Merge branch 'master' into fix/export-api-returns-stale-resources

fix(backend): export API no longer returns stale resources
Signed-off-by: hainenber <dotronghai96@gmail.com>
2026-08-16 04:51:19 +00:00 · 2026-07-18 13:10:46 +07:00 · 2026-07-02 22:19:12 +07:00
4626 changed files with 96180 additions and 297363 deletions
@@ -79,7 +79,6 @@ github:
          - lint-check
          - cypress-matrix-required
          - dependency-review
-          - enforce-single-migration-head
          - frontend-build
          - playwright-tests-required
          - pre-commit (current)
@@ -105,9 +105,9 @@ Charts built from enriched datasets containing:
 pre-commit install

 # Quick validation (faster than --all-files)
-pre-commit run                   # Staged files only
+pre-commit run                    # Staged files only
 pre-commit run mypy              # Python type checking
-pre-commit run format            # Code formatting
+pre-commit run prettier          # Code formatting
 pre-commit run eslint            # Frontend linting
 ```

@@ -32,6 +32,7 @@
        "ms-python.vscode-pylance",
        "charliermarsh.ruff",
        "dbaeumer.vscode-eslint",
+        "esbenp.prettier-vscode"
      ]
    }
  }
@@ -59,6 +59,7 @@
        "ms-python.vscode-pylance",
        "charliermarsh.ruff",
        "dbaeumer.vscode-eslint",
+        "esbenp.prettier-vscode"
      ]
    }
  }
@@ -1,3 +1,22 @@
+# Notify all committers of DB migration changes, per SIP-59
+
+/superset/migrations/ @mistercrunch @michael-s-molina @betodealmeida @eschutho @sadpandajoe
+
+# Notify some committers of changes in the components
+
+/superset-frontend/src/components/Select/ @michael-s-molina @geido @kgabryje
+/superset-frontend/src/components/MetadataBar/ @michael-s-molina @geido @kgabryje
+/superset-frontend/src/components/DropdownContainer/ @michael-s-molina @geido @kgabryje
+
+# Notify Helm Chart maintainers about changes in it
+
+/helm/superset/ @dpgaspar @villebro @nytai @michael-s-molina @mistercrunch @rusackas @Antonio-RiveroMartnez @hainenber
+
+# Notify E2E test maintainers of changes
+
+/superset-frontend/playwright/ @sadpandajoe @geido @eschutho @rusackas @mistercrunch
+/superset-frontend/cypress-base/ @sadpandajoe @geido @eschutho @rusackas @mistercrunch
+
 # Notify PMC members of changes to GitHub Actions

 /.github/ @villebro @geido @eschutho @rusackas @betodealmeida @nytai @mistercrunch @kgabryje @sha174n @dpgaspar @sadpandajoe @hainenber
@@ -11,19 +30,23 @@

 /.asf.yaml @villebro @geido @eschutho @rusackas @betodealmeida @nytai @mistercrunch @kgabryje @dpgaspar @sha174n @Antonio-RiveroMartnez

-# Maps are fragile and political. GeoJson edits MUST be made in the Jupyter notebook or they'll be overwritten.
+# Maps are a finicky contribution process we care about

 **/*.geojson @villebro @rusackas
 **/*.ipynb @villebro @rusackas
-/superset-frontend/plugins/plugin-chart-country-map/ @villebro @rusackas
+/superset-frontend/plugins/legacy-plugin-chart-country-map/ @villebro @rusackas
+
+# Notify translation maintainers of changes to translations
+
+/superset/translations/ @sfirke @rusackas @villebro @sadpandajoe @hainenber

 # Notify PMC members of changes to extension-related files

-/docs/developer_docs/extensions/ @michael-s-molina @villebro @rusackas
-/superset-extensions-cli/ @michael-s-molina @villebro @rusackas @sadpandajoe
-/superset/extensions/ @michael-s-molina @villebro @rusackas @sadpandajoe
-/superset-frontend/src/extensions/ @michael-s-molina @villebro @rusackas @sadpandajoe
-
-# Notify PMC members of config changes e.g. feature flags
-
-/superset/config.py @michael-s-molina @villebro @rusackas @sadpandajoe
+/docs/developer_portal/extensions/ @michael-s-molina @villebro @rusackas
+/superset-core/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje
+/superset-extensions-cli/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje
+/superset/core/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje
+/superset/extensions/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje
+/superset-frontend/src/packages/superset-core/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje
+/superset-frontend/src/core/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje
+/superset-frontend/src/extensions/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje
@@ -50,8 +50,9 @@ body:
    attributes:
      label: Python version
      options:
+        - "3.9"
+        - "3.10"
        - "3.11"
-        - "3.12"
        - Not applicable
        - I don't know
    validations:
@@ -5,6 +5,10 @@ inputs:
    description: 'Python version to set up. Accepts a version number, "current", or "next".'
    required: true
    default: 'current'
+  cache:
+    description: 'Cache dependencies. Options: pip'
+    required: false
+    default: 'pip'
  requirements-type:
    description: 'Type of requirements to install. Options: base, development, default'
    required: false
@@ -39,31 +43,17 @@ runs:
      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
      with:
        python-version: ${{ steps.set-python-version.outputs.python-version }}
-    - name: Install uv
-      if: inputs.install-superset == 'true'
-      uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
-      with:
-        python-version: ${{ steps.set-python-version.outputs.python-version }}
-        enable-cache: true
-    - name: Update apt package lists
-      # cache-apt-pkgs-action assumes a fresh `apt-cache` index (true on GitHub-hosted
-      # runners, not on all self-hosted/custom runner images), so refresh it explicitly
-      # or package lookups silently resolve to an empty list.
-      if: inputs.install-superset == 'true'
-      shell: bash
-      run: sudo apt-get update
-    - name: Install apt packages
-      if: inputs.install-superset == 'true'
-      uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
-      with:
-        packages: libldap2-dev libsasl2-dev
-        version: 1.0
+        cache: ${{ inputs.cache }}
    - name: Install dependencies
      env:
        INPUT_INSTALL_SUPERSET: ${{ inputs.install-superset }}
        INPUT_REQUIREMENTS_TYPE: ${{ inputs.requirements-type }}
      run: |
        if [ "$INPUT_INSTALL_SUPERSET" = "true" ]; then
+          sudo apt-get update && sudo apt-get -y install libldap2-dev libsasl2-dev
+
+          pip install --upgrade pip setuptools wheel uv
+
          if [ "$INPUT_REQUIREMENTS_TYPE" = "dev" ]; then
            uv pip install --system -r requirements/development.txt
          elif [ "$INPUT_REQUIREMENTS_TYPE" = "base" ]; then
@@ -28,11 +28,6 @@ updates:
      # See https://github.com/apache/superset/pull/37384#issuecomment-3793991389
      # TODO: remove the plugin once Lodash usage has been migrated to a more readily tree-shakeable alternative
      - dependency-name: "@swc/plugin-transform-imports"
-      # deck.gl and luma.gl share strict peer constraints across the root and
-      # plugin workspaces, and root overrides pin their transitive versions.
-      # Upgrade both families together in a manually validated change.
-      - dependency-name: "@deck.gl/*"
-      - dependency-name: "@luma.gl/*"
      # `just-handlerbars-helpers` library in plugin-chart-handlebars requires `currencyformatter`` to be < 2
      - dependency-name: "currencyformatter.js"
        update-types: ["version-update:semver-major"]
@@ -47,13 +42,6 @@ updates:
      # as a single manual upgrade anyway. TODO: remove when Babel 8 support is viable.
      - dependency-name: "@babel/*"
        update-types: ["version-update:semver-major"]
-      # v2.0.0 renamed ZSTDDecompress to decompress and made it async, breaking
-      # the webpack dev proxy (see #38662, #39138, #39139). Dependabot reopened
-      # the same bump in #39369 after the first revert, so pin it here instead
-      # of relying on a package.json comment (package.json is JSON and can't
-      # hold comments). Remove this once the proxy code is updated to await
-      # the async decompress() API.
-      - dependency-name: "simple-zstd"
    directory: "/superset-frontend/"
    schedule:
      interval: "daily"
@@ -71,15 +59,12 @@ updates:
      babel:
        patterns:
          - "@babel/*"
-      storybook:
+      deckgl:
        patterns:
-          - "@storybook/*"
-          - "storybook"
-          - "eslint-plugin-storybook"
-      ag-grid:
+          - "@deck.gl/*"
+      lumagl:
        patterns:
-          - "ag-grid-react"
-          - "ag-grid-community"
+          - "@luma.gl/*"
    open-pull-requests-limit: 30
    versioning-strategy: increase
    cooldown:
@@ -114,22 +99,6 @@ updates:
    directory: "/docs/"
    schedule:
      interval: "daily"
-    groups:
-      storybook:
-        patterns:
-          - "@storybook/*"
-          - "storybook"
-      docusaurus:
-        patterns:
-          - "@docusaurus/*"
-      docusaurus-openapi:
-        patterns:
-          - "docusaurus-plugin-openapi-docs"
-          - "docusaurus-theme-openapi-docs"
-      typescript-eslint:
-        patterns:
-          - "@typescript-eslint/*"
-          - "typescript-eslint"
    open-pull-requests-limit: 10
    versioning-strategy: increase
    cooldown:
@@ -201,23 +201,18 @@ cypress-run-all() {
  # navigation flow under E2E. We diverge from the entrypoint on:
  #   --timeout 120: heavy dashboard import/export specs exceed the 60s
  #     default
+  #   --max-requests / --max-requests-jitter: recycle the worker under
+  #     test load to avoid leaks accumulating across the run
  #   superset.app:create_app(): explicit factory so we don't depend on
  #     FLASK_APP being exported
-  #
-  # No --max-requests, matching the entrypoint's default of 0 (recycling
-  # off). With a single worker a recycle takes the whole backend offline for
-  # the graceful-timeout drain — browser keep-alive connections hold it open
-  # for the full 30s — plus ~5s of app boot. A run issues ~3800 requests in
-  # ~8 minutes, so recycling every 500 produced seven ~35s outages per run
-  # and flaked whichever specs happened to navigate into one. Lowering
-  # --graceful-timeout is not enough: a dashboard load plus chart render
-  # needs 6-10s, which still lands inside the window.
  nohup gunicorn \
    --bind "127.0.0.1:$port" \
    --workers 1 \
    --worker-class gthread \
    --threads 20 \
    --timeout 120 \
+    --max-requests 500 \
+    --max-requests-jitter 50 \
    --access-logfile - \
    --error-logfile - \
    "superset.app:create_app()" \
@@ -261,7 +256,7 @@ cypress-run-all() {
  # UNCOMMENT the next few commands to monitor memory usage
  # monitor_memory &  # Start memory monitoring in the background
  # memoryMonitorPid=$!
-  python ../../scripts/cypress_run.py --retries 5 $USE_DASHBOARD_FLAG
+  python ../../scripts/cypress_run.py --parallelism $PARALLELISM --parallelism-id $PARALLEL_ID --group $PARALLEL_ID --retries 5 $USE_DASHBOARD_FLAG
  # kill $memoryMonitorPid
 }

@@ -299,14 +294,16 @@ playwright-run() {
  export PLAYWRIGHT_BASE_URL

  # See cypress-run-all() above for the args rationale (1 worker × 20
-  # gthread threads matching docker/entrypoints/run-server.sh, a 120s
-  # timeout for heavy E2E load, and why worker recycling is off).
+  # gthread threads matching docker/entrypoints/run-server.sh, plus a
+  # 120s timeout and request-recycling for heavy E2E load).
  nohup gunicorn \
    --bind "127.0.0.1:$port" \
    --workers 1 \
    --worker-class gthread \
    --threads 20 \
    --timeout 120 \
+    --max-requests 500 \
+    --max-requests-jitter 50 \
    --access-logfile - \
    --error-logfile - \
    "superset.app:create_app()" \
@@ -23,7 +23,7 @@ on:

 jobs:
  bump-python-package:
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
    permissions:
      actions: write
      contents: write
@@ -31,7 +31,7 @@ jobs:
      checks: write
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: true
          ref: master
@@ -40,15 +40,12 @@ jobs:
        uses: ./.github/actions/setup-supersetbot/

      - name: Set up Python ${{ inputs.python-version }}
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
-          python-version: "3.11"
+          python-version: "3.10"

      - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
-        with:
-          python-version: "3.11"
-          enable-cache: true
+        run: pip install uv

      - name: supersetbot bump-python -p "${{ github.event.inputs.package }}"
        env:
@@ -11,7 +11,6 @@ on:
 permissions:
  contents: read
  pull-requests: read
-  actions: read

 # cancel previous workflow jobs for PRs
 concurrency:
@@ -20,14 +19,10 @@ concurrency:

 jobs:
  check-python-deps:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-22.04
    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
-        with:
-          expand-composite-actions: true
-
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          submodules: recursive
@@ -51,7 +46,7 @@ jobs:
      - name: Login to Docker Hub
        if: steps.check.outputs.python
        continue-on-error: true
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          username: ${{ secrets.DOCKERHUB_USER }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -19,13 +19,13 @@ concurrency:
 jobs:
  check_db_migration_conflict:
    name: Check DB migration conflict
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Check and notify
@@ -16,7 +16,7 @@ concurrency:

 jobs:
  changes:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
@@ -26,7 +26,7 @@ jobs:
      frontend: ${{ steps.check.outputs.frontend }}
    steps:
      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Check for file changes
@@ -42,7 +42,7 @@ jobs:
    # analysis runners don't spin up. push/schedule runs always proceed:
    # the change-detector returns "all changed" for non-PR events.
    if: needs.changes.outputs.python == 'true' || needs.changes.outputs.frontend == 'true'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      actions: read
@@ -58,13 +58,13 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
        with:
          languages: ${{ matrix.language }}
          # If you wish to specify custom queries, you can do so here or in a config file.
@@ -75,6 +75,6 @@ jobs:
          # queries: security-extended,security-and-quality

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
        with:
          category: "/language:${{matrix.language}}"
@@ -1,63 +0,0 @@
-name: Auto-approve Dependabot patch bumps
-
-# Posts an approving review on Dependabot PRs that only bump a patch
-# version, using the same trigger/guard convention already proven to work
-# for Dependabot PRs in sync-requirements-for-python-dep-upgrade-pr.yml
-# (plain `pull_request` gets a working, write-capable GITHUB_TOKEN here
-# because Dependabot pushes branches directly to this repo, not a fork).
-#
-# This does NOT auto-merge anything - repo-wide auto-merge is disabled
-# (Settings > General > Pull Requests > "Allow auto-merge" is off), and
-# flipping that is a separate, repo-wide decision this workflow doesn't
-# make on its own. Branch protection also still requires 1 approving
-# review; this just means that review can already exist by the time a
-# human looks at the PR, for the (large majority of) ecosystems whose
-# files aren't matched by any CODEOWNERS pattern. One ecosystem - the npm
-# bump under .github/actions - matches the /.github/ CODEOWNERS entry, so
-# those PRs will still need a human owner's approval regardless of this
-# workflow; it posts a review there too, but that alone won't satisfy the
-# code-owner requirement.
-on:
-  pull_request:
-    types: [opened, synchronize]
-
-# Cancel a superseded run if Dependabot pushes to the same PR again before
-# the previous run finished (matches the pattern used elsewhere in
-# superset-docs-verify.yml).
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  approve-patch-bump:
-    name: Approve patch-level bump
-    # Mirrors the guard in sync-requirements-for-python-dep-upgrade-pr.yml:
-    # limited to (1) PRs authored by Dependabot and (2) the upstream repo,
-    # since forked PRs don't get a write-capable token here anyway.
-    if: >
-      github.repository == 'apache/superset' &&
-      github.event.pull_request.user.login == 'dependabot[bot]' &&
-      github.event.pull_request.head.repo.fork == false
-    runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write # to post the approving review via `gh pr review`
-    steps:
-      - name: Fetch Dependabot metadata
-        id: metadata
-        # This exact SHA is on ASF Infra's action allowlist
-        # (apache/infrastructure-actions approved_patterns.yml) as of this
-        # writing. Do not bump without opening an Infra ticket to allow
-        # the new SHA first!
-        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
-
-      - name: Approve patch-level bump
-        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_URL: ${{ github.event.pull_request.html_url }}
-          DEPENDENCY_NAMES: ${{ steps.metadata.outputs.dependency-names }}
-        run: |
-          gh pr review --approve "$PR_URL" \
-            --body "Auto-approved: patch-level bump only ($DEPENDENCY_NAMES)."
@@ -20,19 +20,19 @@ concurrency:

 permissions:
  contents: read
-  actions: read

 jobs:
  dependency-review:
    if: github.event_name == 'pull_request'
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
    steps:
      - name: "Checkout Repository"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: "Dependency Review"
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        continue-on-error: true
        with:
          fail-on-severity: critical
          # compatible/incompatible licenses addressed here: https://www.apache.org/legal/resolved.html
@@ -48,14 +48,10 @@ jobs:
  python-dependency-liccheck:
    # NOTE: Configuration for liccheck lives in our pyproject.yml.
    # You cannot use a liccheck.ini file in this workflow.
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-22.04
    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
-        with:
-          expand-composite-actions: true
-
      - name: "Checkout Repository"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

@@ -19,7 +19,7 @@ concurrency:

 jobs:
  changes:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
@@ -30,7 +30,7 @@ jobs:
      docker: ${{ steps.check.outputs.docker }}
    steps:
      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Check for file changes
@@ -40,64 +40,17 @@ jobs:
          token: ${{ secrets.GITHUB_TOKEN }}

  setup_matrix:
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
    timeout-minutes: 5
    outputs:
      matrix_config: ${{ steps.set_matrix.outputs.matrix_config }}
    steps:
      - id: set_matrix
        run: |
-          MATRIX_CONFIG=$(if [ "${{ github.event_name }}" == "pull_request" ]; then echo '["dev", "lean"]'; else echo '["dev", "lean", "websocket", "dockerize", "py311", "py312"]'; fi)
+          MATRIX_CONFIG=$(if [ "${{ github.event_name }}" == "pull_request" ]; then echo '["dev", "lean"]'; else echo '["dev", "lean", "py310", "websocket", "dockerize", "py311", "py312"]'; fi)
          echo "matrix_config=${MATRIX_CONFIG}" >> $GITHUB_OUTPUT
          echo $GITHUB_OUTPUT

-  # Runs unconditionally (no dependency on `changes`, and no build-preset
-  # matrix restriction) so a regression in the PY_VER override logic is
-  # always caught on PRs. Without this, the real docker-build job only runs
-  # when the change detector flags docker/python/frontend changes (a
-  # workflow-only edit like this one does not), and even then the PR build
-  # matrix never includes the "py311"/"py312" presets that logic protects -
-  # so a break here would otherwise first surface on a push to master.
-  pyver-override-check:
-    name: verify docker build PY_VER override
-    runs-on: ubuntu-26.04
-    timeout-minutes: 5
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Setup supersetbot
-        uses: ./.github/actions/setup-supersetbot/
-      - name: Assert PY_VER override applies to every preset except py311/py312
-        shell: bash
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          # Asserts against the actual buildx command line `supersetbot docker
-          # --dry-run` would run, not just this repo's own extra-flags helper,
-          # so a regression in supersetbot itself (dropping the py311/py312
-          # PY_VER pin, or reordering args so our override no longer lands
-          # last) is caught here too, instead of only surfacing on master.
-          assert_effective_py_ver() {
-            local preset="$1" expected="$2" extra_flags command actual
-            extra_flags="$(scripts/docker-build-extra-flags.sh "$preset" dummy-tag)"
-            command="$(supersetbot docker --preset "$preset" --platform linux/amd64 --extra-flags "$extra_flags" --dry-run)"
-            # docker buildx keeps the LAST value of a repeated --build-arg key.
-            actual="$(grep -oE -- '--build-arg PY_VER=[^[:space:]]+' <<<"$command" | tail -1)"
-            if [ "$actual" != "--build-arg PY_VER=$expected" ]; then
-              echo "::error::preset '$preset' expected effective --build-arg PY_VER=$expected, got: ${actual:-<none>} (full command: $command)"
-              exit 1
-            fi
-          }
-          for preset in dev lean websocket dockerize; do
-            assert_effective_py_ver "$preset" "3.11.14-slim-trixie"
-          done
-          assert_effective_py_ver py311 "3.11-slim-bookworm"
-          assert_effective_py_ver py312 "3.12-slim-bookworm"
-          echo "PY_VER override logic verified against the assembled buildx command for all build presets"
-
  docker-build:
    name: docker-build
    needs: [setup_matrix, changes]
@@ -105,7 +58,7 @@ jobs:
      needs.changes.outputs.python == 'true' ||
      needs.changes.outputs.frontend == 'true' ||
      needs.changes.outputs.docker == 'true'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 60
    strategy:
      matrix:
@@ -118,7 +71,7 @@ jobs:

    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

@@ -170,22 +123,13 @@ jobs:
          # pull timeouts, 504/401 on push, ECONNRESET) that otherwise fail
          # the whole job. buildx reuses the buildkit layer cache from the
          # failed attempt, so a retry mostly re-does just the failed push.
-          #
-          # See scripts/docker-build-extra-flags.sh for why "py311"/"py312"
-          # are excluded from the PY_VER override applied to every other
-          # preset; that logic is also exercised on every PR by the
-          # always-on pyver-override-check job below, since this job itself
-          # only runs when the change detector flags docker/python/frontend
-          # changes and the PR build matrix never includes py311/py312.
-          EXTRA_FLAGS="$(scripts/docker-build-extra-flags.sh "$BUILD_PRESET" "$IMAGE_TAG")"
-
          for attempt in 1 2 3; do
            if supersetbot docker \
              $PUSH_OR_LOAD \
              --preset "$BUILD_PRESET" \
              --context "$EVENT" \
              --context-ref "$RELEASE" $FORCE_LATEST \
-              --extra-flags "$EXTRA_FLAGS" \
+              --extra-flags "--build-arg INCLUDE_CHROMIUM=false --tag $IMAGE_TAG" \
              $PLATFORM_ARG; then
              break
            fi
@@ -229,11 +173,11 @@ jobs:
    # goal is to check that building the latest image works, not required for all PR pushes
    needs: changes
    if: github.event_name == 'push' && github.ref == 'refs/heads/master' && needs.changes.outputs.docker == 'true'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Free up disk space
@@ -262,14 +206,3 @@ jobs:
        shell: bash
        run: |
          docker compose -f docker-compose-image-tag.yml up superset-init --exit-code-from superset-init
-
-  actions-timeline:
-    needs: [docker-build, docker-compose-image-tag]
-    if: always()
-    runs-on: ubuntu-26.04
-    permissions:
-      actions: read
-    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
-        with:
-          expand-composite-actions: true
@@ -15,7 +15,7 @@ jobs:
    # gate on. Restrict to the canonical repo: forks cannot mint a valid OIDC
    # token for this package and must not publish.
    if: github.repository == 'apache/superset'
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
    permissions:
      contents: read
      id-token: write # required for npm trusted publishing (OIDC)
@@ -23,7 +23,7 @@ jobs:
      run:
        working-directory: superset-embedded-sdk
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      # Note: registry-url is intentionally omitted. When set, actions/setup-node
@@ -31,7 +31,7 @@ jobs:
      # token, which makes npm attempt token auth and skip the OIDC
      # trusted-publishing exchange. With no .npmrc auth line, npm authenticates
      # via OIDC against the default registry (registry.npmjs.org).
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: "./superset-embedded-sdk/.nvmrc"
      - run: npm ci
@@ -16,15 +16,15 @@ concurrency:

 jobs:
  embedded-sdk-test:
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
    defaults:
      run:
        working-directory: superset-embedded-sdk
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: "./superset-embedded-sdk/.nvmrc"
          registry-url: "https://registry.npmjs.org"
@@ -1,82 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-name: Enforce single Alembic migration head
-on:
-  push:
-    branches:
-      - "master"
-      - "[0-9].[0-9]*"
-  pull_request:
-    types: [synchronize, opened, reopened, ready_for_review]
-
-# No `paths:` filter on purpose: this job is a required status check, and a
-# required check that never runs for a given PR blocks that PR from merging
-# forever. It has to fire on every PR so it always reports a status; whether
-# migrations changed is decided inside the job, not the trigger.
-
-# cancel previous workflow jobs for PRs
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  enforce-single-migration-head:
-    runs-on: ubuntu-26.04
-    permissions:
-      contents: read
-      pull-requests: read
-    steps:
-      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Check for migration file changes
-        id: check
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ github.token }}
-          script: |
-            if (context.eventName === 'push') {
-              core.setOutput('changed', 'true');
-              return;
-            }
-            const files = await github.paginate(github.rest.pulls.listFiles, {
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: context.issue.number,
-            });
-            const changed = files.some((f) => f.filename.startsWith('superset/migrations/'));
-            core.setOutput('changed', String(changed));
-      - name: Setup Python
-        if: steps.check.outputs.changed == 'true'
-        uses: ./.github/actions/setup-backend/
-        with:
-          requirements-type: base
-      - name: Assert a single Alembic head
-        if: steps.check.outputs.changed == 'true'
-        env:
-          SUPERSET__SQLALCHEMY_DATABASE_URI: "sqlite:///:memory:"
-        run: |
-          heads="$(superset db heads)"
-          echo "$heads"
-          head_count=$(printf '%s\n' "$heads" | grep -c .)
-          if [ "$head_count" -ne 1 ]; then
-            echo "::error::superset/migrations resolves to $head_count Alembic heads (expected exactly 1)."
-            echo "Another migration already landed with the same down_revision this branch was cut from."
-            echo "Add a no-op merge revision joining the heads: https://superset.apache.org/docs/contributing/development#merging-db-migrations"
-            exit 1
-          fi
@@ -1,135 +0,0 @@
-name: Frontend bundle size (nightly baseline + analyzer)
-
-# Refreshes the bundle-size baseline that superset-frontend.yml's `bundle-size`
-# job compares PRs against, and publishes a browsable bundle-analyzer treemap
-# report of the same build. Deliberately NOT triggered on every push to
-# master: a day-old baseline/report is fine for catching relative
-# regressions on PRs and for browsing what's actually in the bundle, and
-# building the production bundle on every one of the many pushes master
-# gets per day would burn CI time for no benefit a nightly refresh doesn't
-# already cover.
-on:
-  schedule:
-    - cron: "0 6 * * *"
-  workflow_dispatch: {}
-
-concurrency:
-  group: ${{ github.workflow }}
-  cancel-in-progress: true
-
-env:
-  TAG: apache/superset:bundle-size-nightly-${{ github.run_id }}
-
-permissions:
-  contents: read
-
-jobs:
-  refresh-baseline:
-    runs-on: ubuntu-26.04
-    timeout-minutes: 30
-    env:
-      NETLIFY_SITE_ID: ${{ secrets.NETLIFY_BUNDLE_ANALYZER_SITE_ID }}
-    steps:
-      - name: "Checkout master"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-          ref: master
-
-      - name: Build Docker Image
-        run: |
-          docker buildx build \
-            -t $TAG \
-            --cache-from=type=registry,ref=apache/superset-cache:3.11-slim-trixie \
-            --target superset-node-ci \
-            .
-
-      # Same cache the PR-time bundle-size job restores/writes -- webpack's
-      # persistent filesystem cache turns a warm production build into ~20s
-      # instead of several minutes. See superset-frontend.yml for the
-      # matching restore step and why it's keyed this way.
-      - name: Restore webpack build cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: superset-frontend/.temp_cache
-          key: >-
-            webpack-prod-cache-${{ hashFiles('superset-frontend/package-lock.json',
-            'superset-frontend/babel.config.js', 'superset-frontend/tsconfig.json',
-            'superset-frontend/webpack.config.js') }}
-
-      # Only ever pull the last recorded data point off the cache, keyed by
-      # run ID -- `restore-keys` prefix-matches the most recently created
-      # entry. Absent on the very first run ever; benchmark-action starts a
-      # fresh history in that case.
-      - name: Restore bundle size history
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: bundle-size-history.json
-          key: bundle-size-history-${{ github.run_id }}
-          restore-keys: |
-            bundle-size-history-
-
-      # BUNDLE_ANALYZER rides along in the same build as BUNDLE_SIZE_STATS --
-      # they're independent env-gated additions in webpack.config.js (one
-      # sets `config.stats`, the other pushes plugins), so one production
-      # build produces both the numeric stats.json and the analyzer's
-      # report.html. Only report.html is mounted out, not
-      # BUNDLE_ANALYZER's sibling `statistics.html` sunburst -- that file is
-      # documented in webpack.config.js as routinely exceeding 100MB for
-      # this app (it's .gitignore'd for exactly that reason), too large to
-      # publish as a static site page.
-      - name: Build production bundle with stats and analyzer report
-        run: |
-          mkdir -p ${{ github.workspace }}/superset-frontend/bundle-stats
-          mkdir -p ${{ github.workspace }}/superset-frontend/.temp_cache
-          mkdir -p ${{ github.workspace }}/superset/static/assets
-          docker run \
-          -v ${{ github.workspace }}/superset-frontend/bundle-stats:/app/superset-frontend/bundle-stats \
-          -v ${{ github.workspace }}/superset-frontend/.temp_cache:/app/superset-frontend/.temp_cache \
-          -v ${{ github.workspace }}/superset/static/assets:/app/superset/static/assets \
-          --rm $TAG \
-          bash -c \
-          "npm i && BUNDLE_SIZE_STATS=true BUNDLE_ANALYZER=true npm run build -- --json=bundle-stats/stats.json"
-
-      - name: Summarize bundle size
-        run: |
-          node superset-frontend/scripts/bundle-size-summary.js \
-            superset-frontend/bundle-stats/stats.json > bundle-size-summary.json
-          rm -rf superset-frontend/bundle-stats
-
-      # No PR to comment on here, so comment-on-alert is off -- the job
-      # summary (summary-always) is the only surface for this run.
-      - name: Update bundle size baseline
-        uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1
-        with:
-          tool: customSmallerIsBetter
-          output-file-path: bundle-size-summary.json
-          external-data-json-path: bundle-size-history.json
-          fail-on-alert: false
-          summary-always: true
-
-      - name: Save bundle size history
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: bundle-size-history.json
-          key: bundle-size-history-${{ github.run_id }}
-
-      # Publishes the treemap to Netlify (the same host already used for
-      # superset-storybook.netlify.app and docs previews, reusing the
-      # existing NETLIFY_AUTH_TOKEN). Skipped until
-      # NETLIFY_BUNDLE_ANALYZER_SITE_ID exists -- create a new (free)
-      # Netlify site named superset-bundle-analyzer and add its site ID as
-      # that secret to turn this on; nothing else in this workflow depends
-      # on it.
-      - name: Publish bundle analyzer report to Netlify
-        if: ${{ env.NETLIFY_SITE_ID != '' }}
-        env:
-          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
-        run: |
-          mkdir -p netlify-publish
-          cp superset/static/assets/report.html netlify-publish/index.html
-          # zizmor: ignore[adhoc-packages] - netlify-cli is a one-shot CI deploy
-          # tool, not an application dependency; a global/npx install has no
-          # lockfile context. Version pinned above the floor set by other
-          # ad-hoc installs in this repo (bump deliberately when upgrading).
-          npx --yes netlify-cli@27.0.1 deploy --prod --dir=netlify-publish
@@ -11,7 +11,7 @@ permissions:

 jobs:
  config:
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
    outputs:
      has-secrets: ${{ steps.check.outputs.has-secrets }}
    steps:
@@ -29,15 +29,15 @@ jobs:
    needs: config
    if: needs.config.outputs.has-secrets
    name: Generate Report
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          submodules: recursive
      - name: Setup Java
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
        with:
          distribution: "temurin"
          java-version: "11"
@@ -19,7 +19,7 @@ concurrency:

 jobs:
  validate-all-ghas:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    permissions:
      contents: read
      # Required for the zizmor action to upload its SARIF results to
@@ -27,12 +27,12 @@ jobs:
      security-events: write
    steps:
      - name: Checkout Repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "20"

@@ -45,8 +45,5 @@ jobs:
      - name: Run Script
        run: bash .github/workflows/github-action-validator.sh

-      - name: Test docs-deploy freshness gate
-        run: bash .github/workflows/scripts/check-docs-deploy-freshness.test.sh
-
      - name: Check for security issues on GHA workflows
-        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
@@ -1,115 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-name: Hold Label CI Gate
-
-on:
-  pull_request:
-    types: [labeled, unlabeled]
-
-permissions: {}
-
-jobs:
-  cancel-on-hold:
-    name: Cancel CI runs when hold label applied
-    if: github.event.action == 'labeled' && startsWith(github.event.label.name, 'hold')
-    runs-on: ubuntu-26.04
-    permissions:
-      actions: write
-      pull-requests: read
-    steps:
-      - name: Cancel in-progress workflow runs
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { owner, repo } = context.repo;
-            const sha = context.payload.pull_request.head.sha;
-
-            const { data: { workflow_runs: runs } } =
-              await github.rest.actions.listWorkflowRunsForRepo({
-                owner,
-                repo,
-                head_sha: sha,
-                per_page: 100,
-              });
-
-            const active = runs.filter(r =>
-              ['in_progress', 'queued', 'waiting', 'requested', 'pending'].includes(r.status)
-            );
-
-            core.info(`Found ${active.length} active run(s) to cancel for SHA ${sha}`);
-
-            for (const run of active) {
-              try {
-                await github.rest.actions.cancelWorkflowRun({
-                  owner,
-                  repo,
-                  run_id: run.id,
-                });
-                core.info(`Cancelled run ${run.id} (${run.name})`);
-              } catch (err) {
-                core.warning(`Could not cancel run ${run.id}: ${err.message}`);
-              }
-            }
-
-  rerun-on-unhold:
-    name: Re-run CI when hold label removed
-    if: github.event.action == 'unlabeled' && startsWith(github.event.label.name, 'hold')
-    runs-on: ubuntu-24.04
-    permissions:
-      actions: write
-      pull-requests: read
-    steps:
-      - name: Re-trigger cancelled workflow runs
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { owner, repo } = context.repo;
-            const sha = context.payload.pull_request.head.sha;
-
-            // Check that no other hold* labels remain on the PR
-            const labels = context.payload.pull_request.labels.map(l => l.name);
-            const stillHeld = labels.some(l => l.startsWith('hold'));
-            if (stillHeld) {
-              core.info('PR still has a hold label — skipping re-run.');
-              return;
-            }
-
-            const { data: { workflow_runs: runs } } =
-              await github.rest.actions.listWorkflowRunsForRepo({
-                owner,
-                repo,
-                head_sha: sha,
-                per_page: 100,
-              });
-
-            const cancelled = runs.filter(r => r.conclusion === 'cancelled');
-            core.info(`Found ${cancelled.length} cancelled run(s) to re-trigger for SHA ${sha}`);
-
-            for (const run of cancelled) {
-              try {
-                await github.rest.actions.reRunWorkflow({
-                  owner,
-                  repo,
-                  run_id: run.id,
-                });
-                core.info(`Re-triggered run ${run.id} (${run.name})`);
-              } catch (err) {
-                core.warning(`Could not re-run ${run.id}: ${err.message}`);
-              }
-            }
@@ -2,21 +2,21 @@ name: supersetbot orglabel based on author

 on:
  issues:
-    types: [opened, edited]
+    types: [created, edited]

  pull_request:
-    types: [opened, edited]
+    types: [created, edited]

 jobs:
  superbot-orglabel:
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
    permissions:
      contents: read
      pull-requests: write
      issues: write
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

@@ -30,4 +30,4 @@ jobs:
          # Label the issue with the appropriate org using supersetbot
          # - this requires for the author to be publicly associated with their org
          # - and for the org to be listed in `supersetbot/src/metadata.js`
-          supersetbot orglabel --issue ${{ github.event.number || github.event.issue.number }} --repo ${{ github.repository }} || true
+          supersetbot orglabel --issue ${{ github.event.number }} --repo ${{ github.repository }} || true
@@ -1,54 +0,0 @@
-name: Label Merge Conflicts
-
-# Sweeps every open PR and labels the ones GitHub reports as CONFLICTING with
