetadata = genGuideMeta(() => ({
-  pathname: '/guides/database/database-linter',
+  pathname: '/guides/database/database-advisors',
   meta,
 }))
 

apps/docs/app/guides/database/extensions/wrappers/[[...slug]]/page.tsx

@@ -15,7 +15,7 @@ import { linkTransform, type UrlTransformFunction } from '~/lib/mdx/plugins/rehy
 import remarkMkDocsAdmonition from '~/lib/mdx/plugins/remarkAdmonition'
 import { removeTitle } from '~/lib/mdx/plugins/remarkRemoveTitle'
 import remarkPyMdownTabs from '~/lib/mdx/plugins/remarkTabs'
-import { getGitHubFileContents } from '~/lib/octokit'
+import { getGitHubFileContents, octokit } from '~/lib/octokit'
 import type { SerializeOptions } from '~/types/next-mdx-remote-serialize'
 import { isFeatureEnabled } from 'common'
 import matter from 'gray-matter'
@@ -29,10 +29,62 @@ import { Admonition } from 'ui-patterns'
 // We fetch these docs at build time from an external repo
 const org = 'supabase'
 const repo = 'wrappers'
-const branch = 'main'
 const docsDir = 'docs/catalog'
 const externalSite = 'https://supabase.github.io/wrappers'
 
+type DocsTagsQueryResponse = {
+  repository: {
+    refs: {
+      nodes: { name: string }[] | null
+      pageInfo: { hasNextPage: boolean; endCursor: string | null }
+    }
+  }
+}
+
+const docsTagsQuery = `
+  query DocsTagsQuery($owner: String!, $name: String!, $after: String) {
+    repository(owner: $owner, name: $name) {
+      refs(
+        refPrefix: "refs/tags/",
+        orderBy: { field: TAG_COMMIT_DATE, direction: DESC },
+        first: 5,
+        after: $after
+      ) {
+        nodes { name }
+        pageInfo { hasNextPage endCursor }
+      }
+    }
+  }
+`
+
+async function getLatestDocsTag(after: string | null = null): Promise<string | null> {
+  try {
+    /**
+     * We use GraphQL as it's the only way to use `orderBy` on Github API.
+     */
+    const {
+      repository: {
+        refs: {
+          nodes,
+          pageInfo: { hasNextPage, endCursor },
+        },
+      },
+    } = await octokit().graphql<DocsTagsQueryResponse>(docsTagsQuery, {
+      owner: org,
+      name: repo,
+      after,
+    })
+
+    return (
+      nodes?.find(({ name }) => /^docs_v\d+\.\d+\.\d+/.test(name))?.name ??
+      (hasNextPage && endCursor ? await getLatestDocsTag(endCursor) : null)
+    )
+  } catch (error) {
+    console.error(`Error fetching docs tags for wrappers federated pages: ${error}`)
+    return null
+  }
+}
+
 // Each external docs page is mapped to a local page
 const pageMap = [
   {
@@ -378,16 +430,22 @@ const getContent = async (params: Params) => {
     let remoteFile: string
     ;({ remoteFile, meta } = federatedPage)
 
-    editLink = `${org}/${repo}/blob/${branch}/${docsDir}/${remoteFile}`
+    const tag = await getLatestDocsTag()
+
+    if (!tag) {
+      throw new Error('No latest docs tag found for federated wrappers pages')
+    }
+
+    editLink = `${org}/${repo}/blob/${tag}/${docsDir}/${remoteFile}`
 
     let rawContent = await getGitHubFileContents({
       org,
       repo,
       path: `${docsDir}/${remoteFile}`,
-      branch,
+      branch: tag,
     })
 
-    assetsBaseUrl = `https://raw.githubusercontent.com/${org}/${repo}/${branch}/docs/assets/`
+    assetsBaseUrl = `https://raw.githubusercontent.com/${org}/${repo}/${tag}/docs/assets/`
 
     const { content: contentWithoutFrontmatter } = matter(rawContent)
     content = removeRedundantH1(contentWithoutFrontmatter)

apps/docs/app/guides/deployment/ci/[slug]/page.tsx

@@ -87,7 +87,7 @@ const getContent = async ({ slug }: Params) => {
   )
 
   return {
-    pathname: `/guides/cli/github-action/${slug}` satisfies `/${string}`,
+    pathname: `/guides/deployment/ci/${slug}` satisfies `/${string}`,
     meta,
     content,
     editLink,

