QT/superset2
1
0
Fork 0
mirror of https://github.com/apache/superset.git synced 2026-07-20 13:45:47 +00:00
Code Issues Packages Projects Releases Wiki Activity
20,423 Commits 543 Branches 558 Tags
053f1292a4c9a26ff55d289473d5a61ba26bc608
Commit Graph

1126 Commits

Author SHA1 Message Date
Amin Ghadersohi
053f1292a4 fix(mcp): preserve form_data_key URL for preview callers of generate_explore_link 
Returning a durable permalink URL by default broke callers that re-parse the
URL for a form_data_key: update_chart_preview failed its success path with
"missing form_data_key" and generate_chart preview mode lost its unsaved-state
key. Add a prefer_permalink flag (default True for the explore tool) and have
the two preview callers pass prefer_permalink=False to keep the
/explore/?form_data_key=... contract. Add a regression test.
 2026-06-06 22:14:02 +00:00
Amin Ghadersohi
8b85cdbd4a test(mcp): mock permalink command in form_data_key fallback test 
After narrowing the explore-link exception handling, the durable-permalink
path no longer swallows the AttributeError raised by check_chart_access
accessing g.user outside a request context. Patch CreateExplorePermalinkCommand.run
to fail explicitly so the test deterministically exercises the form_data_key
fallback, matching the test's stated intent.
 2026-06-06 18:58:39 +00:00
Amin Ghadersohi
0f65ec35ca Merge branch 'master' into mcp-chart-explore-url 2026-06-05 15:55:41 -07:00
Evan Rusackas
19d01521bf fix(dashboard): replace chartsInScope references at import time (#38171) 
Co-authored-by: Rémy Dubois <remy.dubois@komodohealth.com>
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-05 11:42:24 -07:00
Evan Rusackas
1623ceda73 fix(result_set): preserve JSON/JSONB data as objects instead of strings (#38172) 
Co-authored-by: Claude <noreply@anthropic.com>
 2026-06-05 11:41:40 -07:00
madhushreeag
fa42b13eb8 fix(dataset): preserve numeric column types when pydruid infers STRING from first-row value (#40677) 
Co-authored-by: madhushree agarwal <madhushree_agarwal@apple.com>
 2026-06-05 09:25:57 -07:00
Amin Ghadersohi
aa4092ba68 fix(mcp): add select_columns lean defaults to get_dashboard_info, get_chart_info, get_dataset_info (#40473) 
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Co-authored-by: Richard Fogaça <richardfogaca@gmail.com>
 2026-06-05 11:10:13 -03:00
Elizabeth Thompson
42367afb25 fix(reports): add per-tile animation wait to prevent partial ECharts renders in tiled screenshots (#40694) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-04 16:43:34 -07:00
Vitor Avila
7406098708 fix(dashboard-filter): Consider dashboard filters to charts not declared in the dashboard position (#40774) 2026-06-04 16:43:38 -03:00
Evan Rusackas
0d1b702ce8 feat(extensions): static supply-chain controls — denylist + version policy (#40668) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-04 12:29:03 -07:00
Amin Ghadersohi
7d69f76127 fix(mcp): API key authentication for MCP — transport, validation, and RBAC (#39604) 2026-06-04 15:04:43 -04:00
Evan Rusackas
9a31362fa5 fix(reports): stamp email subject date at send time, not import time (#40693) 
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-04 12:03:28 -07:00
Amin Ghadersohi
d694de8856 fix(mcp): relocate extract_permalink_key_from_url and fix UUID datasource 
- Move extract_permalink_key_from_url from chart_helpers to url_utils
  and reimplement via urlparse path parsing instead of regex
- Fix generate_explore_link tool to use dataset.id (resolved numeric ID)
  instead of request.dataset_id (may be UUID string) when building the
  datasource field in the returned form_data dict
- Add unit tests for extract_permalink_key_from_url in test_url_utils.py
 2026-06-04 18:30:42 +00:00
Amin Ghadersohi
62fae8c493 fix(mcp): generate durable explore permalink URL instead of ephemeral form_data_key 
The `generate_explore_link` MCP tool previously returned a URL like
`/explore/?form_data_key=<key>` backed by Redis cache (~24h expiry).
When the key expired the URL became unreachable, preventing LLMs from
iteratively building and sharing charts.

This commit changes the URL strategy:
1. Try `CreateExplorePermalinkCommand` first (DB-backed key-value store,
   does not expire) → `/explore/p/<key>/`
2. Fall back to `MCPCreateFormDataCommand` (Redis cache) on permalink
   failure → `/explore/?form_data_key=<key>`
3. Fall back to plain dataset URL on both failing.

The tool response now includes a `permalink_key` field (populated when
the durable permalink path is used) alongside the existing `form_data_key`
(populated only in the Redis-fallback case).

