rusackas and Claude Opus 4.8
67a193f1d9
fix(testcontainers): stop third-party dialect entry points from leaking global compiler state
...
sqlalchemy-monetdb mutates SQLAlchemy's shared, process-global
compiler.OPERATORS mapping in place on import instead of subclassing it
(OPERATORS = compiler.OPERATORS; OPERATORS[operators.ne] = " <> "). Once
Superset's own get_available_engine_specs() enumerates the "monetdb"
sqlalchemy.dialects entry point to build the "available databases" list
(which happens on every app boot, not just when MonetDB is actually
used), that changes `!=` rendering to `<>` for every dialect for the
rest of the process -- breaking test_where_operators identically across
the test-mysql/test-postgres/test-sqlite CI jobs, since installing the
monetdb extra now pulls sqlalchemy-monetdb into their shared dev
requirements.
Snapshot/restore sqlalchemy.sql.compiler.OPERATORS around each
third-party dialect entry point load so a misbehaving connector can't
leak global compiler state just because it was enumerated here.
Also fix the new mongodb testcontainers pagination test: pymongosql's
SQL-to-Mongo AST parser reads LIMIT/OFFSET off the compiled SQL text
ahead of parameter substitution, so a bound `LIMIT ?`/`OFFSET ?`
placeholder is silently dropped. Compile with literal_binds=True instead,
matching how Superset actually issues chart/SQL Lab queries.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-08-28 05:56:24 -07:00
8c5be889d9
fix(cockroachdb): replace abandoned cockroachdb package with sqlalchemy-cockroachdb ( #43501 )
...
Co-authored-by: Superset Dev <dev@superset.apache.org >
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com >
2026-08-27 19:48:13 -07:00
Elizabeth Thompson and Claude Opus 4.8
7b145a520c
fix(tags): catch TemplateError when validating access for tagged SQL Lab queries ( #43423 )
...
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com >
2026-08-27 15:06:46 -07:00
Elizabeth Thompson and Claude Opus 4.8
20be48c085
fix(explore): catch TemplateError when validating access for permalinked query datasources ( #43605 )
...
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com >
2026-08-27 15:06:38 -07:00
Aurimas Navardauskas
e1c7a51674
fix(mcp): flag failed tool calls with isError ( #43374 )
2026-08-27 14:59:19 -07:00
Gabriel Torres Ruiz
ecbd6578b0
fix(db_engine_specs): always mask OAuth2 client secret in encrypted extra ( #43491 )
2026-08-27 18:42:51 -03:00
Amin Ghadersohi
ea3206b076
fix(mcp): surface rejected filter columns in get_chart_data ( #43598 )
2026-08-27 17:36:50 -04:00
Amin Ghadersohi
478f612f25
fix(mcp): add open-world tool annotations ( #43529 )
2026-08-27 17:36:30 -04:00
Amin Ghadersohi
a16bc0d94f
fix(mcp): apply time grain overrides from extra_form_data ( #43599 )
2026-08-27 17:35:23 -04:00
Amin Ghadersohi and Claude
bcc6af6c5f
fix(dao): don't mask transient OperationalError as a "not found" result ( #43479 )
...
Co-authored-by: Claude <noreply@anthropic.com >
2026-08-27 17:34:53 -04:00
6d8cbbfe8d
fix(api): stop export downloads inheriting the one-year Cache-Control ( #43185 )
...
Co-authored-by: bikashJMV <bikash@jmv.co.in >
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com >
Co-authored-by: Evan Rusackas <evan@preset.io >
2026-08-27 12:17:02 -07:00
Sepuri Sai Krishna and Evan Rusackas
926e0e6a92
fix(chart-data): validate select()'s exclude option instead of raising 500s ( #42410 )
...
Co-authored-by: Evan Rusackas <evan@preset.io >
2026-08-27 12:14:33 -07:00
Amogh Atreya and Evan Rusackas
76151beade
fix(export): truncate exported filenames to prevent Windows path extraction errors ( #42531 ) ( #42541 )
...
Co-authored-by: Evan Rusackas <evan@preset.io >
2026-08-27 08:48:58 -07:00
Amin Ghadersohi and Claude
905a35d05f
fix(mcp): resolve dashboard permalinks ( #43482 )
...
