QT/superset2
1
0
Fork 0
mirror of https://github.com/apache/superset.git synced 2026-07-19 21:25:38 +00:00
Code Issues Packages Projects Releases Wiki Activity
20,702 Commits 536 Branches 558 Tags
be0d9bc9e3fd4e55cbbafa51eb333b575f062a5e
Commit Graph

20702 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Evan
be0d9bc9e3 fix(embedded): include all_columns from stored query context in guest sort targets 
Address review feedback: the stored query context loop in
_collect_sortable_identifiers omitted all_columns, silently rejecting
legitimate guest sorts on table charts configured with 'show all
columns'. Add it, plus a regression test and clarifying comments on the
order-by union and the intentional stored_values asymmetry.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-23 05:51:00 -07:00
Evan
7c1fa4ae72 fix(embedded): include legacy singular metric and reject malformed orderby in guest sort guard 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 23:00:13 -07:00
Claude Code
27c481d75d fix(embedded): allow guest users to sort table columns 
query_context_modified() compared a guest request's orderby against the
stored chart's orderby with a strict subset check, alongside columns,
metrics and groupby. Saved charts usually store an empty orderby, so when
a guest clicked a column header to sort a table in an embedded dashboard
the new orderby value failed the subset check and the request was
rejected with "Guest user cannot modify chart payload", even though
sorting only changes result ordering and not which data is read.

Handle orderby separately: a guest may sort by any column or metric the
stored chart already references, but order-by terms that are not present
in the stored chart (e.g. a free-form random() expression) are still
rejected, preserving the existing SQL-injection guard. The columns/
metrics/groupby comparison is extracted into a helper to keep
query_context_modified within the complexity budget, and the inner loop's
variable shadowing of `key` is fixed along the way.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-18 21:46:53 -07:00
rijekaDrina
79cfe4d9bc feat(i18n): add Serbian translations (Cyrillic + Latin) (#41137) 
Signed-off-by: Aleksije Micic <aleksije.micic1997@gmail.com>
Co-authored-by: Aleksije Micic <aleksije.micic1997@gmail.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Evan Rusackas <evan@preset.io>
 2026-06-18 17:45:04 -07:00
Evan Rusackas
3eae8cd614 fix(alerts): don't show a never-run report as a green success (#29622) (#41121) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-18 15:55:30 -07:00
Elizabeth Thompson
0c9ece65bb fix(reports): require user in get_screenshot, simplify Selenium lifecycle, and fail on tiled screenshot error (#41080) 
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-18 15:46:17 -07:00
Elizabeth Thompson
7040388ad1 fix(query_object_factory): normalize deprecated query fields before constructing QueryObject (#41204) 2026-06-18 15:02:07 -07:00
Elizabeth Thompson
a5ece52207 fix(views): add new_target to deprecated explore_json endpoints (#41159) 2026-06-18 15:02:03 -07:00
Evan Rusackas
a7c0f4b83d fix(embedded-sdk): omit registry-url so npm uses OIDC publishing (#41211) 
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 13:43:23 -07:00
Evan Rusackas
0f05239260 fix(embedded-sdk): clear placeholder token so npm uses OIDC publishing (#41210) 
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 13:26:32 -07:00
Evan Rusackas
60a7804193 fix(embedded-sdk): surface npm publish stderr in release script (#41206) 
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 13:16:15 -07:00
Evan Rusackas
4053f53c29 ci(embedded-sdk): fix release CI by publishing via npm trusted publishing (OIDC) (#41207) 
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 11:33:39 -07:00
Nitish Agarwal
7837054dbc fix(chart): cross-filter emits dimension value instead of metric label for stacked bars (#38120) 
Co-authored-by: Evan Rusackas <evan@preset.io>
 2026-06-18 11:24:36 -07:00
Evan Rusackas
69c8f37c67 docs(installation): fix PyPI install Python version and OS dependencies (#41178) 
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 11:03:50 -07:00
Abdul Rehman
76e2418f1e fix(mcp): add safeguards to ensure all MCP tools are wrapped with mcp_auth_hook (#40412) 
Co-authored-by: Evan Rusackas <evan@preset.io>
 2026-06-18 10:27:53 -07:00
Vitor Avila
b4e3452bfd fix(chart API): Do not duplicate Jinja-applied filters with filters_dashboard_id (#41131) 2026-06-18 14:25:54 -03:00
jesperct
188c84f1cd fix(explore): drop inherit/custom time shifts when switching to a viz that can't honor them (#40865) 2026-06-18 10:23:31 -07:00
dependabot[bot]
74ae5a45f9 chore(deps): bump dompurify from 3.4.9 to 3.4.11 in /superset-frontend (#41201) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-18 08:22:57 -07:00
dependabot[bot]
fc61918364 chore(deps): bump undici from 7.25.0 to 7.28.0 in /superset-frontend (#41202) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-18 08:22:47 -07:00
dependabot[bot]
3e811087de chore(deps): bump dompurify from 3.4.2 to 3.4.11 in /docs (#41203) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-18 08:22:39 -07:00
ksnikiforov
c218dc418b fix(dashboard): fixed first/last aggregations in pivot tables (#33275) 
Co-authored-by: Evan Rusackas <evan@preset.io>
