Evan and Claude Opus 4.8
9b7f632718
fix(api): restrict rejected-field log token to a safe character set
...
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-22 21:04:29 -07:00
Amin Ghadersohi and Claude Fable 5
7d9b918f4d
feat(api): log rejected related/distinct field access as security events
...
When a user-supplied column_name fails the related/distinct allowlist check,
the API incremented a statsd counter and returned 404 but emitted no structured
log event, so rejected field-access attempts were absent from the security
audit trail (no user identity, endpoint, or attempted value).
Emit a sanitized security log event (user id, endpoint, attempted column) on
these denials, alongside the existing statsd counter. The column name is
sanitized to a single bounded token to prevent log injection. The allowlist
control itself is unchanged.
Extends the related-field failure integration test to assert the event is
logged with the rejected column name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-06-22 17:59:04 -07:00
Vitor Avila and GitHub
3b46a5f121
fix(chart API): Consider time grain filters with the filters_dashboard_id param ( #41290 )
2026-06-22 20:01:24 -03:00
416fa266d9
chore(datatablecontrol): Removed unused useTableColumns ( #41155 )
...
Co-authored-by: Evan Rusackas <evan@preset.io >
2026-06-22 15:38:19 -07:00
f70a2eac89
fix(dashboard): normalize legacy currentState to filterState in native_filters URL param ( #40929 )
...
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-06-22 15:37:18 -07:00
Hans Yu and GitHub
c49391ab08
refactor: update Connection.execute() to use queries with text() ( #40277 )
2026-06-22 15:36:15 -07:00
0fbace5b5d
docs: Update INTHEWILD.yaml ( #36894 )
...
Co-authored-by: Evan Rusackas <evan@preset.io >
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com >
2026-06-22 15:34:28 -07:00
c55c85f824
fix(helm)!: replace dockerize initContainer with bash TCP wait ( #40425 )
...
Co-authored-by: Claude Code <noreply@anthropic.com >
2026-06-22 14:44:51 -07:00
e34b7c2daf
fix(gsheets): pass service_account_info via adapter_kwargs ( #38443 )
...
Co-authored-by: Antonio Pio Volgarino <avolgarino@zanichelli.it >
Co-authored-by: Joe Li <joe@preset.io >
Co-authored-by: Evan Rusackas <evan@preset.io >
Co-authored-by: Amin Ghadersohi <amin.ghadersohi@gmail.com >
Co-authored-by: Claude Fable 5 <noreply@anthropic.com >
2026-06-22 11:34:08 -07:00
eac5bd23bd
ci(docs): fix Netlify docs preview never skipping on non-docs PRs ( #41070 )
...
Co-authored-by: Claude Code <noreply@anthropic.com >
2026-06-22 11:33:14 -07:00
27a65257ee
perf(screenshots): reuse Playwright browser across tasks instead of launching per-task ( #41243 )
...
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-06-22 11:32:30 -07:00
Gonzalo Majlis and GitHub
932bb2f154
feat(i18n): update Spanish (es) translations ( #41265 )
2026-06-22 14:24:24 -04:00
4b87e03e7c
chore(deps): bump http-proxy-middleware from 2.0.9 to 2.0.10 in /docs ( #41287 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-22 11:05:35 -07:00
yousoph and GitHub
2a7fadbd08
fix(sql-lab): use consistent icon size for schema refresh button ( #41105 )
2026-06-22 10:30:23 -07:00
Đỗ Trọng Hải and GitHub
403e11e2ef
feat(ci): add workflow to automatically sync pinned requirements for pip Dependabot PRs ( #40557 )
2026-06-23 00:00:12 +07:00
Michael S. Molina and GitHub
d76b896c9c
chore: Updates CHANGELOG.md and UPDATING.md with 6.1.0 ( #41249 )
2026-06-22 13:53:48 -03:00
Pham Quang Binh and GitHub
36632c20eb
fix(databases): apply IMPERSONATE_WITH_EMAIL_PREFIX to StarRocks engine ( #37984 )
2026-06-22 23:45:05 +07:00
Abdul Rehman and GitHub
cb1694575c
fix(dataset-api): disambiguate get_or_create by schema ( #40494 )
2026-06-22 09:45:02 -07:00
Ujjwal Jain and GitHub
449bd69802
fix(logging): safely render database URIs in startup warnings ( #38229 )
2026-06-22 09:05:16 -07:00
7340d06a05
feat(reports): adding link to report content ( #40525 )
...
Co-authored-by: Evan Rusackas <evan@preset.io >
2026-06-22 08:30:40 -04:00
b8aeecfc44
fix(export): dashboard export must not leak env-local chartIds ( #32972 ) ( #40588 )
...