-# `requires:rebase` (removing it once a rebase makes the PR mergeable again),
-# so the label can be used to filter the PR backlog for the ones that need a
-# rebase before they can be reviewed/merged.
-#
-# The action itself always re-checks *every* open PR via GraphQL on each run
-# regardless of what triggered it (see eps1lon/actions-label-merge-conflict's
-# sources/main.ts) - there's no way to scope it to "just this PR". The
-# project's own README suggests triggering on `push` (to the default branch)
-# plus `pull_request_target: [synchronize]`, but on a repo with Superset's PR
-# volume that combination would re-sweep the entire open-PR list on every
-# merge to master *and* every push to *any* open PR - many times an hour.
-# A schedule bounds that to a fixed, predictable cadence instead; adjust it
-# if 2 hours turns out to be too slow or too chatty in practice.
-on:
-  schedule:
-    - cron: "0 */2 * * *"
-  workflow_dispatch:
-
-# Avoid two full backlog sweeps racing (a manual workflow_dispatch landing
-# mid-schedule-tick, say); queue rather than cancel so an in-progress
-# paginated sweep always runs to completion.
-concurrency:
-  group: ${{ github.workflow }}
-  cancel-in-progress: false
-
-permissions: {}
-
-jobs:
-  label-merge-conflicts:
-    # Scheduled/dispatch workflows still run on forks that carry this file;
-    # skip anywhere but the canonical repo.
-    if: github.repository == 'apache/superset'
-    name: Label Merge Conflicts
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write # to add/remove requires:rebase and need:merge
-    steps:
-      # ASF Infra allowlists this whole action via a wildcard
-      # (eps1lon/actions-label-merge-conflict@*), so any pinned SHA/version
-      # is already fine here - no Infra ticket needed for future bumps.
-      - uses: eps1lon/actions-label-merge-conflict@0273be72a0bbd58fcd71d0d6c02c209b50d1e5e1 # v3.1.0
-        with:
-          dirtyLabel: "requires:rebase"
-          # A conflicting PR isn't actually ready to merge; strip that signal
-          # if it was previously set so reviewers don't act on a stale one.
-          removeOnDirtyLabel: "need:merge"
-          repoToken: ${{ secrets.GITHUB_TOKEN }}
-          # Intentionally no commentOnDirty/commentOnClean: the label alone is
-          # the signal (matches the label's existing description, and avoids
-          # a one-time comment storm across the whole backlog on first run).
@@ -12,9 +12,9 @@ jobs:
    permissions:
      contents: read
      pull-requests: write
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
    steps:
-    - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
+    - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
      with:
        sync-labels: true

@@ -6,13 +6,13 @@ on:
 jobs:
  latest-release:
    name: Add/update tag to new release
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
    permissions:
      contents: write

    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          submodules: recursive
@@ -15,15 +15,15 @@ concurrency:
 jobs:
  license_check:
    name: License Check
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          submodules: recursive
      - name: Setup Java
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
        with:
          distribution: "temurin"
          java-version: "11"
@@ -1,113 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-#
-# Mirror the Docker Hub service-container images that CI relies on into the
-# repository's GitHub Container Registry (GHCR) namespace.
-#
-# WHY: CI jobs declare Postgres/MySQL/Redis/Presto as `services:` containers
-# pulled anonymously from Docker Hub. Anonymous pulls share the runner's IP
-# rate limit, which causes intermittent timeouts / 429s / 502s on `master`
-# and same-repo PRs. The obvious fix — adding `credentials:` to the service
-# blocks — breaks fork PRs hard: forks can't read secrets, so the templated
-# username/password resolve to '' and GitHub rejects the workflow at parse
-# time ("Unexpected value ''"), failing every fork job at "Set up job".
-#
-# Mirroring to GHCR sidesteps both problems: public GHCR images are pulled
-# without Docker Hub's anonymous rate limit AND without any credentials, so
-# the consuming workflows need no `credentials:` block and forks work
-# unchanged.
-#
-# ONE-TIME BOOTSTRAP (maintainer, after this lands on the default branch):
-#   1. Run this workflow once (Actions tab → "Mirror service images to GHCR"
-#      → Run workflow), or wait for the weekly schedule.
-#   2. In the org's Packages settings, set each mirrored package's visibility
-#      to **public** (apache/superset → ci/postgres, ci/mysql, ci/redis,
-#      ci/presto). Public visibility is what lets fork CI pull without auth.
-#   3. Only then merge the follow-up that repoints the `services.*.image`
-#      refs at these GHCR copies and drops the `credentials:` blocks.
-#
-# NOTE: this mirrors only the images declared as `services:` containers (the
-# ones that broke forks). The `bde2020` hive-metastore image pulled via
-# `docker compose` in the Presto/Hive job is a separate path and is left for
-# a follow-up.
-
-name: Mirror service images to GHCR
-
-on:
-  schedule:
-    # Weekly, Monday 06:00 UTC — keeps the mirror fresh as upstream tags move.
-    - cron: "0 6 * * 1"
-  workflow_dispatch: {}
-
-concurrency:
-  group: mirror-service-images
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-  packages: write
-
-jobs:
-  mirror:
-    # Never run on forks: they lack both the secrets and write access to the
-    # apache GHCR namespace, so a scheduled run there would only ever fail.
-    if: github.repository == 'apache/superset'
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        # Keep this list in sync with the `services.*.image` refs in
-        # superset-e2e.yml, superset-python-integrationtest.yml, and
-        # superset-python-presto-hive.yml.
-        image:
-          - postgres:17-alpine
-          - redis:7-alpine
-          - mysql:8.0
-          - starburstdata/presto:350-e.6
-    steps:
-      - name: Log in to Docker Hub (authenticated source pulls)
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        with:
-          username: ${{ secrets.DOCKERHUB_USER }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Log in to GHCR (push target)
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-
-      - name: Copy image to GHCR
-        env:
-          # Pass the matrix value through the environment rather than
-          # interpolating it into the shell, to avoid template injection.
-          SRC_IMAGE: ${{ matrix.image }}
-        run: |
-          set -euo pipefail
-          # Destination keeps the image's short name (drop any namespace),
-          # under a `ci/` prefix in this repo's GHCR namespace.
-          name="${SRC_IMAGE##*/}"
-          dst="ghcr.io/${GITHUB_REPOSITORY}/ci/${name}"
-          echo "Mirroring docker.io/${SRC_IMAGE} -> ${dst}"
-          # imagetools copies the full (multi-arch) manifest registry-to-
-          # registry without a local pull/retag/push round trip.
-          docker buildx imagetools create --tag "${dst}" "docker.io/${SRC_IMAGE}"
-          echo "- \`docker.io/${SRC_IMAGE}\` → \`${dst}\`" >> "${GITHUB_STEP_SUMMARY}"
@@ -17,7 +17,7 @@ concurrency:

 jobs:
  check-hold-label:
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
    steps:
    - name: Check for 'hold' label
      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -21,13 +21,13 @@ concurrency:

 jobs:
  lint-check:
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          submodules: recursive
@@ -15,7 +15,6 @@ on:

 permissions:
  contents: read
-  actions: read

 # cancel previous workflow jobs for PRs
 concurrency:
@@ -24,7 +23,7 @@ concurrency:

 jobs:
  pre-commit:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 20
    strategy:
      matrix:
@@ -34,7 +33,7 @@ jobs:
        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["current"]') || fromJSON('["current", "next"]') }}
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          submodules: recursive
@@ -48,22 +47,13 @@ jobs:
          python-version: ${{ matrix.python-version }}

      - name: Setup Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0

      - name: Install helm-docs
        run: go install github.com/norwoodj/helm-docs/cmd/helm-docs@v1.14.2

-      # Spike: run the existing .pre-commit-config.yaml through prek (a Rust
-      # reimplementation of pre-commit) instead of pre-commit itself, to see
-      # whether it's viable to speed up this job. CI-only — contributors keep
-      # installing/running `pre-commit` locally exactly as documented; nothing
-      # here changes that.
-      - name: Install prek
-        run: |
-          curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.11/prek-installer.sh | sh
-
      - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: "superset-frontend/.nvmrc"
          cache: "npm"
@@ -79,18 +69,19 @@ jobs:
          cd docs
          yarn install --immutable

-      - name: Cache prek environments
+      - name: Cache pre-commit environments
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
-          path: ~/.cache/prek
-          key: prek-v1-${{ runner.os }}-py${{ matrix.python-version }}-${{ hashFiles('.pre-commit-config.yaml') }}
+          path: ~/.cache/pre-commit
+          key: pre-commit-v2-${{ runner.os }}-py${{ matrix.python-version }}-${{ hashFiles('.pre-commit-config.yaml') }}
          restore-keys: |
-            prek-v1-${{ runner.os }}-py${{ matrix.python-version }}-
+            pre-commit-v2-${{ runner.os }}-py${{ matrix.python-version }}-

      - name: Determine changed files
        id: changed_files
        env:
          EVENT_NAME: ${{ github.event_name }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          BEFORE_SHA: ${{ github.event.before }}
        run: |
          set -euo pipefail
@@ -104,15 +95,7 @@ jobs:
          # Resolve the commit to diff against.
          base=""
          if [ "${EVENT_NAME}" = "pull_request" ]; then
-            # HEAD is the PR merge commit, so its first parent is the current
-            # tip of the base branch. github.event.pull_request.base.sha is
-            # NOT that: GitHub freezes it at PR creation, so on a long-lived
-            # PR it points at the original branch point and the diff picks up
-            # all of the base branch's churn since then — thousands of paths,
-            # enough for the CHANGED_FILES env var below to exceed the
-            # kernel's per-variable size limit and kill the step with
-            # "Argument list too long" before bash even starts.
-            base="$(git rev-parse HEAD^1 2>/dev/null || true)"
+            base="${BASE_SHA}"
          elif [ -n "${BEFORE_SHA:-}" ] && \
               [ "${BEFORE_SHA}" != "0000000000000000000000000000000000000000" ]; then
            base="${BEFORE_SHA}"
@@ -131,15 +114,6 @@ jobs:
          # Files present in HEAD that changed since the base (drop deletions).
          files="$(git diff --name-only --diff-filter=ACMRT "${base}...HEAD")"

-          # Env vars have a hard per-variable size limit (E2BIG at step
-          # start). A PR that legitimately touches thousands of files is
-          # better served by --all-files anyway.
-          if [ "$(printf '%s' "${files}" | wc -c)" -gt 100000 ]; then
-            echo "::notice::Changed-file list too large to pass via env; falling back to --all-files."
-            echo "mode=all" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
          if [ -z "${files}" ]; then
            echo "mode=none" >> "$GITHUB_OUTPUT"
          else
@@ -151,7 +125,7 @@ jobs:
            } >> "$GITHUB_OUTPUT"
          fi

-      - name: pre-commit (via prek)
+      - name: pre-commit
        env:
          MODE: ${{ steps.changed_files.outputs.mode }}
          CHANGED_FILES: ${{ steps.changed_files.outputs.files }}
@@ -161,22 +135,22 @@ jobs:

          case "${MODE}" in
            all)
-              echo "ℹ️ Running prek on all files."
-              prek run --all-files
+              echo "ℹ️ Running pre-commit on all files."
+              pre-commit run --all-files
              ;;
            files)
-              echo "ℹ️ Running prek on changed files:"
+              echo "ℹ️ Running pre-commit on changed files:"
              echo "${CHANGED_FILES}"
              # shellcheck disable=SC2086
-              prek run --files ${CHANGED_FILES}
+              pre-commit run --files ${CHANGED_FILES}
              ;;
            none)
-              echo "ℹ️ No source files changed; nothing for prek to check."
+              echo "ℹ️ No source files changed; nothing for pre-commit to check."
              exit 0
              ;;
            *)
              echo "⚠️ Unrecognized changed-files mode '${MODE}'; checking all files."
-              prek run --all-files
+              pre-commit run --all-files
              ;;
          esac
          PRE_COMMIT_EXIT_CODE=$?
@@ -198,12 +172,3 @@ jobs:
            echo "📖 More details here: https://superset.apache.org/docs/contributing/development#git-hooks"
            exit 1
          fi
-
-  actions-timeline:
-    needs: pre-commit
-    if: always()
-    runs-on: ubuntu-26.04
-    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
-        with:
-          expand-composite-actions: true
@@ -11,7 +11,7 @@ permissions:

 jobs:
  config:
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
    outputs:
      has-secrets: ${{ steps.check.outputs.has-secrets }}
    steps:
@@ -29,11 +29,11 @@ jobs:
    needs: config
    if: needs.config.outputs.has-secrets
    name: Bump version and publish package(s)
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    permissions:
      contents: write
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          # pulls all commits (needed for lerna / semantic release to correctly version)
@@ -50,7 +50,7 @@ jobs:

      - name: Install Node.js
        if: env.HAS_TAGS
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: "./superset-frontend/.nvmrc"

@@ -40,7 +40,7 @@ concurrency:

 jobs:
  config:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    outputs:
      has-secrets: ${{ steps.check.outputs.has-secrets }}
      latest-release: ${{ steps.latest.outputs.tag }}
@@ -93,33 +93,23 @@ jobs:
    needs: config
    if: needs.config.outputs.has-secrets == '1'
    name: docker-rebuild
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    strategy:
      # Mirror the same matrix the release publisher uses so every variant
      # operators consume from Docker Hub gets the refreshed base.
      matrix:
-        build_preset: ["dev", "lean", "websocket", "dockerize", "py311", "py312"]
+        build_preset: ["dev", "lean", "py310", "websocket", "dockerize", "py311", "py312"]
      fail-fast: false
    steps:
      - name: "Checkout release tag: ${{ needs.config.outputs.latest-release }}"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ needs.config.outputs.latest-release }}
          fetch-depth: 0
          persist-credentials: false

-      # Keep workflow tooling on the triggering revision. Release tags can
-      # contain action pins that no longer satisfy the repository allowlist.
-      - name: Checkout workflow actions
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.sha }}
-          path: workflow-source
-          persist-credentials: false
-          sparse-checkout: .github/actions
-
      - name: Setup Docker Environment
-        uses: ./workflow-source/.github/actions/setup-docker
+        uses: ./.github/actions/setup-docker
        with:
          dockerhub-user: ${{ secrets.DOCKERHUB_USER }}
          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -127,12 +117,12 @@ jobs:
          build: "true"

      - name: Use Node.js 20
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 20

      - name: Setup supersetbot
-        uses: ./workflow-source/.github/actions/setup-supersetbot/
+        uses: ./.github/actions/setup-supersetbot/

      - name: Rebuild and push
        env:
@@ -165,7 +155,7 @@ jobs:
  notify-on-failure:
    needs: [config, docker-rebuild]
    if: failure() && needs.config.outputs.has-secrets == '1'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    permissions:
      contents: read
      issues: write
@@ -181,7 +171,7 @@ jobs:
            --repo "$REPOSITORY" \
            --title "Scheduled Docker image refresh failed for ${LATEST_RELEASE}" \
            --label "infra:container" \
-            --label "#bug" \
+            --label "bug" \
            --body "The weekly Docker base-image refresh failed for release \`${LATEST_RELEASE}\`. Published images may be missing upstream base-layer security patches until this is resolved.

          Failed run: ${RUN_URL}"
@@ -1,49 +0,0 @@
-#!/bin/bash
-#
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# Shared freshness gate used by the Docs Deployment workflow
-# (superset-docs-deploy.yml) both up front (check-freshness) and again right
-# before the deploy step (recheck-freshness). Writes an output declaring
-# whether BUILD_SHA is still master's current tip, so a superseded run can
-# skip cleanly instead of racing (and clobbering, or being force-cancelled
-# by) a fresher run.
-#
-# Required env vars:
-#   BUILD_SHA     - the commit SHA this run is building
-#   REPO          - "owner/repo" to query, e.g. github.repository
-#   OUTPUT_NAME   - the GITHUB_OUTPUT key to write, e.g. "is-current"
-#   GITHUB_OUTPUT - path to append outputs to (set by the Actions runner)
-# Optional env vars:
-#   EVENT_NAME    - if "workflow_dispatch", bypasses the check and always
-#                   reports current, since a manual dispatch is a deliberate,
-#                   one-off action rather than something racing other triggers
-#   GH_TOKEN      - passed through to `gh`, needed to call the GitHub API
-
-set -euo pipefail
-
-if [ "${EVENT_NAME:-}" = "workflow_dispatch" ]; then
-  echo "${OUTPUT_NAME}=true" >>"$GITHUB_OUTPUT"
-  exit 0
-fi
-
-latest_sha="$(gh api "repos/${REPO}/commits/master" --jq .sha)"
-if [ "${latest_sha}" = "${BUILD_SHA}" ]; then
-  echo "${OUTPUT_NAME}=true" >>"$GITHUB_OUTPUT"
-else
-  echo "${OUTPUT_NAME}=false" >>"$GITHUB_OUTPUT"
-  echo "::notice::master has moved on to ${latest_sha} since ${BUILD_SHA} was triggered — skipping this stale run."
-fi
@@ -1,100 +0,0 @@
-#!/bin/bash
-#
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# Exercises check-docs-deploy-freshness.sh against a stubbed `gh`, covering
-# the dispatch-bypass, current-tip and stale-tip branches so the output
-# contract (is-current / still-current) can't silently regress. Run
-# directly, no extra tooling required:
-#   bash .github/workflows/scripts/check-docs-deploy-freshness.test.sh
-
-set -euo pipefail
-
-script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-script_under_test="${script_dir}/check-docs-deploy-freshness.sh"
-
-failures=0
-
-# Runs the script under test with a stubbed `gh` reporting $1 as master's
-# latest sha, asserting that GITHUB_OUTPUT ends up containing exactly $4.
-run_case() {
-  local case_name="$1"
-  local latest_sha="$2"
-  local build_sha="$3"
-  local event_name="$4"
-  local expected_line="$5"
-
-  local workdir
-  workdir="$(mktemp -d)"
-  trap 'rm -rf "${workdir}"' RETURN
-
-  # Fake `gh` that just echoes back the requested "latest" sha regardless of
-  # arguments, so the script under test never touches the network.
-  cat >"${workdir}/gh" <<EOF
-#!/bin/bash
-echo '${latest_sha}'
-EOF
-  chmod +x "${workdir}/gh"
-
-  local output_file="${workdir}/github_output"
-  : >"${output_file}"
-
-  if PATH="${workdir}:${PATH}" \
-    GITHUB_OUTPUT="${output_file}" \
-    OUTPUT_NAME="is-current" \
-    REPO="apache/superset" \
-    BUILD_SHA="${build_sha}" \
-    EVENT_NAME="${event_name}" \
-    GH_TOKEN="fake-token" \
-    bash "${script_under_test}"; then
-    :
-  else
-    echo "FAIL (${case_name}): script exited non-zero"
-    failures=$((failures + 1))
-    return
-  fi
-
-  local actual
-  actual="$(cat "${output_file}")"
-  if [ "${actual}" = "${expected_line}" ]; then
-    echo "PASS (${case_name})"
-  else
-    echo "FAIL (${case_name}): expected '${expected_line}', got '${actual}'"
-    failures=$((failures + 1))
-  fi
-}
-
-# `gh` prints "should-not-be-called" for the dispatch case above the trick:
-# it's never actually invoked since the bypass short-circuits before the
-# `gh api` call, but the fake still needs a body.
-run_case "workflow_dispatch bypasses the check" \
-  "unused" "abc123" "workflow_dispatch" \
-  "is-current=true"
-
-run_case "build sha matches master's tip" \
-  "abc123" "abc123" "push" \
-  "is-current=true"
-
-run_case "build sha is stale" \
-  "def456" "abc123" "push" \
-  "is-current=false"
-
-if [ "${failures}" -gt 0 ]; then
-  echo "${failures} case(s) failed"
-  exit 1
-fi
-
-echo "All cases passed"
@@ -153,7 +153,7 @@ jobs:

      - name: Checkout PR code (only if build needed)
        if: steps.auth.outputs.authorized == 'true' && steps.check.outputs.build_needed == 'true'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ steps.check.outputs.target_sha }}
          persist-credentials: false
@@ -11,7 +11,6 @@ on:
 permissions:
  contents: read
  pull-requests: read
-  actions: read

 # cancel previous workflow jobs for PRs
 concurrency:
@@ -20,7 +19,7 @@ concurrency:

 jobs:
  test-load-examples:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    env:
      PYTHONPATH: ${{ github.workspace }}
      SUPERSET_CONFIG: tests.integration_tests.superset_test_config
@@ -41,12 +40,8 @@ jobs:
        ports:
          - 16379:6379
    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
-        with:
-          expand-composite-actions: true
-
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          submodules: recursive
@@ -18,13 +18,22 @@ on:

  workflow_dispatch: {}

+# Serialize deploys: the action pushes to apache/superset-site without
+# rebasing, so concurrent runs race on the final push and the loser fails
+# with `! [rejected] asf-site -> asf-site (fetch first)`. Cancel any
+# in-progress run as soon as a newer one starts — the destination repo
+# isn't touched until the final push step, so canceling mid-build is safe,
+# and the freshest content always wins.
+concurrency:
+  group: docs-deploy-asf-site
+  cancel-in-progress: true
+
 permissions:
  contents: read
-  actions: read

 jobs:
  config:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    outputs:
      has-secrets: ${{ steps.check.outputs.has-secrets }}
    steps:
@@ -38,96 +47,36 @@ jobs:

        env:
          SUPERSET_SITE_BUILD: ${{ (secrets.SUPERSET_SITE_BUILD != '' && secrets.SUPERSET_SITE_BUILD != '') || '' }}
-
-  # Master gets frequent, sometimes bursty pushes, and each one can trigger a
-  # deploy attempt. Rather than let every superseded attempt get force-killed
-  # by the build-deploy concurrency group below (which shows up as a
-  # `cancelled` — i.e. red/failing-looking — check on that commit), have each
-  # run check up front whether it's still building master's current tip and,
-  # if not, skip cleanly. Deliberately outside the docs-deploy-asf-site
-  # concurrency group so it runs immediately for every trigger without
-  # blocking or being blocked by anything.
-  check-freshness:
-    runs-on: ubuntu-26.04
-    outputs:
-      is-current: ${{ steps.check.outputs.is-current }}
-    steps:
-      # Sparse checkout: this job's only job is to be fast, so it fetches
-      # nothing but the freshness-check script itself.
-      - name: Checkout freshness-check script
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-          sparse-checkout: |
-            .github/workflows/scripts
-          sparse-checkout-cone-mode: false
-      - name: "Check whether this is still master's current commit"
-        id: check
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          BUILD_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
-          EVENT_NAME: ${{ github.event_name }}
-          REPO: ${{ github.repository }}
-          OUTPUT_NAME: is-current
-        run: .github/workflows/scripts/check-docs-deploy-freshness.sh
-
  build-deploy:
-    needs: [config, check-freshness]
-    # Only the run for master's current tip proceeds; anything superseded
-    # already skipped at check-freshness above instead of landing here.
+    needs: config
    # For workflow_run triggers, only deploy when the triggering run originated
    # from this repository (not a fork), ensuring the checked-out code and any
    # local actions executed with deploy credentials are trusted.
    if: >-
      needs.config.outputs.has-secrets &&
-      needs.check-freshness.outputs.is-current == 'true' &&
      (github.event_name != 'workflow_run' ||
       github.event.workflow_run.head_repository.full_name == github.repository)
    name: Build & Deploy
-    runs-on: ubuntu-26.04
-    # Serialize deploys: the action pushes to apache/superset-site without
-    # rebasing, so concurrent runs race on the final push and the loser fails
-    # with `! [rejected] asf-site -> asf-site (fetch first)`. Queue instead of
-    # canceling: a run that already passed check-freshness can still be
-    # sitting in the queue for a runner when a newer run starts and finishes
-    # first. cancel-in-progress would let that stale, queued run kill the
-    # newer run's in-progress deploy the moment it's finally scheduled, and
-    # then skip itself at the re-check below — losing the deploy entirely.
-    # Queuing means the stale run just waits its turn and then no-ops at the
-    # re-check, so the fresher content that already deployed is never
-    # clobbered or lost. The check-freshness gate above means it should be
-    # rare for more than one run to reach this point, so the queue stays
-    # short in practice.
-    concurrency:
-      group: docs-deploy-asf-site
-      cancel-in-progress: false
+    runs-on: ubuntu-24.04
    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
-        with:
-          expand-composite-actions: true
-
      - name: "Checkout ${{ github.event.workflow_run.head_sha || github.sha }}"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
          persist-credentials: false
          submodules: recursive
      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: "./docs/.nvmrc"
      - name: Setup Python
        uses: ./.github/actions/setup-backend/
-      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+      - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
        with:
          distribution: "zulu"
          java-version: "21"
      - name: Install Graphviz
-        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
-        with:
-          packages: graphviz
-          version: 1.0
-          execute_install_scripts: true
+        run: sudo apt-get install -y graphviz
      - name: Compute Entity Relationship diagram (ERD)
        env:
          SUPERSET_SECRET_KEY: not-a-secret
@@ -172,24 +121,7 @@ jobs:
        working-directory: docs
        run: |
          yarn build
-      # The check-freshness job above narrows the window but doesn't close it: an
-      # older run can observe is-current=true, then sit through this build while a
-      # newer run's own freshness check also passes and it deploys and finishes
-      # first. If this (stale) run then wins entry into the concurrency group, it
-      # would overwrite the newer content that already deployed. Re-check right
-      # before the one step that actually mutates superset-site, so a stale run
-      # skips deploying instead of clobbering a fresher one that already ran.
-      - name: "Re-check freshness immediately before deploying"
-        id: recheck-freshness
-        if: github.event_name != 'workflow_dispatch'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          BUILD_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
-          REPO: ${{ github.repository }}
-          OUTPUT_NAME: still-current
-        run: .github/workflows/scripts/check-docs-deploy-freshness.sh
      - name: deploy docs
-        if: github.event_name == 'workflow_dispatch' || steps.recheck-freshness.outputs.still-current == 'true'
        uses: ./.github/actions/github-action-push-to-another-repository
        env:
          API_TOKEN_GITHUB: ${{ secrets.SUPERSET_SITE_BUILD }}
@@ -21,79 +21,64 @@ permissions:
  contents: read

 jobs:
-  lychee:
-    # See docs here: https://github.com/lycheeverse/lychee-action
+  linkinator:
+    # See docs here: https://github.com/marketplace/actions/linkinator
    # Only run on pull_request, not workflow_run
    if: github.event_name == 'pull_request'
    name: Link Checking
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
-      # Restores the on-disk request cache (.lycheecache) lychee writes when
-      # `--cache` is set, so re-runs don't re-check every external link from
-      # scratch. Key never matches exactly (github.run_id is unique per run),
-      # so actions/cache always saves a fresh copy afterwards; restore-keys
-      # falls back to the most recent prior cache on lookup.
-      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: .lycheecache
-          key: lychee-cache-${{ github.run_id }}
-          restore-keys: lychee-cache-
-      # v2.8.0 and v2.9.0 are both on ASF Infra's action allowlist
-      # (apache/infrastructure-actions approved_patterns.yml) as of this
-      # writing. Do not bump past v2.9.0 without opening an Infra ticket
-      # to allow the new SHA first!
-      - uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0
+      # Do not bump this linkinator-action version without opening
+      # an ASF Infra ticket to allow the new version first!
+      - uses: JustinBeckwith/linkinator-action@af984b9f30f63e796ae2ea5be5e07cb587f1bbd9 # v2.3
        continue-on-error: true # This will make the job advisory (non-blocking, no red X)
        with:
-          fail: false
-          args: >-
-            --verbose --no-progress
-            --cache --max-cache-age 7d
-            --exclude '^https://github.com/apache/(superset|incubator-superset)/(pull|issues)/\d+'
-            --exclude '^https://github.com/apache/(superset|incubator-superset)/commit/[a-f0-9]+'
-            --exclude 'superset-frontend/.*CHANGELOG\.md'
-            --exclude 'http://localhost:8088/'
-            --exclude 'http://127.0.0.1:3000/'
-            --exclude 'http://localhost:9001/'
-            --exclude 'https://charts.bitnami.com/bitnami'
-            --exclude 'https://www.li.me/'
-            --exclude 'https://www.fanatics.com/'
-            --exclude 'https://tails.com/gb/'
-            --exclude 'https://www.techaudit.info/'
-            --exclude 'https://avetilearning.com/'
-            --exclude 'https://www.udemy.com/'
-            --exclude 'https://trustmedis.com/'
-            --exclude 'http://theiconic.com.au/'
-            --exclude 'https://dev.mysql.com/doc/refman/5.7/en/innodb-limits.html'
-            --exclude '^https://img\.shields\.io/.*'
-            --exclude 'https://vkusvill.ru/'
-            --exclude 'https://www.linkedin.com/in/mark-thomas-b16751158/'
-            --exclude 'https://theiconic.com.au/'
-            --exclude 'https://wattbewerb.de/'
-            --exclude 'https://timbr.ai/'
-            --exclude 'https://opensource.org/license/apache-2-0'
-            --exclude 'https://www.plaidcloud.com/'
-            './**/*.md' './**/*.mdx'
+          paths: "**/*.md, **/*.mdx"
+          linksToSkip: >-
+            ^https://github.com/apache/(superset|incubator-superset)/(pull|issues)/\d+,
+            ^https://github.com/apache/(superset|incubator-superset)/commit/[a-f0-9]+,
+            superset-frontend/.*CHANGELOG\.md,
+            http://localhost:8088/,
+            http://127.0.0.1:3000/,
+            http://localhost:9001/,
+            https://charts.bitnami.com/bitnami,
+            https://www.li.me/,
+            https://www.fanatics.com/,
+            https://tails.com/gb/,
+            https://www.techaudit.info/,
+            https://avetilearning.com/,
+            https://www.udemy.com/,
+            https://trustmedis.com/,
+            http://theiconic.com.au/,
+            https://dev.mysql.com/doc/refman/5.7/en/innodb-limits.html,
+            ^https://img\.shields\.io/.*,
+            https://vkusvill.ru/,
+            https://www.linkedin.com/in/mark-thomas-b16751158/,
+            https://theiconic.com.au/,
+            https://wattbewerb.de/,
+            https://timbr.ai/,
+            https://opensource.org/license/apache-2-0,
+            https://www.plaidcloud.com/

  build-on-pr:
    # Build docs when PR changes docs/** (uses committed databases.json)
    if: github.event_name == 'pull_request'
    name: Build (PR trigger)
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    defaults:
      run:
        working-directory: docs
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          submodules: recursive
      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: "./docs/.nvmrc"
      - name: yarn install
@@ -121,19 +106,19 @@ jobs:
      github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.head_repository.full_name == github.repository
    name: Build (after integration tests)
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    defaults:
      run:
        working-directory: docs
    steps:
      - name: "Checkout PR head: ${{ github.event.workflow_run.head_sha }}"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ github.event.workflow_run.head_sha }}
          persist-credentials: false
          submodules: recursive
      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: "./docs/.nvmrc"
      - name: yarn install
@@ -28,7 +28,7 @@ concurrency:

 jobs:
  changes:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
@@ -38,7 +38,7 @@ jobs:
      frontend: ${{ steps.check.outputs.frontend }}
    steps:
      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Check for file changes
@@ -50,20 +50,27 @@ jobs:
  cypress-matrix:
    needs: changes
    if: (needs.changes.outputs.python == 'true' || needs.changes.outputs.frontend == 'true') && github.event.pull_request.draft == false
-    runs-on: ubuntu-26.04
+    # Somehow one test flakes on 24.04 for unknown reasons, this is the only GHA left on 22.04
+    runs-on: ubuntu-22.04
    timeout-minutes: 30
    permissions:
      contents: read
      pull-requests: read
    strategy:
      # when one test fails, DO NOT cancel the other
-      # app_root variant, because this will kill Cypress processes
+      # parallel_id, because this will kill Cypress processes
      # leaving the Dashboard hanging ...
      # https://github.com/cypress-io/github-action/issues/48
      fail-fast: false
      matrix:
+        parallel_id: [0, 1]
        browser: ["chrome"]
        app_root: ${{ github.event_name == 'push' && fromJSON('["", "/app/prefix"]') || fromJSON('[""]') }}
+        # The /app/prefix variant (push events only) is smoke-tested on a single
+        # shard rather than the full matrix, so exclude it from the other shards.
+        exclude:
+          - parallel_id: 1
+            app_root: "/app/prefix"
    env:
      SUPERSET_ENV: development
      SUPERSET_CONFIG: tests.integration_tests.superset_test_config
@@ -90,21 +97,21 @@ jobs:
      # Conditional checkout based on context
      - name: Checkout for push or pull_request event
        if: github.event_name == 'push' || github.event_name == 'pull_request'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          submodules: recursive
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
      - name: Checkout using ref (workflow_dispatch)
        if: github.event_name == 'workflow_dispatch' && github.event.inputs.ref != ''
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          ref: ${{ github.event.inputs.ref }}
          submodules: recursive
      - name: Checkout using PR ID (workflow_dispatch)
        if: github.event_name == 'workflow_dispatch' && github.event.inputs.pr_id != ''
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          ref: refs/pull/${{ github.event.inputs.pr_id }}/merge
@@ -121,7 +128,7 @@ jobs:
        with:
          run: testdata
      - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: "./superset-frontend/.nvmrc"
          cache: "npm"
@@ -142,6 +149,8 @@ jobs:
        uses: ./.github/actions/cached-dependencies
        env:
          CYPRESS_BROWSER: ${{ matrix.browser }}
+          PARALLEL_ID: ${{ matrix.parallel_id }}
+          PARALLELISM: 2
          CYPRESS_RECORD_KEY: ${{ secrets.CYPRESS_RECORD_KEY }}
          NODE_OPTIONS: "--max-old-space-size=4096"
        with:
@@ -159,12 +168,12 @@ jobs:
        if: failure()
        with:
          path: ${{ github.workspace }}/superset-frontend/cypress-base/cypress/screenshots
-          name: cypress-artifact-${{ github.run_id }}-${{ github.job }}-${{ matrix.browser }}--${{ steps.set-safe-app-root.outputs.safe_app_root }}
+          name: cypress-artifact-${{ github.run_id }}-${{ github.job }}-${{ matrix.browser }}-${{ matrix.parallel_id }}--${{ steps.set-safe-app-root.outputs.safe_app_root }}

  playwright-tests:
    needs: changes
    if: needs.changes.outputs.python == 'true' || needs.changes.outputs.frontend == 'true'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-22.04
    timeout-minutes: 30
    permissions:
      contents: read
@@ -198,21 +207,21 @@ jobs:
      # Conditional checkout based on context (same as Cypress workflow)
      - name: Checkout for push or pull_request event
        if: github.event_name == 'push' || github.event_name == 'pull_request'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          submodules: recursive
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
      - name: Checkout using ref (workflow_dispatch)
        if: github.event_name == 'workflow_dispatch' && github.event.inputs.ref != ''
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          ref: ${{ github.event.inputs.ref }}
          submodules: recursive
      - name: Checkout using PR ID (workflow_dispatch)
        if: github.event_name == 'workflow_dispatch' && github.event.inputs.pr_id != ''
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          ref: refs/pull/${{ github.event.inputs.pr_id }}/merge
@@ -229,7 +238,7 @@ jobs:
        with:
          run: playwright_testdata
      - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: "./superset-frontend/.nvmrc"
          cache: "npm"
@@ -256,21 +265,6 @@ jobs:
          NODE_OPTIONS: "--max-old-space-size=4096"
        with:
          run: playwright-run "${{ matrix.app_root }}"
-      - name: Run Playwright (Soft-delete Tests)
-        uses: ./.github/actions/cached-dependencies
-        env:
-          NODE_OPTIONS: "--max-old-space-size=4096"
-          # Scoped to this step: each playwright-run boots its own gunicorn
-          # with the step's env, so the Required Tests server above keeps
-          # master's Flask configuration while this one runs with SOFT_DELETE
-          # on — the same isolation pattern as the Embedded step in