apps/docs/app/guides/deployment/terraform/[[...slug]]/page.tsx

@@ -136,7 +136,7 @@ const getContent = async ({ slug }: Params) => {
 
   return {
     pathname:
-      `/guides/platform/terraform${slug?.length ? `/${slug.join('/')}` : ''}` satisfies `/${string}`,
+      `/guides/deployment/terraform${slug?.length ? `/${slug.join('/')}` : ''}` satisfies `/${string}`,
     meta,
     content,
     editLink,

apps/docs/app/guides/deployment/terraform/reference/page.tsx

@@ -22,7 +22,7 @@ const meta = {
 }
 
 const generateMetadata = genGuideMeta(() => ({
-  pathname: '/guides/platform/terraform/reference',
+  pathname: '/guides/deployment/terraform/reference',
   meta,
 }))
 

apps/docs/app/guides/local-development/cli/config/page.tsx

@@ -12,7 +12,7 @@ const meta = {
 }
 
 const generateMetadata = genGuideMeta(() => ({
-  pathname: '/guides/cli/config',
+  pathname: '/guides/local-development/cli/config',
   meta,
 }))
 

apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts

@@ -338,8 +338,12 @@ export const gettingstarted: NavMenuConstant = {
   items: [
     { name: 'Build with AI tools', url: '/guides/ai-tools' },
     { name: 'API Keys', url: '/guides/getting-started/api-keys' },
-    { name: 'Local Development', url: '/guides/cli/getting-started' },
+    { name: 'Local Development', url: '/guides/local-development/cli/getting-started' },
     { name: 'Architecture', url: '/guides/getting-started/architecture' },
+    {
+      name: 'Migrating to new API keys',
+      url: '/guides/getting-started/migrating-to-new-api-keys',
+    },
     {
       name: 'Framework Quickstarts',
       enabled: frameworkQuickstartsEnabled,

apps/docs/content/_partials/api_keys_deprecation.mdx

@@ -0,0 +1,12 @@
+<Admonition type="deprecation" title="Changes to API keys">
+
+Supabase has changed the way keys work to improve project security and developer experience. You can [read the full announcement on GitHub](https://github.com/orgs/supabase/discussions/29260).
+
+**They will be deprecated by the end of 2026, and you should now use the publishable (`sb_publishable_xxx`) and secret (`sb_secret_xxx`) keys instead**.
+
+In most cases, you can get keys from [the Project's **Connect** dialog](/dashboard/project/\_?showConnect=true&connectTab={{ .tab }}&framework={{ .framework }}), but if you want a specific key, you can find them in the [**Settings > API Keys**](/dashboard/project/_/settings/api-keys/) section of the Dashboard.
+
+- **For new keys**, open the **API Keys** tab, if you don't have a publishable key already, click **Create new API Keys**, and copy the value from the **Publishable key** section for client-side operations. For server-side operations, copy the value from the **Secret keys** section.
+- **For legacy keys**, copy the `anon` key for client-side operations and the `service_role` key for server-side operations from the **Legacy API Keys** tab.
+
+</Admonition>

apps/docs/content/_partials/api_settings.mdx

@@ -6,15 +6,5 @@ To do this, you need to get the Project URL and key from [the project **Connect*
 
 [Read the API keys docs](/docs/guides/getting-started/api-keys) for a full explanation of all key types and their uses.
 
-<Admonition type="note" title="Changes to API keys">
-
-Supabase is changing the way keys work to improve project security and developer experience. You can [read the full announcement on GitHub](https://github.com/orgs/supabase/discussions/29260).
-
-The older `anon` and `service_role` keys will work until the end of 2026 but **we strongly encourage switching to and using** the new publishable (`sb_publishable_xxx`) and secret (`sb_secret_xxx`) keys now.
-
-In most cases, you can get keys from [the Project's **Connect** dialog](/dashboard/project/\_?showConnect=true&connectTab={{ .tab }}&framework={{ .framework }}), but if you want a specific key, you can find them in the [**Settings > API Keys**](/dashboard/project/_/settings/api-keys/) section of the Dashboard.
-
-- **For legacy keys**, copy the `anon` key for client-side operations and the `service_role` key for server-side operations from the **Legacy API Keys** tab.
-- **For new keys**, open the **API Keys** tab, if you don't have a publishable key already, click **Create new API Keys**, and copy the value from the **Publishable key** section.
-
-</Admonition>
+<$Partial path="api_keys_deprecation.mdx" variables={{ "framework": "{{ .framework }}", "tab": "{{ .tab }}" }}
+/>

apps/docs/content/_partials/api_settings_steps.mdx

@@ -8,15 +8,5 @@ To do this, you need to get the Project URL and key from [the project **Connect*
 
 [Read the API keys docs](/docs/guides/getting-started/api-keys) for a full explanation of all key types and their uses.
 