Co-authored-by: Amin Ghadersohi <amin.ghadersohi@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Enzo Martellucci <52219496+EnxDev@users.noreply.github.com>
 2026-06-18 10:49:12 +02:00
dependabot[bot]
c98ed92303 chore(deps): bump markdown-to-jsx from 9.8.1 to 9.8.2 in /superset-frontend (#41191) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-18 01:07:47 -07:00
dependabot[bot]
84c32ec132 chore(deps-dev): bump @types/node from 25.9.2 to 25.9.3 in /superset-frontend (#41190) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-18 00:47:15 -07:00
dependabot[bot]
8636875b39 chore(deps-dev): bump eslint-plugin-storybook from 10.4.2 to 10.4.3 in /superset-frontend (#41192) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-18 00:47:12 -07:00
dependabot[bot]
dde6974ac2 chore(deps): bump dom-to-image-more from 3.7.2 to 3.9.0 in /superset-frontend (#41193) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-18 00:47:08 -07:00
dependabot[bot]
e36eb6f47c chore(deps-dev): bump @types/node from 25.9.2 to 25.9.3 in /superset-websocket (#41186) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-18 00:26:54 -07:00
dependabot[bot]
f6e12278dc chore(deps-dev): update @types/node requirement from ^25.9.2 to ^25.9.3 in /superset-frontend/packages/superset-ui-core (#41188) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-18 00:26:51 -07:00
dependabot[bot]
43d5b6319b chore(deps-dev): bump baseline-browser-mapping from 2.10.34 to 2.10.35 in /superset-frontend (#41189) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-18 00:26:48 -07:00
melikmertd
ae0b1f0308 fix(countrymap chart): city names of Türkiye edited in Countrymap Chart. (#32497) 
Co-authored-by: Đỗ Trọng Hải <41283691+hainenber@users.noreply.github.com>
 2026-06-17 21:46:11 -07:00
Evan Rusackas
4acb777a40 chore(sqllab): remove dead TableElement component and syncTable action (#41071) 
Co-authored-by: Superset Dev <dev@superset.apache.org>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
 2026-06-17 19:29:09 -07:00
Durgaprasad M L
7e98410743 fix(theme): embedded method overrides dashboard level config (#40777) 
Co-authored-by: Mehmet Salih Yavuz <salih.yavuz@proton.me>
 2026-06-17 18:33:04 -07:00
Hans Yu
883b7a286d refactor: update SQLAlchemy select() syntax to 2.0 (#40276) 2026-06-17 17:50:32 -07:00
Evan Rusackas
d9d8b2bcc0 chore(ci): correct action ref version comments (zizmor) (#41160) 
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-17 15:42:14 -07:00
Evan Rusackas
9da54eff84 chore(ci): set least-privilege workflow permissions (zizmor) (#41161) 
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-17 15:41:47 -07:00
dependabot[bot]
fb2b9fa8ff chore(deps): bump cryptography from 46.0.7 to 48.0.1 (#41010) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Evan <evan@preset.io>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-17 15:01:20 -07:00
Dante R. Giuliano
31797005db docs(INTHEWILD): adding Tech Solution (#37178) 
Co-authored-by: Evan Rusackas <evan@preset.io>
Co-authored-by: Joe Li <joe@preset.io>
 2026-06-17 14:59:15 -07:00
Evan Rusackas
ca2d340db3 fix(security): validate dynamic method dispatch in asyncEvent (#41163) 
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-17 14:58:34 -07:00
jesperct
ef82da8458 fix(charts): apply datetime format to unaggregated temporal columns (#41060) 2026-06-17 14:56:09 -07:00
Jean Massucatto
fee1cf9f08 chore(sqllab): remove dead TableElement component (#41029) 2026-06-17 14:54:41 -07:00
jesperct
2d2a8f3ab0 fix(plugin-chart-handlebars): follow the app theme in Customize code editors (#40952) 2026-06-17 14:52:52 -07:00
dependabot[bot]
a19093e65a chore(deps-dev): bump webpack-dev-server from 5.2.4 to 5.2.5 in /superset-frontend (#41168) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-17 12:55:44 -07:00
dependabot[bot]
b72a0a53c0 chore(deps): bump webpack-dev-server from 5.2.4 to 5.2.5 in /docs (#41169) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-17 12:55:40 -07:00
Thomas Bernhard
512b6f43c1 chore(embedded sdk): bump sdk version number (#40991) 2026-06-17 12:47:41 -07:00
Evan Rusackas
b18fab7fc1 ci(docker): free disk space before image build to fix "no space left on device" (#41068) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-17 12:43:43 -07:00
Evan Rusackas
b06c6b7464 ci: bump setup-python to v6 (Node 24) before Node 20 deprecation (#41066) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-17 11:56:47 -07:00
Evan Rusackas
bede4b2121 ci(docker): retry image build to absorb transient Docker Hub registry errors (#41069) 
Co-authored-by: Claude Code <noreply@anthropic.com>
 2026-06-17 11:56:23 -07:00
İbrahim Ercan
5e812c8757 feat(docker): add environment values to set log file for worker and beat (#40998) 
Co-authored-by: Ibrahim Ercan <ibrahim.ercan@vlmedia.com.tr>
 2026-06-17 10:42:45 -07:00
Craig Ingram
de390f22a4 fix(helm): Evaluate init.extraContainers templates (#31878) 
Co-authored-by: Evan Rusackas <evan@preset.io>
superset-helm-chart-0.16.2 		2026-06-17 10:39:40 -07:00
dependabot[bot]
464c67d586 chore(deps-dev): bump @storybook/addon-links from 10.4.2 to 10.4.3 in /superset-frontend (#41146) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Superset Dev <dev@superset.apache.org>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
 2026-06-17 10:17:00 -07:00
dependabot[bot]
7f7f87e823 chore(deps-dev): bump prettier from 3.8.3 to 3.8.4 in /docs (#41140) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-17 09:49:28 -07:00