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-06-22 03:50:29 -07:00
7128760d32
chore(deps-dev): bump baseline-browser-mapping from 2.10.36 to 2.10.37 in /superset-frontend ( #41271 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-22 01:30:25 -07:00
6118a01bc1
chore(deps): bump mapbox-gl from 3.24.0 to 3.24.1 in /superset-frontend ( #41273 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-22 01:30:21 -07:00
b7451cd16d
chore(deps-dev): bump yeoman-test from 11.5.3 to 11.6.0 in /superset-frontend ( #41274 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-22 01:30:18 -07:00
4312d67775
chore(deps): bump react-arborist from 3.10.1 to 3.10.5 in /superset-frontend ( #41276 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-22 01:30:14 -07:00
55190b1da0
chore(deps-dev): bump eslint-plugin-storybook from 10.4.3 to 10.4.4 in /superset-frontend ( #41277 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-22 01:30:11 -07:00
dc8f0d7b24
chore(deps-dev): bump eslint from 10.4.1 to 10.5.0 in /superset-frontend ( #41278 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-22 01:30:07 -07:00
8b430caef4
chore(deps-dev): bump eslint from 10.4.1 to 10.5.0 in /superset-websocket ( #41269 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-22 00:36:54 -07:00
f5dd28714d
chore(deps): bump baseline-browser-mapping from 2.10.36 to 2.10.37 in /docs ( #41270 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-22 00:36:49 -07:00
6d15876b13
chore(deps-dev): bump grpcio from 1.71.0 to 1.81.1 ( #41254 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Evan <evan@preset.io >
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-21 23:39:37 -07:00
3dd570cd9b
chore(deps-dev): bump trino from 0.330.0 to 0.337.0 ( #41255 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Evan <evan@preset.io >
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-21 23:39:34 -07:00
e6fffe95c2
chore(deps): bump pyyaml from 6.0.2 to 6.0.3 ( #41256 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Evan <evan@preset.io >
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-21 23:39:30 -07:00
27d9bcb7bc
chore(deps): bump greenlet from 3.5.0 to 3.5.1 ( #41258 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Evan <evan@preset.io >
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-21 23:39:27 -07:00
f33c209f7a
chore(deps): bump flask-cors from 6.0.2 to 6.0.5 ( #41260 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Evan <evan@preset.io >
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-21 23:39:24 -07:00
ba339fd9c1
chore(deps): bump msgpack from 1.0.8 to 1.2.1 ( #41261 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Evan <evan@preset.io >
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-21 23:39:20 -07:00
Abdul Rehman and GitHub
defacc3237
fix(deps): declare cachetools explicitly in pyproject.toml ( #40987 )
2026-06-22 00:45:59 +07:00
b612f573d7
chore(deps-dev): update ydb-sqlalchemy requirement from >=0.1.2 to >=0.1.22 ( #41253 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-20 23:34:37 +07:00
99ffaf3694
chore(deps-dev): update sqlalchemy-solr requirement from >=0.2.0 to >=0.2.4.3 ( #41257 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-20 23:33:49 +07:00
Viktor Högberg and GitHub
14d4432843
fix: remove erroneous box shadow when bulk selecting ( #41198 )
2026-06-20 22:15:00 +07:00
Đỗ Trọng Hải and GitHub
686beb9117
chore(build): replace d3-color usage with existing tinycolor2 ( #39468 )
...
Signed-off-by: hainenber <dotronghai96@gmail.com >
2026-06-20 21:44:02 +07:00
3aa1218f9b
feat(ci): do not run expensive E2E tests on draft PRs ( #40720 )
...
Signed-off-by: hainenber <dotronghai96@gmail.com >
Co-authored-by: Evan Rusackas <evan@preset.io >
2026-06-20 13:03:26 +07:00
Mehmet Salih Yavuz and GitHub
0d92d0dbb7
chore(deps): finish pip→uv swap in Makefile and CI ( #41197 )
2026-06-20 10:56:25 +07:00
Đỗ Trọng Hải and GitHub
2d5df6625b
build(deps): update major versions for memoize-one, json-stringify-pretty-compact and webpack-cli ( #38793 )
...
Signed-off-by: hainenber <dotronghai96@gmail.com >
2026-06-20 10:48:10 +07:00
d0a34d9372
chore(deps): bump @visx/scale from 3.12.0 to 4.0.0 in /superset-frontend ( #41231 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-19 15:07:06 -07:00
Jean Dupuis and GitHub
b2e5f80db2
fix(sql): preserve multi-arg DISTINCT in sanitize_clause and format ( #39340 )
2026-06-19 13:02:50 -07:00
f1504611fd
docs(config): document customizing the landing page via FAB_INDEX_VIEW ( #41222 )
...
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-19 13:01:47 -07:00
382a094795
chore(deps): bump @visx/grid from 3.12.0 to 4.0.0 in /superset-frontend ( #41240 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-19 11:39:05 -07:00
Vitor Avila and GitHub
334b13c3d9
fix(chart API): apply dashboard filters by live scope, not stale chartsInScope ( #41214 )
2026-06-19 15:22:54 -03:00
Vitor Avila and GitHub
9e130e5927
fix(chart): preserve SQL_QUERY_MUTATOR line comments structure ( #41215 )
2026-06-19 15:07:24 -03:00
fe017d0b20
chore(deps): bump @visx/responsive from 3.12.0 to 4.0.0 in /superset-frontend ( #41239 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-19 11:04:20 -07:00