-<Admonition type="note" title="Changes to API keys">
-
-Supabase is changing the way keys work to improve project security and developer experience. You can [read the full announcement on GitHub](https://github.com/orgs/supabase/discussions/29260).
-
-The older `anon` and `service_role` keys will work until the end of 2026 but **we strongly encourage switching to and using** the new publishable (`sb_publishable_xxx`) and secret (`sb_secret_xxx`) keys now.
-
-In most cases, you can get keys from [the Project's **Connect** dialog](/dashboard/project/\_?showConnect=true&connectTab={{ .tab }}&framework={{ .framework }}), but if you want a specific key, you can find them in the [**Settings > API Keys**](/dashboard/project/_/settings/api-keys/) section of the Dashboard.
-
-- **For legacy keys**, copy the `anon` key for client-side operations and the `service_role` key for server-side operations from the **Legacy API Keys** tab.
-- **For new keys**, open the **API Keys** tab, if you don't have a publishable key already, click **Create new API Keys**, and copy the value from the **Publishable key** section.
-
-</Admonition>
+<$Partial path="api_keys_deprecation.mdx" variables={{ "framework": "{{ .framework }}", "tab": "{{ .tab }}" }}
+/>

apps/docs/content/guides/api/creating-routes.mdx

@@ -66,16 +66,7 @@ Every Supabase project has a unique API URL. Your API is secured behind an API g
 
 To do this, you need to get the Project URL and key from [the project's **Connect** dialog](/dashboard/project/_?showConnect=true).
 
-<Admonition type="note" title="Changes to API keys">
-
-Supabase is changing the way keys work to improve project security and developer experience. You can [read the full announcement](https://github.com/orgs/supabase/discussions/29260), but in the transition period, you can use both the current `anon` and `service_role` keys and the new publishable key with the form `sb_publishable_xxx` which will replace the older keys.
-
-In most cases, you can get the correct key from [the Project's **Connect** dialog](/dashboard/project/_?showConnect=true), but if you want a specific key, you can find all keys in [the API Keys section of a Project's Settings page](/dashboard/project/_/settings/api-keys/):
-
-- **For legacy keys**, copy the `anon` key for client-side operations and the `service_role` key for server-side operations from the **Legacy API Keys** tab.
-- **For new keys**, open the **API Keys** tab, if you don't have a publishable key already, click **Create new API Keys**, and copy the value from the **Publishable key** section.
-
-</Admonition>
+<$Partial path="api_keys_deprecation.mdx" variables={{ "framework": "{{ .framework }}", "tab": "{{ .tab }}" }} />
 
 [Read the API keys docs](/docs/guides/getting-started/api-keys) for a full explanation of all key types and their uses.
 

apps/docs/content/guides/auth/quickstarts/react.mdx

@@ -68,8 +68,6 @@ hideToc: true
         <ProjectConfigVariables variable="url" />
         <ProjectConfigVariables variable="publishable" />
 
-
-
     </StepHikeCompact.Details>
 
     <StepHikeCompact.Code>

apps/docs/content/guides/getting-started/api-keys.mdx

@@ -32,15 +32,7 @@ There are 4 types of API keys that you can use with Supabase:
 | <span className="whitespace-nowrap!">`anon`</span>         | JWT (long lived)                                                 | Low        | <span className="whitespace-nowrap!">Platform, CLI</span> | Legacy version of publishable keys.                                                                                                                                                                                                                                                               |
 | <span className="whitespace-nowrap!">`service_role`</span> | JWT (long lived)                                                 | Elevated   | <span className="whitespace-nowrap!">Platform, CLI</span> | Legacy version of secret keys.                                                                                                                                                                                                                                                                    |
 
-<Admonition type="caution" title="Changes to API keys">
-
-Supabase has changed the way keys work to improve project security and developer experience. You can read [the full announcement](https://github.com/orgs/supabase/discussions/29260).
-
-`anon` and `service_role` keys are based on the project's JWT secret. They are generated when your project is created and you can only change them when you rotate the JWT secret. This can cause significant issues in production applications. **You should now use the `sb_publishable_xxx` and `sb_secret_xxx` keys instead**.
-
-You can still find legacy keys in the **Legacy anon, service_role API keys** tab of the [**Settings > API Keys**](/dashboard/project/_/settings/api-keys/) section of the Dashboard:
-
-</Admonition>
+<$Partial path="api_keys_deprecation.mdx" />
 
 ## Publishable keys