QT/superset2
1
0
Fork 0
mirror of https://github.com/apache/superset.git synced 2026-07-27 17:12:36 +00:00
Code Issues Packages Projects Releases Wiki Activity
21,632 Commits 552 Branches 561 Tags
3bdf134aaa2f3cc34739964f7c276506949f0653
Commit Graph

21632 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Shaitan
3191b0fdcd fix: apply dashboard access check in related_objects endpoints (#40333) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-03 12:55:38 +01:00
Shaitan
cf08a5ebf7 feat(docker): add environment-based debugger control (#40327) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Mehmet Salih Yavuz <salih.yavuz@proton.me>
Co-authored-by: Beto Dealmeida <roberto@dealmeida.net>
Co-authored-by: Elizabeth Thompson <eschutho@gmail.com>
Co-authored-by: Evan Rusackas <evan@preset.io>
Co-authored-by: Jay Masiwal <masiwaljay.02@gmail.com>
Co-authored-by: JUST.in DO IT <justin.park@airbnb.com>
Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Amin Ghadersohi <amin.ghadersohi@gmail.com>
Co-authored-by: chaselynisabella <chaselynisabella@gmail.com>
 2026-06-03 12:55:31 +01:00
Shaitan
f7f50a7977 fix(sqllab): quote CTAS target identifiers and validate tmp_table_name format (#40245) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-03 12:55:25 +01:00
Shaitan
725f5ed2a9 fix(api): enforce per-object ownership validation in chart, dataset, and report commands (#39303) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-03 12:55:15 +01:00
Shaitan
faa76f6741 fix(embedding): add optional dataset allowlist to guest tokens (#39302) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-03 12:55:09 +01:00
Shaitan
8e4a460cc7 fix(charts): apply DISALLOWED_SQL_FUNCTIONS gate to adhoc expressions (#40568) 
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
 2026-06-03 12:52:22 +01:00
Evan Rusackas
b9dc9d722e fix(export): sanitize user-supplied CSV export filename (charts + SQL Lab) (#40632) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-03 00:14:48 -07:00
Evan Rusackas
fa41769a08 fix(embedded): enforce configured allowed domains for postMessage origin (#40629) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 22:58:30 -07:00
Evan Rusackas
df21fe6571 chore(mcp): return a generic error from the webdriver pool-stats endpoint (#40559) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 21:51:32 -07:00
Evan Rusackas
12bef03f4a fix(jinja): apply consistent escaping to url_param values from request args (#40633) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 21:23:48 -07:00
Evan Rusackas
0b9764aed5 fix(mcp): honor AUTH_ROLE_ADMIN and warn on permission-less protected tools (#40659) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 21:20:11 -07:00
Evan Rusackas
ac522ded1c fix(ssh-tunnel): validate server_address format (SSRF defense-in-depth) (#40665) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 21:19:24 -07:00
Evan Rusackas
c54990c861 fix(plugin-chart-ag-grid-table): validate filter values/operators in state converter (#40623) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 18:44:29 -07:00
Evan Rusackas
3bbb35e8a3 ci(bashlib): drop the dead bc-based NONCE (perf + reliability) (#40691) 
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-02 16:49:49 -07:00
Shaitan
a2a369cb5c fix(charts): sanitize tooltip HTML across nvd3, rose and partition plugins (#40502) 
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Co-authored-by: Evan Rusackas <evan@preset.io>
 2026-06-02 16:45:38 -07:00
Evan Rusackas
9af6746dbe fix(models): HTML-escape data-controlled values in dashboard_link and Slice.icons (#40639) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 16:15:11 -07:00
Evan Rusackas
6abee0289b fix(reports): guard SUCCESS-state report execution against duplicate sends and stuck WORKING state (#40657) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 15:09:14 -07:00
Evan Rusackas
8c62f533d7 fix(core): restrict allowed CSS properties in sanitized HTML (#40627) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 14:24:00 -07:00
Oleg Ovcharuk
17d1a45bc9 feat(ydb): switch to native YDB sqlglot dialect (#40170) 2026-06-02 17:13:41 -04:00
Shaitan
6eaee211aa fix(sqllab): require dataset match for raw query access (#40409) 
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
 2026-06-02 21:50:27 +01:00
Evan Rusackas
3e589436fa fix(reports): sanitize error text in email notification template (#40641) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 13:40:10 -07:00
Evan Rusackas
a9df2c7e5e fix(mcp): address post-approval review feedback on auth logging PR #40646 (#40684) 
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-02 13:39:23 -07:00
Evan Rusackas