-          # superset-playwright.yml. Without a flag-on server the
-          # recently-archived specs skip themselves everywhere and ship zero
-          # executed E2E coverage; in the Required run above they are
-          # collected and skipped, which is expected.
-          SUPERSET_FEATURE_SOFT_DELETE: "true"
-        with:
-          run: playwright-run "${{ matrix.app_root }}" recently-archived/
      - name: Set safe app root
        if: failure()
        id: set-safe-app-root
@@ -307,7 +301,7 @@ jobs:
  cypress-matrix-required:
    needs: [changes, cypress-matrix]
    if: always()
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions: {}
    steps:
@@ -329,7 +323,7 @@ jobs:
  playwright-tests-required:
    needs: [changes, playwright-tests]
    if: always()
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions: {}
    steps:
@@ -347,14 +341,3 @@ jobs:
            exit 1
          fi
          echo "playwright-tests result: $RESULT (changes: $CHANGES)"
-
-  actions-timeline:
-    needs: [cypress-matrix, playwright-tests, cypress-matrix-required, playwright-tests-required]
-    if: always()
-    runs-on: ubuntu-26.04
-    permissions:
-      actions: read
-    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
-        with:
-          expand-composite-actions: true
@@ -11,7 +11,6 @@ on:
 permissions:
  contents: read
  pull-requests: read
-  actions: read

 # cancel previous workflow jobs for PRs
 concurrency:
@@ -20,7 +19,7 @@ concurrency:

 jobs:
  test-superset-extensions-cli-package:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 30
    strategy:
      matrix:
@@ -32,7 +31,7 @@ jobs:
        working-directory: superset-extensions-cli
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          submodules: recursive
@@ -70,12 +69,3 @@ jobs:
        with:
          name: superset-extensions-cli-coverage-html
          path: htmlcov/
-
-  actions-timeline:
-    needs: test-superset-extensions-cli-package
-    if: always()
-    runs-on: ubuntu-26.04
-    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
-        with:
-          expand-composite-actions: true
@@ -21,19 +21,13 @@ permissions:

 jobs:
  frontend-build:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 30
-    # The change detector reads the PR's file list, which needs
-    # `pull-requests: read`. Public repos serve that endpoint without it;
-    # private forks return 403.
-    permissions:
-      contents: read
-      pull-requests: read
    outputs:
      should-run: ${{ steps.check.outputs.frontend }}
    steps:
      - name: Checkout Code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          fetch-depth: 0
@@ -57,7 +51,7 @@ jobs:
          git show -s --format=raw HEAD
          docker buildx build \
            -t $TAG \
-            --cache-from=type=registry,ref=apache/superset-cache:3.11-slim-trixie \
+            --cache-from=type=registry,ref=apache/superset-cache:3.10-slim-trixie \
            --target superset-node-ci \
            .

@@ -80,7 +74,7 @@ jobs:
      matrix:
        shard: [1, 2, 3, 4, 5, 6, 7, 8]
      fail-fast: false
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - name: Download Docker Image Artifact
@@ -110,13 +104,13 @@ jobs:
  report-coverage:
    needs: [sharded-jest-tests]
    if: needs.frontend-build.outputs.should-run == 'true'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      id-token: write
    steps:
      - name: Checkout Code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          fetch-depth: 0
@@ -128,19 +122,31 @@ jobs:
          pattern: coverage-artifacts-*
          path: coverage/

+      - name: Reorganize test result reports
+        run: |
+          find coverage/
+          for i in {1..8}; do
+            mv coverage/coverage-artifacts-${i}/coverage-final.json coverage/coverage-shard-${i}.json
+          done
+        shell: bash
+
+      - name: Merge Code Coverage
+        run: npx nyc merge coverage/ merged-output/coverage-summary.json
+
      - name: Upload Code Coverage
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          flags: javascript
          use_oidc: true
          verbose: true
-          directory: coverage
+          disable_search: true
+          files: merged-output/coverage-summary.json
          slug: apache/superset

  lint-frontend:
    needs: frontend-build
    if: needs.frontend-build.outputs.should-run == 'true'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - name: Download Docker Image Artifact
@@ -165,7 +171,7 @@ jobs:
  validate-frontend:
    needs: frontend-build
    if: needs.frontend-build.outputs.should-run == 'true'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - name: Download Docker Image Artifact
@@ -177,15 +183,15 @@ jobs:
        run: |
          zstd -d < docker-image.tar.zst | docker load

-      - name: Validate dependency tree
+      - name: Build Plugins Packages
        run: |
          docker run --rm $TAG bash -c \
-          "npm ls --all --package-lock-only --depth=0 --json > /dev/null"
+          "npm run plugins:build"

  test-storybook:
    needs: frontend-build
    if: needs.frontend-build.outputs.should-run == 'true'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 25
    steps:
      - name: Download Docker Image Artifact
@@ -201,111 +207,3 @@ jobs:
        run: |
          docker run --rm $TAG bash -c \
          "npm run build-storybook && npx playwright install-deps && npx playwright install chromium && npm run test-storybook:ci"
-
-  actions-timeline:
-    needs: [report-coverage, lint-frontend, validate-frontend, test-storybook]
-    if: always()
-    runs-on: ubuntu-26.04
-    permissions:
-      actions: read
-    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
-        with:
-          expand-composite-actions: true
-
-  # Compares a PR's own bundle size against the last nightly-recorded
-  # baseline (see frontend-bundle-size-nightly.yml, which owns actually
-  # persisting new baselines). PR-only: a push to master doesn't need this
-  # check re-run against itself, and re-persisting the baseline on every
-  # push to master -- which happens many times a day -- would burn a full
-  # production build for no benefit nightly refresh doesn't already cover.
-  bundle-size:
-    needs: frontend-build
-    if: needs.frontend-build.outputs.should-run == 'true' && github.event_name == 'pull_request'
-    runs-on: ubuntu-26.04
-    timeout-minutes: 15
-    permissions:
-      contents: read
-      pull-requests: write
-    steps:
-      - name: Checkout Code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
-
-      - name: Download Docker Image Artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: docker-image
-
-      - name: Load Docker Image
-        run: |
-          zstd -d < docker-image.tar.zst | docker load
-
-      # webpack's persistent filesystem cache (superset-frontend/webpack.config.js)
-      # turns a warm production build into ~20s instead of several minutes,
-      # but GH-hosted runners are fresh VMs with nothing carried over between
-      # jobs -- without restoring it explicitly, every single PR would pay
-      # the full cold-build cost. Keyed on the same files webpack's own
-      # `buildDependencies` invalidates on, so a stale cache is never used.
-      - name: Restore webpack build cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: superset-frontend/.temp_cache
-          key: >-
-            webpack-prod-cache-${{ hashFiles('superset-frontend/package-lock.json',
-            'superset-frontend/babel.config.js', 'superset-frontend/tsconfig.json',
-            'superset-frontend/webpack.config.js') }}
-
-      # Only ever pull the last recorded data point off the cache, keyed by
-      # run ID -- `restore-keys` prefix-matches the most recently created
-      # entry, which is always the latest nightly run. Absent before the
-      # first nightly run ever happens; benchmark-action starts a fresh
-      # history in that case.
-      - name: Restore bundle size history
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: bundle-size-history.json
-          key: bundle-size-history-${{ github.run_id }}
-          restore-keys: |
-            bundle-size-history-
-
-      - name: Build production bundle with stats
-        run: |
-          mkdir -p ${{ github.workspace }}/superset-frontend/bundle-stats
-          mkdir -p ${{ github.workspace }}/superset-frontend/.temp_cache
-          docker run \
-          -v ${{ github.workspace }}/superset-frontend/bundle-stats:/app/superset-frontend/bundle-stats \
-          -v ${{ github.workspace }}/superset-frontend/.temp_cache:/app/superset-frontend/.temp_cache \
-          --rm $TAG \
-          bash -c \
-          "npm i && BUNDLE_SIZE_STATS=true npm run build -- --json=bundle-stats/stats.json"
-
-      - name: Summarize bundle size
-        run: |
-          node superset-frontend/scripts/bundle-size-summary.js \
-            superset-frontend/bundle-stats/stats.json > bundle-size-summary.json
-          rm -rf superset-frontend/bundle-stats
-
-      # Comparison + alert only -- this job never persists. See
-      # frontend-bundle-size-nightly.yml for why.
-      #
-      # comment-on-alert is gated to same-repo PRs: on a fork PR,
-      # GITHUB_TOKEN is forced read-only regardless of the `permissions`
-      # block above, so once the alert threshold is crossed the action's
-      # `pulls.createReview` call 403s. That error isn't gated by
-      # fail-on-alert (which only governs the deliberate alert-threshold
-      # failure) -- it propagates and fails the job outright. Fork PRs
-      # still get the comparison via the job summary (summary-always).
-      - name: Compare bundle size against nightly baseline
-        uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1
-        with:
-          tool: customSmallerIsBetter
-          output-file-path: bundle-size-summary.json
-          external-data-json-path: bundle-size-history.json
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          comment-on-alert: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
-          alert-threshold: "110%"
-          fail-on-alert: false
-          summary-always: true
@@ -8,7 +8,6 @@ on:

 permissions:
  contents: read
-  actions: read

 # Serialize runs per PR without cancelling: when a first-time contributor's
 # queued runs are approved together, cancel-in-progress lets an older run
@@ -20,14 +19,10 @@ concurrency:

 jobs:
  lint-test:
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
-        with:
-          expand-composite-actions: true
-
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          submodules: recursive
@@ -36,18 +31,13 @@ jobs:
      - name: Set up Helm
        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
        with:
-          version: v3.21.3
+          version: v3.16.4

      - name: Setup Python
        uses: ./.github/actions/setup-backend/
        with:
          install-superset: "false"

-      # Still vendored (not de-vendored like chart-releaser-action below): the
-      # allowlisted helm/chart-testing-action@v2.8.0 depends internally on
-      # astral-sh/setup-uv@v7.0.0, which isn't itself on the ASF Actions
-      # allowlist (only v8.1.0+ are, at apache/infrastructure-actions'
-      # actions.yml). Needs an INFRA request before this can de-vendor too.
      - name: Set up chart-testing
        uses: ./.github/actions/chart-testing-action

@@ -69,9 +59,3 @@ jobs:
          CT_LINT_CONF: lintconf.yaml
          CT_SINCE: HEAD
          CT_CHART_REPOS: bitnami=https://charts.bitnami.com/bitnami
-
-      - name: Set up helm-unittest
-        run: helm plugin install https://github.com/helm-unittest/helm-unittest --version v1.1.1
-
-      - name: Run helm-unittest
-        run: helm unittest helm/superset
@@ -1,9 +1,6 @@
 # This workflow automates the release process for Helm charts.
-# Each run force-recreates a single 'helm-publish' branch from the tip of 'gh-pages' and
-# opens (or reuses) one pull request against 'gh-pages', allowing the changes to be
-# reviewed and merged manually. Because chart-releaser rebuilds index.yaml from all
-# published GitHub releases, the branch always contains every chart released since the
-# last merge, and the PR can never go stale or conflict with gh-pages.
+# The workflow creates a new branch for the release and opens a pull request against the 'gh-pages' branch,
+# allowing the changes to be reviewed and merged manually.

 name: "Helm: release charts"

@@ -21,15 +18,9 @@ on:
        required: false
        default: "master"

-# Serialize runs: concurrent runs would race on force-pushing the shared
-# helm-publish branch while chart-releaser is mid-release.
-concurrency:
-  group: helm-release
-  cancel-in-progress: false
-
 jobs:
  release:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    permissions:
      contents: write
      pull-requests: write
@@ -38,7 +29,7 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ inputs.ref || github.ref_name }}
          persist-credentials: true
@@ -66,9 +57,9 @@ jobs:
          echo "DEBUG TAGS"
          git show-ref --tags

-      - name: Set pages branch name
+      - name: Create unique pages branch name
        id: vars
-        run: echo "branch_name=helm-publish" >> $GITHUB_ENV
+        run: echo "branch_name=helm-publish-${GITHUB_SHA:0:7}" >> $GITHUB_ENV

      - name: Force recreate branch from gh-pages
        env:
@@ -95,23 +86,23 @@ jobs:
          # Return to the original branch
          git checkout local_gha_temp

+      - name: Fetch/list all tags
+        run: |
+          git submodule update
+          cat .github/actions/chart-releaser-action/action.yml
+
      - name: Run chart-releaser
-        uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
+        uses: ./.github/actions/chart-releaser-action
        with:
          version: v1.6.0
          charts_dir: helm
          mark_as_latest: false
-          # A helm/** change without a Chart.yaml version bump repackages the
-          # already-released version; without this, cr aborts on the existing
-          # release tag (422 already_exists) instead of proceeding to rebuild
-          # the index, and the whole run fails.
-          skip_existing: true
          pages_branch: ${{ env.branch_name }}
        env:
          CR_TOKEN: "${{ github.token }}"
          CR_RELEASE_NAME_TEMPLATE: "superset-helm-chart-{{ .Version }}"

-      - name: Open or reuse Pull Request
+      - name: Open Pull Request
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
@@ -122,72 +113,15 @@ jobs:
              throw new Error("Branch name is not defined.");
            }

-            // The branch is force-recreated from gh-pages on every run, so an
-            // already-open PR for it now reflects this run's charts; opening
-            // another would both fail (422) and recreate the stale-PR pileup
-            // this fixed branch exists to avoid.
-            const { data: existing } = await github.rest.pulls.list({
+            const pr = await github.rest.pulls.create({
              owner,
              repo,
-              state: "open",
-              head: `${owner}:${branchName}`,
-              base: "gh-pages",
+              title: `Helm chart release for ${branchName}`,
+              head: branchName,
+              base: "gh-pages", // Adjust if the target branch is different
+              body: `This PR releases Helm charts to the gh-pages branch.`,
            });

-            let current;
-            if (existing.length > 0) {
-              current = existing[0];
-              core.info(`Reusing existing pull request: ${current.html_url}`);
-            } else {
-              const { data: pr } = await github.rest.pulls.create({
-                owner,
-                repo,
-                title: "Helm chart release",
-                head: branchName,
-                base: "gh-pages", // Adjust if the target branch is different
-                body: [
-                  "This PR releases Helm charts to the gh-pages branch.",
-                  "",
-                  "It is force-updated from the tip of `gh-pages` by every release run,",
-                  "so it always contains every chart released since the last merge and",
-                  "never needs to be closed as superseded.",
-                ].join("\n"),
-              });
-              current = pr;
-              core.info(`Pull request created: ${current.html_url}`);
-            }
-
-            // Sweep release PRs left open by older runs (per-SHA helm-publish-*
-            // branches from the previous scheme). Their content is a subset of
-            // the evergreen PR, so close them with a pointer to it.
-            const { data: openPrs } = await github.rest.pulls.list({
-              owner,
-              repo,
-              state: "open",
-              base: "gh-pages",
-              per_page: 100,
-            });
-
-            for (const stale of openPrs) {
-              if (
-                stale.number !== current.number &&
-                stale.head.repo?.full_name === process.env.GITHUB_REPOSITORY &&
-                stale.head.ref.startsWith("helm-publish")
-              ) {
-                await github.rest.issues.createComment({
-                  owner,
-                  repo,
-                  issue_number: stale.number,
-                  body: `Superseded by #${current.number}, which now carries all unreleased charts. Closing.`,
-                });
-                await github.rest.pulls.update({
-                  owner,
-                  repo,
-                  pull_number: stale.number,
-                  state: "closed",
-                });
-                core.info(`Closed superseded release PR #${stale.number}`);
-              }
-            }
+            core.info(`Pull request created: ${pr.data.html_url}`);
        env:
          BRANCH_NAME: ${{ env.branch_name }}
@@ -24,7 +24,7 @@ concurrency:

 jobs:
  changes:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
@@ -34,7 +34,7 @@ jobs:
      frontend: ${{ steps.check.outputs.frontend }}
    steps:
      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Check for file changes
@@ -48,7 +48,7 @@ jobs:
  playwright-tests-experimental:
    needs: changes
    if: needs.changes.outputs.python == 'true' || needs.changes.outputs.frontend == 'true'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-22.04
    timeout-minutes: 30
    continue-on-error: true
    permissions:
@@ -83,21 +83,21 @@ jobs:
      # Conditional checkout based on context (same as Cypress workflow)
      - name: Checkout for push or pull_request event
        if: github.event_name == 'push' || github.event_name == 'pull_request'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          submodules: recursive
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
      - name: Checkout using ref (workflow_dispatch)
        if: github.event_name == 'workflow_dispatch' && github.event.inputs.ref != ''
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          ref: ${{ github.event.inputs.ref }}
          submodules: recursive
      - name: Checkout using PR ID (workflow_dispatch)
        if: github.event_name == 'workflow_dispatch' && github.event.inputs.pr_id != ''
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          ref: refs/pull/${{ github.event.inputs.pr_id }}/merge
@@ -114,7 +114,7 @@ jobs:
        with:
          run: playwright_testdata
      - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: "./superset-frontend/.nvmrc"
          cache: "npm"
@@ -155,17 +155,6 @@ jobs:
          INCLUDE_EMBEDDED: "true"
        with:
          run: playwright-run "${{ matrix.app_root }}" embedded
-      - name: Run Playwright (Mobile Tests)
-        uses: ./.github/actions/cached-dependencies
-        env:
-          NODE_OPTIONS: "--max-old-space-size=4096"
-          # Scoped to this step for the same reason as the embedded flags
-          # above: the mobile consumption mode should not alter Flask's
-          # configuration for the required desktop test steps.
-          SUPERSET_FEATURE_MOBILE_CONSUMPTION_MODE: "true"
-          INCLUDE_MOBILE: "true"
-        with:
-          run: playwright-run "${{ matrix.app_root }}" mobile/
      - name: Set safe app root
        if: failure()
        id: set-safe-app-root
@@ -181,14 +170,3 @@ jobs:
            ${{ github.workspace }}/superset-frontend/playwright-results/
            ${{ github.workspace }}/superset-frontend/test-results/
          name: playwright-experimental-artifact-${{ github.run_id }}-${{ github.job }}-${{ matrix.browser }}--${{ steps.set-safe-app-root.outputs.safe_app_root }}
-
-  actions-timeline:
-    needs: playwright-tests-experimental
-    if: always()
-    runs-on: ubuntu-26.04
-    permissions:
-      actions: read
-    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
-        with:
-          expand-composite-actions: true
@@ -20,7 +20,7 @@ concurrency:

 jobs:
  changes:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
@@ -29,7 +29,7 @@ jobs:
      python: ${{ steps.check.outputs.python }}
    steps:
      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Check for file changes
@@ -41,7 +41,7 @@ jobs:
  test-mysql:
    needs: changes
    if: needs.changes.outputs.python == 'true'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 45
    permissions:
      id-token: write
@@ -72,7 +72,7 @@ jobs:
          - 16379:6379
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          submodules: recursive
@@ -127,7 +127,7 @@ jobs:
  test-postgres:
    needs: changes
    if: needs.changes.outputs.python == 'true'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 45
    permissions:
      id-token: write
@@ -157,7 +157,7 @@ jobs:
          - 16379:6379
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          submodules: recursive
@@ -188,7 +188,7 @@ jobs:
  test-sqlite:
    needs: changes
    if: needs.changes.outputs.python == 'true'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 45
    permissions:
      id-token: write
@@ -207,7 +207,7 @@ jobs:
          - 16379:6379
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          submodules: recursive
@@ -243,7 +243,7 @@ jobs:
  test-postgres-required:
    needs: [changes, test-postgres]
    if: always()
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - name: Check test-postgres result
@@ -255,14 +255,3 @@ jobs:
            exit 1
          fi
          echo "test-postgres result: $RESULT"
-
-  actions-timeline:
-    needs: [test-mysql, test-postgres, test-sqlite, test-postgres-required]
-    if: always()
-    runs-on: ubuntu-26.04
-    permissions:
-      actions: read
-    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
-        with:
-          expand-composite-actions: true
@@ -16,7 +16,7 @@ concurrency:

 jobs:
  changes:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
@@ -25,7 +25,7 @@ jobs:
      python: ${{ steps.check.outputs.python }}
    steps:
      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Check for file changes
@@ -37,7 +37,7 @@ jobs:
  test-postgres-presto:
    needs: changes
    if: needs.changes.outputs.python == 'true'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 45
    permissions:
      id-token: write
@@ -72,7 +72,7 @@ jobs:
          - 16379:6379
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          submodules: recursive
@@ -100,7 +100,7 @@ jobs:
  test-postgres-hive:
    needs: changes
    if: needs.changes.outputs.python == 'true'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 45
    permissions:
      id-token: write
@@ -127,7 +127,7 @@ jobs:
          - 16379:6379
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          submodules: recursive
@@ -158,14 +158,3 @@ jobs:
          verbose: true
          use_oidc: true
          slug: apache/superset
-
-  actions-timeline:
-    needs: [test-postgres-presto, test-postgres-hive]
-    if: always()
-    runs-on: ubuntu-26.04
-    permissions:
-      actions: read
-    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
-        with:
-          expand-composite-actions: true
@@ -1,70 +0,0 @@
-name: Python Unit Test Results
-
-on:
-  # zizmor: ignore[dangerous-triggers] - runs in base-branch context and only consumes artifacts uploaded by Python-Unit; never checks out PR code (see note below)
-  workflow_run:
-    workflows: ["Python-Unit"]
-    types: [completed]
-
-# This workflow publishes a check run annotating failing Python unit tests
-# inline on the PR diff, using JUnit XML uploaded by the Python-Unit workflow.
-# It uses the workflow_run trigger so that it always runs in the base-branch
-# context and can safely be granted write permissions, even for PRs from
-# forks or Dependabot.
-#
-# IMPORTANT: This workflow must NEVER check out code from the PR branch. All
-# data comes from artifacts uploaded by the Python-Unit workflow.
-permissions:
-  contents: read
-  checks: write
-  issues: read
-  actions: read
-
-jobs:
-  report:
-    runs-on: ubuntu-26.04
-    timeout-minutes: 10
-    if: >
-      github.event.workflow_run.conclusion == 'success' ||
-      github.event.workflow_run.conclusion == 'failure'
-    steps:
-      # Fails soft (continue-on-error) because the source unit-tests job is
-      # itself gated on change detection: a docs-only PR skips it entirely,
-      # so there is nothing to download or report on.
-      - name: Download JUnit results
-        id: download
-        continue-on-error: true
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          # merge-multiple is intentionally omitted: each matrix leg's
-          # artifact (junit-results-current, junit-results-next) uses the
-          # same XML filenames, so merging them into one directory would let
-          # one Python version's results overwrite the other's. Downloading
-          # into per-artifact subdirectories keeps both, and the glob below
-          # is recursive so it still picks up every XML file.
-          pattern: "junit-results-*"
-          path: artifacts
-          run-id: ${{ github.event.workflow_run.id }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Download event file
-        id: download-event
-        if: steps.download.outcome == 'success'
-        continue-on-error: true
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: "Event File"
-          path: event
-          run-id: ${{ github.event.workflow_run.id }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Publish test results
-        if: steps.download.outcome == 'success' && steps.download-event.outcome == 'success'
-        uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2.24.0
-        with:
-          commit: ${{ github.event.workflow_run.head_sha }}
-          event_file: event/event.json
-          event_name: ${{ github.event.workflow_run.event }}
-          files: "artifacts/**/*.xml"
-          check_name: "Python Unit Test Results"
-          comment_mode: "off"
@@ -21,7 +21,7 @@ concurrency:

 jobs:
  changes:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
@@ -30,7 +30,7 @@ jobs:
      python: ${{ steps.check.outputs.python }}
    steps:
      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Check for file changes
@@ -42,7 +42,7 @@ jobs:
  unit-tests:
    needs: changes
    if: needs.changes.outputs.python == 'true'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      id-token: write
@@ -61,7 +61,7 @@ jobs:
      SQLALCHEMY_WARN_20: "1"
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          submodules: recursive
@@ -74,14 +74,14 @@ jobs:
          SUPERSET_TESTENV: true
          SUPERSET_SECRET_KEY: not-a-secret
        run: |
-          pytest --durations-min=0.5 --cov-report= --cov=superset ./tests/common ./tests/unit_tests --cache-clear --maxfail=50 --junit-xml=test-results/junit-unit.xml
+          pytest --durations-min=0.5 --cov-report= --cov=superset ./tests/common ./tests/unit_tests --cache-clear --maxfail=50
      - name: Python 100% coverage unit tests
        env:
          SUPERSET_TESTENV: true
          SUPERSET_SECRET_KEY: not-a-secret
        run: |
-          pytest --durations-min=0.5 --cov=superset/sql/ ./tests/unit_tests/sql/ --cache-clear --cov-fail-under=100 --junit-xml=test-results/junit-sql-coverage.xml
-          pytest --durations-min=0.5 --cov=superset/semantic_layers/ ./tests/unit_tests/semantic_layers/ --cache-clear --cov-fail-under=100 --junit-xml=test-results/junit-semantic-layers-coverage.xml
+          pytest --durations-min=0.5 --cov=superset/sql/ ./tests/unit_tests/sql/ --cache-clear --cov-fail-under=100
+          pytest --durations-min=0.5 --cov=superset/semantic_layers/ ./tests/unit_tests/semantic_layers/ --cache-clear --cov-fail-under=100
      - name: Upload code coverage
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
@@ -89,33 +89,6 @@ jobs:
          verbose: true
          use_oidc: true
          slug: apache/superset
-      # Uploaded even when a pytest step above fails, since that is exactly
-      # when the JUnit results are needed downstream, to annotate the PR with
-      # the failing tests. Consumed by the "Python Unit Test Results" workflow
-      # via workflow_run (see that workflow for why it can't just be a step
-      # here: it needs to run with write permissions, which this PR-triggered
-      # job can't safely have on a fork PR).
-      - name: Upload JUnit test results
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: junit-results-${{ matrix.python-version }}
-          path: test-results/
-          retention-days: 7
-
-  # Uploads the raw pull_request event payload so the "Python Unit Test
-  # Results" workflow (running via workflow_run, in base-branch context) can
-  # look up which PR/commit to annotate without checking out untrusted code.
-  event-file:
-    runs-on: ubuntu-26.04
-    timeout-minutes: 5
-    steps:
-      - name: Upload event file
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: Event File
-          path: ${{ github.event_path }}
-          retention-days: 7

  # Stable required-status-check anchor. `unit-tests` is a matrix job gated on
  # change detection, so on non-Python PRs it is skipped and never produces its
@@ -126,16 +99,9 @@ jobs:
  unit-tests-required:
    needs: [changes, unit-tests]
    if: always()
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 5
-    permissions:
-      contents: read
-      actions: read
    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
-        with:
-          expand-composite-actions: true
-
      - name: Check unit-tests result
        env:
          RESULT: ${{ needs.unit-tests.result }}
@@ -20,7 +20,7 @@ permissions:

 jobs:
  post-comment:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    # Only act when the Translations workflow failed (which means a regression
    # was detected — the workflow exits 1 on regression).
    if: github.event.workflow_run.conclusion == 'failure'
@@ -19,13 +19,13 @@ concurrency:

 jobs:
  frontend-check-translations:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    permissions:
      contents: read
      pull-requests: read
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          submodules: recursive
@@ -38,7 +38,7 @@ jobs:

      - name: Setup Node.js
        if: steps.check.outputs.frontend
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: "./superset-frontend/.nvmrc"
          cache: "npm"
@@ -55,13 +55,13 @@ jobs:
          npm run build-translation

  babel-extract:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    permissions:
      contents: read
      pull-requests: read
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          submodules: recursive
@@ -78,10 +78,7 @@ jobs:

      - name: Install gettext tools
        if: steps.check.outputs.python == 'true' || steps.check.outputs.frontend == 'true'
-        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
-        with:
-          packages: gettext
-          version: 1.0
+        run: sudo apt-get update && sudo apt-get install -y gettext

      # Fetch the base ref so we can compare PR-introduced regressions
      # against a fair baseline (also runs babel_update against the base
@@ -156,14 +153,3 @@ jobs:
      - name: Fail if regression detected
        if: steps.regression.outcome == 'failure'
        run: exit 1
-
-  actions-timeline:
-    needs: [frontend-check-translations, babel-extract]
-    if: always()
-    runs-on: ubuntu-26.04
-    permissions:
-      actions: read
-    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
-        with:
-          expand-composite-actions: true
@@ -21,15 +21,15 @@ concurrency:

 jobs:
  app-checks:
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: './superset-websocket/.nvmrc'
      - name: Install dependencies
@@ -41,9 +41,9 @@ jobs:
      - name: typescript checks
        working-directory: ./superset-websocket
        run: npm run type
-      - name: code format check
+      - name: prettier
        working-directory: ./superset-websocket
-        run: npm run format-check
+        run: npm run prettier-check
      - name: unit tests
        working-directory: ./superset-websocket
        run: npm run test
@@ -15,7 +15,7 @@ on:

 jobs:
  supersetbot:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    if: >
      github.event_name == 'workflow_dispatch' ||
      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@supersetbot'))
@@ -38,7 +38,7 @@ jobs:
            });

      - name: "Checkout ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

@@ -27,7 +27,7 @@ jobs:
      # zizmor: ignore[artipacked] - required persisted credentials to push synced requirement changes back to remote
      - name: Checkout source code
        if: ${{ steps.dependabot-metadata.outputs.package-ecosystem == 'pip' }}
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: true
@@ -38,7 +38,7 @@ jobs:
      - name: Login to Docker Hub
        if: ${{ steps.dependabot-metadata.outputs.package-ecosystem == 'pip' }}
        continue-on-error: true
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          username: ${{ secrets.DOCKERHUB_USER }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -32,7 +32,7 @@ concurrency:

 jobs:
  config:
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
    outputs:
      has-secrets: ${{ steps.check.outputs.has-secrets }}
    steps:
@@ -50,17 +50,17 @@ jobs:
    needs: config
    if: needs.config.outputs.has-secrets
    name: docker-release
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    permissions:
      contents: write
    strategy:
      matrix:
        build_preset:
-          ["dev", "lean", "websocket", "dockerize", "py311", "py312"]
+          ["dev", "lean", "py310", "websocket", "dockerize", "py311", "py312"]
      fail-fast: false
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          fetch-depth: 0
@@ -75,7 +75,7 @@ jobs:

      - name: Use Node.js 20
        # zizmor: ignore[cache-poisoning] - node only runs the supersetbot CLI; no dependency cache is enabled
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 20
          package-manager-cache: false
@@ -120,20 +120,20 @@ jobs:
  update-prs-with-release-info:
    needs: config
    if: needs.config.outputs.has-secrets
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Use Node.js 20
        # zizmor: ignore[cache-poisoning] - node only runs the supersetbot CLI; no dependency cache is enabled
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 20
          package-manager-cache: false
@@ -11,7 +11,7 @@ permissions:

 jobs:
  config:
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
    outputs:
      has-secrets: ${{ steps.check.outputs.has-secrets }}
    steps:
@@ -28,16 +28,16 @@ jobs:
  process-and-upload:
    needs: config
    if: needs.config.outputs.has-secrets
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
    name: Generate Reports
    steps:
      - name: Checkout Repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: "./superset-frontend/.nvmrc"

@@ -7,7 +7,7 @@ on:

 jobs:
  welcome:
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
    if: github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
    permissions:
      pull-requests: write
@@ -57,7 +57,6 @@ local_config.py
 /superset_text.yml
 superset.egg-info/
 superset/bin/supersetc
-superset/extensions/.reload_trigger
 tmp
 rat-results.txt
 superset/app/
@@ -138,7 +137,6 @@ PROJECT.md
 .aider*
 .claude_rc*
 .claude/settings.local.json
-.claude/worktrees/
 .env.local
 oxc-custom-build/
 *.code-workspace
@@ -30,6 +30,9 @@
 [submodule ".github/actions/chart-testing-action"]
 	path = .github/actions/chart-testing-action
 	url = https://github.com/helm/chart-testing-action
+[submodule ".github/actions/chart-releaser-action"]
+	path = .github/actions/chart-releaser-action
+	url = https://github.com/helm/chart-releaser-action
 [submodule ".github/actions/github-action-push-to-another-repository"]
 	path = .github/actions/github-action-push-to-another-repository
 	url = https://github.com/cpina/github-action-push-to-another-repository
@@ -62,9 +62,9 @@ repos:
        args: ["--markdown-linebreak-ext=md"]
  - repo: local
    hooks:
-      - id: oxfmt-frontend
-        name: oxfmt (frontend)
-        entry: bash -c 'cd superset-frontend && files=(); for f in "$@"; do files+=("${f#superset-frontend/}"); done; npx oxfmt --write --no-error-on-unmatched-pattern -- "${files[@]}"' --
+      - id: prettier-frontend
+        name: prettier (frontend)
+        entry: bash -c 'cd superset-frontend && files=(); for f in "$@"; do files+=("${f#superset-frontend/}"); done; npx prettier --write -- "${files[@]}"' --
        language: system
        pass_filenames: true
        files: ^superset-frontend/.*\.(js|jsx|ts|tsx|css|scss|sass|json)$
@@ -144,7 +144,7 @@ repos:
              git fetch --no-recurse-submodules origin "$TARGET_BRANCH" 2>/dev/null || true
            fi
            BASE=$(git merge-base origin/"$TARGET_BRANCH" HEAD 2>/dev/null) || BASE="HEAD"
-            files=$(git diff --name-only --diff-filter=ACM "$BASE"..HEAD 2>/dev/null | grep '^superset/.*\.py$' | grep -v '^superset/migrations/' || true)
+            files=$(git diff --name-only --diff-filter=ACM "$BASE"..HEAD 2>/dev/null | grep '^superset/.*\.py$' || true)
            if [ -n "$files" ]; then
              pylint --rcfile=.pylintrc --load-plugins=superset.extensions.pylint --reports=no $files
            else
@@ -10,6 +10,7 @@
 .stylelintignore
 .flake8
 .nvmrc
+.prettierrc
 .rat-excludes
 .swcrc
 .*log
@@ -63,6 +64,7 @@ tsconfig.tsbuildinfo
 .*yml
 .*iml
 .esprintrc
+.prettierignore
 generator-superset/*
 temporary_superset_ui/*

@@ -2,31 +2,24 @@

 Apache Superset is a data visualization platform with Flask/Python backend and React/TypeScript frontend.

-## Run Pre-commit Before Pushing
+## ⚠️ CRITICAL: Always Run Pre-commit Before Pushing

-Always run pre-commit against the files changed by the current branch before
-pushing. This matches CI and keeps unrelated failures already present on
-`master` from blocking otherwise independent work.
+**ALWAYS run `pre-commit run --all-files` before pushing commits.** CI will fail if pre-commit checks don't pass. This is non-negotiable.

