QT/superset2
1
0
Fork 0
mirror of https://github.com/apache/superset.git synced 2026-07-27 09:02:29 +00:00
Code Issues Packages Projects Releases Wiki Activity
18,582 Commits 561 Branches 561 Tags
f94de107b4ef19ee2b77173350d1d11d11a00244
Commit Graph

981 Commits

Author SHA1 Message Date
Daniel Vaz Gaspar
f6f60266fb chore(deps): bump yaml from 1.10.2 to 1.10.3 in /superset-frontend (#697) 
Fixes Uncontrolled Recursion vulnerability in yaml 1.x.
Updates 3 nested entries (storybook, babel-plugin-macros, superset-ui-demo).

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-29 09:12:55 -07:00
Daniel Vaz Gaspar
aff4204c05 chore(deps): bump prismjs from 1.29.0 to 1.30.0 in /superset-frontend (#698) 
Fixes Arbitrary Code Injection vulnerability in prismjs.

Note: refractor 3.6.0 pins prismjs ~1.27.0 — that nested entry requires
a refractor upgrade to fix (addressed separately).

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-29 09:12:55 -07:00
Daniel Vaz Gaspar
bbfbc92590 chore(deps): bump mdast-util-to-hast from 13.2.0 to 13.2.1 in /superset-frontend (#694) 
Fixes Improperly Controlled Modification of Object Attributes vulnerability.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-29 09:12:55 -07:00
Daniel Vaz Gaspar
4026e52d27 chore(deps): bump jws from 4.0.0 to 4.0.1 in /superset-frontend (#695) 
Fixes Improper Verification of Cryptographic Signature vulnerability.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-29 09:12:55 -07:00
Daniel Vaz Gaspar
2cb1ad79d7 chore(deps): bump ajv from 6.12.6 to 6.14.0 and 8.17.1 to 8.18.0 in /superset-frontend (#693) 
Fixes ReDoS vulnerability (CVE) in ajv 8.17.1. Also bumps nested ajv 6.x
entries to 6.14.0 to match upstream.

Upstream: 577b965a60

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-29 09:12:55 -07:00
Daniel Vaz Gaspar
eff77319e9 chore(deps-dev): bump copy-webpack-plugin to 14.0.0 and css-minimizer-webpack-plugin to 8.0.0 (#690) 
Bumps copy-webpack-plugin 13.0.0→14.0.0 and css-minimizer-webpack-plugin
7.0.2→8.0.0 to resolve serialize-javascript 6.0.2→7.0.5 (CVE-2026-34043,
BDSA-2020-4569 CVSS 8.1, tagged Zero-click RCE).

Note: webpack's bundled terser-webpack-plugin still pulls serialize-javascript
6.0.2 as a transitive dep — requires webpack upgrade to fully resolve.

Cherry-picked from upstream apache/superset commits 361afff798, a2c23a2a58.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-29 09:12:55 -07:00
Daniel Vaz Gaspar
2f2418258a chore(deps): bump js-yaml from 3.14.1 to 3.14.2 and 4.1.0 to 4.1.1 in /superset-frontend (#687) 
Bumps root js-yaml 3.14.1→3.14.2 and nested js-yaml 4.1.0→4.1.1
to address prototype pollution vulnerability (CVE-2025-64718, CVSS 9.8).
Lerna's exact-pinned 4.1.0 entries are left as-is since they require
that exact version.

Cherry-picked from upstream apache/superset commit 362b5e3b89.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-29 09:12:55 -07:00
Daniel Vaz Gaspar
40724b2e2d chore(deps): bump lodash-es from 4.17.23 to 4.18.1 in /superset-frontend (#686) 
Bumps lodash-es to ^4.18.1 in generator-superset to address prototype
pollution and arbitrary code injection vulnerabilities.

Cherry-picked from upstream apache/superset commit a9ced5c881.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-29 09:12:55 -07:00
Daniel Vaz Gaspar
806ee595df chore(deps): bump dompurify from 3.3.3 to 3.4.0 in /superset-frontend (#685) 
Bumps dompurify to ^3.4.0 in superset-ui-core and legacy-preset-chart-nvd3
to address 3 known vulnerabilities (CVEs). Removes stale nested lock entries
so both workspace packages resolve to the hoisted 3.4.0.