Co-authored-by: Claude <noreply@anthropic.com >
2026-08-27 11:35:36 -04:00
Endi Monan
5879994e68
fix(charts): resolve export filenames from the chart, not the form data ( #43280 )
2026-08-27 08:31:32 -03:00
Vitor Avila
371e5e25e8
fix(trino): honor the verify arg for the user impersonation flow ( #43534 )
2026-08-26 19:44:30 -03:00
Luiz Otavio and Claude Opus 5
a140e74f5f
fix(excel): handle duplicate column labels in xlsx export ( #43561 )
...
Co-authored-by: Claude Opus 5 <noreply@anthropic.com >
2026-08-26 16:39:03 -03:00
Amin Ghadersohi
434511cb37
fix(mcp): reject unsafe dashboard layout replacements ( #43476 )
2026-08-26 14:28:26 -04:00
Alexandru Soare
455e6603c1
feat(reports): gate retry functionality behind ALERT_REPORTS_RETRY flag ( #43553 )
2026-08-26 09:18:11 -07:00
Amin Ghadersohi and Claude
1fd763bd29
fix(mcp): honor and validate chart filters ( #43478 )
...
Co-authored-by: Claude <noreply@anthropic.com >
2026-08-25 20:54:09 -07:00
62d74be0af
fix(metadb): apply SUPERSET_META_DB_LIMIT after join instead of per-table ( #36304 ) ( #42598 )
...
Co-authored-by: Claude Code <noreply@anthropic.com >
Co-authored-by: Joe Li <joe@preset.io >
2026-08-25 19:31:11 -07:00
Evan Rusackas and Superset Dev
61ab0cdb5d
fix(ocient): update GIS test fixtures for pyocient's relocated geo types ( #43496 )
...
Co-authored-by: Superset Dev <dev@superset.apache.org >
2026-08-25 17:18:02 -07:00
Bexultan and Bexultan Mustafin
649d6f1b41
fix(mcp): defer unknown numeric types to compile ( #43131 )
...
Co-authored-by: Bexultan Mustafin <bexultan.mustafin@ffins.kz >
2026-08-25 15:35:00 -07:00
Bexultan and Bexultan Mustafin
90dab7cf61
fix(mcp): accept common chart input variants ( #43130 )
...
Co-authored-by: Bexultan Mustafin <bexultan.mustafin@ffins.kz >
2026-08-25 15:22:52 -07:00
Sepuri Sai Krishna and Joe Li
68386a53ee
chore(database): remove dead extra validation exception classes ( #42411 )
...
Co-authored-by: Joe Li <joe@preset.io >
2026-08-25 15:14:16 -07:00
b89da3e9fc
docs(versioning): fix post-flip doc and comment drift ( #43493 )
...
Co-authored-by: Mike Bridge <michael.bridge@ext.preset.io >
Co-authored-by: Claude Fable 5 <noreply@anthropic.com >
2026-08-25 13:00:25 -07:00
Mike Bridge and Claude Fable 5
88d2c2954e
feat(deletion-retention): persist purge block reason codes on the audit log ( #43485 )
...
Co-authored-by: Claude Fable 5 <noreply@anthropic.com >
2026-08-25 12:46:55 -07:00
6c2fef29cb
feat(snowflake): Add support for OAuth 2.0 authentication ( #36856 )
...
Co-authored-by: Evan Rusackas <evan@preset.io >
Co-authored-by: Evan Rusackas <evan@rusackas.com >
Co-authored-by: Claude <noreply@anthropic.com >
Co-authored-by: Joe Li <joe@preset.io >
2026-08-24 21:22:14 -07:00
Evan Rusackas and Superset Dev
bd7b739212
chore: remove obsolete pandas/SQLAlchemy version compat shim ( #43497 )
...
Co-authored-by: Superset Dev <dev@superset.apache.org >
2026-08-24 20:11:52 -07:00
Durgaprasad M L and Evan Rusackas
107204a1fc
fix(sqllab): allow SQL Lab query owners to create charts without all_datasource_access ( #42479 )
...
Co-authored-by: Evan Rusackas <evan@rusackas.com >
2026-08-24 16:51:57 -07:00
Joe Li
ca3d7670b7
fix(ci): restore scheduled CI checks ( #43266 )
2026-08-24 12:31:50 -07:00
Joe Li and Claude
7dbf71a379
fix(query-object): reject malformed ad-hoc metrics ( #43353 )
...