8508af3201 chore(key_value): prune expired entries from the key-value store (#40663) 
Co-authored-by: Claude Code <noreply@anthropic.com>
Co-authored-by: Ville Brofeldt <ville.v.brofeldt@gmail.com>
 2026-06-02 12:36:32 -07:00
Evan Rusackas
49f3dbba73 fix(dashboard): address post-approval review feedback on #40528 (#40685) 
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-02 12:16:15 -07:00
Amin Ghadersohi
616c243278 fix(deps): revert joserfc JWT error migration — fastmcp still uses authlib (#40688) 2026-06-02 12:02:17 -07:00
Evan Rusackas
00dd31494d fix: sanitize URL sinks and trim sensitive log fields (#40546) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 11:52:02 -07:00
Evan Rusackas
b97d3ef520 fix(api,sql): use json_response in Api.query and log dialect fallback (#40644) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 11:48:46 -07:00
Evan Rusackas
4d2b10d916 chore(excel): strip document metadata from Excel exports (#40661) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 11:48:36 -07:00
SBIN2010
86fa5bb46f feat(table v2): agGridTableChart add row numer column (#39284) 
Co-authored-by: Evan Rusackas <evan@preset.io>
Co-authored-by: codeant-ai-for-open-source[bot] <244253245+codeant-ai-for-open-source[bot]@users.noreply.github.com>
 2026-06-02 11:37:26 -07:00
Evan Rusackas
19c2b67d09 fix(websocket): validate last_id query param format (#40626) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 11:36:33 -07:00
Jean Massucatto
d2d46169bf fix(explore): tighten popover title-to-tabs spacing to 12px (#40410) 2026-06-02 11:30:27 -07:00
Jean Massucatto
1b8099811b fix(chart-list): sort by changed_on instead of last_saved_at (#39984) 2026-06-02 10:58:23 -07:00
Evan Rusackas
242c27a974 test(presto): 401 Unauthorized must surface as CONNECTION_ACCESS_DENIED_ERROR (#33554) (#40618) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-02 10:49:58 -07:00
Evan Rusackas
24422c8311 test(histogram): metric filters require aggregation in buildQuery (#30330) (#40617) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-02 10:49:43 -07:00
Evan Rusackas
1632b235ae fix(sqllab): surface stacktrace in SQL Lab error responses (#28248) (#40585) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-02 10:41:39 -07:00
Evan Rusackas
093b43c7a5 fix(exports,email,logs): csv formula escaping, subject CRLF stripping, UTC log pruning (#40645) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 18:32:36 +01:00
Durgaprasad M L
4996d7c277 fix: avoid warning spam when default spinner SVG is missing (#40481) 
Co-authored-by: Sam Firke <sfirke@users.noreply.github.com>
 2026-06-02 10:26:37 -07:00
Evan Rusackas
d26a7aac3d fix(dashboard): hide Edit button in embedded dashboards (#40687) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 10:17:10 -07:00
jesperct
699e741c69 fix(time-comparison): shift offset filter when X-axis is adhoc Custom SQL (#40586) 2026-06-02 09:52:42 -07:00
Jean Massucatto
fc0245bdb0 fix(charts): show non-filterable columns in metric section for table … (#39524) 2026-06-02 18:31:42 +02:00
Jean Massucatto
7275116f4c fix(world-map): preserve bubbles and exclude only null metrics from color scale (#39926) 2026-06-02 18:05:49 +02:00
Richard Fogaca Nienkotter
88abd41c8b fix(sql-lab): prevent crash when host shell lacks useAppDispatch export (#40591) 
Co-authored-by: yousoph <sophieyou12@gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-02 12:52:01 -03:00
Jean Massucatto
ddb647cd3a fix(dashboard): clear undo history (#40569) 2026-06-02 17:47:27 +02:00
Evan Rusackas
aba6ea536c fix(dashboard): prevent "undefined undefined" owner names in properties modal (#40528) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 08:31:37 -07:00
Evan Rusackas
ca8855dc03 fix(mcp): generic auth errors, required token expiry, and safer auth logging (#40646) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 08:31:05 -07:00
Evan Rusackas
052e567f77 fix: guard dynamic dispatch and bound a regex quantifier (#40547) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-02 08:09:22 -07:00
Mehmet Salih Yavuz
e2ed989639 fix(reports): skip permalink when dashboard state has no anchor or filters (#40530) 2026-06-02 11:37:30 +03:00
Kamil Gabryjelski
2abbb64e6b feat(gsheets): restore public/private sheet selector (#40466) 
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
 2026-06-02 07:10:21 +02:00
Evan Rusackas
c6faa50338 fix(cli): encrypt sqlalchemy_uri password on import_datasources (#31983) (#40584) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-01 22:08:48 -07:00
Evan Rusackas
817a35f445 fix(mcp): deny deactivated user accounts in MCP authentication (#40631) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-01 22:08:29 -07:00