Cherry-picked from upstream apache/superset commit 03725d1aaa.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-29 09:12:55 -07:00
dependabot[bot]
e85830bfea chore(deps): bump markdown-to-jsx from 9.7.13 to 9.7.15 in /superset-frontend (#39217) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 0d91f5e982)
 2026-04-20 14:49:20 -07:00
dependabot[bot]
c7aa7946c0 chore(deps): bump markdown-to-jsx from 9.7.6 to 9.7.8 in /superset-frontend (#38507) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 5f99d613a0)
 2026-04-20 14:49:20 -07:00
dependabot[bot]
08adb0bcdc chore(deps): bump markdown-to-jsx from 9.7.4 to 9.7.6 in /superset-frontend (#38225) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 4809903bb8)
 2026-04-20 14:49:20 -07:00
dependabot[bot]
e7940d2df9 chore(deps): bump markdown-to-jsx from 9.7.3 to 9.7.4 in /superset-frontend (#37959) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit ffd7f10320)
 2026-04-20 14:49:20 -07:00
dependabot[bot]
3f929c643c chore(deps): bump markdown-to-jsx from 9.7.2 to 9.7.3 in /superset-frontend (#37730) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 1c35c3f6d0)
 2026-04-20 14:49:20 -07:00
dependabot[bot]
c59576b288 chore(deps): bump markdown-to-jsx from 9.6.1 to 9.7.2 in /superset-frontend (#37691) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 27889651b3)
 2026-04-20 14:49:20 -07:00
dependabot[bot]
0171080b2a chore(deps): bump markdown-to-jsx from 9.6.0 to 9.6.1 in /superset-frontend (#37420) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 09b5af5945)
 2026-04-20 14:49:20 -07:00
dependabot[bot]
0df13f512a chore(deps): bump lodash from 4.17.23 to 4.18.1 in /superset-frontend (#39043) 
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: hainenber <dotronghai96@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: hainenber <dotronghai96@gmail.com>
(cherry picked from commit c372f5980c)
 2026-04-20 14:49:20 -07:00
dependabot[bot]
61e8aeb2d8 chore(deps): bump dompurify from 3.3.2 to 3.3.3 in /superset-frontend (#38592) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Đỗ Trọng Hải <41283691+hainenber@users.noreply.github.com>
(cherry picked from commit f4a57a13bc)
 2026-04-20 14:49:20 -07:00
dependabot[bot]
212da53fa4 chore(deps): bump dompurify from 3.3.1 to 3.3.2 in /superset-frontend (#38455) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Evan Rusackas <evan@preset.io>
(cherry picked from commit d752be5f74)
 2026-04-20 14:49:20 -07:00
Kamil Gabryjelski
d8d7e674c2 feat: Dataset folders editor (#36239) 
(cherry picked from commit a6a66ca483)
(cherry picked from commit 3cb90d7cc093d03403598397e6aadd69be47e9b0)
 2026-02-28 23:33:54 -08:00
dependabot[bot]
b100abb338 chore(deps): bump react-error-boundary from 6.0.0 to 6.1.0 in /superset-frontend (#37206) 
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: hainenber <dotronghai96@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: hainenber <dotronghai96@gmail.com>
(cherry picked from commit 6453980d8d)
 2026-02-17 23:43:59 -08:00
dependabot[bot]
4f7fca981d chore(deps): bump markdown-to-jsx from 7.7.4 to 9.6.0 in /superset-frontend (#37354) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 7c69ec7f24)
 2026-02-17 23:16:08 -08:00
dependabot[bot]
8b5a649d66 chore(deps): bump min-document from 2.19.0 to 2.19.1 in /superset-frontend (#36046) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit e915d7d1d0)
 2026-02-17 23:11:28 -08:00
dependabot[bot]
92a6c6fb7c chore(deps): bump brace-expansion in /superset-frontend (#34744) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 691926f0e1)
 2026-02-17 23:07:44 -08:00
dependabot[bot]
079ffaedd4 chore(deps): bump qs from 6.14.1 to 6.14.2 in /superset-frontend (#37936) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 5300f65a74)
 2026-02-17 23:04:03 -08:00
dependabot[bot]
698059b524 chore(deps): update dompurify requirement from ^3.3.0 to ^3.3.1 in /superset-frontend/plugins/legacy-preset-chart-nvd3 (#36471) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Evan Rusackas <evan@rusackas.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
(cherry picked from commit 955953b467)
 2026-02-17 23:04:03 -08:00
dependabot[bot]
f3a4870b76 chore(deps): update dompurify requirement from ^3.2.4 to ^3.3.1 in /superset-frontend/packages/superset-ui-core (#36513) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Evan Rusackas <evan@rusackas.com>
(cherry picked from commit 46e21c3003)