 ```bash
 # Stage your changes first
 git add .

-# Run pre-commit on staged files
-pre-commit run
+# Run pre-commit on all files
+pre-commit run --all-files

 # If there are auto-fixes, stage them and commit
 git add .
 git commit --amend  # or new commit
 ```

-Use `pre-commit run --all-files` when auditing or repairing the repository-wide
-baseline. If that check finds failures in files untouched by the current branch,
-fix them in a separate branch rather than adding unrelated changes to the
-current pull request.
-
 Common pre-commit failures:
- **Formatting** - black, oxfmt, eslint will auto-fix
+- **Formatting** - black, prettier, eslint will auto-fix
 - **Type errors** - mypy failures need manual fixes
 - **Linting** - ruff, pylint issues need manual fixes

@@ -167,7 +160,7 @@ The Developer Portal auto-generates MDX documentation from Storybook stories. **
 ### Generator Location
 - Script: `docs/scripts/generate-superset-components.mjs`
 - Wrapper: `docs/src/components/StorybookWrapper.jsx`
- Output: `docs/developer_docs/components/`
+- Output: `docs/developer_portal/components/`

 ## Architecture Patterns

@@ -270,7 +263,7 @@ git add .                        # Pre-commit only checks staged files
 # Quick validation (faster than --all-files)
 pre-commit run                   # Staged files only
 pre-commit run mypy              # Python type checking
-pre-commit run format            # Code formatting
+pre-commit run prettier          # Code formatting
 pre-commit run eslint            # Frontend linting
 ```

@@ -35,4 +35,4 @@ The Developer Portal includes comprehensive guides for:
 - [Code Review Process](https://superset.apache.org/developer_portal/contributing/code-review)
 - [Development How-tos](https://superset.apache.org/developer_portal/contributing/howtos)

-Source for the Developer Portal documentation is [located here](https://github.com/apache/superset/tree/master/docs/developer_docs).
+Source for the Developer Portal documentation is [located here](https://github.com/apache/superset/tree/master/docs/developer_portal).
@@ -15,8 +15,8 @@
 # limitations under the License.
 #

-# Python version installed; we need 3.11-3.12
-PYTHON=`command -v python3.11 || command -v python3.12`
+# Python version installed; we need 3.10-3.11
+PYTHON=`command -v python3.11 || command -v python3.10`

 .PHONY: install superset venv pre-commit up down logs ps nuke ports open

@@ -76,7 +76,7 @@ update-js:

 venv:
 	# Create a virtual environment and activate it (recommended)
-	if ! [ -x "${PYTHON}" ]; then echo "You need Python 3.11 or 3.12 installed"; exit 1; fi
+	if ! [ -x "${PYTHON}" ]; then echo "You need Python 3.10 or 3.11 installed"; exit 1; fi
 	test -d venv || ${PYTHON} -m venv venv # setup a python3 virtualenv
 	. venv/bin/activate

@@ -95,7 +95,7 @@ py-format: pre-commit
 	pre-commit run black --all-files

 js-format:
-	cd superset-frontend; npm run format
+	cd superset-frontend; npm run prettier

 flask-app:
 	flask run -p 8088 --reload --debugger
@@ -29,10 +29,8 @@ under the License.
 [![Last Commit](https://img.shields.io/github/last-commit/apache/superset)](https://github.com/apache/superset/commits/master)
 [![Open Issues](https://img.shields.io/github/issues/apache/superset)](https://github.com/apache/superset/issues)
 [![Open PRs](https://img.shields.io/github/issues-pr/apache/superset)](https://github.com/apache/superset/pulls)
-[![Get on Slack](https://img.shields.io/badge/slack-join-orange.svg)](https://bit.ly/join-superset-slack)
+[![Get on Slack](https://img.shields.io/badge/slack-join-orange.svg)](http://bit.ly/join-superset-slack)
 [![Documentation](https://img.shields.io/badge/docs-apache.org-blue.svg)](https://superset.apache.org)
-[![Storybook](https://img.shields.io/badge/storybook-live-ff4785.svg)](https://superset-storybook.netlify.app)
-[![Bundle Analyzer](https://img.shields.io/badge/bundle%20analyzer-nightly-8dd6f9.svg)](https://superset-bundle-analyzer.netlify.app)

 <picture width="500">
  <source
@@ -188,7 +186,7 @@ Try out Superset's [quickstart](https://superset.apache.org/docs/quickstart/) gu
 ## Get Involved

 - Ask and answer questions on [StackOverflow](https://stackoverflow.com/questions/tagged/apache-superset) using the **apache-superset** tag
- [Join our community's Slack](https://bit.ly/join-superset-slack)
+- [Join our community's Slack](http://bit.ly/join-superset-slack)
  and please read our [Slack Community Guidelines](https://github.com/apache/superset/blob/master/CODE_OF_CONDUCT.md#slack-community-guidelines)
 - [Join our dev@superset.apache.org Mailing list](https://lists.apache.org/list.html?dev@superset.apache.org). To join, simply send an email to [dev-subscribe@superset.apache.org](mailto:dev-subscribe@superset.apache.org)
 - Follow us on social media:
@@ -14,7 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-FROM python:3.11-slim-trixie
+FROM python:3.10-slim-trixie

 RUN useradd --user-group --create-home --no-log-init --shell /bin/bash superset

@@ -14,7 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-FROM python:3.11-slim-trixie
+FROM python:3.10-slim-trixie

 RUN useradd --user-group --create-home --no-log-init --shell /bin/bash superset

@@ -14,7 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-FROM python:3.11-slim-trixie
+FROM python:3.10-slim-trixie
 ARG VERSION

 RUN git clone --depth 1 --branch ${VERSION} https://github.com/apache/superset.git /superset
@@ -14,7 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-FROM python:3.11-slim-trixie
+FROM python:3.10-slim-trixie

 RUN apt-get update -y
 RUN apt-get install -y \
@@ -423,7 +423,7 @@ git push origin ${SUPERSET_VERSION}

 ### Publishing a Convenience Release to PyPI

-Extract the release to the `/tmp` folder to build the PyPI release. Files in the `/tmp` folder will be automatically deleted by the OS.
+Extract the release to the `/tmp` folder to build the PiPY release. Files in the `/tmp` folder will be automatically deleted by the OS.

 ```bash
 mkdir -p /tmp/superset && cd /tmp/superset
@@ -1,5 +1,3 @@
-#!/usr/bin/env bash
-
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
 # distributed with this work for additional information
@@ -17,6 +15,8 @@
 # specific language governing permissions and limitations
 # under the License.

+#!/bin/bash
+
 # Function to determine Python command
 get_python_command() {
    if command -v python3 &>/dev/null; then
@@ -168,11 +168,6 @@ categories:
      url: https://www.now.vn/
      contributors: ["@davidkohcw"]

-    - name: Pattern
-      url: https://www.pattern.com
-      contributors: ["@alephys26", "@hladush", "@sanketjadhavSF"]
-      logo: pattern_logo.png
-
    - name: Qunar
      url: https://www.qunar.com/
      contributors: ["@flametest"]
@@ -24,350 +24,6 @@ assists people when migrating to a new version.

 ## Next

-### OAuth2 database callback metrics include their outcome
-
-The unqualified `DatabaseRestApi.oauth2` StatsD counter has been replaced with
-`DatabaseRestApi.oauth2.success`, `DatabaseRestApi.oauth2.warning`, and
-`DatabaseRestApi.oauth2.error`. Update monitoring rules and dashboards that consume
-the old counter to use the outcome-specific replacements.
-
- [42935](https://github.com/apache/superset/pull/42935): The MCP service now refuses to start (`MCPAuthConfigError`) when `MCP_JWT_ISSUER` trusts more than one issuer and no `MCP_USER_RESOLVER` is configured, instead of only logging a warning. This was already a documented misconfiguration (the default resolver isn't issuer-scoped, so distinct trusted issuers minting the same username/email would resolve to the same Superset user); deployments trusting multiple issuers must configure an `MCP_USER_RESOLVER` that derives its identity from the token's `iss` claim before upgrading. Single-issuer deployments are unaffected.
- [42393](https://github.com/apache/superset/pull/42393): Exported dataset YAML now carries a `uuid` for each metric and column so that custom folder assignments (which reference metrics/columns by UUID) survive an import into another workspace. This affects any export bundle that contains datasets, not just a dataset export: chart, dashboard, database and full-asset exports all embed the same dataset YAML, so a dashboard exported from this release also fails to import into an older one even though no dataset was exported directly. As with `folders` and `currency_code_column`, the affected `datasets/` files fail schema validation (`Unknown field: uuid`) when imported into Superset releases that predate this change; regenerate or hand-edit exports for older targets in mixed-version fleets.
- [42300](https://github.com/apache/superset/pull/42300): Timeseries charts (line/area/bar) with a Y-axis bound in effect — either an explicit `yAxisBounds` or one derived from `truncateYAxis` — now clamp out-of-range data points to that bound instead of letting ECharts drop the point (and the line segments around it) entirely. Any existing chart with a configured Y-axis bound and data outside it will look different after upgrading: a gap becomes a point pinned to the boundary. The clamp also rewrites the value ECharts reads for that point's tooltip and data label, so the displayed value is the bound rather than the true observation.
- [42087](https://github.com/apache/superset/pull/42087): Stored calculated-column and metric expressions are validated when a query is built, under the same sub-query policy already applied to adhoc expressions. Previously only the dataset update path checked them on save, so expressions written by v1 import, by dataset duplication, or before that check existed were never validated. Since `ALLOW_ADHOC_SUBQUERY` defaults to `False` (see [19242](https://github.com/apache/superset/pull/19242)), a dataset whose stored expression contains a sub-query works before upgrading and afterwards fails at chart render with `Custom SQL fields cannot contain sub-queries.` There is no migration step, and the error does not name the offending dataset column, so audit stored expressions before upgrading: either rewrite them without the sub-query, or set `ALLOW_ADHOC_SUBQUERY = True` to keep the previous behaviour for both stored and adhoc expressions.
-
-### Selenium support removed — Playwright is now required for screenshots
-
-Selenium support has been removed. **Playwright is now required** for all
-report and thumbnail screenshot generation. Install it with:
-
-```bash
-pip install playwright && playwright install chromium
-```
-
-**Breaking config changes:**
-
- `PLAYWRIGHT_REPORTS_AND_THUMBNAILS` feature flag removed (Playwright is the only backend now)
- `WEBDRIVER_TYPE` config key removed (Playwright always uses Chromium)
- `WEBDRIVER_CONFIGURATION` config key removed (Selenium-only)
- `SCREENSHOT_PAGE_LOAD_WAIT` config key removed (Selenium-only)
- `SCREENSHOT_SELENIUM_RETRIES` config key removed (Selenium-only)
- `SCREENSHOT_WAIT_FOR_ERROR_MODAL_VISIBLE` config key removed (Selenium-only)
- `SCREENSHOT_WAIT_FOR_ERROR_MODAL_INVISIBLE` config key removed (Selenium-only)
- `MachineAuthProvider.authenticate_webdriver()` removed; use `authenticate_browser_context()` instead
-
-**What operators should do before upgrading:**
-
-1. Install Playwright: `pip install playwright && playwright install chromium`
-2. Remove any references to the removed config keys from custom `superset_config.py`
-3. If you subclassed `MachineAuthProvider`, remove any `authenticate_webdriver` override and migrate auth logic to `authenticate_browser_context`
-
-### CSV/XLSX report exports of Table charts keep raw numeric values
-
-Table and Pivot Table charts sent as text in a report email now apply the
-chart's number and currency formatting so the values match what a user sees in
-Explore. As part of this, the CSV and XLSX result formats return early before
-formatting: previously the Table post-processor applied `d3NumberFormat` to
-every result format, so CSV/XLSX exports contained pre-formatted strings.
-CSV/XLSX exports now preserve numeric values and column types, which is better
-for downstream analysis but is a visible change for anyone who relied on the
-formatted text in those files. The rendered email body (the only place the
-formatting is intended for) is unaffected.
-
-### SQLAlchemy bumped to 2.0, flask-sqlalchemy to 3.1.1
-
-Superset's core ORM dependencies move from SQLAlchemy 1.4 to 2.0 and
-flask-sqlalchemy `<3.0` to 3.1.1, completing the migration tracked in
-[discussion #40273](https://github.com/apache/superset/discussions/40273).
-
-**Custom `db_engine_specs`, plugins, or extensions that import SQLAlchemy
-internals directly** should review the
-[SQLAlchemy 1.4-to-2.0 migration guide](https://docs.sqlalchemy.org/en/20/changelog/migration_20.html)
-for API changes that affect them — most 1.4 code already runs unmodified
-under 2.0's compatibility mode, but patterns like `Engine.execute()`,
-string-keyed `Row` access, and `MetaData(bind=)` are removed outright.
-
-**Several optional DB-connector extras remain capped below their
-SQLAlchemy-2.0-only releases**, either because that bump is a separate
-follow-up ([#42891](https://github.com/apache/superset/pull/42891): dremio,
-exasol, firebird, redshift, risingwave) or because the upstream dialect
-package has no SQLAlchemy 2.0 support yet at all (aurora-data-api, d1,
-kusto, solr; ocient's 2.0 compatibility is unverified). Installing one of
-these extras continues to pull a SQLAlchemy-1.4-line version of that
-dialect; each package's constraint in `pyproject.toml` documents why.
-
-No application-level configuration changes are required for deployments
-that don't touch SQLAlchemy directly.
-
-### Soft delete is on by default, and purging is live
-
-`SOFT_DELETE` now ships **on** (`DEFAULT_FEATURE_FLAGS`), so deleting a
-dashboard, chart, or dataset archives it rather than removing it. Archived
-objects are hidden from normal listings, recoverable from **Recently Archived**,
-and permanently removed once the retention window elapses.
-`SOFT_DELETE_PURGE_DRY_RUN` also flips to `False`, so the nightly
-`deletion_retention.purge_soft_deleted` task deletes for real instead of only
-logging `would_purge` counts.
-
-**What operators should do before upgrading:**
-
- **Size the first live purge.** The first real run removes every entity that
-  aged past `SOFT_DELETE_RETENTION_DAYS` (default 30) since soft delete began
-  capturing, which on a busy deployment can be a large batch in one window. To
-  see the size first, set `SOFT_DELETE_PURGE_DRY_RUN = True`, read the
-  `would_purge` counts from one nightly run, then set it back.
- **Check a replaced `CELERY_CONFIG`.** A deployment that redefines it rather
-  than inheriting must carry both `superset.tasks.deletion_retention` in
-  `imports` and the `deletion_retention.purge_soft_deleted` beat entry;
-  a startup warning now names whichever is absent.
-
-**Both switches are retained.** `SOFT_DELETE = False` restores hard-delete
-behaviour and `SOFT_DELETE_PURGE_DRY_RUN = True` suspends purging, at any time.
-One caveat on turning soft delete back off: objects archived while it was on are
-**resurrected** into normal listings, since the rows were never removed — an
-emergency stop rather than a clean rollback.
-
-### Version history is on by default
-
-`VERSION_HISTORY` and `ENABLE_VERSIONING_CAPTURE` now both ship **on**. Every
-save of a chart, dashboard, or dataset writes version rows, and the version
-history panel appears on Explore and Dashboard pages. The two flip together
-deliberately: a panel with capture off renders an empty "No history yet" that
-misrepresents the entity as unchanged.
-
-**What operators should expect:**
-
- **Storage growth.** Capture writes shadow rows per save, so the metadata
-  database grows with edit volume. The `version_history.prune_old_versions`
-  beat task removes rows whose transaction is older than
-  `SUPERSET_VERSION_HISTORY_RETENTION_DAYS` (default 30). A deployment that
-  replaces `CELERY_CONFIG` rather than inheriting it must carry both the
-  `superset.tasks.version_history_retention` import and the beat entry; a
-  startup warning names whichever is absent.
- **`PUT` responses change shape.** Entity updates now return populated
-  `old_version_uuid` / `new_version_uuid` fields and an `ETag` header, which
-  were null or absent while capture was off.
-
-`ENABLE_VERSIONING_CAPTURE` is **retained permanently** as an operational
-kill-switch — not removed with the rollout toggles. Setting it to a falsy value
-stops capture within a restart, without a revert-and-redeploy. Unlike the
-soft-delete toggle, turning it off is a clean stop: existing version rows remain
-readable and no entity state is altered.
-
-### Scheduled report execution now enforces one application deadline
-
-Scheduled report (not alert) executions are now governed by a single
-end-to-end deadline shared by browser readiness, capture/PDF generation,
-notification delivery, and terminal-state persistence, configured via
-`ALERT_REPORTS_EXECUTION_BUDGET_SECONDS` (with per-phase reserve settings).
-Behavior changes to be aware of:
-
- The effective budget for a schedule is
-  `min(ALERT_REPORTS_EXECUTION_BUDGET_SECONDS, working_timeout)`. The default
-  budget (one hour) matches the historical `working_timeout` model default,
-  so default installations see no change in how long a report may run —
-  but reports now fail cleanly (with an error notification) at the deadline
-  instead of being killed silently by Celery.
- For REPORT schedules, the Celery `soft_time_limit`/`time_limit` are now
-  derived from that same effective budget plus
-  `ALERT_REPORTS_EXECUTION_HARD_TIMEOUT_GRACE_SECONDS`, replacing the
-  previous `working_timeout + ALERT_REPORTS_WORKING_TIME_OUT_LAG` /
-  `+ ALERT_REPORTS_WORKING_SOFT_TIME_OUT_LAG` derivation. Alert schedules
-  keep the previous behavior.
- A `working_timeout` smaller than the summed phase reserves is floored at
-  the minimum viable budget (reserves + 30s) with a warning; such reports
-  fail fast at the first phase check rather than erroring at setup.
- Dashboard reports whose charts have not mounted are no longer captured
-  blank: readiness is polled until the deadline, and the report fails loudly
-  if charts never mount. Thumbnails and non-report screenshots keep their
-  previous behavior.
-
-### Embedded (guest token) API responses no longer echo database errors
-
-API responses served to a guest-token principal now carry a generic
-`An error occurred while fetching the data.` in place of the underlying error
-(`You don't have permission to access this resource.` on a 401/403), and drop
-the `stacktrace` and error `extra` payloads. Engine errors routinely quote
-catalog, schema, table and column names of the warehouse, which embedded
-viewers should not see. Errors Superset authors itself — access denials, OAuth2
-redirects, timeouts, payload validation — keep their message and type, though
-their `extra` is still reduced to the fields the client needs. Responses to
-every non-guest principal are unchanged, and the full error is still logged
-server-side.
-
-### `UnsavedChangesModal` no longer accepts a `zIndex` prop
-
-`@superset-ui/core`'s `UnsavedChangesModal` dropped its `zIndex` prop (and the
-hardcoded default it fed) in favor of letting Ant Design's own stacking
-handle placement. Callers passing `zIndex` to override the modal's layering
-will now get a TypeScript error and must remove the prop; keeping a manual
-override was exactly the footgun this change removes (see #42510). No
-callers in the Superset frontend codebase itself passed this prop.
-
-### Row-level security now filters table reads a same-named CTE used to hide
-
-`extract_tables_from_statement()` decided whether a reference was a CTE by matching its
-bare name against the enclosing scope's CTE names; it now resolves the name through
-`Scope.cte_sources`. Three kinds of real table read whose bare name collided with a CTE's
-were mistaken for the CTE and dropped from a statement's tables, so they were neither
-RLS-filtered nor access-checked: a schema- or catalog-qualified reference, a non-recursive
-CTE's own name inside its body, and a forward reference to a later `WITH` item.
-
-```sql
-WITH orders AS (SELECT 1 AS d) SELECT * FROM (SELECT * FROM public.orders) AS z
-WITH orders AS (SELECT * FROM orders) SELECT * FROM orders
-WITH q1 AS (SELECT key FROM q2), q2 AS (SELECT 1 AS key) SELECT * FROM q1
-```
-
-Each read is now reported, so it is filtered when `RLS_IN_SQLLAB` is enabled, matched
-against `DISALLOWED_SQL_TABLES`, and requires dataset access under
-`raise_for_access(force_dataset_match=True)`. A query that previously ran, reading those
-rows unfiltered, may now be filtered or rejected. There is no opt-out — the previous
-behavior was a row-level-security bypass.
-
-### Table aliases keep their quoting through the row-level security rewrite
-
-Both RLS transformers took the table alias as a string with its quoting stripped and
-emitted it verbatim; they now carry the parsed identifier. Emitted SQL is unchanged for an
-unquoted identifier; a quoted one keeps its quoting, and a column-alias list
-(`FROM t AS x (c1, c2)`) survives the rewrite instead of being dropped. This repairs
-row-level security for any aliased table on Snowflake, and for at least one statement shape
-on MSSQL where the rewrite previously raised `AttributeError`.
-
-### Principal listing APIs now honour related-field filters
-
-Two authorization-related listing behaviors changed for API clients. Neither
-affects the Superset UI — `include_ids` and `security/subject` have no frontend
-callers — but external clients will notice:
-
- `GET /api/v1/<resource>/related/<column>?include_ids=...` now applies the
-  endpoint's `base_related_field_filters`. Previously the forced IDs were fetched
-  with no filtering, so a caller could resolve principals the related-field
-  filters deliberately hide; those IDs are now omitted from the response.
- `GET /api/v1/security/subject/` now honours `EXCLUDE_USERS_FROM_LISTS` and
-  `EXTRA_RELATED_QUERY_FILTERS`, matching every other principal-listing endpoint.
-  List counts may drop, and fetching an excluded principal via
-  `GET /api/v1/security/subject/<id>` now returns `404`.
-
-### v1 chart import no longer re-adds the importer as editor on overwrite
-
-Re-importing over an existing chart (an overwrite or a soft-delete restore) no
-longer appends the importing user to the chart's `editors`, matching the
-dashboard importer's behavior. This changes anything only for a user who was not
-already an editor of that chart — typically an admin overwriting a chart they do
-not own, who was previously added as an editor as a side effect of the import.
-Newly-created charts are unaffected.
-### ClickHouse: system sampling queries retry with a bounded read
-
-System-generated sampling queries — filter-value dropdowns, the Samples
-tab/dataset preview, and datetime format detection — that ClickHouse rejects
-with a `max_rows_to_read` error (`TOO_MANY_ROWS`, code 158) are now retried
-once with `SETTINGS read_overflow_mode='break'` appended, so they return a
-partial result bounded by the operator's row cap instead of failing. The retry
-applies only to statements Superset generates for physical-table datasets;
-virtual datasets and user-authored SQL remain fully governed by configured
-read limits, and queries that already succeed are never altered. Operators who
-rely on `max_rows_to_read` as a hard failure gate for these system queries can
-restore the previous behavior per database with
-`"disable_sampling_read_limit_override": true` in the database's Extra JSON.
-Note that a retried query returns partial data with no truncation indicator
-(e.g. a filter dropdown may list only a subset of values on tables above the
-row cap).
-
-### Dashboard "Export Data to Excel" requires a Celery worker and S3 bucket
-
-A new dashboard action exports every chart's data to a single multi-sheet
-`.xlsx` asynchronously. It is disabled by default and turns on only when
-`EXCEL_EXPORT_S3_BUCKET` is set (the endpoint returns `501` otherwise). It also
-requires a running Celery worker and a configured SMTP transport, since the task
-emails the requesting user a pre-signed download link. New config keys:
-`EXCEL_EXPORT_S3_BUCKET`, `EXCEL_EXPORT_S3_KEY_PREFIX`,
-`EXCEL_EXPORT_LINK_TTL_SECONDS`, `EXCEL_EXPORT_S3_CLIENT_KWARGS`,
-`EXCEL_EXPORT_TABLE_VIZ_TYPES`, and `EXCEL_EXPORT_QUERY_CONTEXT_BUILDER`.
-
-The feature depends on `boto3`, which is **not** installed by default; install it
-with `pip install apache-superset[excel-export]`.
-
-Charts store their `query_context` only once they have been (re-)saved in
-Explore, so older charts may have none. For a fixed, conservative set of viz
-types (`table`, `big_number_total`, `big_number`, `pie`) the export rebuilds a
-query context from the chart's saved form data so those charts still export.
-The rebuild is a single-query mapping and does **not** reproduce plugin
-post-processing (pivot, rolling, forecast) or multi-query charts, so any chart of
-another type without a saved query context is skipped and listed in the email for
-the user to re-save. To cover those types, set `EXCEL_EXPORT_QUERY_CONTEXT_BUILDER`
-to a callable that receives the chart's form data and returns a query-context
-payload (or `None` to fall back to the built-in rebuild) — for example one backed
-by a service that runs the chart's real frontend `buildQuery`.
-
-A second mode, **Export Images to Excel**, embeds non-table charts as rendered
-images (which viz types stay tabular is controlled by
-`EXCEL_EXPORT_TABLE_VIZ_TYPES`). It renders through the headless webdriver, so the
-menu option only appears when the webdriver screenshot feature flags
-(`ENABLE_DASHBOARD_SCREENSHOT_ENDPOINTS`,
-`ENABLE_DASHBOARD_DOWNLOAD_WEBDRIVER_SCREENSHOT`) are enabled.
-
-Deployments that override `CELERY_CONFIG` must add
-`"superset.tasks.export_dashboard_excel"` to their `imports` tuple, or the task
-will not register and exports will silently never run.
-
-### SQL_QUERY_MUTATOR now honors MUTATE_AFTER_SPLIT in SQL Lab
-
-SQL Lab now applies `SQL_QUERY_MUTATOR` according to `MUTATE_AFTER_SPLIT`, matching the documented semantics and the chart/query path. This only affects deployments that define `SQL_QUERY_MUTATOR` in `superset_config.py`:
-
- With `MUTATE_AFTER_SPLIT = True`, the mutator previously never ran in SQL Lab; it now runs on each individual statement (including on engines like BigQuery and Kusto that execute multiple statements as one block, where each statement is mutated before the statements are joined).
- With `MUTATE_AFTER_SPLIT = False` (the default), multi-statement SQL Lab queries previously applied the mutator to each statement separately; the mutator now runs once on the whole un-split query, as documented. Single-statement queries are unaffected.
- With `MUTATE_AFTER_SPLIT = False` on engines that execute statements individually, the mutator's output is re-parsed to split it into statements. A mutator that emits SQL Superset's parser cannot parse will now fail with a clear parse error before execution, and one that strips a query down to nothing raises an invalid-SQL error instead of executing an empty query.
-
-### Python 3.10 support removed
-
-Python 3.10 is no longer supported. Superset now requires **Python 3.11 or higher**.
-Update your environment (virtualenv, Docker base image, CI configuration, etc.) to
-Python 3.11+ before upgrading. The `apache/superset-cache:3.10-slim-trixie` and
-`py310` Docker image variants are no longer published.
-
-### `from_dttm` and `to_dttm` Jinja template variables removed
-
-The `{{ from_dttm }}` and `{{ to_dttm }}` Jinja template variables, deprecated since
-v5.0, have been removed from the Jinja context and are no longer available in virtual
-dataset SQL or custom SQL expressions.
-
-Replace usages with the `get_time_filter()` function. For example:
-
-```sql
-- Before
-SELECT * FROM tbl
-WHERE dttm_col > '{{ from_dttm }}' AND dttm_col < '{{ to_dttm }}'
-
-- After
-{% set tf = get_time_filter("dttm_col") %}
-SELECT * FROM tbl
-WHERE dttm_col > {{ tf.from_expr }} AND dttm_col <= {{ tf.to_expr }}
-```
-
-Note that `from_expr` and `to_expr` are already fully-formatted SQL expressions (e.g.
-`TO_TIMESTAMP('2024-01-01', ...)`) — do not wrap them in single quotes.
-
-### Removed deck.gl JavaScript tooltip/data-mutator controls and ENABLE_JAVASCRIPT_CONTROLS
-
-The `ENABLE_JAVASCRIPT_CONTROLS` feature flag and the deck.gl chart controls it gated
-(`js_tooltip`, `js_onclick_href`, `js_data_mutator`, and the GeoJSON layer's label/icon
-JavaScript-mode generators) have been removed. These controls let users write arbitrary
-JavaScript, sandboxed via Node's `vm` module, to customize deck.gl tooltips, click
-behavior, and data transforms; the flag defaulted off and the feature saw negligible use.
-
-The deck.gl "Extra data for JS" control (`js_columns`) has also been removed. It only
-ever existed to feed extra columns into the JavaScript controls above; deck.gl's
-built-in field-based tooltips and cross-filtering already pull in any columns they need
-via `tooltip_contents`/`cross_filter_column`, so this control had no remaining purpose.
-Any chart layer whose "Advanced" control panel section only contained this control no
-longer has an "Advanced" section.
-
-Any saved charts with these fields set will simply ignore them going forward and fall back
-to deck.gl's built-in field-based tooltips (`tooltip_contents`/`tooltip_template`) and
-native click/cross-filter behavior. No migration is required; the fields are dropped
-silently on next save.
-
 ### Owners, dashboard roles, and RLS roles replaced by Subjects

 Superset now uses subject-based access assignments for dashboards, charts, datasets,
@@ -455,10 +111,6 @@ are the intended model going forward; deprecating and removing implicit viewersh
 in a later major version.

 - [41044](https://github.com/apache/superset/issues/41044): Removes the deprecated `AVOID_COLORS_COLLISION` feature flag (it defaulted to `True`). Color-collision avoidance is now permanently enabled; any config override setting it to `False` is ignored.
- [41714](https://github.com/apache/superset/pull/41714): **Breaking — the legacy `explore_json` chart-data pipeline is removed** at its long-declared `5.0.0` EOL. The `/superset/explore_json/` and `/superset/explore_json/data/<cache_key>` endpoints, `superset/viz.py`, the `Slice.viz` property, the `get_viz` factory, the `load_explore_json_into_cache` celery task and the `viz=` overload of `security_manager.raise_for_access` are gone. Anything importing `superset.viz` must migrate to the QueryContext / `pandas_postprocessing` pipeline behind `/api/v1/chart/data`. All 15 remaining legacy charts were migrated first: most keep their `viz_type` and renderer (no action needed for saved charts), while saved nvd3 Bubble charts are auto-migrated to the ECharts Bubble Chart (`bubble_v2`) and saved "Time-series Percent Change" (`compare`) charts to the ECharts Line Chart, which restores the nvd3 renderer's interactive percent re-basing via a draggable baseline. The deck.gl Multiple Layers chart now fetches its layers entirely client-side, refitting the viewport as each layer's data arrives, and caps the number of sub-slices fanned out per chart at `DECK_MULTI_MAX_SLICES` (default 50, configurable); dashboard filter badges no longer aggregate child-layer filter metadata.
-
- [41714](https://github.com/apache/superset/pull/41714): Charts migrated in place keep a `NULL` saved query context until they are next opened in Explore (which regenerates it automatically) or re-saved. Until then, cache warm-up and annotation layers referencing such a chart report an actionable error rather than warming/rendering; opening the chart once resolves it.
- [41714](https://github.com/apache/superset/pull/41714): **Breaking for third-party viz plugins** — the `useLegacyApi` field of `ChartMetadata` in `@superset-ui/core` is removed. Plugins that set it must provide a `buildQuery` and consume `/api/v1/chart/data`. The migrated first-party packages also drop their `legacy-` prefix: `@superset-ui/legacy-plugin-chart-{calendar,chord,country-map,horizon,paired-t-test,parallel-coordinates,partition,rose,world-map}` → `@superset-ui/plugin-chart-*`, and `@superset-ui/legacy-preset-chart-nvd3` → `@superset-ui/preset-chart-nvd3`. The `can_explore_json` permission is no longer created or granted; custom roles referencing it should switch to the `can_read` permissions on `Chart`.

 - [41813](https://github.com/apache/superset/pull/41813): `redis` (the Python client, `redis-py`) is bumped from 5.3.1 to 8.0.1. redis-py 8 changes several connection defaults; Superset's own Redis-backed features (`GLOBAL_ASYNC_QUERIES_CACHE_BACKEND`, `DISTRIBUTED_COORDINATION_CONFIG`, and the MCP Redis store) explicitly pin the pre-upgrade behavior so this bump is a no-op for them: the wire protocol stays RESP2 (not the new RESP3 default, which requires Redis/Sentinel 6+ to speak `HELLO`) and there is still no socket timeout by default (redis-py 8 defaults to 5s, which could otherwise newly time out large cached payloads or slow networks). The no-timeout default can now be overridden via two new config keys, `CACHE_REDIS_SOCKET_TIMEOUT` / `CACHE_REDIS_SOCKET_CONNECT_TIMEOUT`, on any `CacheConfig` dict using `CACHE_TYPE: RedisCache` or `RedisSentinelCache`. Separately, redis-py 6+ changed the default for `ssl_check_hostname` from `False` to `True` for SSL connections using `ssl_cert_reqs="required"` (the default) — this is a security improvement, so it has **not** been reverted; deployments with `CACHE_REDIS_SSL=True` whose certificates lack a hostname matching the connection address should set `CACHE_REDIS_SSL_CERT_REQS="none"` (disables cert verification entirely, matching hostname-check bypass) or replace the certificate. General-purpose cache/results backends configured via `CACHE_CONFIG` / `DATA_CACHE_CONFIG` / `RESULTS_BACKEND` with `CACHE_TYPE: RedisCache` go through `flask-caching`'s own Redis backend (outside Superset's code) and are subject to the same new defaults; pass `socket_timeout` / `protocol` via `CACHE_OPTIONS` there if needed. Celery broker and result-backend connections (built by `kombu`, also outside Superset's code) keep their no-socket-timeout behavior (`kombu` passes `socket_timeout=None` explicitly) but do **not** pin the wire protocol, so they follow redis-py's RESP3 default — which requires a Redis server new enough to speak `HELLO` (Redis 6+). Deployments using a pre-6.0 Redis server (EOL) as a Celery broker should upgrade the server before taking this bump.

@@ -478,7 +130,7 @@ in a later major version.

 - **`SqlaTable.sql_url` query-string format.** `SqlaTable.sql_url` now URL-encodes `table_name` and joins it as a query parameter rather than concatenating a second `?`. Previously, with `Database.sql_url` returning `/sqllab/?dbid=<id>`, the concatenation produced `/sqllab/?dbid=<id>?table_name=<raw>` — a malformed second `?` that broke the query parser. External code that parsed the legacy `<base>?table_name=<raw>` shape now sees properly percent-encoded values (e.g. `/` → `%2F`, ` ` → `+` or `%20`); decode with `urllib.parse.parse_qsl`.

- **New config flag `EMBEDDED_DISABLE_PERMALINK_ORIGIN_REWRITE` (default `False`).** Share/permalink URLs now substitute `window.location.origin` for the backend-supplied origin so a proxied or subdirectory-deployed Superset never hands the user an unreachable internal hostname. Operators whose reverse proxy correctly forwards `X-Forwarded-Host` _and_ who want permalinks to carry the backend's literal origin can opt out by setting `EMBEDDED_DISABLE_PERMALINK_ORIGIN_REWRITE = True` in `superset_config.py`. Default `False` (rewrite is on); flipping the default would regress the dominant proxied/subdir deployment to an unreachable host.
+- **New config flag `EMBEDDED_DISABLE_PERMALINK_ORIGIN_REWRITE` (default `False`).** Share/permalink URLs now substitute `window.location.origin` for the backend-supplied origin so a proxied or subdirectory-deployed Superset never hands the user an unreachable internal hostname. Operators whose reverse proxy correctly forwards `X-Forwarded-Host` *and* who want permalinks to carry the backend's literal origin can opt out by setting `EMBEDDED_DISABLE_PERMALINK_ORIGIN_REWRITE = True` in `superset_config.py`. Default `False` (rewrite is on); flipping the default would regress the dominant proxied/subdir deployment to an unreachable host.

 - [41651](https://github.com/apache/superset/pull/41651): **New do-not-translate standard for translation catalogs.** Strings that must stay identical to the source — icon names (e.g. `bolt`), enum/option values (`step-after`), SQL keywords, API field names (`error_message`), code constants, and example placeholders — are now marked with a `#. do-not-translate` extracted comment. The list lives in the `superset/translations/do-not-translate.txt` registry; `scripts/translations/apply_do_not_translate.py` stamps the marker onto `messages.pot` during `babel_update.sh`, and `pybabel update` propagates it to every `.po`, so the status is consistent across all languages. The AI backfill (`backfill_po.py`) and translators leave these entries untranslated (source fallback). The legacy per-catalog convention (a `# Не переводить` translator comment in the `ru` catalog) is still honored for back-compat but is superseded by this standard; contributors adding new machine-read strings should add the msgid to the registry rather than annotating individual catalogs.

@@ -515,7 +167,7 @@ Theme tokens are unaffected — antd 6 removed none of the tokens Superset expos

 ### Guest-token RLS rules reject unknown fields

-The `rls` rules passed to `POST /api/v1/security/guest_token/` are now validated strictly: a rule may only contain `dataset` and `clause`. Previously unknown fields were silently dropped, so a mistyped or legacy scope key (most commonly `datasource` instead of `dataset`) produced a rule with no `dataset`, which is treated as a _global_ rule applied to every dataset the embedded resource can reach. Such a request now returns HTTP 400 identifying the offending field instead of issuing a token with an unintended global rule. Integrators that were sending extra fields in RLS rules must remove them; valid dataset-scoped (`{"dataset": 41, "clause": "..."}`) and global (`{"clause": "..."}`) rules are unaffected.
+The `rls` rules passed to `POST /api/v1/security/guest_token/` are now validated strictly: a rule may only contain `dataset` and `clause`. Previously unknown fields were silently dropped, so a mistyped or legacy scope key (most commonly `datasource` instead of `dataset`) produced a rule with no `dataset`, which is treated as a *global* rule applied to every dataset the embedded resource can reach. Such a request now returns HTTP 400 identifying the offending field instead of issuing a token with an unintended global rule. Integrators that were sending extra fields in RLS rules must remove them; valid dataset-scoped (`{"dataset": 41, "clause": "..."}`) and global (`{"clause": "..."}`) rules are unaffected.

 ### MCP service requires `MCP_JWT_AUDIENCE` when JWT auth is enabled

@@ -554,36 +206,6 @@ The pivot table chart's `First` and `Last` aggregations now return the first and

 The `error` and `response` parameters of the `retryDelay` and `retryOn` callbacks in `FetchRetryOptions` (exported from `@superset-ui/core`) are now typed `Error | null` and `Response | null` to match the actual call-site signature provided by `fetch-retry`. Because these parameter types are contravariant, consumers who typed their callbacks with the non-nullable `(attempt: number, error: Error, response: Response) => number` will get a TypeScript compile error. Widen your callback signatures to accept `Error | null` / `Response | null`.

-### Pivot Table totals are now computed by the database (per-metric "Aggregation function" control removed)
-
-Pivot Table subtotals and grand totals are now computed by the database at each
-rollup level instead of re-aggregating the already-aggregated cell values on the
-client. This fixes long-standing incorrect totals for non-additive metrics
-(ratios such as `SUM(a)/SUM(b)`, `COUNT_DISTINCT`, `AVG`, percentiles, etc.),
-which previously summed the displayed cell values.
-
-As a result the per-table **"Aggregation function"** control (which let you pick
-how totals were aggregated client-side, e.g. Sum/Average/Count) has been
-removed: totals now always reflect the metric's own definition evaluated at the
-total's granularity. For additive metrics (`SUM`/`COUNT`/`MIN`/`MAX`) the result
-is unchanged. If you previously relied on a plain sum-of-cells total for a
-non-additive metric, that specific behavior is no longer available.
-
-The "Sum as Fraction of Total/Rows/Columns" display options are back as a
-new, standalone **"Show values as"** control (below "Combine metrics" in the
-Options panel), since those were mathematically correct even before this
-change and are unrelated to the totals-correctness fix. A DB migration
-derives the new field from any still-present `aggregateFunction` Sum-fraction
-value, so a chart that had one of those options configured picks the
-equivalent "Show values as" setting back up automatically. The "Count as
-Fraction of ..." variants are **not** migrated: they divided a record count,
-while the new control divides the metric's own value, so translating them
-automatically would silently change what the chart displays rather than
-restore it; those charts need to be manually reconfigured if the value-based
-percentage is what's wanted. Charts that used any other non-fraction
-`aggregateFunction` value (Sum, Average, Count, ...) are unaffected, since
-that specific behavior remains unavailable per the above.
-
 ### `thumbnail_url` removed from dashboard list API response

 The `thumbnail_url` field has been removed from `GET /api/v1/dashboard/` list responses. External consumers relying on this field must now construct the thumbnail URL client-side using `id` and `changed_on_utc`:
@@ -594,12 +216,6 @@ The `thumbnail_url` field has been removed from `GET /api/v1/dashboard/` list re

 The thumbnail endpoint redirects to the current digest URL regardless of whether the supplied digest is exact. If the image is not yet cached, that digest URL may return `202` and trigger async generation. Using `changed_on_utc` as the digest is sufficient for cache-busting purposes.

-### Dashboard import can overwrite related charts, datasets, and databases
-
-Re-importing an existing dashboard previously overwrote only the dashboard itself; its related charts, datasets, and databases were never updated (the importer hardcoded `overwrite=False` for them). They can now be overwritten as part of the import.
-
-A new `overwrite_all` form field controls this, and defaults to `false` everywhere, so existing behavior is preserved: passing `overwrite=true` alone still overwrites only the dashboard, exactly as before. To also overwrite the related charts, datasets, and databases on the `/api/v1/dashboard/import/` endpoint, pass `overwrite_all=true` explicitly. The import modal in the UI exposes this as an "also overwrite all assets" checkbox, and the CLI `superset import-dashboards` and the `ImportDashboardsCommand` likewise default `overwrite_all` to `false`.
-
 ### Tagging fix for `create_all`-bootstrapped schemas

 Only affects deployments whose metadata schema was created with SQLAlchemy's `create_all` (rather than `superset db upgrade`) on a foreign-key-enforcing backend — PostgreSQL, or MySQL with `FOREIGN_KEY_CHECKS=1`. Such schemas carry three invalid foreign keys on `tagged_object.object_id` that break tagging (`TAGGING_SYSTEM = True`) with a `ForeignKeyViolation`. Schemas built via `superset db upgrade` are unaffected.
@@ -613,7 +229,6 @@ ALTER TABLE tagged_object DROP CONSTRAINT <constraint_name>;
 -- MySQL: find names via `SHOW CREATE TABLE tagged_object;`
 ALTER TABLE tagged_object DROP FOREIGN KEY <constraint_name>;
 ```
-
 ### Entity version-history infrastructure (gated off by default)

