QT/superset2
1
0
Fork 0
mirror of https://github.com/apache/superset.git synced 2026-07-18 20:55:47 +00:00
Code Issues Packages Projects Releases Wiki Activity
20,413 Commits 531 Branches 558 Tags
ad613d472aaab62d95c8ddaee5ffdeb0175a113f
Commit Graph

1637 Commits

Author SHA1 Message Date
Evan
ad613d472a fix(encrypt): fail closed on empty engine value; sync SIP runbook; typed CLI tests 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-13 04:18:19 -07:00
Claude Code
782c1db8d8 feat(encrypt): add CBC→GCM re-encryption migrator + CLI engine flag 
Phase 2 of the authenticated-encryption-at-rest proposal. Teaches the
existing SecretsMigrator an engine-migration mode (decrypt with the source
engine under the current SECRET_KEY, re-encrypt with a target engine) and
exposes it via `superset re-encrypt-secrets --engine aes-gcm`. The run is
transactional and idempotent per column, so existing installs can move from
AES-CBC to authenticated AES-GCM without bricking stored secrets. Default
engine is unchanged ("aes"); behavior is opt-in. Adds UPDATING.md runbook and
updates the SIP to reflect Phases 1–2 shipping here.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-05 11:41:45 -07:00
Claude Code
f748de3423 feat(encrypt): make encryption engine selectable (AES-GCM support) [DRAFT/SIP] 
App-encrypted fields (DB passwords, SSH tunnel creds, OAuth tokens) use
sqlalchemy_utils EncryptedType, which defaults to AES-CBC — unauthenticated
encryption vulnerable to bit-flipping/tamper of ciphertext at rest. AES-GCM is
authenticated and fails closed on tampering.

Phase 1 (this change, backward compatible): add a configurable encryption
engine via SQLALCHEMY_ENCRYPTED_FIELD_ENGINE ("aes" | "aes-gcm"), defaulting to
"aes" so existing deployments are unchanged. The default SQLAlchemyUtilsAdapter
now honors it; an explicit engine kwarg still wins. New installs can opt into
AES-GCM with one line instead of writing a custom adapter.

Includes docs/sip/authenticated-encryption-at-rest.md describing the full
proposal: Phase 2 (a CBC->GCM re-encryption migrator built on SecretsMigrator)
and Phase 3 (flip default for fresh installs). The instance-wide re-encryption
migration is intentionally NOT included here — it is the subject of the SIP.

