 Durgaprasad M LandEvan Rusackas
|
107204a1fc
|
fix(sqllab): allow SQL Lab query owners to create charts without all_datasource_access (#42479)
Co-authored-by: Evan Rusackas <evan@rusackas.com>
|
2026-08-24 16:51:57 -07:00 |
|
|
|
7f1b41444c
|
fix: add missing access checks to semantic-layer and theme endpoints (#43389)
Co-authored-by: Superset Dev <dev@superset.apache.org>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
|
2026-08-24 08:52:45 -07:00 |
|
|
|
8a32324184
|
fix: add missing ownership checks to tag, report-log, and dataset-schema endpoints (#43390)
Co-authored-by: Superset Dev <dev@superset.apache.org>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
|
2026-08-24 08:44:22 -07:00 |
|
|
Enzo Martellucci
|
c3ed8b312d
|
fix(security): surface extra_editors in dashboard/chart lists (#43392)
|
2026-08-24 11:49:29 +02:00 |
|
|
Alexandru Soare
|
a05a099987
|
fix(embedded): block custom SQL injection in guest user chart payloads (#43111)
|
2026-08-21 17:05:40 +03:00 |
|
|
Amin GhadersohiandClaude Fable 5
|
086b4af65d
|
feat(mcp): per-resource token scopes with user-permission intersection (#42297)
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
|
2026-08-18 13:11:27 -04:00 |
|
|
|
fd063d17bf
|
fix(security): harden account password-change and session-invalidation handling (#42934)
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Co-authored-by: Joe Li <joe@preset.io>
|
2026-08-18 17:40:08 +01:00 |
|
|
|
13eb47a1da
|
fix(api): improved request handling and embedded dashboard scoping (#42930)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Superset Dev <dev@superset.apache.org>
|
2026-08-17 23:50:25 -07:00 |
|
|
Evan RusackasandClaude Opus 4.8
|
59361581cd
|
fix(embedded): restore chart rendering for guest dashboards (#43095)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
|
2026-08-13 05:38:57 -07:00 |
|
|
|
8014f782d3
|
feat: bump SQLAlchemy to 2.0 and flask-sqlalchemy to 3.1.1 (#42803)
Co-authored-by: Claude Code <noreply@anthropic.com>
Co-authored-by: Superset Dev <dev@superset.apache.org>
|
2026-08-12 19:55:14 -07:00 |
|
|
Evan RusackasandClaude Opus 4.8
|
01ecefd732
|
fix(security_manager): stop SupersetAuthView from shadowing AUTH_REMOTE_USER (#42949)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
|
2026-08-12 18:09:46 -07:00 |
|
|
Evan RusackasandClaude Opus 4.8
|
584466e02b
|
fix(sql-lab): improved SQL statement parsing and validation (#42928)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
|
2026-08-11 19:35:43 -07:00 |
|
|
Mike MaandEvan Rusackas
|
2eb1e04283
|
fix: hydrate JWT user before list API filters (#39946)
Co-authored-by: Evan Rusackas <evan@preset.io>
|
2026-08-10 14:18:28 -07:00 |
|
|
|
4a587b8539
|
feat(security): actionable, request-access-aware data permission errors (#41843)
Co-authored-by: Greg Neighbors <gregneighbors@Gregs-Air-2.lan>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Greg Neighbors <gregneighbors@Gregs-MacBook-Air-2.local>
|
2026-08-08 11:51:15 -07:00 |
|
|
Evan RusackasandClaude Code
|
2ecce20e48
|
chore(viz): remove legacy explore_json + viz.py pipeline (#41714)
Co-authored-by: Claude Code <noreply@anthropic.com>
|
2026-08-06 13:22:15 -07:00 |
|
|
Enzo MartellucciandClaude Opus 4.8
|
069605828d
|
feat(subjects): scope principal listings and default new assets to creator groups (#42472)
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
2026-07-29 14:36:45 +02:00 |
|
|
Joe LiandClaude Opus 4.8
|
1d752a0ced
|
fix(embedded): load guest charts with missing or stale query_context (#42150)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
|
2026-07-27 14:14:55 -07:00 |
|
|
Evan RusackasandClaude Code
|
206fe7ab12
|
fix(embedded): stop rejecting guest chart data built from control-specific params keys (#42295)
Co-authored-by: Claude Code <noreply@anthropic.com>
|
2026-07-23 13:31:04 -07:00 |
|
|
Evan RusackasandClaude Fable 5
|
9178faf9b1
|
refactor: set cascade_backrefs=False for Query (#42210)
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
|
2026-07-20 10:20:09 -07:00 |
|
|
Ville Brofeldt
|
2112fbd379
|
feat(subjects): add read-only Subject REST API and DAO (#41897)
|
2026-07-10 04:29:34 -07:00 |
|
|
Gabriel Torres Ruiz
|
1fd43ffe52
|
feat(mcp): scope embedded-guest data reads to the token's dashboards (#41753)
|
2026-07-09 14:58:01 -03:00 |
|
|
Ville Brofeldt
|
33f0fc93ed
|
feat: introduce Subject model and entity editors/viewers (#38831)
|
2026-07-08 11:00:03 -07:00 |
|
|
|
04f8b700d7
|
feat(datasets): soft-delete and restore (#40130)
Co-authored-by: Mike Bridge <michael.bridge@ext.preset.io>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
|
2026-07-07 08:57:08 -07:00 |
|
|
|
ab0e77c1cb
|
fix(embedded): allow guest users to sort by visible columns (#37371)
Co-authored-by: Amin Ghadersohi <amin.ghadersohi@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
|