 Introduces the schema and SQLAlchemy-Continuum wiring that captures version history for charts, dashboards, and datasets, plus read-only `GET /api/v1/{chart,dashboard,dataset}/<uuid>/versions/` endpoints. This ships **inert**: a new config flag `ENABLE_VERSIONING_CAPTURE` defaults to `False`, so no save writes any version rows and the endpoints return empty. It is an operational kill-switch (a release toggle that becomes a permanent ops switch), not a feature flag — set it to `True` to enable capture once validated. The migration is additive; existing entity `PUT` responses gain `old_version_uuid` / `new_version_uuid` body fields and an `ETag` header (both null/absent when capture is off).
@@ -626,52 +241,6 @@ A few save- and import-path internals change **unconditionally** (independent of

 These are behavior changes that take effect on upgrade regardless of `ENABLE_VERSIONING_CAPTURE`; no operator action is required.

-### Cross-entity version activity stream
-
-A read-only companion to the version-history endpoints: each entity type gains a `GET /api/v1/{chart,dashboard,dataset}/<uuid>/activity/` endpoint returning a chronological, access-filtered stream of edits — the entity's own edits plus, for charts and dashboards, transitive edits to related entities during their association windows. Datasets have no related layer in V2, so `include=related` returns an empty stream for a dataset and `include=all` reduces to the dataset's own edits.
-
-| Param                | Type                         | Default    | Purpose                                                                                                |
-| -------------------- | ---------------------------- | ---------- | ------------------------------------------------------------------------------------------------------ |
-| `since` / `until`    | ISO 8601                     | —          | Bound `issued_at`                                                                                      |
-| `include`            | `self` \| `related` \| `all` | `all`      | Own edits, related edits, or both                                                                      |
-| `q`                  | string                       | —          | Case-insensitive search over the full history, applied before pagination (so `count` reflects matches) |
-| `page` / `page_size` | integer                      | `0` / `25` | Pagination (`page_size` clamped to 200)                                                                |
-
-Authorization reuses the resource's `can_read` permission and per-object `raise_for_access`; related-entity rows are visibility-filtered to what the caller may see. The stream is empty unless version capture is on (`ENABLE_VERSIONING_CAPTURE`).
-
-### Version-history retention (pruning)
-
-Entity version history (the `version_transaction` / `*_version` shadow tables that back version capture) is aged out by a nightly Celery beat task, `version_history.prune_old_versions` (`superset.tasks.version_history_retention`).
-
-| Key | Default | Purpose |
-|---|---|---|
-| `SUPERSET_VERSION_HISTORY_RETENTION_DAYS` | `30` | Version rows whose owning `version_transaction.issued_at` is older than this many days are pruned. Each entity's live row (`end_transaction_id IS NULL`) is always preserved, as are the live rows of its children and associations; closed historical rows (including the baseline) age out. Set to `0` or a negative value to disable pruning. |
-
-The task ships in the default `CeleryConfig` (both the `superset.tasks.version_history_retention` import and the beat entry). A deployment that overrides `CELERY_CONFIG` without the beat entry logs a startup warning. When the override explicitly defines `imports`, a missing retention module is also reported; an absent `imports` setting is not diagnosed because Celery may register tasks through `include`, autodiscovery, or worker startup imports. Retention only prunes whatever history exists — capture itself is gated separately by `ENABLE_VERSIONING_CAPTURE`, which now ships on.
-
-### Deletion retention (soft-deleted entities are eventually purged)
-
-Soft-deleted dashboards, charts, and datasets are now permanently removed after a retention window (default 30 days; `SOFT_DELETE_RETENTION_DAYS`, `0` disables; settable per workspace at runtime via the `deletion-retention set-window` CLI, which takes precedence). The `deletion_retention.purge_soft_deleted` Celery beat task runs daily and removes each aged-out entity together with its M:N join rows, owned children, datasource permission, and version-history shadow rows. After purge an entity is **unrecoverable** — its detail and `/restore` endpoints return 404 and its version history is gone.
-
-Purging is **live by default** (`SOFT_DELETE_PURGE_DRY_RUN=False`), so the retention promise above is real on a stock deployment. Set it to `True` to have the task log `would_purge` counts and delete nothing — the lever is retained, so an operator can return to dry-run at any time. Note `would_purge` is an **upper bound** — it counts every entity past the retention window without evaluating deletion blockers, so a real run may purge fewer (entities referenced by report schedules or set as a user's welcome dashboard are blocked and reported separately). The task only acts while the `SOFT_DELETE` rollout flag is on; it now ships on by default.
-
-Deployments that replace the default `CELERY_CONFIG` must ensure workers register `superset.tasks.deletion_retention` and schedule the `deletion_retention.purge_soft_deleted` task themselves. The shipped Docker development config uses `imports` and includes both entries. While `SOFT_DELETE` is statically enabled, a missing beat entry logs a startup warning; when the override explicitly defines `imports`, a missing purge module is also reported.
-
-Operators can immediately erase a specific entity for compliance (GDPR) via `superset deletion-retention force-purge --uuid <uuid>`; this applies legacy hard-delete semantics — a live chart referencing a force-purged dataset is left without a datasource until re-pointed (the chart is not modified), and it purges the named entity even when it was never soft-deleted. Every scheduled evaluation writes a provisional, content-free record to the new `purge_audit_log` table before the cascade starts. Meaningful retained outcomes survive the entity they name. Consecutive scheduled evaluations with the same blocked outcome suppress only the redundant current provisional record; completed outcomes, outcome transitions, and every force-purge attempt remain independent and immutable. The **scheduled** purge fails closed when its provisional record cannot be written, while **force-purge** proceeds even if the audit write fails — the operator is present and deletion outranks audit for a compliance erasure. Operators can monitor `deletion_retention.blocked_audit_suppressed` and `deletion_retention.blocked_audit_dedupe_fallback` to verify suppression and fail-safe fallback behavior without changing the existing blocked-workload gauge.
-
-### Recently Archived view and permanent delete (purge) endpoints
-
-Behind the same `SOFT_DELETE` flag, a **Recently Archived** page (Settings menu, `/archived/`) lists soft-deleted charts, dashboards, and datasets with their archive time and archiving user, and offers **Recover** and **Delete permanently** row actions. The page admits any viewer holding `can_read` on **any** of the three types and offers each viewer only the types they can read; a viewer with none of the three sees an explanatory empty state, and unauthenticated requests are redirected to login.
-
-**New endpoints** — `POST /api/v1/{chart,dashboard,dataset}/<uuid>/purge` permanently delete a single **soft-deleted** row, running the same cascade as the retention task. Irreversible. Requires `can_write` on the entity plus editorship of the row (or admin), mirroring `/restore`. The endpoints answer 404 while `SOFT_DELETE` is off (restore deliberately stays live so rows archived before a flag-off remain recoverable), 404 for rows that are not soft-deleted, and 422 with a reason when the purge is blocked (an alert/report references the entity, a user has the dashboard as their welcome page, or a restrictive foreign key intervenes). A purge that cannot write its audit record is refused with 422 rather than executed unrecorded — unlike the operator CLI, an end user's purge never outranks the audit.
-
-With the flag on, delete confirmations across the chart/dashboard/dataset list pages change shape: a recoverable archive is confirmed with a primary **Archive** button and no type-DELETE friction, and the copy states the retention window when one is configured. A bulk dataset selection that includes semantic views keeps the full danger treatment, because semantic views have no soft-delete — they are deleted permanently and the confirmation says so.
-
-This also resolves the limitation noted under *Soft delete and restore for datasets*: a database blocked by soft-deleted datasets can now be freed by purging those datasets (per-entity endpoint, retention task, or `force-purge` CLI) instead of hard-deleting `tables` rows out-of-band.
-
-The `purge_audit_log` table is **never pruned by design** — the audit must survive the entities it names; operators who need to age it out should prune manually.
-
-
 ### Webhook alerts/reports block private/internal hosts by default

 Webhook alert/report dispatch (`WebhookNotification.send`) now validates the target URL's host against the same private/internal-IP block applied to dataset import URLs. If the resolved host is in a loopback, link-local, private (RFC-1918), shared-CGNAT, or multicast range, the webhook is rejected with `NotificationParamException`.
@@ -719,7 +288,6 @@ Operators can tune or disable the policy via config:
 ### Data uploads bounded by UPLOAD_MAX_FILE_SIZE_BYTES

 Single data-file uploads (CSV, Excel, columnar) are now bounded by the `UPLOAD_MAX_FILE_SIZE_BYTES` config option, which defaults to `100 * 1024 * 1024` (100 MB). Files larger than this are rejected with a `413` before their contents are buffered into memory. Set `UPLOAD_MAX_FILE_SIZE_BYTES = None` to disable the check and restore unbounded uploads.
-
 ### Currency symbol position follows the locale when unset

 When a chart's currency control leaves the **Prefix or suffix** field empty, the currency symbol position is now derived from the deployment locale's own convention via `Intl.NumberFormat` instead of always defaulting to a suffix. For example, under the default `en-US` locale `USD`, `GBP`, and `EUR` render as a prefix (`$ 1,000`), while eurozone locales such as `fr-FR` render `EUR` as a suffix (`1 000 €`). An explicit Prefix/Suffix selection is always honored and is unaffected.
@@ -845,7 +413,7 @@ SQLALCHEMY_ENCRYPTED_FIELD_ENGINE = "aes"
   ```bash
   superset re-encrypt-secrets --engine aes-gcm
   ```
-   A live instance keeps writing _new_ secrets as AES-CBC during the window between step 2 and the restart in step 4; this second pass sweeps those up (it is idempotent, so already-migrated values are skipped).
+   A live instance keeps writing *new* secrets as AES-CBC during the window between step 2 and the restart in step 4; this second pass sweeps those up (it is idempotent, so already-migrated values are skipped).

 Schedule the cutover in a quiet window. Runtime reads use only the single configured engine, so in a multi-worker deployment there is an unavoidable brief decrypt-outage between the migration commit and the last worker restarting with the new config — each migrator run is transactional, but the fleet-wide cutover is not zero-downtime.

@@ -873,11 +441,11 @@ With the flag enabled: `DELETE /api/v1/dataset/<id>` no longer hard-deletes the

 **Schema migration:** the migration adds a nullable `deleted_at` column and an index on it (`ix_tables_deleted_at`) to the `tables` table. The column add is instant; the index build runs inline (no `CONCURRENTLY`) and may briefly block writes on the `tables` table (INSERT/UPDATE/DELETE are queued while the index builds; reads are unaffected) on large Postgres deployments. MySQL InnoDB builds the index online (no blocking). Production deployments with many thousands of datasets should run this migration during a maintenance window.

-**Rollback note:** if the application code is rolled back after datasets have been soft-deleted, the older code path's visibility filter no longer applies and previously hidden rows become visible to the older code. Pair the rollback with a data decision (restore the rows, hard-delete them, or also downgrade the migration) rather than assuming the old hard-delete semantics still hold. **Downgrading the migration destroys the deletion markers**: `downgrade()` drops the `deleted_at` column, so any not-yet-restored soft-deleted datasets silently become live, active datasets with no record they were ever deleted. Reconcile the trash (restore or hard-delete each row) _before_ downgrading, and disable the `SOFT_DELETE` flag first so no new soft deletes land mid-rollback.
+**Rollback note:** if the application code is rolled back after datasets have been soft-deleted, the older code path's visibility filter no longer applies and previously hidden rows become visible to the older code. Pair the rollback with a data decision (restore the rows, hard-delete them, or also downgrade the migration) rather than assuming the old hard-delete semantics still hold. **Downgrading the migration destroys the deletion markers**: `downgrade()` drops the `deleted_at` column, so any not-yet-restored soft-deleted datasets silently become live, active datasets with no record they were ever deleted. Reconcile the trash (restore or hard-delete each row) *before* downgrading, and disable the `SOFT_DELETE` flag first so no new soft deletes land mid-rollback.

 **SQL Lab / dataset-creation flows:** creating a dataset over a table whose dataset sits in the trash is refused. The SQL Lab "save as dataset" flow (`get_or_create_dataset`) and file uploads return a **422 naming the hidden twin and the restore endpoint**; the plain create, update, and duplicate paths currently fail with the generic "already exists" 422. In all cases the remediation is the same: restore the hidden dataset (or use a different table name). Perm-string maintenance also covers hidden rows: renaming a database rewrites `perm`/`schema_perm`/`catalog_perm` on soft-deleted datasets and their charts, so a later restore does not resurrect stale permission strings.

-**Importer behavior:** importing a dataset YAML whose UUID matches an existing **soft-deleted** dataset is treated as an implicit restore-with-update — **and this happens even when `overwrite` is not set**. This is a deliberate asymmetry with active rows: an active dataset imported without `overwrite=true` is returned unchanged, but a soft-deleted UUID match is restored _and_ has the upload's contents applied regardless of the `overwrite` argument, on the reasoning that re-importing a deleted dataset's exact UUID is an explicit request to bring it back. The restore preserves the original PK, the chart back-reference, `table_columns`, and `sql_metrics`. Non-editors get `ImportFailedError`. Callers without `can_write` get `ImportFailedError` instead of silently receiving the soft-deleted row.
+**Importer behavior:** importing a dataset YAML whose UUID matches an existing **soft-deleted** dataset is treated as an implicit restore-with-update — **and this happens even when `overwrite` is not set**. This is a deliberate asymmetry with active rows: an active dataset imported without `overwrite=true` is returned unchanged, but a soft-deleted UUID match is restored *and* has the upload's contents applied regardless of the `overwrite` argument, on the reasoning that re-importing a deleted dataset's exact UUID is an explicit request to bring it back. The restore preserves the original PK, the chart back-reference, `table_columns`, and `sql_metrics`. Non-editors get `ImportFailedError`. Callers without `can_write` get `ImportFailedError` instead of silently receiving the soft-deleted row.

 **Uniqueness-validation changes that apply regardless of the feature flag:** two dataset uniqueness checks were tightened alongside this work and are active even with `SOFT_DELETE` off. (1) Create/update uniqueness treats a dataset whose `catalog` is `NULL` as belonging to the database's default catalog, so a legacy twin pair (`catalog=NULL` vs. `catalog=<default>`, same database/schema/name) that older versions allowed now fails validation with "already exists" when either row is edited — resolve by renaming or removing one of the twins. (2) Duplicating a dataset now checks name collisions scoped to the target (database, catalog, schema) instead of globally by name alone: duplicates into other databases that were previously blocked are now allowed.

@@ -897,14 +465,12 @@ With the flag enabled: `DELETE /api/v1/chart/<id>` no longer hard-deletes the ch

 **Schema migration:** the migration adds a nullable `deleted_at` column and an index on it (`ix_slices_deleted_at`) to the `slices` table. The column add is instant; the index build runs inline (no `CONCURRENTLY`) and may briefly block writes on the `slices` table (INSERT/UPDATE/DELETE are queued while the index builds; reads are unaffected) on large Postgres deployments. MySQL InnoDB builds the index online (no blocking).

-**Rollback note:** if the application code is rolled back after charts have been soft-deleted, the older code path's visibility filter no longer applies and previously hidden rows become visible to the older code. Pair the rollback with a data decision (restore the rows, hard-delete them, or also downgrade the migration) rather than assuming the old hard-delete semantics still hold. **Downgrading the migration destroys the deletion markers**: `downgrade()` drops the `deleted_at` column, so any not-yet-restored soft-deleted charts silently become live, active charts with no record they were ever deleted. Reconcile the trash (restore or hard-delete each row) _before_ downgrading, and disable the `SOFT_DELETE` flag first so no new soft deletes land mid-rollback.
+**Rollback note:** if the application code is rolled back after charts have been soft-deleted, the older code path's visibility filter no longer applies and previously hidden rows become visible to the older code. Pair the rollback with a data decision (restore the rows, hard-delete them, or also downgrade the migration) rather than assuming the old hard-delete semantics still hold. **Downgrading the migration destroys the deletion markers**: `downgrade()` drops the `deleted_at` column, so any not-yet-restored soft-deleted charts silently become live, active charts with no record they were ever deleted. Reconcile the trash (restore or hard-delete each row) *before* downgrading, and disable the `SOFT_DELETE` flag first so no new soft deletes land mid-rollback.

-**Importer behavior:** importing a chart YAML whose UUID matches an existing **soft-deleted** chart is treated as an implicit restore-with-update — **and this happens even when `overwrite` is not set**. This is a deliberate asymmetry with active rows: an active chart imported without `overwrite=true` is returned unchanged, but a soft-deleted UUID match is restored _and_ has the upload's contents applied regardless of the `overwrite` argument, on the reasoning that re-importing a deleted chart's exact UUID is an explicit request to bring it back. The restore preserves the original PK and all out-of-archive references (`dashboard_slices` junctions, `report.chart_id`, tag rows). The operation is permission-gated: non-editors get `ImportFailedError`, and callers without `can_write` get `ImportFailedError` instead of silently receiving the soft-deleted row.
+**Importer behavior:** importing a chart YAML whose UUID matches an existing **soft-deleted** chart is treated as an implicit restore-with-update — **and this happens even when `overwrite` is not set**. This is a deliberate asymmetry with active rows: an active chart imported without `overwrite=true` is returned unchanged, but a soft-deleted UUID match is restored *and* has the upload's contents applied regardless of the `overwrite` argument, on the reasoning that re-importing a deleted chart's exact UUID is an explicit request to bring it back. The restore preserves the original PK and all out-of-archive references (`dashboard_slices` junctions, `report.chart_id`, tag rows). The operation is permission-gated: non-editors get `ImportFailedError`, and callers without `can_write` get `ImportFailedError` instead of silently receiving the soft-deleted row.

 - [39914](https://github.com/apache/superset/pull/39914) `ALERT_REPORT_SLACK_V2` now defaults to `True` and the legacy Slack v1 integration (`Slack` recipient type, `files.upload` API) is deprecated for removal in the next major. Slack blocked new apps from `files.upload` in May 2024 and fully retired the method for all apps on November 12, 2025; because the v1 path sends files through `files.upload`, v1 file-bearing sends now fail at the API level — only text-only `chat_postMessage` still works via the legacy path. Grant your Slack bot the `channels:read` and `groups:read` scopes so existing `Slack` recipients can be auto-upgraded to `SlackV2` on next send. Operators who explicitly override the flag to `False`, or whose Slack bot is missing those scopes, will see deprecation warnings while text-only sends continue through the legacy path.

- [42089](https://github.com/apache/superset/pull/42089) automatically upgrades resolvable Slack v1 recipients, preserves text-only v1 delivery with execution warnings when migration cannot finish, and rejects retired v1 file uploads with actionable scope guidance. Slack delivery uses at-most-once terminal writes and a schedule-wide retry budget configured by `SLACK_SEND_RETRY_MAX_TIME`, clamped to the report's remaining working timeout. Deployments using `SupersetMetastoreCache` for the Slack channel cache must schedule the `slack.cache_channels` Celery task to repopulate misses outside report transactions; see [Alerts and Reports](https://superset.apache.org/admin-docs/configuration/alerts-reports#slack-delivery-timeouts-and-retries).
-
 ### Soft delete and restore for dashboards

 **Everything in this section applies only when the `SOFT_DELETE` feature flag is enabled. The flag defaults to `False`** (`@lifecycle: development`), so on a default deployment `DELETE /api/v1/dashboard/<id>` continues to **hard-delete permanently** — nothing is recoverable. Enable `SOFT_DELETE` to get the behavior described below.
@@ -925,22 +491,16 @@ The partial-index replacement is dialect-dependent: PostgreSQL uses a native `WH

 **Slug semantics:** on PostgreSQL and MySQL 8.0.13+, the slug of a soft-deleted dashboard is **free for reuse**. A new active dashboard can claim it immediately. Restoring a soft-deleted dashboard whose slug has since been claimed returns **422 with a clean error** (`DashboardSlugConflictError`) — rename one of the dashboards and retry; the restore is not silently rejected by a database-level constraint violation.

-**Importer behavior:** importing a dashboard YAML whose UUID matches an existing **soft-deleted** dashboard is treated as an implicit restore-with-update — **and this happens even when `overwrite` is not set**. This is a deliberate asymmetry with active rows: an active dashboard imported without `overwrite=true` is returned unchanged (the import never mutates it), but a soft-deleted UUID match is restored _and_ has the upload's contents applied regardless of the `overwrite` argument, on the reasoning that re-importing a deleted dashboard's exact UUID is an explicit request to bring it back. The restore preserves the original PK and all pre-deletion relationship rows (`dashboard_slices` junctions, editor/viewer subjects, tags). Callers whose imports must never mutate existing state should treat bundles that may contain previously deleted UUIDs accordingly. The operation is permission-gated: it requires `can_write` and editorship of the deleted row (or admin) — non-editors get `ImportFailedError`, and callers without `can_write` get `ImportFailedError` instead of silently receiving the soft-deleted row.
-
-### Engine spec capability flag: `supports_offset`
-
-A new `BaseEngineSpec.supports_offset` attribute (default `True`) indicates whether a database engine supports the SQL `OFFSET` clause. Engines that do not support `OFFSET` — such as Elasticsearch SQL and OpenDistro — opt out by setting it to `False`, and Superset uses each engine's cursor API to paginate drill-to-detail samples instead of emitting `OFFSET`. Downstream forks maintaining custom engine specs may set the flag to `False` (and implement `fetch_data_with_cursor`) to avoid crashes when paginated drill-to-detail queries are run against engines without `OFFSET` support.
-
-**Note on deep-pagination cost:** Cursor-based engines (including Elasticsearch and OpenDistro) are forward-only, so reaching page `N` of a drill-to-detail view issues `N` round trips to the cluster. Deep pagination is therefore linear in page number; users paginating into the hundreds or thousands will notice added latency compared to `OFFSET`-capable engines.
+**Importer behavior:** importing a dashboard YAML whose UUID matches an existing **soft-deleted** dashboard is treated as an implicit restore-with-update — **and this happens even when `overwrite` is not set**. This is a deliberate asymmetry with active rows: an active dashboard imported without `overwrite=true` is returned unchanged (the import never mutates it), but a soft-deleted UUID match is restored *and* has the upload's contents applied regardless of the `overwrite` argument, on the reasoning that re-importing a deleted dashboard's exact UUID is an explicit request to bring it back. The restore preserves the original PK and all pre-deletion relationship rows (`dashboard_slices` junctions, editor/viewer subjects, tags). Callers whose imports must never mutate existing state should treat bundles that may contain previously deleted UUIDs accordingly. The operation is permission-gated: it requires `can_write` and editorship of the deleted row (or admin) — non-editors get `ImportFailedError`, and callers without `can_write` get `ImportFailedError` instead of silently receiving the soft-deleted row.

 ### Granular Export Controls

 A new feature flag `GRANULAR_EXPORT_CONTROLS` introduces three fine-grained permissions that replace the legacy `can_csv` permission:

-| Permission           | Controls                     |
-| -------------------- | ---------------------------- |
-| `can_export_data`    | CSV, Excel, JSON exports     |
-| `can_export_image`   | Screenshot/PDF exports       |
+| Permission | Controls |
+|---|---|
+| `can_export_data` | CSV, Excel, JSON exports |
+| `can_export_image` | Screenshot/PDF exports |
 | `can_copy_clipboard` | Copy-to-clipboard operations |

 When the feature flag is enabled, these permissions are enforced on both the frontend (disabled buttons with tooltips) and backend (403 responses from API endpoints). When disabled, legacy `can_csv` behavior is preserved.
@@ -963,38 +523,25 @@ Added a new combined datasource list endpoint at `GET /api/v1/datasource/` to se
 - Semantic views are included only when the `SEMANTIC_LAYERS` feature flag is enabled.
 - The endpoint enforces strict `order_column` validation and returns `400` for invalid sort columns.

-### Custom time range "Now"/"Today" anchors resolve in local time
-
-Custom time ranges that use the "Now" or "Today" anchor (for the Start, End, or the relative anchor itself) previously resolved that anchor in UTC before formatting it into a naive datetime string, which was then re-parsed elsewhere as local time. For users outside UTC, this made the resolved anchor drift by their browser's UTC offset. "Now"/"Today" now resolve directly in local time, matching the later local re-parse.
-
-Charts and dashboards using these anchors will compute a different (correct) timestamp after upgrading; if a chart's filters or drill-downs were tuned to compensate for the old offset, review them after upgrading.
-
 ## 6.1.0

 ### ClickHouse minimum driver version bump

 The minimum required version of `clickhouse-connect` has been raised to `>=0.13.0`. If you are using the ClickHouse connector, please upgrade your `clickhouse-connect` package. The `_mutate_label` workaround that appended hash suffixes to column aliases has also been removed, as it is no longer needed with modern versions of the driver.

-### Kenya Country Map: Updated Administrative Divisions
-
-The Kenya country map has been updated to reflect the 47 counties established under Kenya's 2010 constitution, replacing the outdated 8-province boundaries from the Natural Earth dataset. County keys now use ISO 3166-2:KE codes (`KE-01` through `KE-47`), replacing the former province codes (`KE-110`, `KE-200`, ..., `KE-800`). Dashboards that join on the old province codes will need to re-key their datasets to use the new county codes.
-
 ### MCP Tool Observability

 MCP (Model Context Protocol) tools now include enhanced observability instrumentation for monitoring and debugging:

 **Two-layer instrumentation:**
-
 1. **Middleware layer** (`LoggingMiddleware`): Automatically logs all MCP tool calls with `duration_ms` and `success` status in the audit log (Action Log UI, logs table)
 2. **Sub-operation tracking**: All 19 MCP tools include granular `event_logger.log_context()` blocks for tracking individual operations like validation, database writes, and query execution

 **Action naming convention:**
-
 - Tool-level logs: `mcp_tool_call` (via middleware)
 - Sub-operation logs: `mcp.{tool_name}.{operation}` (e.g., `mcp.generate_chart.validation`, `mcp.execute_sql.query_execution`)

 **Querying MCP logs:**
-
 ```sql
 -- Top slowest MCP operations
 SELECT action, COUNT(*) as calls, AVG(duration_ms) as avg_ms
@@ -1029,7 +576,6 @@ A new `DISTRIBUTED_COORDINATION_CONFIG` configuration provides a unified Redis-b
 The distributed coordination is used by the Global Task Framework (GTF) for abort notifications and task completion signaling, and will eventually replace `GLOBAL_ASYNC_QUERIES_CACHE_BACKEND` as the standard signaling backend. Configuring this is recommended for Redis enabled production deployments.

 Example configuration in `superset_config.py`:
-
 ```python
 DISTRIBUTED_COORDINATION_CONFIG = {
    "CACHE_TYPE": "RedisCache",
@@ -1044,11 +590,9 @@ See `superset/config.py` for complete configuration options.
 ### WebSocket config for GAQ with Docker

 [35896](https://github.com/apache/superset/pull/35896) and [37624](https://github.com/apache/superset/pull/37624) updated documentation on how to run and configure Superset with Docker. Specifically for the WebSocket configuration, a new `docker/superset-websocket/config.example.json` was added to the repo, so that users could copy it to create a `docker/superset-websocket/config.json` file. The existing `docker/superset-websocket/config.json` was removed and git-ignored, so if you're using GAQ / WebSocket make sure to:
-
 - Stash/backup your existing `config.json` file, to re-apply it after (will get git-ignored going forward)
 - Update the `volumes` configuration for the `superset-websocket` service in your `docker-compose.override.yml` file, to include the `docker/superset-websocket/config.json` file. For example:
-
-```yaml
+``` yaml
 services:
  superset-websocket:
    volumes:
@@ -1061,9 +605,7 @@ services:
 ### Example Data Loading Improvements

 #### New Directory Structure
-
 Examples are now organized by name with data and configs co-located:
-
 ```
 superset/examples/
 ├── _shared/              # Shared database & metadata configs
@@ -1076,14 +618,12 @@ superset/examples/
 ```

 #### Simplified Parquet-based Loading
-
 - Auto-discovery: create `superset/examples/my_dataset/data.parquet` to add a new example
 - Parquet is an Apache project format: compressed (~27% smaller), self-describing schema
 - YAML configs define datasets, charts, and dashboards declaratively
 - Removed Python-based data generation from individual example files

 #### Test Data Reorganization
-
 - Moved `big_data.py` to `superset/cli/test_loaders.py` - better reflects its purpose as a test utility
 - Fixed inverted logic for `--load-test-data` flag (now correctly includes .test.yaml files when flag is set)
 - Clarified CLI flags:
@@ -1093,7 +633,6 @@ superset/examples/
  - `--load-big-data` / `-b`: Generate synthetic stress-test data

 #### Bug Fixes
-
 - Fixed numpy array serialization for PostgreSQL (converts complex types to JSON strings)
 - Fixed KeyError for `allow_csv_upload` field in database configs (now optional with default)
 - Fixed test data loading logic that was incorrectly filtering files
@@ -1103,7 +642,6 @@ superset/examples/
 The MCP (Model Context Protocol) service enables AI assistants and automation tools to interact programmatically with Superset.

