chore: production deploy

.github/workflows/cli-go-ci.yml

@@ -78,7 +78,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4
+      - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4
         with:
           version: 2026.7.0
           install: true

.github/workflows/cli-go-codeql.yml

@@ -67,7 +67,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -95,7 +95,7 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           category: "/language:${{matrix.language}}"
 defaults:

.github/workflows/cli-go-mirror-image.yml

@@ -34,14 +34,14 @@ jobs:
         run: |
           echo "image=${TAG##*/}" >> $GITHUB_OUTPUT
       - name: configure aws credentials
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
           aws-region: us-east-1
-      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+      - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
         with:
           registry: public.ecr.aws
-      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+      - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/cli-go-pg-prove.yml

@@ -45,7 +45,7 @@ jobs:
       - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
         with:
           endpoint: builders
-      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+      - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -67,7 +67,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+      - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}

.github/workflows/cli-go-publish-migra.yml

@@ -45,7 +45,7 @@ jobs:
       - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
         with:
           endpoint: builders
-      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+      - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -67,7 +67,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+      - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}

.github/workflows/mirror-template-images.yml

@@ -50,7 +50,7 @@ jobs:
           dependency-firewall-token: ${{ secrets.DF_FIREWALL_TOKEN }}
 
       - name: Log in to ghcr.io
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/release-shared.yml

@@ -426,7 +426,7 @@ jobs:
 
       - name: Sync stable release to Linear
         if: ${{ inputs.channel == 'stable' && env.LINEAR_CLI_STABLE_RELEASE_ACCESS_KEY != '' }}
-        uses: linear/linear-release-action@c0cb8354a362c24c6d3e0948f37fd66d07588e3f # v0
+        uses: linear/linear-release-action@3858a5d7892435dc63302ac76b0cdb587435caa9 # v0
         with:
           access_key: ${{ env.LINEAR_CLI_STABLE_RELEASE_ACCESS_KEY }}
           version: v${{ inputs.version }}
@@ -437,7 +437,7 @@ jobs:
 
       - name: Sync beta release to Linear
         if: ${{ inputs.channel == 'beta' && env.LINEAR_CLI_BETA_RELEASE_ACCESS_KEY != '' }}
-        uses: linear/linear-release-action@c0cb8354a362c24c6d3e0948f37fd66d07588e3f # v0
+        uses: linear/linear-release-action@3858a5d7892435dc63302ac76b0cdb587435caa9 # v0
         with:
           access_key: ${{ env.LINEAR_CLI_BETA_RELEASE_ACCESS_KEY }}
           version: v${{ inputs.version }}

.vscode/settings.json

@@ -2,6 +2,5 @@
   "editor.defaultFormatter": "oxc.oxc-vscode",
   "editor.formatOnSave": true,
   "editor.formatOnSaveMode": "file",
-  "typescript.experimental.useTsgo": true,
-  "oxc.useExecPath": true,
+  "typescript.experimental.useTsgo": true
 }

apps/cli-e2e/src/tests/database-core.e2e.test.ts

@@ -252,7 +252,17 @@ describe("db push", () => {
       expect(result.stderr).toContain("connect");
     });
 
-    testParity(["db", "push", "--local"]);
+    // Known parity divergence: Go never emits the Docker-start hint for --local (CLI-1995).
+    testParity(["db", "push", "--local"], {
+      normalize: {
+        stderr: {
+          stripPatterns: [
+            /\nMake sure your local IP is allowed in Network Restrictions and Network Bans\.\n[^\n]*/g, // Expected from Go
+            /\nMake sure Docker is running, then run: supabase start/g, // Expected from TS
+          ],
+        },
+      },
+    });
   });
 
   describe("db push:linked", () => {

apps/cli-e2e/src/tests/migrations.e2e.test.ts

@@ -24,6 +24,8 @@ const CONNECT_REFUSED_STDERR_STRIP: readonly RegExp[] = [
   /(?<=failed to connect to postgres:).*/g,
   // Go's SetConnectSuggestion: Network-Restrictions hint + dashboard URL line.
   /\nMake sure your local IP is allowed in Network Restrictions and Network Bans\.\n[^\n]*/g,
+  // TS's local-only Docker hint (CLI-1995); Go never emits this for --local.
+  /\nMake sure Docker is running, then run: supabase start/g,
   // TS's generic --debug suggestion.
   /\nTry rerunning the command with --debug to troubleshoot the error\./g,
 ];

apps/cli-go/go.mod

@@ -42,7 +42,7 @@ require (
 	github.com/multigres/multigres v0.0.0-20260126223308-f5a52171bbc4
 	github.com/oapi-codegen/nullable v1.2.0
 	github.com/olekukonko/tablewriter v1.1.4
-	github.com/posthog/posthog-go v1.19.0
+	github.com/posthog/posthog-go v1.22.0
 	github.com/spf13/afero v1.15.0
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10