 2026-02-17 23:04:03 -08:00
dependabot[bot]
0b61bf224e chore(deps): bump lodash-es from 4.17.22 to 4.17.23 in /superset-frontend (#37347) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit b576665f9a)
 2026-02-17 23:04:03 -08:00
dependabot[bot]
17c7b27891 chore(deps): bump lodash from 4.17.21 to 4.17.23 in /superset-frontend (#37348) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 3a811d680d)
 2026-02-17 23:04:03 -08:00
Nancy Chauhan
60e6fa2672 fix(security): update jspdf to 4.0.0 to address CVE-2025-68428 (#37553) 
(cherry picked from commit 8fd3401077)
 2026-02-17 23:04:03 -08:00
Đỗ Trọng Hải
eef2d9781c feat(deps): significant npm audit fix to trim off inadvertently runtime dep from upstream libraries (#37220) 
Signed-off-by: hainenber <dotronghai96@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
(cherry picked from commit a1d65c7529)
 2026-02-17 23:04:03 -08:00
dependabot[bot]
d395f5b368 chore(deps): bump @deck.gl/layers from 9.1.13 to 9.2.2 in /superset-frontend (#35743) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Evan Rusackas <evan@rusackas.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
(cherry picked from commit f2e677c150)
 2026-01-26 12:40:53 -08:00
Gabriel Torres Ruiz
13b5b3f8d1 feat(theming): add per-theme custom font URL support (#36317) 2026-01-26 12:40:50 -08:00
Alexandru Soare
32eddb6b1f feat(Tabs): Rearange tabs when editing dashboard (#35156) 
(cherry picked from commit 71c015c579)
 2026-01-26 12:40:48 -08:00
Enzo Martellucci
c41b061063 fix(ui): bump AntD to 5.26.0 to fix Splitter drag menu issue (#35782) 
(cherry picked from commit 84a1abd357)
 2026-01-26 12:40:46 -08:00
Kamil Gabryjelski
163573e8c9 fix: Broken splitter in sql lab and some minor visual fixes (#35416) 
(cherry picked from commit 88e5581d04)
 2026-01-26 12:40:44 -08:00
Mehmet Salih Yavuz
9ef9b9b827 chore(effect): add eslint plugin to reduce rerenders (#35223) 
(cherry picked from commit 5fbda3af40)
 2026-01-26 12:40:44 -08:00
Kamil Gabryjelski
dbf99d99f9 chore: Bump ag grid to 34.2.0 (#35193) 
(cherry picked from commit a889ae75fc)
 2026-01-26 12:40:43 -08:00
Joe Li
8469bf3dc8 feat(playwright): Add Playwright CI Integration for Cypress Migration (SIP-178) (#35110) 
Co-authored-by: Claude <noreply@anthropic.com>
(cherry picked from commit 1187902e68)
 2026-01-26 12:40:43 -08:00
Richard Fogaca Nienkotter
5663fb7fa9 feat(custom-tooltip): custom tooltip on deck.gl charts (#34276) 
(cherry picked from commit a66737cb05)
 2026-01-26 12:40:43 -08:00
Vitor Avila
3ebd40559c feat: Use dashboard name for screenshot download (#34988) 
(cherry picked from commit ce74ae095d)
 2026-01-26 12:40:41 -08:00
Maxime Beauchemin
c37a91b5cb feat(matrixify): implement matrix of any charts as core Superset feature (#34526) 
Co-authored-by: Claude <noreply@anthropic.com>
(cherry picked from commit e6c8343fd0)
 2026-01-26 12:40:40 -08:00
Rafael Benitez
1dd37ed8c8 fix: pin remark-gfm to v3.0.1 for compatibility with react-markdown v8 (#36388) 
Co-authored-by: Claude <noreply@anthropic.com>
(cherry picked from commit daec330127)
 2026-01-26 12:40:29 -08:00
Rafael Benitez
0773e25383 fix: pin remark-gfm to v3.0.1 for compatibility with react-markdown v8 (#36388) 
Co-authored-by: Claude <noreply@anthropic.com>
(cherry picked from commit daec330127)
 2026-01-21 13:58:59 -08:00
Elizabeth Thompson
ad7acecbf2 fix: Remove emotion-rgba from dependencies and codebase (#35124) 
(cherry picked from commit 19ddcb7e5c)
 2025-09-15 12:00:14 -07:00
Gabriel Torres Ruiz
a423f8ecda fix(ListView): implement AntD pagination for ListView component (#35057) 
(cherry picked from commit 36daa2dc3f)
 2025-09-12 18:56:26 -07:00
amaannawab923
e10b6e8ae9 fix(webpack): Bump webpack dev-server to handle Errors on Firefox where error object is not defined (#34791) 
(cherry picked from commit 277f03c207)
 2025-08-21 09:42:35 -07:00
Maxime Beauchemin
fbcdf6909c feat: replace react-color with AntD ColorPicker for theming support (#34712) 
Co-authored-by: Claude <noreply@anthropic.com>
 2025-08-15 11:05:30 -07:00
Maxime Beauchemin
d79fc92a1a fix(theming): Fix ag-grid theming regression in SQL Lab (#34675) 
Co-authored-by: Claude <noreply@anthropic.com>
 2025-08-13 16:21:47 -07:00
dependabot[bot]
1f80725b0e chore(deps-dev): bump eslint-import-resolver-typescript from 3.7.0 to 4.4.4 in /superset-frontend (#34460) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-08-12 09:04:04 -07:00