DRAFT: flipping the engine on a populated DB without the Phase 2 migrator makes
existing secrets undecryptable; this PR only adds the safe opt-in plumbing for
discussion.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-05 11:41:12 -07:00
Shaitan
cf08a5ebf7 feat(docker): add environment-based debugger control (#40327) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Mehmet Salih Yavuz <salih.yavuz@proton.me>
Co-authored-by: Beto Dealmeida <roberto@dealmeida.net>
Co-authored-by: Elizabeth Thompson <eschutho@gmail.com>
Co-authored-by: Evan Rusackas <evan@preset.io>
Co-authored-by: Jay Masiwal <masiwaljay.02@gmail.com>
Co-authored-by: JUST.in DO IT <justin.park@airbnb.com>
Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Amin Ghadersohi <amin.ghadersohi@gmail.com>
Co-authored-by: chaselynisabella <chaselynisabella@gmail.com>
 2026-06-03 12:55:31 +01:00
dependabot[bot]
41da35e9db chore(deps-dev): bump typescript-eslint from 8.59.4 to 8.60.0 in /docs (#40598) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-01 17:03:52 -07:00
dependabot[bot]
f04221a06c chore(deps-dev): bump webpack from 5.107.1 to 5.107.2 in /docs (#40597) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-01 16:42:05 -07:00
dependabot[bot]
8beea84952 chore(deps-dev): bump @typescript-eslint/parser from 8.59.4 to 8.60.0 in /docs (#40600) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-01 16:41:16 -07:00
Evan Rusackas
2b8e31bf68 ci(docs): skip Netlify docs preview on PRs that don't touch docs (#40590) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-01 19:06:57 -04:00
Evan Rusackas
ab5ea1f7d3 chore(deps): force d3-color 3.1.0 in docs (#40541) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-05-31 00:33:05 -07:00
Evan Rusackas
469979714f chore(deps): force serialize-javascript 7.0.5 in docs (#40540) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-05-31 10:54:45 +07:00
Evan Rusackas
f4787a4f25 chore(deps): bump ws to 8.20.1 in docs (#40538) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-05-30 13:08:13 +07:00
Evan Rusackas
fa4e571db5 chore(deps): force uuid 11.1.1 in docs (#40542) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-05-30 13:04:31 +07:00
Evan Rusackas
44a8d9d469 chore(deps): pin lodash, lodash-es, and yaml in docs to patched releases (#40535) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-05-29 21:26:39 -07:00
dependabot[bot]
63e3a18e8f chore(deps): bump baseline-browser-mapping from 2.10.31 to 2.10.32 in /docs (#40484) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-29 13:42:32 -07:00
dependabot[bot]
61cb0aeae7 chore(deps): bump @swc/core from 1.15.33 to 1.15.40 in /docs (#40515) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-29 13:41:35 -07:00
Torsten Stöter
5003ee1499 docs: remove out-of-place phrase (#40226) 2026-05-23 13:42:52 +07:00
dependabot[bot]
55203bbc74 chore(deps): bump qs from 6.14.2 to 6.15.2 in /docs (#40383) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-23 11:55:04 +07:00
Evan Rusackas
af6ac4d09c feat(i18n): AI-assisted translation backfill tooling + Spanish translations (#39448) 
Co-authored-by: Claude Code <noreply@anthropic.com>
Co-authored-by: codeant-ai-for-open-source[bot] <244253245+codeant-ai-for-open-source[bot]@users.noreply.github.com>
Co-authored-by: Superset Dev <dev@superset.apache.org>
Co-authored-by: Đỗ Trọng Hải <41283691+hainenber@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>
 2026-05-22 21:07:27 -07:00
dependabot[bot]
31087177ab chore(deps-dev): bump webpack from 5.107.0 to 5.107.1 in /docs (#40364) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-22 21:21:22 +07:00
SkinnyPigeon
105820f1f4 docs(reports): playwright setup clarification (#40168) 2026-05-20 10:32:02 -07:00
Evan Rusackas
92b1b0a219 ci(docs): soft-fail badge localization on transient fetch errors (#40236) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-05-20 10:21:58 -07:00
dependabot[bot]
ea1ce7140c chore(deps-dev): bump webpack from 5.106.2 to 5.107.0 in /docs (#40291) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-20 22:35:32 +07:00
dependabot[bot]
aa9af6c307 chore(deps-dev): bump typescript-eslint from 8.59.3 to 8.59.4 in /docs (#40254) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-19 21:52:10 -07:00
dependabot[bot]
fbb3056508 chore(deps): bump baseline-browser-mapping from 2.10.30 to 2.10.31 in /docs (#40255) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-19 21:51:56 -07:00
Evan Rusackas
1230b9091b docs: hide Component Playground top-level nav item (#40247) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-05-19 09:32:53 -07:00
dependabot[bot]