apps/cli-go/go.sum

@@ -970,8 +970,8 @@ github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/posthog/posthog-go v1.19.0 h1:GsPilbAfQo8dbIo2yheTZ8pbmE5yYW3G289kXrxZxFA=
-github.com/posthog/posthog-go v1.19.0/go.mod h1://M430hNH3e8CDv4i8SJesb26816Mpa6GIZaiP4pNQU=
+github.com/posthog/posthog-go v1.22.0 h1:VNy+sMJ9MMnENr9dMSxfQt/5bB4UhwRdZfasOAghMMg=
+github.com/posthog/posthog-go v1.22.0/go.mod h1://M430hNH3e8CDv4i8SJesb26816Mpa6GIZaiP4pNQU=
 github.com/prometheus/client_golang v0.9.0-pre1.0.20180209125602-c332b6f63c06/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=

apps/cli-go/internal/branches/create/create.go

@@ -33,8 +33,8 @@ func Run(ctx context.Context, body api.CreateBranchBody, fsys afero.Fs) error {
 	if err != nil {
 		return errors.Errorf("failed to create preview branch: %w", err)
 	} else if resp.JSON201 == nil {
-		if orgSlug, isGated := utils.SuggestUpgradeOnError(ctx, flags.ProjectRef, "branching_limit", resp.StatusCode()); isGated {
-			telemetry.TrackUpgradeSuggested(ctx, "branching_limit", orgSlug)
+		if feature, orgSlug, isGated := utils.SuggestUpgradeOnError(ctx, flags.ProjectRef, "branching_limit", resp.StatusCode(), resp.Body); isGated {
+			telemetry.TrackUpgradeSuggested(ctx, feature, orgSlug)
 		}
 		return errors.Errorf("unexpected create branch status %d: %s", resp.StatusCode(), string(resp.Body))
 	}

apps/cli-go/internal/branches/create/create_test.go

@@ -118,4 +118,24 @@ func TestCreateCommand(t *testing.T) {
 		assert.ErrorContains(t, err, "unexpected create branch status 402")
 		assert.Contains(t, utils.CmdSuggestion, "/org/test-org/billing")
 	})
+
+	t.Run("suggests upgrade from envelope without entitlements round-trip", func(t *testing.T) {
+		t.Cleanup(apitest.MockPlatformAPI(t))
+		t.Cleanup(func() { utils.CmdSuggestion = "" })
+		gock.New(utils.DefaultApiHost).
+			Post("/v1/projects/" + flags.ProjectRef + "/branches").
+			Reply(http.StatusPaymentRequired).
+			JSON(map[string]interface{}{
+				"message": "Branching is supported only on the Pro plan or above",
+				"error": map[string]interface{}{
+					"code":        "entitlement_required",
+					"feature":     "branching_limit",
+					"upgrade_url": "https://supabase.com/dashboard/org/acme/billing",
+				},
+			})
+		fsys := afero.NewMemMapFs()
+		err := Run(context.Background(), api.CreateBranchBody{Region: cast.Ptr("sin")}, fsys)
+		assert.ErrorContains(t, err, "unexpected create branch status 402")
+		assert.Contains(t, utils.CmdSuggestion, "org/acme/billing")
+	})
 }

apps/cli-go/internal/branches/update/update.go

@@ -23,8 +23,8 @@ func Run(ctx context.Context, branchId string, body api.UpdateBranchBody, fsys a
 	if err != nil {
 		return errors.Errorf("failed to update preview branch: %w", err)
 	} else if resp.JSON200 == nil {
-		if orgSlug, isGated := utils.SuggestUpgradeOnError(ctx, projectRef, "branching_persistent", resp.StatusCode()); isGated {
-			telemetry.TrackUpgradeSuggested(ctx, "branching_persistent", orgSlug)
+		if feature, orgSlug, isGated := utils.SuggestUpgradeOnError(ctx, projectRef, "branching_persistent", resp.StatusCode(), resp.Body); isGated {
+			telemetry.TrackUpgradeSuggested(ctx, feature, orgSlug)
 		}
 		return errors.Errorf("unexpected update branch status %d: %s", resp.StatusCode(), string(resp.Body))
 	}

apps/cli-go/internal/debug/postgres.go

@@ -2,12 +2,15 @@ package debug
 
 import (
 	"context"
+	"crypto/tls"
+	"encoding/binary"
 	"encoding/json"
 	"errors"
 	"io"
 	"log"
 	"net"
 	"os"
+	"time"
 