2026-07-02 15:50:56 -07:00 |
|
|
Evan RusackasandClaude Code
|
adc03ce525
|
refactor: make import/expression layer SQLAlchemy 2.0-compatible (#41179)
Co-authored-by: Claude Code <noreply@anthropic.com>
|
2026-06-29 11:38:59 -07:00 |
|
|
Evan RusackasandClaude Code
|
5e8a0c0244
|
fix(embedded): allow guest users to sort table columns in embedded dashboards (#41218)
Co-authored-by: Claude Code <noreply@anthropic.com>
|
2026-06-23 10:10:55 -07:00 |
|
|
|
36781fbf47
|
fix(i18n): wrap table access error message with gettext for translation (#38489)
Co-authored-by: Evan <evan@preset.io>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
|
2026-06-22 20:28:05 -07:00 |
|
|
Alexandru Soare
|
6d08e79259
|
feat(security): Add extension hooks for custom access control, ownership, and asset lifecycle (#40707)
|
2026-06-16 15:25:03 +03:00 |
|
|
|
e16bb29faf
|
fix(embedded): allow guests to apply a Time Grain native filter (#32768) (#41017)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
|
2026-06-15 15:22:21 -07:00 |
|
|
|
aa3d2b9e81
|
fix(dashboard): validate native-filter data requests against filter targets (#40979)
Co-authored-by: sha174n <pedro.sousa@preset.io>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
2026-06-13 19:02:28 +01:00 |
|
|
Evan RusackasandClaude Code
|
814b72c6f9
|
feat(security): force password change on first use (opt-in) (#40669)
Co-authored-by: Claude Code <noreply@anthropic.com>
|
2026-06-11 22:23:10 -07:00 |
|
|
Evan RusackasandClaude Code
|
663b47aa75
|
feat: support guest-token revocation per embedded dashboard (#40676)
Co-authored-by: Claude Code <noreply@anthropic.com>
|
2026-06-11 19:37:22 -07:00 |
|
|
Evan RusackasandClaude Opus 4.8
|
9938ee273f
|
feat: terminate active sessions when an account is disabled (#40695)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
|
2026-06-11 19:37:13 -07:00 |
|
|
Evan RusackasandClaude Code
|
5a0e3f15ca
|
feat(embedded): add guest token revocation support (#40671)
Co-authored-by: Claude Code <noreply@anthropic.com>
|
2026-06-10 09:17:30 -07:00 |
|
|
Amin Ghadersohi
|
7d69f76127
|
fix(mcp): API key authentication for MCP — transport, validation, and RBAC (#39604)
|
2026-06-04 15:04:43 -04:00 |
|
|
ShaitanandClaude Sonnet 4.6
|
faa76f6741
|
fix(embedding): add optional dataset allowlist to guest tokens (#39302)
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-06-03 12:55:09 +01:00 |
|
|
ShaitanandClaude Opus 4.7
|
6eaee211aa
|
fix(sqllab): require dataset match for raw query access (#40409)
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
|
2026-06-02 21:50:27 +01:00 |
|
|
|
041ecbc248
|
fix(embedded): resolve guest user permissions in user_view_menu_names (#39197)
Co-authored-by: Evan Rusackas <evan@preset.io>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Claude Code <noreply@anthropic.com>
|
2026-06-01 10:30:05 -07:00 |
|
|
|
b2320820b4
|
feat(core): SoftDeleteMixin and restore infrastructure (#39977)
Co-authored-by: Mike Bridge <michael.bridge@ext.preset.io>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
2026-05-29 13:08:10 -07:00 |
|
|
ShaitanandClaude Sonnet 4.6
|
f663f47628
|
fix(embedding): require non-default JWT secret when embedded dashboards are enabled (#39999)
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-05-28 14:26:40 -07:00 |
|
|
Beto Dealmeida
|
cb53745d43
|
feat: semantic layer extension (#37815)
|
2026-05-05 12:07:46 -04:00 |
|
|
Daniel Vaz GasparandClaude Opus 4.6
|
f6c5219e89
|
fix(security): add UserSAMLModelView to USER_MODEL_VIEWS (#39568)
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
2026-04-22 17:47:41 +01:00 |
|
|
|
c7955a38ef
|
fix: Drill to Detail for Embedded (#39214)
Co-authored-by: Maxime Beauchemin <maximebeauchemin@gmail.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
|
2026-04-09 17:01:48 -03:00 |
|
|
Daniel Vaz GasparandClaude Opus 4.6
|
5815665cc6
|
feat: role/user CRUD events and login/logout tracking in the action log (#39121)
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
|
2026-04-09 15:55:25 +01:00 |
|
|
Ville Brofeldt
|
e56f8cc4fb
|
fix(security_manager): custom auth_view issue (#39098)
|
2026-04-06 09:04:59 -07:00 |
|
|
Mehmet Salih Yavuz
|
95f61bd223
|
fix: add parent_slice_id for multilayer charts to embed (#38243)
|
2026-03-12 21:21:43 +03:00 |
|
|
Enzo Martellucci
|
a17f38a4e2
|
fix(embedded): add CurrentUserRestApi read permission to Public role defaults (#38474)
|
2026-03-10 00:08:37 +01:00 |
|
|
Hugh A. Miles II
|
61fbfda501
|
feat(security): add granular export controls (Phase 1) (#38361)
|
2026-03-09 16:44:56 -04:00 |
|
|
Kamil Gabryjelski
|
3e3c9686de
|
perf(dashboard): Batch RLS filter lookups for dashboard digest computation (#37941)
|
2026-02-16 21:35:55 +01:00 |
|
|
Alexandru Soare
|
9ea5ded988
|
fix(dashboard): Prevent fatal error when database connection is unavailable (#37576)
|
2026-02-06 20:52:17 -08:00 |
|