 #### New Features
-
 - MCP service infrastructure with FastMCP framework
 - Tools for dashboards, charts, datasets, SQL Lab, and instance metadata
 - Optional dependency: install with `pip install apache-superset[fastmcp]`
@@ -1113,7 +651,6 @@ The MCP (Model Context Protocol) service enables AI assistants and automation to
 #### New Configuration Options

 **Development** (single-user, local testing):
-
 ```python
 # superset_config.py
 MCP_DEV_USERNAME = "admin"  # User for MCP authentication
@@ -1122,7 +659,6 @@ MCP_SERVICE_PORT = 5008
 ```

 **Production** (JWT-based, multi-user):
-
 ```python
 # superset_config.py
 MCP_AUTH_ENABLED = True
@@ -1168,14 +704,12 @@ superset mcp run --port 5008 --use-factory-config
 The MCP service runs as a **separate process** from the Superset web server.

 **Important**:
-
 - Requires same Python environment and configuration as Superset
 - Shares database connections with main Superset app
 - Can be scaled independently from web server
 - Requires `fastmcp` package (optional dependency)

 **Installation**:
-
 ```bash
 # Install with MCP support
 pip install apache-superset[fastmcp]
@@ -1189,7 +723,6 @@ Use systemd, supervisord, or Kubernetes to manage the MCP service process.
 See `superset/mcp_service/PRODUCTION.md` for deployment guides.

 **Security**:
-
 - Development: Uses `MCP_DEV_USERNAME` for single-user access
 - Production: **MUST** configure JWT authentication
 - See `superset/mcp_service/SECURITY.md` for details
@@ -1209,10 +742,8 @@ See `superset/mcp_service/PRODUCTION.md` for deployment guides.
 - [35062](https://github.com/apache/superset/pull/35062): Changed the function signature of `setupExtensions` to `setupCodeOverrides` with options as arguments.

 ### Breaking Changes
-
 - [37370](https://github.com/apache/superset/pull/37370): The `APP_NAME` configuration variable no longer controls the browser window/tab title or other frontend branding. Application names should now be configured using the theme system with the `brandAppName` token. The `APP_NAME` config is still used for backend contexts (MCP service, logs, etc.) and serves as a fallback if `brandAppName` is not set.
  - **Migration:**
-
  ```python
  # Before (Superset 5.x)
  APP_NAME = "My Custom App"
@@ -1256,16 +787,16 @@ See `superset/mcp_service/PRODUCTION.md` for deployment guides.

 Eight M:N association tables move from a synthetic `id INTEGER PRIMARY KEY` to a composite `PRIMARY KEY (fk1, fk2)` on their two foreign-key columns. The surrogate `id` is dropped, and the redundant `UNIQUE (fk1, fk2)` on the two tables that carried one is removed (now subsumed by the PK).

-| Table                  | Composite PK                    |
-| ---------------------- | ------------------------------- |
-| `dashboard_roles`      | `(dashboard_id, role_id)`       |
-| `dashboard_slices`     | `(dashboard_id, slice_id)`      |
-| `dashboard_user`       | `(user_id, dashboard_id)`       |
+| Table | Composite PK |
+|---|---|
+| `dashboard_roles` | `(dashboard_id, role_id)` |
+| `dashboard_slices` | `(dashboard_id, slice_id)` |
+| `dashboard_user` | `(user_id, dashboard_id)` |
 | `report_schedule_user` | `(user_id, report_schedule_id)` |
-| `rls_filter_roles`     | `(role_id, rls_filter_id)`      |
-| `rls_filter_tables`    | `(table_id, rls_filter_id)`     |
-| `slice_user`           | `(user_id, slice_id)`           |
-| `sqlatable_user`       | `(user_id, table_id)`           |
+| `rls_filter_roles` | `(role_id, rls_filter_id)` |
+| `rls_filter_tables` | `(table_id, rls_filter_id)` |
+| `slice_user` | `(user_id, slice_id)` |
+| `sqlatable_user` | `(user_id, table_id)` |

 **Before upgrading:**

@@ -1276,7 +807,6 @@ Eight M:N association tables move from a synthetic `id INTEGER PRIMARY KEY` to a
 For large `dashboard_slices` / `report_schedule_user` tables, see the operator runbook in [#39859](https://github.com/apache/superset/pull/39859) — pre-flight inventory queries, per-dialect lock-window sizing, and the duplicate / NULL-FK roll-up — to plan the maintenance window.

 ## 6.0.0
-
 - [33055](https://github.com/apache/superset/pull/33055): Upgrades Flask-AppBuilder to 5.0.0. The AUTH_OID authentication type has been deprecated and is no longer available as an option in Flask-AppBuilder. OpenID (OID) is considered a deprecated authentication protocol - if you are using AUTH_OID, you will need to migrate to an alternative authentication method such as OAuth, LDAP, or database authentication before upgrading.
 - [34871](https://github.com/apache/superset/pull/34871): Fixed Jest test hanging issue from Ant Design v5 upgrade. MessageChannel is now mocked in test environment to prevent rc-overflow from causing Jest to hang. Test environment only - no production impact.
 - [34782](https://github.com/apache/superset/pull/34782): Dataset exports now include the dataset ID in their file name (similar to charts and dashboards). If managing assets as code, make sure to rename existing dataset YAMLs to include the ID (and avoid duplicated files).
@@ -1285,8 +815,8 @@ For large `dashboard_slices` / `report_schedule_user` tables, see the operator r
  - Change any hex color values to one of: `"success"`, `"processing"`, `"error"`, `"warning"`, `"default"`
  - Custom colors are no longer supported to maintain consistency with Ant Design components
 - [34561](https://github.com/apache/superset/pull/34561) Added tiled screenshot functionality for Playwright-based reports to handle large dashboards more efficiently. When enabled (default: `SCREENSHOT_TILED_ENABLED = True`), dashboards with 20+ charts or height exceeding 5000px will be captured using multiple viewport-sized tiles and combined into a single image. This improves report generation performance and reliability for large dashboards.
-  Note: Pillow is now a required dependency (previously optional) to support image processing for tiled screenshots.
-  `thumbnails` optional dependency is now deprecated and will be removed in the next major release (7.0).
+Note: Pillow is now a required dependency (previously optional) to support image processing for tiled screenshots.
+`thumbnails` optional dependency is now deprecated and will be removed in the next major release (7.0).
 - [33084](https://github.com/apache/superset/pull/33084) The DISALLOWED_SQL_FUNCTIONS configuration now includes additional potentially sensitive database functions across PostgreSQL, MySQL, SQLite, MS SQL Server, and ClickHouse. Existing queries using these functions may now be blocked. Review your SQL Lab queries and dashboards if you encounter "disallowed function" errors after upgrading
 - [34235](https://github.com/apache/superset/pull/34235) CSV exports now use `utf-8-sig` encoding by default to include a UTF-8 BOM, improving compatibility with Excel.
 - [34258](https://github.com/apache/superset/pull/34258) changing the default in Dockerfile to INCLUDE_CHROMIUM="false" (from "true") in the past. This ensures the `lean` layer is lean by default, and people can opt-in to the `chromium` layer by setting the build arg `INCLUDE_CHROMIUM=true`. This is a breaking change for anyone using the `lean` layer, as it will no longer include Chromium by default.
@@ -28,10 +28,8 @@ x-superset-image: &superset-image apachesuperset.docker.scarf.sh/apache/superset
 x-superset-volumes:
  &superset-volumes # /app/pythonpath_docker will be appended to the PYTHONPATH in the final container
  - ./docker:/app/docker
+  - ./superset-core:/app/superset-core
  - superset_home:/app/superset_home
-x-superset-environment: &superset-environment
-  # Tagged images must use their bundled packages rather than host bind mounts.
-  DEV_MODE: "false"

 services:
  redis:
@@ -60,7 +58,6 @@ services:
        required: true
      - path: docker/.env-local # optional override
        required: false
-    environment: *superset-environment
    image: *superset-image
    container_name: superset_app
    command: ["/app/docker/docker-bootstrap.sh", "app-gunicorn"]
@@ -82,7 +79,6 @@ services:
        required: true
      - path: docker/.env-local # optional override
        required: false
-    environment: *superset-environment
    depends_on:
      db:
        condition: service_started
@@ -102,7 +98,6 @@ services:
        required: true
      - path: docker/.env-local # optional override
        required: false
-    environment: *superset-environment
    restart: unless-stopped
    depends_on:
      superset-init:
@@ -125,7 +120,6 @@ services:
        required: true
      - path: docker/.env-local # optional override
        required: false
-    environment: *superset-environment
    restart: unless-stopped
    depends_on:
      superset-init:
@@ -71,7 +71,7 @@ x-common-build: &common-build
  context: .
  target: ${SUPERSET_BUILD_TARGET:-dev} # can use `dev` (default) or `lean`
  cache_from:
-    - apache/superset-cache:3.11-slim-trixie
+    - apache/superset-cache:3.10-slim-trixie
  args:
    DEV_MODE: "true"
    INCLUDE_CHROMIUM: ${INCLUDE_CHROMIUM:-false}
@@ -33,7 +33,7 @@ x-common-build: &common-build
  context: .
  target: dev
  cache_from:
-    - apache/superset-cache:3.11-slim-trixie
+    - apache/superset-cache:3.10-slim-trixie

 services:
  redis:
@@ -34,12 +34,11 @@ x-superset-volumes: &superset-volumes
  - superset_home:/app/superset_home
  - ./tests:/app/tests
  - superset_data:/app/data
-  - ./local_extensions:/app/local_extensions
 x-common-build: &common-build
  context: .
  target: ${SUPERSET_BUILD_TARGET:-dev} # can use `dev` (default) or `lean`
  cache_from:
-    - apache/superset-cache:3.11-slim-trixie
+    - apache/superset-cache:3.10-slim-trixie
  args:
    DEV_MODE: "true"
    INCLUDE_CHROMIUM: ${INCLUDE_CHROMIUM:-false}
@@ -38,7 +38,7 @@ RESET='\033[0m'
 echo -e "${GREEN}Updating package lists...${RESET}"
 apt-get update -qq

-echo -e "${GREEN}Installing packages: $*${RESET}"
+echo -e "${GREEN}Installing packages: $@${RESET}"
 apt-get install -yqq --no-install-recommends "$@"

 echo -e "${GREEN}Autoremoving unnecessary packages...${RESET}"
@@ -98,9 +98,7 @@ case "${1}" in
        echo "  🔒 Werkzeug debugger disabled (set SUPERSET_DEBUG_ENABLED=true to enable)"
    fi

-    flask run -p $PORT --reload $DEBUGGER_FLAG --host=0.0.0.0 \
-      --extra-files "/app/superset/extensions/.reload_trigger" \
-      --exclude-patterns "*/node_modules/*:*/.venv/*:*/build/*:*/__pycache__/*:*/superset-frontend/*:*/superset/__init__.py"
+    flask run -p $PORT --reload $DEBUGGER_FLAG --host=0.0.0.0 --exclude-patterns "*/node_modules/*:*/.venv/*:*/build/*:*/__pycache__/*:*/superset-frontend/*"
    ;;
  app-gunicorn)
    echo "Starting web app..."
@@ -84,11 +84,9 @@ class CeleryConfig:
    broker_url = f"redis://{REDIS_HOST}:{REDIS_PORT}/{REDIS_CELERY_DB}"
    imports = (
        "superset.sql_lab",
-        "superset.tasks.deletion_retention",
        "superset.tasks.scheduler",
        "superset.tasks.thumbnails",
        "superset.tasks.cache",
-        "superset.tasks.export_dashboard_excel",
    )
    result_backend = f"redis://{REDIS_HOST}:{REDIS_PORT}/{REDIS_RESULTS_DB}"
    worker_prefetch_multiplier = 1
@@ -102,13 +100,6 @@ class CeleryConfig:
            "task": "reports.prune_log",
            "schedule": crontab(minute=10, hour=0),
        },
-        # Gated on the SOFT_DELETE feature flag, which is off by default: the
-        # task is scheduled either way, but purges nothing while the flag is
-        # unset. Enable it in FEATURE_FLAGS below to exercise retention locally.
-        "deletion_retention.purge_soft_deleted": {
-            "task": "deletion_retention.purge_soft_deleted",
-            "schedule": crontab(minute=0, hour=0),
-        },
    }


@@ -118,18 +109,11 @@ FEATURE_FLAGS = {
    "ALERT_REPORTS": True,
    "DATASET_FOLDERS": True,
    "ENABLE_EXTENSIONS": True,
-    "MOBILE_CONSUMPTION_MODE": True,
    "SEMANTIC_LAYERS": True,
 }
 EXTENSIONS_PATH = "/app/docker/extensions"
 ALERT_REPORTS_NOTIFICATION_DRY_RUN = True
-# The Docker Compose app service is named "superset" and listens on 8088. Report
-# paths are root-relative, so urljoin drops the base path; only the scheme, host,
-# and port must be correct here. SUPERSET_APP_ROOT is kept for consumers that
-# concatenate paths directly (e.g. cache warm-up). For screenshots in the dev
-# stack (unbuilt static assets) point this at the nginx service instead:
-# http://nginx{SUPERSET_APP_ROOT}/
-WEBDRIVER_BASEURL = f"http://superset:8088{os.environ.get('SUPERSET_APP_ROOT', '/')}/"
+WEBDRIVER_BASEURL = f"http://superset_app{os.environ.get('SUPERSET_APP_ROOT', '/')}/"  # When using docker compose baseurl should be http://superset_nginx{ENV{BASEPATH}}/  # noqa: E501
 # The base URL for the email report hyperlinks.
 WEBDRIVER_BASEURL_USER_FRIENDLY = (
    f"http://localhost:8888/{os.environ.get('SUPERSET_APP_ROOT', '/')}/"
@@ -163,10 +163,10 @@ do
    # Iterate through the components of the version strings
    for (( j=0; j<${#THIS_TAG_NAME_ARRAY[@]}; j++ )); do
        echo "Comparing ${THIS_TAG_NAME_ARRAY[$j]} to ${LATEST_RELEASE_TAG_ARRAY[$j]}"
-        if [[ $((THIS_TAG_NAME_ARRAY[$j])) -gt $((LATEST_RELEASE_TAG_ARRAY[$j])) ]]; then
+        if [[ $((THIS_TAG_NAME_ARRAY[$j])) > $((LATEST_RELEASE_TAG_ARRAY[$j])) ]]; then
            compare_result="greater"
            break
-        elif [[ $((THIS_TAG_NAME_ARRAY[$j])) -lt $((LATEST_RELEASE_TAG_ARRAY[$j])) ]]; then
+        elif [[ $((THIS_TAG_NAME_ARRAY[$j])) < $((LATEST_RELEASE_TAG_ARRAY[$j])) ]]; then
            compare_result="lesser"
            break
        fi
@@ -9,13 +9,11 @@ When working on the Storybook-to-MDX documentation system:
 ## Why This Matters

 The generator (`scripts/generate-superset-components.mjs`) should be lightweight - it extracts data from stories and passes it through. When you add special cases to the generator:
-
 - It becomes harder to maintain
 - Stories diverge from their docs representation
 - Future stories need to know about generator quirks

 When you fix stories to match the expected patterns:
-
 - Stories work identically in Storybook and Docs
 - The generator stays simple and predictable
 - Patterns are consistent and learnable
@@ -23,7 +21,6 @@ When you fix stories to match the expected patterns:
 ## Story Patterns for Docs Generation

 ### Required Structure
-
 ```tsx
 // Use inline export default (NOT const meta = ...; export default meta)
 export default {
@@ -48,7 +45,6 @@ export const InteractiveMyComponent: Story = {
 ```

 ### For Components with Variants (size × style grids)
-
 ```tsx
 const sizes = ['small', 'medium', 'large'];
 const variants = ['primary', 'secondary', 'danger'];
@@ -67,20 +63,16 @@ InteractiveButton.parameters = {
 ```

 ### For Components Requiring Children
-
 ```tsx
 InteractiveIconTooltip.parameters = {
  docs: {
    // Component descriptors with dot notation for nested components
-    sampleChildren: [
-      { component: 'Icons.InfoCircleOutlined', props: { iconSize: 'l' } },
-    ],
+    sampleChildren: [{ component: 'Icons.InfoCircleOutlined', props: { iconSize: 'l' } }],
  },
 };
 ```

 ### For Custom Live Code Examples
-
 ```tsx
 InteractiveMyComponent.parameters = {
  docs: {
@@ -92,7 +84,6 @@ InteractiveMyComponent.parameters = {
 ```

 ### For Complex Props (objects, arrays)
-
 ```tsx
 InteractiveMenu.parameters = {
  docs: {
@@ -108,13 +99,13 @@ InteractiveMenu.parameters = {

 ## Common Issues and How to Fix Them (in the Story)

-| Issue                                   | Wrong Approach                | Right Approach                                    |
-| --------------------------------------- | ----------------------------- | ------------------------------------------------- |
-| Component not generated                 | Add pattern to generator      | Change story to use inline `export default`       |
+| Issue | Wrong Approach | Right Approach |
+|-------|---------------|----------------|
+| Component not generated | Add pattern to generator | Change story to use inline `export default` |
 | Control shows as text instead of select | Add special case in generator | Add `argTypes` with `control: { type: 'select' }` |
-| Missing children/content                | Modify StorybookWrapper       | Add `parameters.docs.sampleChildren`              |
-| Gallery not showing                     | Add to generator output       | Add `parameters.docs.gallery` config              |
-| Wrong live example                      | Hardcode in generator         | Add `parameters.docs.liveExample`                 |
+| Missing children/content | Modify StorybookWrapper | Add `parameters.docs.sampleChildren` |
+| Gallery not showing | Add to generator output | Add `parameters.docs.gallery` config |
+| Wrong live example | Hardcode in generator | Add `parameters.docs.liveExample` |

 ## Files

@@ -1,9 +0,0 @@
-{
-  "$schema": "./node_modules/oxfmt/configuration_schema.json",
-  "singleQuote": true,
-  "trailingComma": "all",
-  "arrowParens": "avoid",
-  "printWidth": 80,
-  "sortPackageJson": false,
-  "ignorePatterns": ["**/*.mdx"]
-}
@@ -0,0 +1,5 @@
+{
+  "singleQuote": true,
+  "trailingComma": "all",
+  "arrowParens": "avoid"
+}
@@ -69,7 +69,6 @@ yarn eslint              # Lint TypeScript/JavaScript files
 ## 📁 Documentation Structure

 ### Main Documentation (`/docs`)
-
 The primary documentation lives in `/docs` with this structure:

 ```
@@ -105,57 +104,54 @@ docs/
 ```

 ### Admin Docs (`/admin_docs`)
-
 Admin-focused content: installation, configuration, security.

 ### Developer Docs (`/developer_docs`)
-
 Developer-focused content: API documentation, architecture guides, CLI tools, code examples.

 ### Component Playground (`/components`)
-
 Interactive component examples for UI development.

 ## 📝 Documentation Standards

 ### File Types
-
 - **`.md` files**: Basic Markdown documents
 - **`.mdx` files**: Markdown with JSX - can include React components
 - **`.tsx` files in `/src`**: Custom React components and pages

 ### Frontmatter Structure
-
 Every documentation page should have frontmatter:

 ```yaml
 ---
 title: Page Title
 description: Brief description for SEO
-sidebar_position: 1 # Optional: controls order in sidebar
+sidebar_position: 1  # Optional: controls order in sidebar
 ---
 ```

 ### MDX Component Usage
-
 MDX files can import and use React components:

-````mdx
+```mdx
 import Tabs from '@theme/Tabs';
 import TabItem from '@theme/TabItem';

 <Tabs>
  <TabItem value="npm" label="npm" default>
-    ```bash npm install superset ```
+    ```bash
+    npm install superset
+    ```
  </TabItem>
  <TabItem value="yarn" label="yarn">
-    ```bash yarn add superset ```
+    ```bash
+    yarn add superset
+    ```
  </TabItem>
 </Tabs>
-````
+```

 ### Code Blocks
-
 Use triple backticks with language identifiers:

 ````markdown
@@ -175,7 +171,6 @@ pip install apache-superset
 ````

 ### Admonitions
-
 Docusaurus supports various admonition types:

 ```markdown
@@ -203,21 +198,20 @@ This is an info box
 ## 🔄 Version Management

 ### Version Configuration
-
 Versions are managed through `versions-config.json`:

 ```json
 {
  "docs": {
    "disabled": false,
-    "lastVersion": "6.0.0", // Default version shown
-    "includeCurrentVersion": true, // Show "Next" version
+    "lastVersion": "6.0.0",        // Default version shown
+    "includeCurrentVersion": true,  // Show "Next" version
    "onlyIncludeVersions": ["current", "6.0.0"],
    "versions": {
      "current": {
        "label": "Next",
        "path": "",
-        "banner": "unreleased" // Shows warning banner
+        "banner": "unreleased"     // Shows warning banner
      },
      "6.0.0": {
        "label": "6.0.0",
@@ -230,7 +224,6 @@ Versions are managed through `versions-config.json`:
 ```

 ### Creating New Versions
-
 **IMPORTANT**: Always use the custom scripts, NOT native Docusaurus commands:

 ```bash
@@ -242,10 +235,8 @@ yarn docusaurus docs:version 6.1.0
 ```

 ### Version Files Created
-
 When versioning, these files are created (per section, with the
 section's plugin id as prefix):
-
 - `<section>_versioned_docs/version-X.X.X/` - Snapshot of current docs
 - `<section>_versioned_sidebars/version-X.X.X-sidebars.json` - Sidebar config
 - `<section>_versions.json` - List of all versions
@@ -255,7 +246,6 @@ Section plugin ids: `user_docs`, `admin_docs`, `developer_docs`, `components`.
 ## 🎨 Styling and Theming

 ### Custom CSS
-
 Add custom styles in `/src/css/custom.css`:

 ```css
@@ -266,14 +256,13 @@ Add custom styles in `/src/css/custom.css`:
 ```

 ### Custom Components
-
 Create React components in `/src/components/`:

 ```tsx
 // src/components/FeatureCard.tsx
 import React from 'react';

-export default function FeatureCard({ title, description }) {
+export default function FeatureCard({title, description}) {
  return (
    <div className="card">
      <h3>{title}</h3>
@@ -288,7 +277,10 @@ Use in MDX:
 ```mdx
 import FeatureCard from '@site/src/components/FeatureCard';

-<FeatureCard title="Fast" description="Lightning fast queries" />
+<FeatureCard
+  title="Fast"
+  description="Lightning fast queries"
+/>
 ```

 ## 📦 Key Dependencies
@@ -303,7 +295,6 @@ import FeatureCard from '@site/src/components/FeatureCard';
 ## 🔗 Linking Strategies

 ### Internal Links
-
 Use relative paths for internal documentation:

 ```markdown
@@ -312,7 +303,6 @@ Use relative paths for internal documentation:
 ```

 ### External Links
-
 Always use full URLs:

 ```markdown
@@ -320,7 +310,6 @@ Always use full URLs:
 ```

 ### Linking to Code
-
 Reference code in the main repository:

 ```markdown
@@ -330,24 +319,21 @@ See the [main configuration file](https://github.com/apache/superset/blob/master
 ## 🛠️ Common Documentation Tasks

 ### Adding a New Guide
-
 1. Create the `.mdx` file in the appropriate directory
 2. Add frontmatter with title and description
 3. Update sidebar if needed (for manual sidebar configs)

 ### Adding API Documentation
-
 The API docs use Swagger UI embedded in `/docs/api.mdx`:

 ```mdx
-import SwaggerUI from 'swagger-ui-react';
-import 'swagger-ui-react/swagger-ui.css';
+import SwaggerUI from "swagger-ui-react";
+import "swagger-ui-react/swagger-ui.css";

 <SwaggerUI url="/api/v1/openapi.json" />
 ```

 ### Adding Interactive Examples
-
 Use MDX to create interactive documentation:

 ```mdx
@@ -374,7 +360,6 @@ When creating or updating documentation:
 ## 🔍 Searching and Navigation

 ### Sidebar Configuration
-
 Sidebars are configured in `/sidebars.js`:

 ```javascript
@@ -400,7 +385,6 @@ module.exports = {
 ```

 ### Search
-
 Docusaurus includes Algolia DocSearch integration configured in `docusaurus.config.ts`.

 ## 🚫 Common Pitfalls to Avoid
@@ -414,7 +398,6 @@ Docusaurus includes Algolia DocSearch integration configured in `docusaurus.conf
 ## 🔧 Troubleshooting

 ### Dev Server Issues
-
 ```bash
 yarn stop     # Kill any running servers
 yarn clear    # Clear cache
@@ -422,7 +405,6 @@ yarn start    # Restart
 ```

 ### Build Failures
-
 ```bash
 # Check for broken links
 yarn build
@@ -435,9 +417,7 @@ yarn eslint
 ```

 ### Version Issues
-
 If versions don't appear in dropdown:
-
 1. Check `versions-config.json` includes the version
 2. Verify version files exist in `<section>_versioned_docs/`
 3. Restart dev server
@@ -452,10 +432,9 @@ If versions don't appear in dropdown:
 ## 📖 Real Examples and Patterns

 ### Example: Configuration Documentation Pattern
-
 From `docs/configuration/configuring-superset.mdx`:

-````mdx
+```mdx
 ---
 title: Configuring Superset
 hide_title: true
@@ -473,9 +452,7 @@ Superset exposes hundreds of configurable parameters through its
 ```bash
 export SUPERSET_CONFIG_PATH=/app/superset_config.py
 ```
-````
-
-````
+```

 **Key patterns:**
 - Links to source code for reference
@@ -499,10 +476,9 @@ documentation at [docs.preset.io](https://docs.preset.io/).
 ### Connecting to a new database

 <img src={useBaseUrl("/img/tutorial/tutorial_01_add_database_connection.png")} width="600" />
-````
+```

 **Key patterns:**
-
 - Import Docusaurus hooks for dynamic URLs
 - Use of admonitions (:::tip) for helpful information
 - Screenshots with useBaseUrl for proper path resolution
@@ -510,12 +486,11 @@ documentation at [docs.preset.io](https://docs.preset.io/).
 - Step-by-step visual guides

 ### Example: API Documentation Pattern
-
 From `docs/api.mdx`:

 ```mdx
-import SwaggerUI from 'swagger-ui-react';
-import 'swagger-ui-react/swagger-ui.css';
+import SwaggerUI from "swagger-ui-react";
+import "swagger-ui-react/swagger-ui.css";

 ## API Documentation

@@ -523,7 +498,6 @@ import 'swagger-ui-react/swagger-ui.css';
 ```

 **Key patterns:**
-
 - Embedding interactive Swagger UI
 - Importing necessary CSS
 - Direct API spec integration
@@ -534,39 +508,49 @@ import 'swagger-ui-react/swagger-ui.css';
 // For images in static folder
 import useBaseUrl from "@docusaurus/useBaseUrl";

-<img src={useBaseUrl('/img/feature-screenshot.png')} width="600" />
+<img src={useBaseUrl("/img/feature-screenshot.png")} width="600" />

 // With caption
-
 <figure>
-  <img src={useBaseUrl('/img/dashboard.png')} alt="Dashboard view" />
+  <img src={useBaseUrl("/img/dashboard.png")} alt="Dashboard view" />
  <figcaption>Superset Dashboard Interface</figcaption>
 </figure>
 ```

 ### Multi-Tab Code Examples

-````mdx
+```mdx
 import Tabs from '@theme/Tabs';
 import TabItem from '@theme/TabItem';

 <Tabs
  defaultValue="docker"
  values={[
-    { label: 'Docker', value: 'docker' },
-    { label: 'Kubernetes', value: 'k8s' },
-    { label: 'PyPI', value: 'pypi' },
-  ]}
->
-  <TabItem value="docker">```bash docker-compose up ```</TabItem>
-  <TabItem value="k8s">```bash kubectl apply -f superset.yaml ```</TabItem>
-  <TabItem value="pypi">```bash pip install apache-superset ```</TabItem>
+    {label: 'Docker', value: 'docker'},
+    {label: 'Kubernetes', value: 'k8s'},
+    {label: 'PyPI', value: 'pypi'},
+  ]}>
+  <TabItem value="docker">
+    ```bash
+    docker-compose up
+    ```
+  </TabItem>
+  <TabItem value="k8s">
+    ```bash
+    kubectl apply -f superset.yaml
+    ```
+  </TabItem>
+  <TabItem value="pypi">
+    ```bash
+    pip install apache-superset
+    ```
+  </TabItem>
 </Tabs>
-````
+```

 ### Configuration File Examples

-````mdx
+```mdx
 ```python title="superset_config.py"
 # Database connection example
 SQLALCHEMY_DATABASE_URI = 'postgresql://user:password@localhost/superset'
@@ -581,9 +565,7 @@ FEATURE_FLAGS = {
    'DASHBOARD_NATIVE_FILTERS': True,
 }
 ```
-````
-
-````
+```

 ### Cross-Referencing Pattern

@@ -596,11 +578,11 @@ For detailed configuration options, see:
 External resources:
 - [SQLAlchemy Documentation](https://docs.sqlalchemy.org/)
 - [Flask Configuration](https://flask.palletsprojects.com/config/)
-````
+```

 ### Writing Installation Guides

-````mdx
+```mdx
 ## Prerequisites

 :::warning
@@ -614,10 +596,8 @@ Ensure you have Python 3.9+ and Node.js 16+ installed before proceeding.
   git clone https://github.com/apache/superset.git
   cd superset
   ```
-````

 2. **Install Python dependencies**
-
   ```bash
   pip install -e .
   ```
@@ -631,8 +611,7 @@ Ensure you have Python 3.9+ and Node.js 16+ installed before proceeding.
 :::tip Success Check
 Navigate to http://localhost:8088 and login with admin/admin
 :::
-
-````
+```

 ### Documenting API Endpoints

@@ -651,10 +630,9 @@ Returns a list of charts.
 ```bash
 curl -X GET "http://localhost:8088/api/v1/chart/" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
-````
+```

 **Example Response:**
-
 ```json
 {
  "count": 42,
@@ -667,10 +645,8 @@ curl -X GET "http://localhost:8088/api/v1/chart/" \
  ]
 }
 ```
-
 ```

 ---

 **Note**: This documentation site serves as the primary resource for Superset users, administrators, and contributors. Always prioritize clarity, accuracy, and completeness when creating or updating documentation.
-```
@@ -66,7 +66,6 @@ yarn version:add:components 1.2.0
 ```

 What the script does:
-
 1. Refreshes auto-generated content via `generate:smart` (database pages, API reference, component pages).
 2. Calls `yarn docusaurus docs:version` (or the per-section equivalent) to snapshot the section.
 3. Freezes any data-file imports (`@site/static/*.json`, `../../data/*.json`) into a snapshot-local `_versioned_data/` dir so the historical version doesn't silently mutate when the source files change.
@@ -74,7 +73,6 @@ What the script does:
 5. Updates `versions-config.json` and `<section>_versions.json`.

 **Do NOT use** the native Docusaurus commands directly (`yarn docusaurus docs:version`), as they will:
-
 - ❌ Create version files but NOT update `versions-config.json`
 - ❌ Skip auto-gen refresh, freezing whatever was on disk
 - ❌ Skip data-import freezing, leaving the snapshot pointed at live data
@@ -84,11 +82,9 @@ What the script does:
 ### Managing Versions

 #### With Automated Scripts
-
 The automated scripts handle all configuration updates automatically. No manual editing required!

 #### Manual Configuration
-
 If creating versions manually, you'll need to:

 1. **Update `versions-config.json`** (or `docusaurus.config.ts` if not using dynamic config):
@@ -113,7 +109,6 @@ If creating versions manually, you'll need to:
 ### Removing a Version

 #### Using Automated Scripts (Recommended)
-
 ```bash
 # Main Documentation
 yarn version:remove:user_docs 1.0.0
@@ -129,7 +124,6 @@ yarn version:remove:components 1.0.0
 ```

 #### Manual Removal
-
 To manually remove a version:

 1. **Delete the version folder** from the appropriate location:
@@ -159,7 +153,6 @@ To manually remove a version:
 ### Version Configuration Examples

 #### Main Documentation (default plugin)
-
 ```typescript
 docs: {
  includeCurrentVersion: true,
@@ -181,7 +174,6 @@ docs: {
 ```

 #### Developer Docs & Components (custom plugins)
-
 ```typescript
 {
  id: 'developer_docs',
@@ -218,28 +210,23 @@ docs: {
 #### Version Not Showing After Creation

 If you accidentally used `yarn docusaurus docs:version` instead of `yarn version:add`:
-
 1. **Problem**: The version files were created but `versions-config.json` wasn't updated
 2. **Solution**: Either:
   - Revert the changes: `git restore user_docs_versions.json && rm -rf user_docs_versioned_docs/ user_docs_versioned_sidebars/`
   - Then use the correct command: `yarn version:add:user_docs <version>`

 For other issues:
-
 - **Restart the server**: Changes to version configuration require a server restart
 - **Check config file**: Ensure `versions-config.json` includes the new version
 - **Verify files exist**: Check that versioned docs folder was created

 #### Broken Links in Versioned Documentation
-
 When creating a new version, links in the documentation are preserved as-is. Common issues:
-
 - **Cross-section links**: Links between sections (e.g., from developer_docs to docs) need to be version-aware
 - **Absolute vs relative paths**: Use relative paths within the same section
 - **Version-specific URLs**: Update hardcoded URLs to use version variables

 To fix broken links:
-
 1. Use `type: 'doc'` with `docId` for version-aware navigation in navbar
 2. Use relative paths within the same documentation section
 3. Test all versions after creation to identify broken links
@@ -9,8 +9,8 @@ version: 2

 Users can configure automated alerts and reports to send dashboards or charts to an email recipient or Slack channel.

- _Alerts_ are sent when a SQL condition is reached
- _Reports_ are sent on a schedule
+- *Alerts* are sent when a SQL condition is reached
+- *Reports* are sent on a schedule

 Alerts and reports are disabled by default. To turn them on, you'll need to change configuration settings and install a suitable headless browser in your environment.

@@ -26,18 +26,16 @@ Alerts and reports are disabled by default. To turn them on, you'll need to chan
  - emails: `SMTP_*` settings
  - Slack messages: `SLACK_API_TOKEN`
 - Users can customize the email subject by including date code placeholders, which will automatically be replaced with the corresponding UTC date when the email is sent. To enable this functionality, activate the `"DATE_FORMAT_IN_EMAIL_SUBJECT"` [feature flag](/admin-docs/configuration/configuring-superset#feature-flags). This enables date formatting in email subjects, preventing all reporting emails from being grouped into the same thread (optional for the reporting feature).
-  - Use date codes from [strftime.org](https://strftime.org/) to create the email subject.
-  - If no date code is provided, the original string will be used as the email subject.
- Each alert/report has an "Include a link back to Superset" option (enabled by default) controlling whether the call-to-action link is included in email and Slack notifications. The link text in emails is configurable via `EMAIL_REPORTS_CTA`; the Slack message always uses "Explore in Superset". Uncheck the option when recipients should not receive a link to your Superset host, e.g. for external audiences.
+    - Use date codes from [strftime.org](https://strftime.org/) to create the email subject.
+    - If no date code is provided, the original string will be used as the email subject.

 ##### Disable dry-run mode

-Screenshots will be taken but no messages actually sent as long as `ALERT_REPORTS_NOTIFICATION_DRY_RUN = True`, its default value in `docker/pythonpath_dev/superset_config.py`. To disable dry-run mode and start receiving email/Slack notifications, set `ALERT_REPORTS_NOTIFICATION_DRY_RUN` to `False` in [superset config](https://github.com/apache/superset/blob/master/docker/pythonpath_dev/superset_config.py).
+Screenshots will be taken but no messages actually sent as long as `ALERT_REPORTS_NOTIFICATION_DRY_RUN = True`, its default value in `docker/pythonpath_dev/superset_config.py`.  To disable dry-run mode and start receiving email/Slack notifications, set `ALERT_REPORTS_NOTIFICATION_DRY_RUN` to `False` in [superset config](https://github.com/apache/superset/blob/master/docker/pythonpath_dev/superset_config.py).