Co-authored-by: Claude <noreply@anthropic.com >
2026-08-24 12:12:25 -07:00
Joe Li and Claude Sonnet 5
24b95f9ca7
fix(gsheets): correctly format Date-column filter literals ( #43355 )
...
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com >
2026-08-24 12:12:04 -07:00
Joe Li
31f06c0ee6
fix(dataset): correct Hours Offset filter bounds and grain-truncation order ( #43173 )
2026-08-24 11:47:16 -07:00
6ab21b381a
fix(mysql): resolve wire-protocol column types and mutate rows from immutable results ( #42821 )
...
Co-authored-by: Jean Massucatto <massucattoj@gmail.com >
Co-authored-by: Claude <noreply@anthropic.com >
2026-08-24 11:45:15 -07:00
c980b3a361
fix(mcp): tighten auth and request validation edge cases ( #43388 )
...
Co-authored-by: Superset Dev <dev@superset.apache.org >
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com >
2026-08-24 10:58:59 -07:00
Evan Rusackas
f3142e7b15
fix(tags): fix broken import in daos/tag.py ( #43466 )
2026-08-24 10:15:08 -07:00
3f10d8b1cc
fix(versioning): suppress automatic chart normalization changes ( #43350 )
...
Co-authored-by: Mike Bridge <michael.bridge@ext.preset.io >
Co-authored-by: Claude Fable 5 <noreply@anthropic.com >
2026-08-24 09:09:20 -07:00
7f1b41444c
fix: add missing access checks to semantic-layer and theme endpoints ( #43389 )
...
Co-authored-by: Superset Dev <dev@superset.apache.org >
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com >
2026-08-24 08:52:45 -07:00
8a32324184
fix: add missing ownership checks to tag, report-log, and dataset-schema endpoints ( #43390 )
...
Co-authored-by: Superset Dev <dev@superset.apache.org >
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com >
2026-08-24 08:44:22 -07:00
Elizabeth Thompson
9f505eb0cb
fix(examples): replace deprecated timeseries_limit_metric with series_limit_metric ( #43422 )
2026-08-22 15:02:20 -07:00
Joe Li and Claude Sonnet 5
f2610e9dca
fix(sqllab): default PostgreSQL port to 5432 in the dynamic connection form ( #43351 )
...
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com >
2026-08-21 15:59:33 -07:00
Aurimas Navardauskas
5812c0eab5
fix(mcp): fail closed when MCP_AUTH_FACTORY raises ( #43329 )
2026-08-21 15:43:51 -07:00
Mike Bridge and Claude Fable 5
5f3e34908c
fix(charts): surface blocking alerts/reports when archiving a chart ( #43402 )
...
Co-authored-by: Claude Fable 5 <noreply@anthropic.com >
2026-08-21 19:33:32 -03:00
Evan Rusackas and Superset Dev
9781254363
fix(export): escape formula-triggering values consistently and bound post-processing inputs ( #43396 )
...
Co-authored-by: Superset Dev <dev@superset.apache.org >
2026-08-21 12:37:33 -07:00
65893113fe
fix(import): tighten ownership and validation checks across asset importers ( #43393 )
...
Co-authored-by: Superset Dev <dev@superset.apache.org >
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com >
2026-08-21 12:35:33 -07:00
04017f3956
fix(sqllab): re-validate access against rendered SQL and tighten cache/permalink scoping ( #43394 )
...
Co-authored-by: Superset Dev <dev@superset.apache.org >
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com >
2026-08-21 12:35:06 -07:00
2b6044b624
fix: tighten SSRF validation, executor resolution, and cache scoping across reports/thumbnails ( #43395 )
...
Co-authored-by: Superset Dev <dev@superset.apache.org >
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com >
2026-08-21 12:34:37 -07:00
Alexandru Soare
a05a099987
fix(embedded): block custom SQL injection in guest user chart payloads ( #43111 )
2026-08-21 17:05:40 +03:00
Evan Rusackas and Claude Code
05842a6350
feat(metrics): add MEDIAN/STDDEV_SAMP/VAR_SAMP as system-wide aggregates ( #42895 )
...
Co-authored-by: Claude Code <noreply@anthropic.com >
2026-08-21 04:15:17 -07:00