ac5e8f1308 chore(deps): bump swagger-ui-react from 5.32.5 to 5.32.6 in /docs (#40056) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>
 2026-05-18 21:51:35 -07:00
Evan Rusackas
6fa0b48752 docs: cut 6.1.0 versions for user_docs, admin_docs, developer_docs, components (#40126) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-05-18 12:59:39 -07:00
dependabot[bot]
522b6a2296 chore(deps): bump webpack-dev-server from 5.2.2 to 5.2.4 in /docs (#40227) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-18 12:01:08 -07:00
dependabot[bot]
6e5dfa0dd4 chore(deps): bump baseline-browser-mapping from 2.10.29 to 2.10.30 in /docs (#40211) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-18 22:14:27 +07:00
SkinnyPigeon
70419e9d8f feat: Allow specific mcp tools to be disabled (#39835) 2026-05-18 07:22:02 -07:00
dependabot[bot]
e2ff2d5d41 chore(deps): bump reselect from 5.1.1 to 5.2.0 in /docs (#40209) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-18 06:28:25 -07:00
dependabot[bot]
6a6be4c385 chore(deps): bump antd from 6.4.2 to 6.4.3 in /docs (#40210) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-18 06:28:00 -07:00
dependabot[bot]
cf831388d8 chore(deps): bump caniuse-lite from 1.0.30001792 to 1.0.30001793 in /docs (#40212) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-18 06:27:36 -07:00
dependabot[bot]
9eecc5a2a6 chore(deps): bump axios from 1.15.0 to 1.16.1 in /docs (#40177) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-17 10:26:44 -07:00
Evan Rusackas
8a86ab7319 chore(docs): rename default docs plugin to user_docs for consistent versioned dir naming (#40171) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-05-15 22:26:43 -07:00
dependabot[bot]
59b5f69627 chore(deps): bump antd from 6.3.7 to 6.4.2 in /docs (#40149) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-15 21:54:22 +07:00
Evan Rusackas
672e9a1477 fix(docs): tighten onBrokenLinks to throw and fix surfaced broken links (#40102) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-05-14 11:07:18 -07:00
Evan Rusackas
d1e9a5df06 chore(docs): clean up version-cutting tooling and finish developer_portal rename (#39837) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-05-13 20:14:52 -07:00
dependabot[bot]
2c7e418d7b chore(deps): bump @ant-design/icons from 6.2.2 to 6.2.3 in /docs (#40086) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-13 09:31:51 -07:00
Evan Rusackas
e2a8a88d36 docs: Update documentation link for ENABLE_SUPERSET_META_DB (#40076) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-05-12 20:39:39 -07:00
dependabot[bot]
fe22e06011 chore(deps): bump mermaid from 11.10.0 to 11.15.0 in /docs (#40038) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-12 16:25:09 -07:00
dependabot[bot]
c9fb1bc10f chore(deps-dev): bump @typescript-eslint/parser from 8.59.2 to 8.59.3 in /superset-frontend (#40057) 
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: hainenber <dotronghai96@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: hainenber <dotronghai96@gmail.com>
 2026-05-12 22:27:58 +07:00
dependabot[bot]
ad7075d2aa chore(deps): bump fast-uri from 3.0.6 to 3.1.2 in /docs (#39979) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-11 08:59:26 -07:00
dependabot[bot]
3e1cfc6d69 chore(deps): bump @babel/plugin-transform-modules-systemjs from 7.27.1 to 7.29.4 in /docs (#39981) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-11 08:59:04 -07:00
dependabot[bot]
2adb6f64eb chore(deps): bump baseline-browser-mapping from 2.10.27 to 2.10.29 in /docs (#40013) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-11 08:54:43 -07:00
dependabot[bot]
dce3317bc9 chore(deps-dev): bump typescript-eslint from 8.59.1 to 8.59.2 in /docs (#39876) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-08 11:24:38 -07:00
Evan Rusackas
b899556130 docs: Superset 6.1 documentation catch-up (security, alerts/reports, theming, config) (#39440) 
Co-authored-by: Superset Dev <dev@superset.apache.org>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-08 10:11:09 -07:00
Evan Rusackas
2f82236b29 feat(docs): expand docs:screenshots generator with manifest and tutorial captures (#39444) 
Co-authored-by: Claude <claude@anthropic.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Superset Dev <dev@superset.apache.org>
 2026-05-08 10:02:19 -07:00
Evan Rusackas
5bde86785f fix(docs): read capability flags from engine specs in database docs generator (#39449) 
Co-authored-by: Superset Dev <dev@superset.apache.org>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-08 09:13:08 -07:00
dependabot[bot]
7593d2a164 chore(deps): bump caniuse-lite from 1.0.30001791 to 1.0.30001792 in /docs (#39933) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-07 21:57:29 +07:00