 #### In your `Dockerfile`

 You'll need to extend the Superset image to include a headless browser. Your options include:
-
 - Use Playwright with Chromium: this is the recommended approach as of version 4.1.x or greater. Playwright always uses Chromium — the `WEBDRIVER_TYPE` config setting has no effect when Playwright is active. A working example of a Dockerfile that installs these tools is provided under "Building your own production Docker image" on the [Docker Builds](/admin-docs/installation/docker-builds#building-your-own-production-docker-image) page. Enable the `PLAYWRIGHT_REPORTS_AND_THUMBNAILS` feature flag in your config to activate it.
 - Use Firefox (Selenium): you'll need to install geckodriver and Firefox. Set `WEBDRIVER_TYPE` to `"firefox"` in your `superset_config.py`.
 - Use Chrome (Selenium): you'll need to install Chrome. Set `WEBDRIVER_TYPE` to `"chrome"` in your `superset_config.py`.
@@ -83,28 +81,6 @@ SLACK_CACHE_TIMEOUT = int(timedelta(days=2).total_seconds())
 SLACK_API_RATE_LIMIT_RETRY_COUNT = 5
 ```

-When the cache backend is `SupersetMetastoreCache`, report execution does not
-write channel listings into the cache because that backend commits the report's
-database session. Schedule the dedicated warm-up task so cache misses are
-repopulated outside report transactions:
-
-```python
-from celery.schedules import crontab
-
-from superset.config import CeleryConfig
-
-class CustomCeleryConfig(CeleryConfig):
-    beat_schedule = {
-        **CeleryConfig.beat_schedule,
-        "slack.cache_channels": {
-            "task": "slack.cache_channels",
-            "schedule": crontab(minute="0", hour="*"),
-        },
-    }
-
-CELERY_CONFIG = CustomCeleryConfig
-```
-
 #### Slack Enterprise Grid (org-scoped tokens)

 On a Slack Enterprise Grid org, an org-scoped token spans multiple workspaces, so
@@ -120,38 +96,6 @@ SLACK_TEAM_ID = "T01234567"
 This defaults to `None` and only needs to be set when using an org-scoped token;
 it is accepted but ignored for standard workspace-level tokens.

-#### Slack delivery timeouts and retries
-
-Slack delivery uses a request timeout and an application retry budget:
-
-```python
-# Timeout for one Slack API request, in seconds
-SLACK_API_TIMEOUT = 30
-
-# Retry budget shared by every Slack destination and upload phase
-SLACK_SEND_RETRY_MAX_TIME = 150
-
-# Number of explicit HTTP 429 responses retried using Slack's Retry-After value
-SLACK_API_RATE_LIMIT_RETRY_COUNT = 2
-
-# Cooldown after an on-demand channel-cache refresh
-SLACK_CHANNEL_REFRESH_COOLDOWN_SECONDS = 300
-```
-
-All channels and upload phases in one report execution share a single
-`SLACK_SEND_RETRY_MAX_TIME` budget. This prevents a large recipient list from
-multiplying the report's wall-clock retry time. The budget is also clamped to
-the report's remaining working timeout, leaving Celery's configured timeout lag
-available for final state persistence. The effective configured budget is at
-least one second longer than `SLACK_API_TIMEOUT`.
-
-To avoid posting the same report twice, Superset does not replay terminal
-`chat.postMessage` or `files.completeUploadExternal` operations after ambiguous
-server or transport failures. Explicit Slack HTTP 429 responses remain
-retryable. These delivery settings and semantics apply to Slack v2 reports and
-legacy text-only Slack delivery, independently of the
-`ALERT_REPORT_SLACK_V2` feature flag.
-
 ### Webhook integration

 Superset can send alert and report notifications to any HTTP endpoint — useful for chat platforms, incident management tools, or custom automation.
@@ -187,7 +131,7 @@ Superset sends an HTTP POST with `Content-Type: application/json`:
  },
  "text": "Alert condition met: value exceeded threshold",
  "description": "Monthly revenue dropped below target",
-  "url": "https://your-superset-host/dashboard/1/"
+  "url": "https://your-superset-host/superset/dashboard/1/"
 }
 ```

@@ -229,16 +173,6 @@ ALERT_REPORTS_WEBHOOK_HTTPS_ONLY = True

 When enabled, Superset rejects webhook configurations that use `http://` URLs.

-#### Request Timeout
-
-Webhook deliveries use a socket timeout so a request can't hang forever if the webhook target is unreachable, which would otherwise leave the report schedule stuck in a `WORKING` state. Configure it with:
-
-```python
-ALERT_REPORTS_WEBHOOK_TIMEOUT = 60  # seconds
-```
-
-Set to `None` to disable the timeout (not recommended).
-
 #### Retry Behavior

 Superset automatically retries webhook deliveries on `429 Too Many Requests` and `5xx` server errors using exponential backoff. Retries are bounded to roughly 120 seconds of cumulative wall-clock time (worst case ~210 seconds, because the bound is checked against the time elapsed before each attempt, so the final request can begin just under the limit and still run its full request timeout), after which the delivery is abandoned.
@@ -270,7 +204,7 @@ You need to replace default values with your custom Redis, Slack and/or SMTP con
 Superset uses Celery beat and Celery worker(s) to send alerts and reports.

 - The beat is the scheduler that tells the worker when to perform its tasks. This schedule is defined when you create the alert or report.
- The worker will process the tasks that need to be performed when an alert or report is fired.
+- The worker will process the  tasks that need to be performed when an alert or report is fired.

 In the `CeleryConfig`, only the `beat_schedule` is relevant to this feature, the rest of the `CeleryConfig` can be changed for your needs.

@@ -310,53 +244,6 @@ class CeleryConfig:
    }
 CELERY_CONFIG = CeleryConfig

-# Scheduled reports share one deadline across browser readiness, capture/PDF
-# generation, delivery, and terminal-state persistence. The effective budget
-# for a schedule is min(this value, the schedule's working_timeout), so the
-# per-schedule field keeps its meaning as a user-facing cap. The default (one
-# hour) matches the historical working_timeout default, so upgrading changes
-# no default behavior; lower it to enforce a tighter report SLA.
-ALERT_REPORTS_EXECUTION_BUDGET_SECONDS = 3600
-
-# These reserves are part of (not additions to) the total budget and their sum
-# must be less than it. Readiness polling stops in time to leave capacity for
-# the later phases.
-ALERT_REPORTS_EXECUTION_CAPTURE_RESERVE_SECONDS = 60
-ALERT_REPORTS_EXECUTION_DELIVERY_RESERVE_SECONDS = 120
-ALERT_REPORTS_EXECUTION_CLEANUP_RESERVE_SECONDS = 30
-
-# Celery's hard limit leaves this additional window for terminal cleanup after
-# the soft limit, which equals the resolved execution budget (the configured
-# budget capped by each schedule's working_timeout).
-# ALERT_REPORTS_WORKING_TIME_OUT_KILL controls these Celery limits; disabling
-# it does not disable the application deadline above.
-ALERT_REPORTS_EXECUTION_HARD_TIMEOUT_GRACE_SECONDS = 30
-
-# Invalid budget/reserve combinations fail application startup instead of
-# allowing every scheduled report to fail later. A report Celery soft timeout
-# records ERROR and increments `reports.execute.celery_soft_timeout`; it does
-# not attempt an in-band customer error notification during the hard-limit
-# grace window. Alert schedules retain their existing timeout notifications.
-#
-# The application deadline is cooperative between synchronous phases. The
-# Celery limits provide the final preemption boundary when the worker pool
-# supports them; PDF construction is checked immediately before and after the
-# synchronous builder but cannot be interrupted inside that call.
-#
-# Sizing the budget against infrastructure limits:
-# - Kubernetes (or similar) pod termination grace must exceed
-#   budget + hard-timeout grace, or in-flight reports are killed mid-run on
-#   every deploy/node drain despite the application deadline.
-# - The web server's per-request timeout (e.g. gunicorn ``timeout``) bounds
-#   each individual chart data request made by the headless browser -- not
-#   the report as a whole. Readiness allowance beyond that per-request
-#   ceiling buys nothing for a single slow chart (its request dies at the
-#   web layer and the chart reaches an error state), but multi-chart and
-#   tiled captures legitimately accumulate total time well past it.
-
-# Screenshot-specific waits continue to apply to thumbnails and other
-# standalone screenshot calls. Scheduled reports derive their waits from the
-# shared execution deadline above.
 SCREENSHOT_LOCATE_WAIT = 100
 SCREENSHOT_LOAD_WAIT = 600

@@ -390,7 +277,7 @@ WEBDRIVER_OPTION_ARGS = [
 ]

 # This is for internal use, you can keep http
-WEBDRIVER_BASEURL = "http://superset:8088" # This is also the default for Docker Compose, where the app service is named "superset"
+WEBDRIVER_BASEURL = "http://superset:8088" # When running using docker compose use "http://superset_app:8088'
 # This is the link sent to the recipient. Change to your domain, e.g. https://superset.mydomain.com
 WEBDRIVER_BASEURL_USER_FRIENDLY = "http://localhost:8088"
 ```
@@ -426,7 +313,7 @@ Please refer to `ExecutorType` in the codebase for other executor types.

 It's also possible to specify a minimum interval between each report's execution through the config file:

-```python
+``` python
 # Set a minimum interval threshold between executions (for each Alert/Report)
 # Value should be an integer
 ALERT_MINIMUM_INTERVAL = int(timedelta(minutes=10).total_seconds())
@@ -435,7 +322,7 @@ REPORT_MINIMUM_INTERVAL = int(timedelta(minutes=5).total_seconds())

 Alternatively, you can assign a function to `ALERT_MINIMUM_INTERVAL` and/or `REPORT_MINIMUM_INTERVAL`. This is useful to dynamically retrieve a value as needed:

-```python
+``` python
 def alert_dynamic_minimal_interval(**kwargs) -> int:
    """
    Define logic here to retrieve the value dynamically
@@ -448,7 +335,7 @@ ALERT_MINIMUM_INTERVAL = alert_dynamic_minimal_interval

 For security, Superset rewrites external links in alert/report email HTML so
 they go through a warning page before the user is navigated to the external
-site. Internal links (matching your configured base URL) are not affected.
+site.  Internal links (matching your configured base URL) are not affected.

 ```python
 # Disable external link redirection entirely (default: True)
@@ -460,17 +347,17 @@ to determine which hosts are internal.

 ## Troubleshooting

-There are many reasons that reports might not be working. Try these steps to check for specific issues.
+There are many reasons that reports might not be working.  Try these steps to check for specific issues.

 ### Confirm feature flag is enabled and you have sufficient permissions

-If you don't see "Alerts & Reports" under the _Manage_ section of the Settings dropdown in the Superset UI, you need to enable the `ALERT_REPORTS` feature flag (see above). Enable another feature flag and check to see that it took effect, to verify that your config file is getting loaded.
+If you don't see "Alerts & Reports" under the *Manage* section of the Settings dropdown in the Superset UI, you need to enable the `ALERT_REPORTS` feature flag (see above). Enable another feature flag and check to see that it took effect, to verify that your config file is getting loaded.

 Log in as an admin user to ensure you have adequate permissions.

 ### Check the logs of your Celery worker

-This is the best source of information about the problem. In a docker compose deployment, you can do this with a command like `docker logs superset_worker --since 1h`.
+This is the best source of information about the problem.  In a docker compose deployment, you can do this with a command like `docker logs superset_worker --since 1h`.

 ### Check web browser and webdriver installation

@@ -482,7 +369,7 @@ If you are handling the installation of the headless browser on your own, do you

 One symptom of an invalid connection to an email server is receiving an error of `[Errno 110] Connection timed out` in your logs when the report tries to send.

-Confirm via testing that your outbound email configuration is correct. Here is the simplest test, for an un-authenticated email SMTP email service running on port 25. If you are sending over SSL, for instance, study how [Superset's codebase sends emails](https://github.com/apache/superset/blob/master/superset/utils/core.py#L818) and then test with those commands and arguments.
+Confirm via testing that your outbound email configuration is correct.  Here is the simplest test, for an un-authenticated email SMTP email service running on port 25.  If you are sending over SSL, for instance, study how [Superset's codebase sends emails](https://github.com/apache/superset/blob/master/superset/utils/core.py#L818) and then test with those commands and arguments.

 Start Python in your worker environment, replace all example values, and run:

@@ -508,16 +395,16 @@ This should send an email.

 Possible fixes:

- Some cloud hosts disable outgoing unauthenticated SMTP email to prevent spam. For instance, [Azure blocks port 25 by default on some machines](https://learn.microsoft.com/en-us/azure/virtual-network/troubleshoot-outbound-smtp-connectivity). Enable that port or use another sending method.
+- Some cloud hosts disable outgoing unauthenticated SMTP email to prevent spam.  For instance, [Azure blocks port 25 by default on some machines](https://learn.microsoft.com/en-us/azure/virtual-network/troubleshoot-outbound-smtp-connectivity). Enable that port or use another sending method.
 - Use another set of SMTP credentials that you verify works in this setup.

 ### Browse to your report from the worker

-The worker may be unable to reach the report. It will use the value of `WEBDRIVER_BASEURL` to browse to the report. If that route is invalid, or presents an authentication challenge that the worker can't pass, the report screenshot will fail.
+The worker may be unable to reach the report. It will use the value of `WEBDRIVER_BASEURL` to browse to the report.  If that route is invalid, or presents an authentication challenge that the worker can't pass, the report screenshot will fail.

-Check this by attempting to `curl` the URL of a report that you see in the error logs of your worker. For instance, from the worker environment, run `curl http://superset:8088/dashboard/1/`. You may get different responses depending on whether the dashboard exists - for example, you may need to change the `1` in that URL. If there's a URL in your logs from a failed report screenshot, that's a good place to start. The goal is to determine a valid value for `WEBDRIVER_BASEURL` and determine if an issue like HTTPS or authentication is redirecting your worker.
+Check this by attempting to `curl` the URL of a report that you see in the error logs of your worker. For instance, from the worker environment, run `curl http://superset_app:8088/superset/dashboard/1/`. You may get different responses depending on whether the dashboard exists - for example, you may need to change the `1` in that URL. If there's a URL in your logs from a failed report screenshot, that's a good place to start. The goal is to determine a valid value for `WEBDRIVER_BASEURL` and determine if an issue like HTTPS or authentication is redirecting your worker.

-In a deployment with authentication measures enabled like HTTPS and Single Sign-On, it may make sense to have the worker navigate directly to the Superset application running in the same location, avoiding the need to sign in. For instance, you could use `WEBDRIVER_BASEURL="http://superset:8088"` for a docker compose deployment, and set `"force_https": False,` in your `TALISMAN_CONFIG` — appropriate only for an isolated development stack or when HTTPS is enforced by a trusted proxy in front of Superset.
+In a deployment with authentication measures enabled like HTTPS and Single Sign-On, it may make sense to have the worker navigate directly to the Superset application running in the same location, avoiding the need to sign in.  For instance, you could use `WEBDRIVER_BASEURL="http://superset_app:8088"` for a docker compose deployment, and set `"force_https": False,` in your `TALISMAN_CONFIG`.

 ### Duplicate report deliveries

@@ -625,7 +512,6 @@ schedule the queries that have `schedule_info` in their JSON metadata. For sched
 Airflow, additional fields can be easily added to the configuration file above.

 :::resources
-
 - [Tutorial: Automated Alerts and Reporting via Slack/Email in Superset](https://dev.to/ngtduc693/apache-superset-topic-5-automated-alerts-and-reporting-via-slackemail-in-superset-2gbe)
 - [Blog: Integrating Slack alerts and Apache Superset for better data observability](https://medium.com/affinityanswers-tech/integrating-slack-alerts-and-apache-superset-for-better-data-observability-fd2f9a12c350)
-  :::
+:::
@@ -54,8 +54,8 @@ celery --app=superset.tasks.celery_app:app beat

 To setup a result backend, you need to pass an instance of a derivative of `BaseCache` (`from
 flask_caching.backends.base import BaseCache`) to the RESULTS_BACKEND configuration key in your
-superset_config.py. You can use Memcached, Redis, S3, MinIO, memory
-or the file system (in a single server-type setup or for testing), or to write your own
+superset_config.py. You can use Memcached, Redis, S3 (https://pypi.python.org/pypi/s3werkzeugcache),
+memory or the file system (in a single server-type setup or for testing), or to write your own
 caching interface. Your `superset_config.py` may look something like:

 ```python
@@ -89,12 +89,6 @@ issues arise. Please clear your existing results cache store when upgrading an e
 - SQL Lab will _only run your queries asynchronously if_ you enable **Asynchronous Query Execution**
  in your database settings (Sources > Databases > Edit record).

- In order to use dedicated results backend, additional python libraries must be installed. These libraries can be installed using pip.
-  - [redis-py](https://pypi.org/project/redis/) for Redis.
-  - [pylibmc](https://pypi.org/project/pylibmc/) for memcached
-  - [s3werkzeugcache](https://pypi.python.org/pypi/s3werkzeugcache) for S3
-  - [minio-flask-cache](https://github.com/greggailly/minio-flask-cache) for MinIO or other S3 compatible service
-
 ## Celery Flower

 Flower is a web based tool for monitoring the Celery cluster which you can install from pip:
@@ -110,6 +104,5 @@ celery --app=superset.tasks.celery_app:app flower
 ```

 :::resources
-
 - [Blog: How to Set Up Global Async Queries (GAQ) in Apache Superset](https://medium.com/@ngigilevis/how-to-set-up-global-async-queries-gaq-in-apache-superset-a-complete-guide-9d2f4a047559)
-  :::
+:::
@@ -13,7 +13,7 @@ Cross-account IAM role assumption via STS `AssumeRole` is supported, allowing a

 ## Prerequisites

- Enable the `AWS_DATABASE_IAM_AUTH` feature flag in `superset_config.py`. IAM authentication is gated behind this flag; if it is disabled, connections using `aws_iam` fail with _"AWS IAM database authentication is not enabled."_
+- Enable the `AWS_DATABASE_IAM_AUTH` feature flag in `superset_config.py`. IAM authentication is gated behind this flag; if it is disabled, connections using `aws_iam` fail with *"AWS IAM database authentication is not enabled."*
  ```python
  FEATURE_FLAGS = {
      "AWS_DATABASE_IAM_AUTH": True,
@@ -48,14 +48,14 @@ IAM authentication is configured via the **encrypted_extra** field of the databa
 }
 ```

-| Field              | Required | Description                                                                              |
-| ------------------ | -------- | ---------------------------------------------------------------------------------------- |
-| `enabled`          | Yes      | Set to `true` to activate IAM auth                                                       |
-| `role_arn`         | No       | ARN of the cross-account IAM role to assume via STS. Omit for same-account auth          |
-| `external_id`      | No       | External ID for the STS `AssumeRole` call, if required by the target role's trust policy |
-| `region`           | Yes      | AWS region of the database cluster                                                       |
-| `db_username`      | Yes      | The database username associated with the IAM identity                                   |
-| `session_duration` | No       | STS session duration in seconds (default: `3600`)                                        |
+| Field | Required | Description |
+|-------|----------|-------------|
+| `enabled` | Yes | Set to `true` to activate IAM auth |
+| `role_arn` | No | ARN of the cross-account IAM role to assume via STS. Omit for same-account auth |
+| `external_id` | No | External ID for the STS `AssumeRole` call, if required by the target role's trust policy |
+| `region` | Yes | AWS region of the database cluster |
+| `db_username` | Yes | The database username associated with the IAM identity |
+| `session_duration` | No | STS session duration in seconds (default: `3600`) |

 ### Redshift (Serverless)

@@ -15,8 +15,9 @@ fail-fast behavior ensures operators are immediately aware of infrastructure iss

 Superset uses [Flask-Caching](https://flask-caching.readthedocs.io/) for caching purposes.
 Flask-Caching supports various caching backends, including Redis (recommended), Memcached,
-SimpleCache (in-memory), MinIO/S3, or the local filesystem.
-[Custom cache backends](https://flask-caching.readthedocs.io/en/latest/#custom-cache-backends) are also supported.
+SimpleCache (in-memory), or the local filesystem.
+[Custom cache backends](https://flask-caching.readthedocs.io/en/latest/#custom-cache-backends)
+are also supported.

 Caching can be configured by providing dictionaries in
 `superset_config.py` that comply with [the Flask-Caching config specifications](https://flask-caching.readthedocs.io/en/latest/#configuring-flask-caching).
@@ -46,7 +47,6 @@ In order to use dedicated cache stores, additional python libraries must be inst
 - For Redis: we recommend the [redis](https://pypi.python.org/pypi/redis) Python package
 - Memcached: we recommend using [pylibmc](https://pypi.org/project/pylibmc/) client library as
  `python-memcached` does not handle storing binary data correctly.
- MinIO (S3): we recommend using the [minio-flask-cache](https://github.com/greggailly/minio-flask-cache) package

 These libraries can be installed using pip.

@@ -76,21 +76,6 @@ value defined in `DATA_CACHE_CONFIG`.
 Note, that by setting the cache timeout to `-1`, caching for charting data can be disabled, either
 per chart, dataset or database, or by default if set in `DATA_CACHE_CONFIG`.

-## Limiting Cached Result Size
-
-Very large chart or SQL query results can flood the cache backend (Redis/Memcached), evicting many
-smaller useful entries or exhausting memory. To cap the size of any single value written to the data
-cache, set `DATA_CACHE_MAX_VALUE_SIZE` (in bytes) in `superset_config.py`:
-
-```python
-DATA_CACHE_MAX_VALUE_SIZE = 10 * 1024 * 1024  # 10 MB
-```
-
-When a result's serialized size exceeds this threshold it is not written to the data cache — the
-chart still renders, but the next load re-queries the datasource instead of getting a cache hit. The
-`skip_cache_value_too_large` statsd metric is incremented each time this happens. Set to `None` (the
-default) to disable the check.
-
 ## SQL Lab Query Results

 Caching for SQL Lab query results is used when async queries are enabled and is configured using
@@ -134,50 +119,6 @@ CELERY_CONFIG = CustomCeleryConfig
 This will cache the top 5 most popular dashboards every hour. For other
 strategies, check the `superset/tasks/cache.py` file.

-### Warming Up Native Filter Options
-
-Native filter Value-type dropdown option queries (e.g. `SELECT DISTINCT column FROM table`) are
-cached the same way as chart data, via `DATA_CACHE_CONFIG`. However, the strategies above only warm
-up chart render queries, so the first user to open a dashboard's filter dropdown after a cache entry
-expires still triggers a fresh database query.
-
-The `native_filter_options` strategy pre-populates the cache for these dropdown queries. It reads
-each dashboard's `native_filter_configuration`, builds the same `filter_select` chart-data query the
-frontend would send, and executes it as the configured `SUPERSET_CACHE_WARMUP_USER`:
-
-```python
-class CustomCeleryConfig(CeleryConfig):
-    beat_schedule = {
-        **CeleryConfig.beat_schedule,
-        'cache-warmup-native-filters': {
-            'task': 'cache-warmup',
-            'schedule': crontab(minute=0, hour=3),  # daily at 03:00
-            'kwargs': {
-                'strategy_name': 'native_filter_options',
-                'dashboard_ids': [1, 2, 3],
-            },
-        },
-    }
-```
-
-Requirements and limitations:
-
- `SUPERSET_CACHE_WARMUP_USER` must be set to a user with access to the dashboards and datasets
-  referenced by the native filters.
- `DATA_CACHE_CONFIG` must use a backend that actually persists entries (Redis recommended); the
-  default `NullCache` discards writes, so warming has nothing to warm. The effective timeout also
-  needs to be positive — `NATIVE_FILTER_OPTIONS_CACHE_TIMEOUT = -1` disables cache writes for these
-  queries entirely, even with a working backend.
- Schedule the warm-up at least as often as the effective native filter cache timeout (whichever of
-  `NATIVE_FILTER_OPTIONS_CACHE_TIMEOUT`, the chart/dataset/database timeout, or `DATA_CACHE_CONFIG`'s
-  default applies). A looser schedule still leaves a window of cold, unwarmed queries between expiry
-  and the next run — the daily example above assumes a TTL of a day or more.
- Cache entries are warmed under the warm-up user's own cache partition, the same entry that user
-  would create by opening the filter dropdown manually. Users with a different role set or row-level
-  security context may still see a cache miss on first load.
- Cascading/dependent native filters and search-term variants of filter option queries are not
-  warmed by this strategy.
-
 ## Caching Thumbnails

 This is an optional feature that can be turned on by activating its [feature flag](/admin-docs/configuration/configuring-superset#feature-flags) on config:
@@ -345,24 +286,6 @@ DISTRIBUTED_COORDINATION_CONFIG = {
 }
 ```

-By default, connections opened for `DISTRIBUTED_COORDINATION_CONFIG` (as well as
-`GLOBAL_ASYNC_QUERIES_CACHE_BACKEND`, which uses the same `RedisCache`/`RedisSentinelCache`
-backend) have no socket timeout. This can be overridden with `CACHE_REDIS_SOCKET_TIMEOUT` and
-`CACHE_REDIS_SOCKET_CONNECT_TIMEOUT`, both in seconds:
-
-```python
-DISTRIBUTED_COORDINATION_CONFIG = {
-    "CACHE_TYPE": "RedisCache",
-    "CACHE_REDIS_HOST": "localhost",
-    "CACHE_REDIS_PORT": 6379,
-    "CACHE_REDIS_SOCKET_TIMEOUT": 5,  # seconds
-    "CACHE_REDIS_SOCKET_CONNECT_TIMEOUT": 5,  # seconds
-}
-```
-
-These apply to `RedisSentinelCache` connections as well, covering both the sentinel-node
-connections and the resolved master connection.
-
 ### Distributed Lock TTL

 You can configure the default lock TTL (time-to-live) in seconds. Locks automatically expire after
@@ -385,7 +308,6 @@ While database-backed operations work reliably, the Redis backend is recommended
 deployments where low latency and reduced database load are important.

 :::resources
-
 - [Blog: The Data Engineer's Guide to Lightning-Fast Superset Dashboards](https://preset.io/blog/the-data-engineers-guide-to-lightning-fast-apache-superset-dashboards/)
 - [Blog: Accelerating Dashboards with Materialized Views](https://preset.io/blog/accelerating-apache-superset-dashboards-with-materialized-views/)
-  :::
+:::
@@ -97,50 +97,6 @@ for more information on how to configure it.

 At the very least, you'll want to change `SECRET_KEY` and `SQLALCHEMY_DATABASE_URI`. Continue reading for more about each of these.

-## Chart-data query timing
-
-Set `CHART_DATA_INCLUDE_TIMING = True` to add an optional versioned timing object
-to every successful JSON query result returned by the chart-data API. The setting
-is `False` by default, so enabling it is an explicit API-contract choice for an
-operator. File exports, streaming responses, and HTTP error responses do not
-include this object.
-
-```json
-{
-  "timing": {
-    "version": 1,
-    "query": {
-      "query_planning_ms": 1.23,
-      "cache_resolution_ms": 0.45,
-      "data_acquisition_ms": null,
-      "payload_assembly_ms": 0.67,
-      "total_ms": 2.98
-    }
-  }
-}
-```
-
-Durations are milliseconds rounded to two decimal places. A numeric `0.0`
-means that the corresponding stage ran but rounded below that precision;
-`null` means it did not apply. For example, `data_acquisition_ms` is null for
-a normal dataframe cache hit, while metadata-only results have null phase values
-and a numeric total.
-
-The phases have fixed ownership: `query_planning_ms` includes Jinja rendering,
-row-level-security transformation, and cache identity; `cache_resolution_ms`
-includes cache lookup, compatibility policy, deserialization, and rehydration;
-`data_acquisition_ms` includes database work and annotation dependencies; and
-`payload_assembly_ms` includes response shaping and AUTO-currency fallback.
-
-`total_ms` is measured over one continuous per-query execution interval. It
-contains the exposed stages and unattributed work such as query-result cache
-persistence, so it is not the sum of the phase values. Query-context cache
-persistence is excluded. The total also excludes request parsing,
-authorization, contribution-total work before the per-query loop, client
-post-processing, JSON serialization, network transfer, and background async
-producer execution. Additive optional fields can preserve version 1; a field
-rename, removal, or semantic change requires a new version.
-
 ## Specifying a SECRET_KEY

 ### Adding an initial SECRET_KEY
@@ -193,10 +149,10 @@ database engine on a separate host or container.

 Superset supports the following database engines/versions:

-| Database Engine                           | Supported Versions                             |
-| ----------------------------------------- | ---------------------------------------------- |
-| [PostgreSQL](https://www.postgresql.org/) | 10.X, 11.X, 12.X, 13.X, 14.X, 15.X, 16.X, 17.X |
-| [MySQL](https://www.mysql.com/)           | 5.7, 8.X                                       |
+| Database Engine                           | Supported Versions                       |
+| ----------------------------------------- | ---------------------------------------- |
+| [PostgreSQL](https://www.postgresql.org/) | 10.X, 11.X, 12.X, 13.X, 14.X, 15.X, 16.X |
+| [MySQL](https://www.mysql.com/)           | 5.7, 8.X                                 |

 Use the following database drivers and connection strings:

@@ -269,7 +225,7 @@ RequestHeader set X-Forwarded-Proto "https"

 ## Configuring the application root

-_Please be advised that this feature is in BETA._
+*Please be advised that this feature is in BETA.*

 Superset supports running the application under a non-root path. The root path
 prefix can be specified in one of three ways:
@@ -307,22 +263,6 @@ to simplify the process of setting up a non-default root path across the service
 In `docker/.env-local` set `SUPERSET_APP_ROOT` to the desired prefix and then bring the
 services up with `docker compose up --detach`.

-### Swagger UI
-
-By default, Superset's Swagger UI and OpenAPI spec (enabled via `FAB_API_SWAGGER_UI`) are
-served by Flask-AppBuilder and don't account for a non-root `APPLICATION_ROOT` prefix. If
-you're running Superset behind a URL prefix and want the Swagger UI and OpenAPI spec to
-resolve correctly, set:
-
-```python
-FAB_API_SWAGGER_UI_SUPERSET_APP_ROOT = True
-```
-
-in your `superset_config.py` file. This serves an `APPLICATION_ROOT`-aware Swagger UI and
-OpenAPI spec at `/swagger/<version>` and `/api/<version>/_openapi` respectively, resolved
-through the configured prefix. This flag only takes effect when `FAB_API_SWAGGER_UI` is
-also enabled, and defaults to `False`.
-
 ## Custom OAuth2 Configuration

 Superset is built on Flask-AppBuilder (FAB), which supports many providers out of the box
@@ -372,13 +312,10 @@ AUTH_USER_REGISTRATION_ROLE = "Public"
 ```

 In case you want to assign the `Admin` role on new user registration, it can be assigned as follows:
-
 ```python
 AUTH_USER_REGISTRATION_ROLE = "Admin"
 ```
-
 If you encounter the [issue](https://github.com/apache/superset/issues/13243) of not being able to list users from the Superset main page settings, although a newly registered user has an `Admin` role, please re-run `superset init` to sync the required permissions. Below is the command to re-run `superset init` using docker compose.
-
 ```
 docker-compose exec superset superset init
 ```
@@ -631,6 +568,5 @@ SUPERSET_DASHBOARD_POSITION_DATA_LIMIT = 131072  # double the default
 Alternatively, split a very large dashboard into several smaller ones. Note that this check is enforced when saving layout edits in the UI; a dashboard imported from a ZIP with an oversized layout will load and render, but cannot be edited and re-saved until the limit is raised.

 :::resources
-
 - [Blog: Feature Flags in Apache Superset](https://preset.io/blog/feature-flags-in-apache-superset-and-preset/)
-  :::
+:::
@@ -18,23 +18,23 @@ code is less ambiguous and is unique to all regions in the world.
 ## Included Maps

 The current list of countries can be found in the src
-[plugin-chart-country-map/src/countries.ts](https://github.com/apache/superset/blob/master/superset-frontend/plugins/plugin-chart-country-map/src/countries.ts)
+[legacy-plugin-chart-country-map/src/countries.ts](https://github.com/apache/superset/blob/master/superset-frontend/plugins/legacy-plugin-chart-country-map/src/countries.ts)

 The Country Maps visualization already ships with the maps for the following countries:

-<ul style={{ columns: 3 }}>
-  {countriesData.countries.map((country, index) => (
-    <li key={index}>{country}</li>
-  ))}
+<ul style={{columns: 3}}>
+{countriesData.countries.map((country, index) => (
+  <li key={index}>{country}</li>
+))}
 </ul>

 ## Adding a New Country

 To add a new country to the list, you'd have to edit files in
-[@superset-ui/plugin-chart-country-map](https://github.com/apache/superset/tree/master/superset-frontend/plugins/plugin-chart-country-map).
+[@superset-ui/legacy-plugin-chart-country-map](https://github.com/apache/superset/tree/master/superset-frontend/plugins/legacy-plugin-chart-country-map).