 	"github.com/jackc/pgproto3/v2"
 	"github.com/jackc/pgx/v4"
@@ -16,31 +19,84 @@ import (
 
 type Proxy struct {
 	dialContext func(ctx context.Context, network, addr string) (net.Conn, error)
-	errChan     chan error
+	// tlsPlan is pgconn's TLS config per attempt, primary first. DialFunc walks it
+	// so sslmode=allow keeps its plaintext-then-TLS retry, and completes the
+	// handshake itself, leaving logged frames plaintext in memory but not on the wire.
+	tlsPlan  []*tls.Config
+	attempts map[string]int
+	errChan  chan error
 }
 
 func NewProxy() Proxy {
 	dialer := net.Dialer{}
 	return Proxy{
 		dialContext: dialer.DialContext,
+		attempts:    map[string]int{},
 		errChan:     make(chan error, 1),
 	}
 }
 
 func SetupPGX(config *pgx.ConnConfig) {
+	tlsPlan := []*tls.Config{config.TLSConfig}
+	for _, fallback := range config.Fallbacks {
+		if fallback.Host != config.Host {
+			break
+		}
+		// ConnectByUrl drops plaintext fallbacks once the primary is TLS, and it
+		// runs after this, so apply the same rule here or --debug reinstates them.
+		if config.TLSConfig != nil && fallback.TLSConfig == nil {
+			continue
+		}
+		tlsPlan = append(tlsPlan, fallback.TLSConfig)
+	}
 	proxy := Proxy{
 		dialContext: config.DialFunc,
+		tlsPlan:     tlsPlan,
+		attempts:    map[string]int{},
 		errChan:     make(chan error, 1),
 	}
 	config.DialFunc = proxy.DialFunc
+	// pgx must not negotiate TLS again over the in-memory pipe; clearing these
+	// *without* DialFunc's handshake is what downgraded sslmode=require (#5872).
 	config.TLSConfig = nil
+	// pgconn reads Fallbacks independently of TLSConfig, so a restored sslmode=allow
+	// would still retry TLS through this plaintext proxy.
+	for _, fallback := range config.Fallbacks {
+		fallback.TLSConfig = nil
+	}
+}
+
+// nextTLSConfig returns the TLS config for this attempt against addr. pgconn dials
+// each plan entry once per resolved address, in plan order, so a per-address
+// counter replays the same TLS/plaintext sequence it would have used itself.
+func (p *Proxy) nextTLSConfig(addr string) *tls.Config {
+	if p.attempts == nil {
+		p.attempts = map[string]int{}
+	}
+	if len(p.tlsPlan) == 0 {
+		return nil
+	}
+	i := p.attempts[addr]
+	p.attempts[addr]++
+	// pgconn redials an addr for the target_session_attrs retry, so clamp rather
+	// than fall off the plan into plaintext.
+	if i >= len(p.tlsPlan) {
+		i = len(p.tlsPlan) - 1
+	}
+	return p.tlsPlan[i]
 }
 
 func (p *Proxy) DialFunc(ctx context.Context, network, addr string) (net.Conn, error) {
+	tlsConfig := p.nextTLSConfig(addr)
 	serverConn, err := p.dialContext(ctx, network, addr)
 	if err != nil {
 		return nil, err
 	}
+	if tlsConfig != nil {
+		if serverConn, err = startTLS(ctx, serverConn, tlsConfig); err != nil {
+			return nil, err
+		}
+	}
 
 	const bufSize = 1024 * 1024
 	ln := bufconn.Listen(bufSize)
@@ -73,6 +129,43 @@ func (p *Proxy) DialFunc(ctx context.Context, network, addr string) (net.Conn, e
 	return ln.DialContext(ctx)
 }
 
+// libpq's SSLRequest message code, PG_PROTOCOL(1234,5679).
+const sslRequestCode = 80877103
+
+// startTLS mirrors pgconn's own startTLS (pgconn@v1.14.3/pgconn.go:406-419), but
+// handshakes eagerly so a refusal or bad certificate fails the dial rather than
+// surfacing as a parse error inside the forwarding goroutines.
+func startTLS(ctx context.Context, conn net.Conn, tlsConfig *tls.Config) (net.Conn, error) {
+	// pgconn only watches ctx once DialFunc returns, so bound the negotiation here
+	// or an endpoint that accepts TCP and never replies hangs the read forever.
+	if deadline, ok := ctx.Deadline(); ok {
+		if err := conn.SetDeadline(deadline); err != nil {
+			conn.Close()
+			return nil, err
+		}
+		defer func() { _ = conn.SetDeadline(time.Time{}) }()
+	}
+	if err := binary.Write(conn, binary.BigEndian, []int32{8, sslRequestCode}); err != nil {
+		conn.Close()
+		return nil, err
+	}
+	response := make([]byte, 1)
+	if _, err := io.ReadFull(conn, response); err != nil {
+		conn.Close()
+		return nil, err
+	}
+	if response[0] != 'S' {
+		conn.Close()
+		return nil, errors.New("server refused TLS connection")
+	}
+	tlsConn := tls.Client(conn, tlsConfig)
+	if err := tlsConn.HandshakeContext(ctx); err != nil {
+		conn.Close()
+		return nil, err
+	}
+	return tlsConn, nil
+}
+
 type Backend struct {
 	*pgproto3.Backend
 	logger *log.Logger