`extract_permalink_key_from_url()` added to `chart_helpers.py`.
Tests updated to mock `CreateExplorePermalinkCommand.run` by default and
cover both the permalink path and each fallback tier.
 2026-06-04 18:13:20 +00:00
Evan Rusackas
23d18743bd fix(deck.gl): strip all JS-executed form_data keys when JavaScript controls are disabled (#40602) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-04 10:14:33 -07:00
Evan Rusackas
9d1bc6b2cc fix(i18n): don't flag intentional string deletions as translation regressions (#40716) 
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-03 14:47:31 -07:00
Shaitan
6a125bf774 fix(jinja): expose dialect-escaped companion value on get_filters() (#40531) 2026-06-03 21:53:12 +01:00
Shaitan
43fde2fb07 fix(charts): enforce DISALLOWED_SQL_FUNCTIONS and DISALLOWED_SQL_TABLES at chart-data execution (#40567) 
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
 2026-06-03 21:52:48 +01:00
dependabot[bot]
2be2246a00 chore(deps-dev): bump gevent from 24.2.1 to 26.4.0 (#40378) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Code <noreply@anthropic.com>
Co-authored-by: Evan <evan@preset.io>
 2026-06-03 12:58:17 -07:00
Evan Rusackas
80ea36c852 fix(db_engine_specs): escape schema name in regex; document safe filter pattern (#40642) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-03 11:56:51 -07:00
Amin Ghadersohi
f4dfb7f026 fix(mcp): fall back to form_data spatial query for Deck.gl charts (#40339) 2026-06-03 13:30:52 -04:00
Burhanuddin Mundrawala
e5ff6de790 chore: correct typos in config.py and models_test.py comments (#40706) 2026-06-03 21:58:29 +07:00
Shaitan
e3ba85b1a5 fix(redirect): normalize browser-stripped whitespace before protocol-relative check (#40566) 
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
 2026-06-03 12:56:10 +01:00
Shaitan
56fd991efd fix(dataset): unify validation for stored and adhoc SQL expressions (#40392) 
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
 2026-06-03 12:55:50 +01:00
Shaitan
f7f50a7977 fix(sqllab): quote CTAS target identifiers and validate tmp_table_name format (#40245) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-03 12:55:25 +01:00
Shaitan
725f5ed2a9 fix(api): enforce per-object ownership validation in chart, dataset, and report commands (#39303) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-03 12:55:15 +01:00
Shaitan
faa76f6741 fix(embedding): add optional dataset allowlist to guest tokens (#39302) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-03 12:55:09 +01:00
Shaitan
8e4a460cc7 fix(charts): apply DISALLOWED_SQL_FUNCTIONS gate to adhoc expressions (#40568) 
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
 2026-06-03 12:52:22 +01:00
Evan Rusackas
b9dc9d722e fix(export): sanitize user-supplied CSV export filename (charts + SQL Lab) (#40632) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-03 00:14:48 -07:00
Evan Rusackas
12bef03f4a fix(jinja): apply consistent escaping to url_param values from request args (#40633) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 21:23:48 -07:00
Evan Rusackas
0b9764aed5 fix(mcp): honor AUTH_ROLE_ADMIN and warn on permission-less protected tools (#40659) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 21:20:11 -07:00
Evan Rusackas
ac522ded1c fix(ssh-tunnel): validate server_address format (SSRF defense-in-depth) (#40665) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 21:19:24 -07:00
Evan Rusackas
9af6746dbe fix(models): HTML-escape data-controlled values in dashboard_link and Slice.icons (#40639) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 16:15:11 -07:00
Evan Rusackas
6abee0289b fix(reports): guard SUCCESS-state report execution against duplicate sends and stuck WORKING state (#40657) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 15:09:14 -07:00
Shaitan
6eaee211aa fix(sqllab): require dataset match for raw query access (#40409) 
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
 2026-06-02 21:50:27 +01:00
Evan Rusackas
3e589436fa fix(reports): sanitize error text in email notification template (#40641) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 13:40:10 -07:00
Evan Rusackas
8508af3201 chore(key_value): prune expired entries from the key-value store (#40663) 
Co-authored-by: Claude Code <noreply@anthropic.com>
Co-authored-by: Ville Brofeldt <ville.v.brofeldt@gmail.com>
 2026-06-02 12:36:32 -07:00
Amin Ghadersohi
616c243278 fix(deps): revert joserfc JWT error migration — fastmcp still uses authlib (#40688) 2026-06-02 12:02:17 -07:00
Evan Rusackas
b97d3ef520 fix(api,sql): use json_response in Api.query and log dialect fallback (#40644) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 11:48:46 -07:00
Evan Rusackas
4d2b10d916 chore(excel): strip document metadata from Excel exports (#40661) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 11:48:36 -07:00
Evan Rusackas
242c27a974 test(presto): 401 Unauthorized must surface as CONNECTION_ACCESS_DENIED_ERROR (#33554) (#40618) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-02 10:49:58 -07:00
Evan Rusackas
1632b235ae fix(sqllab): surface stacktrace in SQL Lab error responses (#28248) (#40585) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-02 10:41:39 -07:00
Evan Rusackas
093b43c7a5 fix(exports,email,logs): csv formula escaping, subject CRLF stripping, UTC log pruning (#40645) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 18:32:36 +01:00
Durgaprasad M L
4996d7c277 fix: avoid warning spam when default spinner SVG is missing (#40481) 
Co-authored-by: Sam Firke <sfirke@users.noreply.github.com>
 2026-06-02 10:26:37 -07:00
jesperct
699e741c69 fix(time-comparison): shift offset filter when X-axis is adhoc Custom SQL (#40586) 2026-06-02 09:52:42 -07:00
Evan Rusackas
ca8855dc03 fix(mcp): generic auth errors, required token expiry, and safer auth logging (#40646) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 08:31:05 -07:00
Mehmet Salih Yavuz
e2ed989639 fix(reports): skip permalink when dashboard state has no anchor or filters (#40530) 2026-06-02 11:37:30 +03:00
Evan Rusackas
c6faa50338 fix(cli): encrypt sqlalchemy_uri password on import_datasources (#31983) (#40584) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-01 22:08:48 -07:00
Evan Rusackas
817a35f445 fix(mcp): deny deactivated user accounts in MCP authentication (#40631) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-01 22:08:29 -07:00
Amin Ghadersohi
a6d2c95480 chore(deps): migrate MCP service JWT errors from authlib.jose to joserfc (#40582) 2026-06-02 00:41:17 -04:00