-1. Generate a new GeoJSON file for your country following the guide in [this Jupyter notebook](https://github.com/apache/superset/blob/master/superset-frontend/plugins/plugin-chart-country-map/scripts/Country%20Map%20GeoJSON%20Generator.ipynb).
-2. Edit the countries list in [plugin-chart-country-map/src/countries.ts](https://github.com/apache/superset/blob/master/superset-frontend/plugins/plugin-chart-country-map/src/countries.ts).
+1. Generate a new GeoJSON file for your country following the guide in [this Jupyter notebook](https://github.com/apache/superset/blob/master/superset-frontend/plugins/legacy-plugin-chart-country-map/scripts/Country%20Map%20GeoJSON%20Generator.ipynb).
+2. Edit the countries list in [legacy-plugin-chart-country-map/src/countries.ts](https://github.com/apache/superset/blob/master/superset-frontend/plugins/legacy-plugin-chart-country-map/src/countries.ts).
 3. Install superset-frontend dependencies: `cd superset-frontend && npm install`
 4. Verify your countries in Superset plugins storybook: `npm run plugins:storybook`.
 5. Build and install Superset from source code.
@@ -1,184 +0,0 @@
---
-title: Dashboard Performance
-hide_title: true
-sidebar_position: 5
-version: 1
---
-
-<!--
-Licensed to the Apache Software Foundation (ASF) under one
-or more contributor license agreements.  See the NOTICE file
-distributed with this work for additional information
-regarding copyright ownership.  The ASF licenses this file
-to you under the Apache License, Version 2.0 (the
-"License"); you may not use this file except in compliance
-with the License.  You may obtain a copy of the License at
-
-  http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing,
-software distributed under the License is distributed on an
-"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-KIND, either express or implied.  See the License for the
-specific language governing permissions and limitations
-under the License.
-->
-
-# Dashboard Performance
-
-A dashboard's perceived speed is determined by three independent things: how
-many charts have to render, how many queries the backend can execute
-concurrently, and how quickly the underlying data warehouse can return
-results. Superset gives you levers for the first two; the third belongs to
-your warehouse. This page covers the dashboard-side levers and the practical
-guidance around them.
-
-## Is there a maximum chart count per dashboard?
-
-**No hard limit is enforced** — Superset has no configuration key that
-caps the number of charts on a dashboard. In practice, dashboards behave
-well up to a few dozen charts. Beyond that, you'll typically feel friction
-on the initial load and during cross-filter / time-range updates, even with
-the lazy-loading optimizations described below.
-
-Rough thresholds to keep in mind:
-
- **Under ~25 charts**: usually no perceptible problem.
- **25–50 charts**: still fine, but you start to want tabs to break the
-  page into chunks the user actually looks at.
- **Over ~50 charts**: split into multiple dashboards or use tabs
-  aggressively. The bottleneck is rarely Superset itself — it's the
-  warehouse executing dozens of queries in parallel and the browser
-  rendering dozens of chart frames.
-
-These are guidelines, not guarantees. A dashboard of 100 sparkline-style
-charts hitting a fast cache behaves very differently from a dashboard of
-20 heavy aggregations against a cold warehouse.
-
-## Lazy rendering — `DASHBOARD_VIRTUALIZATION`
-
-Superset's dashboard layout is virtualized at the row level. Charts that
-are far below the user's current scroll position render a placeholder
-instead of their visualization until the user scrolls them into view, and
-go back to a placeholder if scrolled well past. The chart component itself
-stays mounted throughout — only the visualization is swapped for a
-placeholder — so this alone does **not** reduce backend query load; see
-[Deferred data fetch](#deferred-data-fetch--dashboard_virtualization_defer_data)
-below for that. This is on by default.
-
-**Feature flag**: `DASHBOARD_VIRTUALIZATION` (default: `True`)
-
-The flag is `stable` and marked for path-to-deprecation — meaning the
-behavior will eventually be non-optional, but the flag still exists so
-operators can disable it if a specific layout misbehaves.
-
-**Behavior** (from `superset-frontend/src/dashboard/components/gridComponents/Row/Row.tsx`):
-
- A chart's visualization is rendered when its row scrolls within **1
-  viewport height** of the visible area.
- A chart's visualization is swapped back for a placeholder when its row
-  scrolls more than **4 viewport heights** away from the visible area.
- Tabs that aren't currently selected don't render their content at all
-  (see below).
- The placeholder-swap-back is skipped in **embedded** mode (so an
-  embedded dashboard keeps its charts rendered once they've been seen,
-  which avoids re-rendering on scroll-up). Both halves are skipped for
-  **headless / bot** rendering (so screenshot / report jobs load every
-  chart).
-
-## Deferred data fetch — `DASHBOARD_VIRTUALIZATION_DEFER_DATA`
-
-By default, `DASHBOARD_VIRTUALIZATION` only controls whether a chart's
-*visualization* is rendered — the chart component still mounts and issues
-its data request immediately, regardless of scroll position.
-`DASHBOARD_VIRTUALIZATION_DEFER_DATA` is a supplementary flag that skips
-the data request itself for charts that aren't currently in view, useful
-for backends where opening a connection or compiling a query is expensive
-even if the result would be thrown away. It only has an effect when
-`DASHBOARD_VIRTUALIZATION` is also enabled — with virtualization off,
-every chart is treated as in view, so there's nothing left to defer.
-
-**Feature flag**: `DASHBOARD_VIRTUALIZATION_DEFER_DATA` (default: `False`)
-
-Enable this if you see warehouse load spike on dashboard *open* even
-though most charts are off-screen.
-
-## Per-tab lazy loading
-
-**This is on by default and has no flag.** A tab's content is not rendered
-until the user activates that tab, so charts inside an unselected tab do
-not fetch data on dashboard open. When the user clicks the tab, that
-tab's charts mount and fetch in the normal way.
-
-Practically: tabs are the single most effective tool for a large
-dashboard. Splitting 60 charts across 4 tabs effectively turns dashboard
-open into "load ~15 charts," and the remaining ones lazy-load only if the
-user goes looking.
-
-## Is there a switch to cap concurrent chart queries?
-
-**No.** Superset does not implement a frontend-side concurrent-request
-limiter. Each chart issues its own data request when it mounts, and the
-browser handles parallelism — typically ~6 in-flight requests per origin
-under HTTP/1.1, though HTTP/2 or HTTP/3 (if your deployment terminates
-TLS that way) can multiplex considerably more over a single connection.
-Backend throughput is bounded by your
-Gunicorn worker count for synchronous query execution, or by your Celery
-worker pool when [async queries](./async-queries-celery.mdx) are enabled.
-
-If you need to throttle warehouse load, the right place is:
-
-1. The warehouse itself (connection pool / concurrency limits).
-2. Superset's Celery configuration (smaller worker pool when async
-   queries are on).
-3. Splitting heavy charts across tabs or separate dashboards (each
-   dashboard load only fetches what's visible).
-
-## Splitting strategies
-
-When a dashboard outgrows comfortable performance, the options in order
-of effort:
-
-**1. Move sections into tabs.** Same dashboard, but only the active tab's
-charts fetch. This is the cheapest change and often the only one needed.
-
-**2. Cache aggressively.** A Redis cache backend (see
-[Caching](./cache.mdx)) means repeat dashboard loads serve from cache
-rather than re-hitting the warehouse. This is especially impactful for
-dashboards opened by many users in close succession.
-
-**3. Enable async queries.** [Async query execution](./async-queries-celery.mdx)
-via Celery decouples query duration from request lifetime, so a slow
-chart doesn't block the page. The user sees other charts come in as
-their queries complete.
-
-**4. Split into multiple dashboards.** Group related charts into purpose-
-specific dashboards rather than one mega-dashboard. Link them from a
-landing dashboard or a navigation menu.
-
-**5. Pre-aggregate at the warehouse level.** If the same expensive
-aggregation appears across many charts, materialize it as a view or
-scheduled table in the warehouse so each chart query is a cheap lookup.
-
-## Operational notes
-
- The feature flags above are set in `superset_config.py`, e.g.:
-
-  ```python
-  FEATURE_FLAGS = {
-      "DASHBOARD_VIRTUALIZATION": True,
-      "DASHBOARD_VIRTUALIZATION_DEFER_DATA": True,
-  }
-  ```
-
- See [Feature Flags](./feature-flags.mdx) for the full list of supported
-  flags and their lifecycle stages.
- Server-side screenshot jobs (alerts, scheduled reports, thumbnails)
-  render the dashboard in a headless, webdriver-controlled browser, which
-  intentionally bypasses row virtualization so the rendered artifact
-  includes every chart, not just the ones above the fold. User-triggered
-  "download as image/PDF" is different: it captures whatever's currently
-  rendered in the user's own browser, so it's still subject to
-  virtualization like any other page view. Metadata/YAML dashboard export
-  doesn't render the frontend at all, so virtualization doesn't apply to
-  it either.
@@ -7,7 +7,7 @@ version: 1

 import featureFlags from '@site/static/feature-flags.json';

-export const FlagTable = ({ flags }) => (
+export const FlagTable = ({flags}) => (
  <table>
    <thead>
      <tr>
@@ -17,21 +17,14 @@ export const FlagTable = ({ flags }) => (
      </tr>
    </thead>
    <tbody>
-      {flags.map(flag => (
+      {flags.map((flag) => (
        <tr key={flag.name}>
-          <td>
-            <code>{flag.name}</code>
-          </td>
-          <td>
-            <code>{flag.default ? 'True' : 'False'}</code>
-          </td>
+          <td><code>{flag.name}</code></td>
+          <td><code>{flag.default ? 'True' : 'False'}</code></td>
          <td>
            {flag.description}
            {flag.docs && (
-              <>
-                {' '}
-                (<a href={flag.docs}>docs</a>)
-              </>
+              <> (<a href={flag.docs}>docs</a>)</>
            )}
          </td>
        </tr>
@@ -57,12 +50,12 @@ FEATURE_FLAGS = {

 Feature flags progress through lifecycle stages:

-| Stage           | Description                                                                    |
-| --------------- | ------------------------------------------------------------------------------ |
+| Stage | Description |
+|-------|-------------|
 | **Development** | Experimental features under active development. May be incomplete or unstable. |
-| **Testing**     | Feature complete but undergoing testing. Usable but may contain bugs.          |
-| **Stable**      | Production-ready features. Safe for all deployments.                           |
-| **Deprecated**  | Features scheduled for removal. Migrate away from these.                       |
+| **Testing** | Feature complete but undergoing testing. Usable but may contain bugs. |
+| **Stable** | Production-ready features. Safe for all deployments. |
+| **Deprecated** | Features scheduled for removal. Migrate away from these. |

 ---

@@ -148,10 +148,10 @@ datasets by saving the following YAML to file and then running the **import_data

 ```yaml
 databases:
-  - database_name: main
-    tables:
-      - table_name: random_time_series
-        columns:
-          - column_name: ds
-            verbose_name: datetime
+- database_name: main
+  tables:
+  - table_name: random_time_series
+    columns:
+    - column_name: ds
+      verbose_name: datetime
 ```
@@ -18,44 +18,14 @@ DECKGL_BASE_MAP = [
    ['tile://https://your_personal_url/{z}/{x}/{y}.png', 'MyTile']
 ]
 ```
-
 Openstreetmap tiles url can be added without prefix.
-
 ```python
 DECKGL_BASE_MAP = [
    ['https://c.tile.openstreetmap.org/{z}/{x}/{y}.png', 'OpenStreetMap']
 ]
 ```

-[Yandex Tiles API](https://yandex.ru/maps-api/docs/tiles-api/request.html) can be used as a custom tile provider. The URL must include the `apikey` from the [Yandex Developer Dashboard](https://developer.tech.yandex.ru/services), tile coordinates (`x`, `y`, and `z`), and the required map layer parameters.
-
-```python
-DECKGL_BASE_MAP = [
-    [
-        "tile://https://tiles.api-maps.yandex.ru/v1/tiles/"
-        "?apikey=YOUR_YANDEX_API_KEY"
-        "&lang=ru_RU"
-        "&x={x}&y={y}&z={z}"
-        "&l=map"
-        "&projection=web_mercator"
-        "&maptype=map",
-        "Yandex Maps - Web Mercator",
-    ],
-    [
-        "tile://https://tiles.api-maps.yandex.ru/v1/tiles/"
-        "?apikey=YOUR_YANDEX_API_KEY"
-        "&lang=ru_RU"
-        "&x={x}&y={y}&z={z}"
-        "&l=map"
-        "&projection=wgs84_mercator"
-        "&maptype=map",
-        "Yandex Maps - WGS84 Mercator",
-    ],
-]
-```
-
 Default values are:
-
 ```python
 DECKGL_BASE_MAP = [
    ['https://tile.openstreetmap.org/{z}/{x}/{y}.png', 'Streets (OSM)'],
@@ -76,7 +46,6 @@ Setting `DECKGL_BASE_MAP` overwrite default values
 :::

 After defining your map tiles, set them in these variables:
-
 - `CORS_OPTIONS`
 - `connect-src` of `TALISMAN_CONFIG` and `TALISMAN_CONFIG_DEV` variables.

@@ -87,7 +56,6 @@ CORS_OPTIONS: dict[Any, Any] = {
        "https://tile.openstreetmap.org",
        "https://tile.osm.ch",
        "https://your_personal_url/{z}/{x}/{y}.png",
-        "https://tiles.api-maps.yandex.ru",
    ]
 }

@@ -104,7 +72,6 @@ TALISMAN_CONFIG = {
            "https://tile.openstreetmap.org",
            "https://tile.osm.ch",
            "https://your_personal_url/{z}/{x}/{y}.png",
-            "https://tiles.api-maps.yandex.ru",
        ],
        ...
 }
@@ -55,11 +55,11 @@ The MCP server runs as a separate process alongside Superset:
 superset mcp run --host 127.0.0.1 --port 5008
 ```

-| Flag      | Default     | Description          |
-| --------- | ----------- | -------------------- |
-| `--host`  | `127.0.0.1` | Host to bind to      |
-| `--port`  | `5008`      | Port to bind to      |
-| `--debug` | off         | Enable debug logging |
+| Flag | Default | Description |
+|------|---------|-------------|
+| `--host` | `127.0.0.1` | Host to bind to |
+| `--port` | `5008` | Port to bind to |
+| `--debug` | off | Enable debug logging |

 The endpoint is available at `http://<host>:<port>/mcp`.

@@ -99,7 +99,7 @@ See [Connecting AI Clients](#connecting-ai-clients) for Claude Code, Claude Web,
 ## Prerequisites

 - Apache Superset 5.0+ running and accessible
- Python 3.11+
+- Python 3.10+
 - The `fastmcp` package (`pip install fastmcp`)

 ---
@@ -193,24 +193,22 @@ MCP_JWT_AUDIENCE = "your-audience"

 :::warning
 Store `MCP_JWT_SECRET` securely. Never commit it to version control. Use environment variables:
-
 ```python
 import os
 MCP_JWT_SECRET = os.environ.get("MCP_JWT_SECRET")
 ```
-
 :::

 #### JWT claims

 The MCP server validates these standard claims:

-| Claim | Config Key         | Description                                                |
-| ----- | ------------------ | ---------------------------------------------------------- |
-| `exp` | --                 | Expiration time (always validated)                         |
-| `iss` | `MCP_JWT_ISSUER`   | Token issuer (optional but recommended)                    |
-| `aud` | `MCP_JWT_AUDIENCE` | Token audience (optional but recommended)                  |
-| `sub` | --                 | Subject -- primary claim used to resolve the Superset user |
+| Claim | Config Key | Description |
+|-------|-----------|-------------|
+| `exp` | -- | Expiration time (always validated) |
+| `iss` | `MCP_JWT_ISSUER` | Token issuer (optional but recommended) |
+| `aud` | `MCP_JWT_AUDIENCE` | Token audience (optional but recommended) |
+| `sub` | -- | Subject -- primary claim used to resolve the Superset user |

 #### User resolution

@@ -437,7 +435,7 @@ services:
  superset:
    image: apache/superset:latest
    ports:
-      - '8088:8088'
+      - "8088:8088"
    volumes:
      - ./superset_config.py:/app/superset_config.py
    environment:
@@ -445,9 +443,9 @@ services:

  mcp:
    image: apache/superset:latest
-    command: ['superset', 'mcp', 'run', '--host', '0.0.0.0', '--port', '5008']
+    command: ["superset", "mcp", "run", "--host", "0.0.0.0", "--port", "5008"]
    ports:
-      - '5008:5008'
+      - "5008:5008"
    volumes:
      - ./superset_config.py:/app/superset_config.py
    environment:
@@ -496,31 +494,31 @@ All MCP settings go in `superset_config.py`. Defaults are defined in `superset/m

 ### Core

-| Setting              | Default       | Description                                                                                                                                                                                                                                                                  |
-| -------------------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `MCP_SERVICE_HOST`   | `"localhost"` | Host the MCP server binds to                                                                                                                                                                                                                                                 |
-| `MCP_SERVICE_PORT`   | `5008`        | Port the MCP server binds to                                                                                                                                                                                                                                                 |
-| `MCP_SERVICE_URL`    | `None`        | Public base URL for MCP-generated links (set this when behind a reverse proxy)                                                                                                                                                                                               |
-| `MCP_DEBUG`          | `False`       | Enable debug logging                                                                                                                                                                                                                                                         |
-| `MCP_DEV_USERNAME`   | --            | Superset username for development mode (no auth)                                                                                                                                                                                                                             |
-| `MCP_RBAC_ENABLED`   | `True`        | Enforce Superset's role-based access control on MCP tool calls. When `True`, each tool checks that the authenticated user has the required FAB permission before executing. Disable only for testing or trusted-network deployments.                                         |
-| `MCP_DISABLED_TOOLS` | `set()`       | Set of tool names to remove from the MCP server at startup. Disabled tools are never advertised to AI clients during tool discovery. Useful when a custom extension tool should replace a built-in Superset tool. See [Disabling built-in tools](#disabling-built-in-tools). |
+| Setting | Default | Description |
+|---------|---------|-------------|
+| `MCP_SERVICE_HOST` | `"localhost"` | Host the MCP server binds to |
+| `MCP_SERVICE_PORT` | `5008` | Port the MCP server binds to |
+| `MCP_SERVICE_URL` | `None` | Public base URL for MCP-generated links (set this when behind a reverse proxy) |
+| `MCP_DEBUG` | `False` | Enable debug logging |
+| `MCP_DEV_USERNAME` | -- | Superset username for development mode (no auth) |
+| `MCP_RBAC_ENABLED` | `True` | Enforce Superset's role-based access control on MCP tool calls. When `True`, each tool checks that the authenticated user has the required FAB permission before executing. Disable only for testing or trusted-network deployments. |
+| `MCP_DISABLED_TOOLS` | `set()` | Set of tool names to remove from the MCP server at startup. Disabled tools are never advertised to AI clients during tool discovery. Useful when a custom extension tool should replace a built-in Superset tool. See [Disabling built-in tools](#disabling-built-in-tools). |

 ### Authentication

-| Setting                | Default   | Description                                                                                                                                                                                                                      |
-| ---------------------- | --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `MCP_AUTH_ENABLED`     | `False`   | Enable JWT authentication                                                                                                                                                                                                        |
-| `MCP_JWT_ALGORITHM`    | `"RS256"` | JWT signing algorithm (`RS256` or `HS256`)                                                                                                                                                                                       |
-| `MCP_JWKS_URI`         | `None`    | JWKS endpoint URL (RS256)                                                                                                                                                                                                        |
-| `MCP_JWT_PUBLIC_KEY`   | `None`    | Static RSA public key string (RS256)                                                                                                                                                                                             |
-| `MCP_JWT_SECRET`       | `None`    | Shared secret string (HS256)                                                                                                                                                                                                     |
-| `MCP_JWT_ISSUER`       | `None`    | Expected `iss` claim                                                                                                                                                                                                             |
-| `MCP_JWT_AUDIENCE`     | `None`    | Expected `aud` claim                                                                                                                                                                                                             |
-| `MCP_REQUIRED_SCOPES`  | `[]`      | Required JWT scopes                                                                                                                                                                                                              |
-| `MCP_JWT_DEBUG_ERRORS` | `False`   | Log detailed JWT errors server-side (never exposed in HTTP responses per RFC 6750)                                                                                                                                               |
-| `MCP_AUTH_FACTORY`     | `None`    | Custom auth provider factory `(flask_app) -> auth_provider`. Takes precedence over built-in JWT                                                                                                                                  |
-| `MCP_USER_RESOLVER`    | `None`    | Custom function `(app, access_token) -> username` to extract a Superset username from a validated JWT token. When `None`, the default resolver checks `preferred_username`, `username`, `email`, and `sub` claims in that order. |
+| Setting | Default | Description |
+|---------|---------|-------------|
+| `MCP_AUTH_ENABLED` | `False` | Enable JWT authentication |
+| `MCP_JWT_ALGORITHM` | `"RS256"` | JWT signing algorithm (`RS256` or `HS256`) |
+| `MCP_JWKS_URI` | `None` | JWKS endpoint URL (RS256) |
+| `MCP_JWT_PUBLIC_KEY` | `None` | Static RSA public key string (RS256) |
+| `MCP_JWT_SECRET` | `None` | Shared secret string (HS256) |
+| `MCP_JWT_ISSUER` | `None` | Expected `iss` claim |
+| `MCP_JWT_AUDIENCE` | `None` | Expected `aud` claim |
+| `MCP_REQUIRED_SCOPES` | `[]` | Required JWT scopes |
+| `MCP_JWT_DEBUG_ERRORS` | `False` | Log detailed JWT errors server-side (never exposed in HTTP responses per RFC 6750) |
+| `MCP_AUTH_FACTORY` | `None` | Custom auth provider factory `(flask_app) -> auth_provider`. Takes precedence over built-in JWT |
+| `MCP_USER_RESOLVER` | `None` | Custom function `(app, access_token) -> username` to extract a Superset username from a validated JWT token. When `None`, the default resolver checks `preferred_username`, `username`, `email`, and `sub` claims in that order. |

 ### Response Size Guard

@@ -541,13 +539,13 @@ MCP_RESPONSE_SIZE_CONFIG = {
 }
 ```

-| Key                  | Default   | Description                                                                                                                                                                                                                                                                                                                                                                                                            |
-| -------------------- | --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `enabled`            | `True`    | Enable response size checking                                                                                                                                                                                                                                                                                                                                                                                          |
-| `token_limit`        | `25000`   | Maximum estimated token count per response                                                                                                                                                                                                                                                                                                                                                                             |
-| `warn_threshold_pct` | `80`      | Warn when response exceeds this percentage of the limit                                                                                                                                                                                                                                                                                                                                                                |
-| `max_list_items`     | `100`     | Cap on list-field length (e.g. `charts`, `native_filters`) applied to the `get_*_info` tools before falling back to more aggressive truncation. Raised from a hardcoded 30 in earlier versions; the higher default only keeps more data before the same token-budget fallback kicks in, so it's not a breaking change, but tenants that tuned workflows around the old 30-item cap should lower this value explicitly. |
-| `excluded_tools`     | See above | Tools exempt from size checking (e.g., tools that return URLs, not data)                                                                                                                                                                                                                                                                                                                                               |
+| Key | Default | Description |
+|-----|---------|-------------|
+| `enabled` | `True` | Enable response size checking |
+| `token_limit` | `25000` | Maximum estimated token count per response |
+| `warn_threshold_pct` | `80` | Warn when response exceeds this percentage of the limit |
+| `max_list_items` | `100` | Cap on list-field length (e.g. `charts`, `native_filters`) applied to the `get_*_info` tools before falling back to more aggressive truncation. Raised from a hardcoded 30 in earlier versions; the higher default only keeps more data before the same token-budget fallback kicks in, so it's not a breaking change, but tenants that tuned workflows around the old 30-item cap should lower this value explicitly. |
+| `excluded_tools` | See above | Tools exempt from size checking (e.g., tools that return URLs, not data) |

 ### Caching

@@ -573,18 +571,18 @@ MCP_CACHE_CONFIG = {
 }
 ```

-| Key                  | Default   | Description                                                 |
-| -------------------- | --------- | ----------------------------------------------------------- |
-| `enabled`            | `False`   | Enable response caching                                     |
-| `CACHE_KEY_PREFIX`   | `None`    | Optional prefix for cache keys (useful for shared Redis)    |
-| `list_tools_ttl`     | `300`     | Cache TTL in seconds for `tools/list`                       |
-| `list_resources_ttl` | `300`     | Cache TTL for `resources/list`                              |
-| `list_prompts_ttl`   | `300`     | Cache TTL for `prompts/list`                                |
-| `read_resource_ttl`  | `3600`    | Cache TTL for `resources/read`                              |
-| `get_prompt_ttl`     | `3600`    | Cache TTL for `prompts/get`                                 |
-| `call_tool_ttl`      | `3600`    | Cache TTL for `tools/call`                                  |
-| `max_item_size`      | `1048576` | Maximum cached item size in bytes (1 MB)                    |
-| `excluded_tools`     | See above | Tools that are never cached (mutating or non-deterministic) |
+| Key | Default | Description |
+|-----|---------|-------------|
+| `enabled` | `False` | Enable response caching |
+| `CACHE_KEY_PREFIX` | `None` | Optional prefix for cache keys (useful for shared Redis) |
+| `list_tools_ttl` | `300` | Cache TTL in seconds for `tools/list` |
+| `list_resources_ttl` | `300` | Cache TTL for `resources/list` |
+| `list_prompts_ttl` | `300` | Cache TTL for `prompts/list` |
+| `read_resource_ttl` | `3600` | Cache TTL for `resources/read` |
+| `get_prompt_ttl` | `3600` | Cache TTL for `prompts/get` |
+| `call_tool_ttl` | `3600` | Cache TTL for `tools/call` |
+| `max_item_size` | `1048576` | Maximum cached item size in bytes (1 MB) |
+| `excluded_tools` | See above | Tools that are never cached (mutating or non-deterministic) |

 ### Redis Store (Multi-Pod)

@@ -599,12 +597,12 @@ MCP_STORE_CONFIG = {
 }
 ```

-| Key                      | Default | Description                                              |
-| ------------------------ | ------- | -------------------------------------------------------- |
-| `enabled`                | `False` | Enable Redis-backed store                                |
-| `CACHE_REDIS_URL`        | `None`  | Redis connection URL (e.g., `redis://redis-host:6379/0`) |
-| `event_store_max_events` | `100`   | Maximum events retained per session                      |
-| `event_store_ttl`        | `3600`  | Event TTL in seconds                                     |
+| Key | Default | Description |
+|-----|---------|-------------|
+| `enabled` | `False` | Enable Redis-backed store |
+| `CACHE_REDIS_URL` | `None` | Redis connection URL (e.g., `redis://redis-host:6379/0`) |
+| `event_store_max_events` | `100` | Maximum events retained per session |
+| `event_store_ttl` | `3600` | Event TTL in seconds |

 ### Tool Search

@@ -627,15 +625,15 @@ MCP_TOOL_SEARCH_CONFIG = {
 }
 ```

-| Key                      | Default   | Description                                                                                                                                                                                                                                                                                                        |
-| ------------------------ | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `enabled`                | `True`    | Enable tool search. When `False`, all tools are listed upfront                                                                                                                                                                                                                                                     |
-| `strategy`               | `"bm25"`  | Search ranking algorithm. `"bm25"` supports natural language; `"regex"` supports pattern matching                                                                                                                                                                                                                  |
-| `max_results`            | `5`       | Maximum tools returned per search query                                                                                                                                                                                                                                                                            |
-| `always_visible`         | See above | Tools that always appear in `list_tools`, regardless of search                                                                                                                                                                                                                                                     |
-| `include_schemas`        | `False`   | When `False` (default, "summary mode"), search results omit `inputSchema` entirely and include a lightweight `parameters_hint` listing top-level parameter names. Set to `True` to include the full `inputSchema` in search results. Full schemas are always used when a tool is actually invoked via `call_tool`. |
-| `compact_schemas`        | `True`    | Strip `$defs` / `$ref` and replace with `{"type": "object"}` in search results to reduce token cost. Only takes effect when `include_schemas=True` — ignored in summary mode.                                                                                                                                      |
-| `max_description_length` | `300`     | Truncate tool descriptions in search results (0 = no truncation). Applies in both summary and full-schema modes.                                                                                                                                                                                                   |
+| Key | Default | Description |
+|-----|---------|-------------|
+| `enabled` | `True` | Enable tool search. When `False`, all tools are listed upfront |
+| `strategy` | `"bm25"` | Search ranking algorithm. `"bm25"` supports natural language; `"regex"` supports pattern matching |
+| `max_results` | `5` | Maximum tools returned per search query |
+| `always_visible` | See above | Tools that always appear in `list_tools`, regardless of search |
+| `include_schemas` | `False` | When `False` (default, "summary mode"), search results omit `inputSchema` entirely and include a lightweight `parameters_hint` listing top-level parameter names. Set to `True` to include the full `inputSchema` in search results. Full schemas are always used when a tool is actually invoked via `call_tool`. |
+| `compact_schemas` | `True` | Strip `$defs` / `$ref` and replace with `{"type": "object"}` in search results to reduce token cost. Only takes effect when `include_schemas=True` — ignored in summary mode. |
+| `max_description_length` | `300` | Truncate tool descriptions in search results (0 = no truncation). Applies in both summary and full-schema modes. |

 :::tip
 Set `enabled: False` to revert to the traditional "show all tools at once" behavior, which some clients or workflows may prefer.
@@ -672,16 +670,16 @@ The MCP server respects Superset's full role-based access control (RBAC). Every

 Each tool declares one or more required FAB permissions. The table below maps tool groups to their permission requirements:

-| Tool group                                                                                               | Required FAB permission                                               |
-| -------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------- |
-| `list_charts`, `get_chart_info`, `get_chart_data`, `get_chart_preview`, `generate_chart`, `update_chart` | `can_read` on `Chart` (read), `can_write` on `Chart` (mutate)         |
-| `list_dashboards`, `get_dashboard_info`, `generate_dashboard`, `add_chart_to_existing_dashboard`         | `can_read` on `Dashboard` (read), `can_write` on `Dashboard` (mutate) |
-| `list_datasets`, `get_dataset_info`, `create_virtual_dataset`                                            | `can_read` on `Dataset` (read), `can_write` on `Dataset` (mutate)     |
-| `list_databases`, `get_database_info`                                                                    | `can_read` on `Database`                                              |
-| `execute_sql`                                                                                            | `can_execute_sql_query` on `SQLLab`                                   |
-| `open_sql_lab_with_context`                                                                              | `can_read` on `SQLLab`                                                |
-| `save_sql_query`                                                                                         | `can_write` on `SavedQuery`                                           |
-| `health_check`                                                                                           | None (public)                                                         |
+| Tool group | Required FAB permission |
+|------------|------------------------|
+| `list_charts`, `get_chart_info`, `get_chart_data`, `get_chart_preview`, `generate_chart`, `update_chart` | `can_read` on `Chart` (read), `can_write` on `Chart` (mutate) |
+| `list_dashboards`, `get_dashboard_info`, `generate_dashboard`, `add_chart_to_existing_dashboard` | `can_read` on `Dashboard` (read), `can_write` on `Dashboard` (mutate) |
+| `list_datasets`, `get_dataset_info`, `create_virtual_dataset` | `can_read` on `Dataset` (read), `can_write` on `Dataset` (mutate) |
+| `list_databases`, `get_database_info` | `can_read` on `Database` |
+| `execute_sql` | `can_execute_sql_query` on `SQLLab` |
+| `open_sql_lab_with_context` | `can_read` on `SQLLab` |
+| `save_sql_query` | `can_write` on `SavedQuery` |
+| `health_check` | None (public) |

 To disable RBAC checking globally (for trusted-network deployments or testing), set:

@@ -708,13 +706,13 @@ This makes MCP activity fully auditable alongside regular Superset activity. The

 Every MCP request passes through a middleware stack before reaching the tool function. The default stack (assembled in `build_middleware_list()` in `server.py`) is:

-| Middleware                            | Purpose                                                                                | Default                                               |
-| ------------------------------------- | -------------------------------------------------------------------------------------- | ----------------------------------------------------- |
-| `StructuredContentStripperMiddleware` | Strips `structuredContent` from responses for Claude.ai bridge compatibility           | Enabled                                               |
-| `LoggingMiddleware`                   | Logs each tool call with user, parameters, and duration                                | Enabled                                               |
-| `GlobalErrorHandlerMiddleware`        | Catches unhandled exceptions and sanitizes sensitive data before it reaches the client | Enabled                                               |
-| `ResponseSizeGuardMiddleware`         | Estimates token count, warns at 80% of limit, blocks at limit                          | Enabled (configurable via `MCP_RESPONSE_SIZE_CONFIG`) |
-| `ResponseCachingMiddleware`           | Caches read-heavy tool responses (in-memory or Redis)                                  | Disabled (enable via `MCP_CACHE_CONFIG`)              |
+| Middleware | Purpose | Default |
+|------------|---------|---------|
+| `StructuredContentStripperMiddleware` | Strips `structuredContent` from responses for Claude.ai bridge compatibility | Enabled |
+| `LoggingMiddleware` | Logs each tool call with user, parameters, and duration | Enabled |
+| `GlobalErrorHandlerMiddleware` | Catches unhandled exceptions and sanitizes sensitive data before it reaches the client | Enabled |
+| `ResponseSizeGuardMiddleware` | Estimates token count, warns at 80% of limit, blocks at limit | Enabled (configurable via `MCP_RESPONSE_SIZE_CONFIG`) |
+| `ResponseCachingMiddleware` | Caches read-heavy tool responses (in-memory or Redis) | Disabled (enable via `MCP_CACHE_CONFIG`) |

 Additional middleware classes (`RateLimitMiddleware`, `FieldPermissionsMiddleware`, `PrivateToolMiddleware`) are implemented in `superset/mcp_service/middleware.py` but are not added to the default pipeline. They are available for operators who want to layer them in via a custom startup path.

@@ -8,10 +8,12 @@ version: 1

 ## CORS

+
 :::note
 In Superset versions prior to `5.x` you have to install to install `flask-cors` with `pip install flask-cors` to enable CORS support.
 :::

+
 The following keys in `superset_config.py` can be specified to configure CORS:

 - `ENABLE_CORS`: Must be set to `True` in order to enable CORS
@@ -52,13 +54,11 @@ Restart Superset for this configuration change to take effect.
 There are two approaches to making dashboards publicly accessible:

 **Option 1: Dataset-based access (simpler)**
-
 1. Set `PUBLIC_ROLE_LIKE = "Public"` in `superset_config.py`
 2. Grant the Public role access to the relevant datasets (Menu → Security → List Roles → Public)
 3. All published dashboards using those datasets become visible to anonymous users

 **Option 2: Dashboard-level access (selective control)**
-
 1. Set `PUBLIC_ROLE_LIKE = "Public"` in `superset_config.py`
 2. Add the `'ENABLE_VIEWERS': True` [Feature Flag](/admin-docs/configuration/feature-flags)
 3. Edit each dashboard's properties and add the "Public" role subject as a viewer
@@ -75,7 +75,7 @@ Now anybody can directly access the dashboard's URL. You can embed it in an ifra
  width="600"
  height="400"
  seamless
-  frameborder="0"
+  frameBorder="0"
  scrolling="no"
  src="https://superset.my-domain.com/superset/dashboard/10/?standalone=1&height=400"
 >
@@ -123,17 +123,17 @@ running a custom auth postback endpoint), you can add the endpoints to `WTF_CSRF
 ## SSH Tunneling

 1. Turn on feature flag
-   - Change [`SSH_TUNNELING`](https://github.com/apache/superset/blob/eb8386e3f0647df6d1bbde8b42073850796cc16f/superset/config.py#L489) to `True`
-   - If you want to add more security when establishing the tunnel we allow users to overwrite the `SSHTunnelManager` class [here](https://github.com/apache/superset/blob/eb8386e3f0647df6d1bbde8b42073850796cc16f/superset/config.py#L507)
-   - You can also set the [`SSH_TUNNEL_LOCAL_BIND_ADDRESS`](https://github.com/apache/superset/blob/eb8386e3f0647df6d1bbde8b42073850796cc16f/superset/config.py#L508) this the host address where the tunnel will be accessible on your VPC
+    - Change [`SSH_TUNNELING`](https://github.com/apache/superset/blob/eb8386e3f0647df6d1bbde8b42073850796cc16f/superset/config.py#L489) to `True`
+    - If you want to add more security when establishing the tunnel we allow users to overwrite the `SSHTunnelManager` class [here](https://github.com/apache/superset/blob/eb8386e3f0647df6d1bbde8b42073850796cc16f/superset/config.py#L507)
+    - You can also set the [`SSH_TUNNEL_LOCAL_BIND_ADDRESS`](https://github.com/apache/superset/blob/eb8386e3f0647df6d1bbde8b42073850796cc16f/superset/config.py#L508) this the host address where the tunnel will be accessible on your VPC

 2. Create database w/ ssh tunnel enabled
-   - With the feature flag enabled you should now see ssh tunnel toggle.
-   - Click the toggle to enable SSH tunneling and add your credentials accordingly.
-     - Superset allows for two different types of authentication (Basic + Private Key). These credentials should come from your service provider.
+    - With the feature flag enabled you should now see ssh tunnel toggle.
+    - Click the toggle to enable SSH tunneling and add your credentials accordingly.
+        - Superset allows for two different types of authentication (Basic + Private Key). These credentials should come from your service provider.

 3. Verify data is flowing
-   - Once SSH tunneling has been enabled, go to SQL Lab and write a query to verify data is properly flowing.
+    - Once SSH tunneling has been enabled, go to SQL Lab and write a query to verify data is properly flowing.

 ## Domain Sharding

--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Đỗ Trọng Hải	7a52c89a7f	Merge branch 'master' into fix/export-api-returns-stale-resources	2026-07-18 13:10:46 +07:00
hainenber	c77c709b79	fix(backend): export API no longer returns stale resources Signed-off-by: hainenber <dotronghai96@gmail.com>	2026-07-02 22:19:12 +07:00