chore(deps-dev): bump sqlalchemy-bigquery from 1.17.1 to 1.17.2 (#43209)

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Đỗ Trọng Hải <41283691+hainenber@users.noreply.github.com>

.github/workflows/bump-python-package.yml

@@ -21,6 +21,9 @@ on:
   #schedule:
   #  - cron: '0 0 * * *'  # Runs daily at midnight UTC
 
+permissions:
+  contents: read
+
 jobs:
   bump-python-package:
     runs-on: ubuntu-slim

.github/workflows/check-db-migration-confict.yml

@@ -16,6 +16,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   check_db_migration_conflict:
     name: Check DB migration conflict

.github/workflows/codeql-analysis.yml

@@ -14,6 +14,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   changes:
     runs-on: ubuntu-26.04

.github/workflows/enforce-single-migration-head.yml

@@ -33,6 +33,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   enforce-single-migration-head:
     runs-on: ubuntu-26.04

.github/workflows/issue-creation.yml

@@ -7,6 +7,9 @@ on:
   pull_request:
     types: [opened, edited]
 
+permissions:
+  contents: read
+
 jobs:
   superbot-orglabel:
     runs-on: ubuntu-slim

.github/workflows/labeler.yml

@@ -7,6 +7,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   labeler:
     permissions:

.github/workflows/latest-release-tag.yml

@@ -3,6 +3,9 @@ on:
   release:
     types: [published] # This makes it run only when a new released is published
 
+permissions:
+  contents: read
+
 jobs:
   latest-release:
     name: Add/update tag to new release

.github/workflows/pr-lint.yml

@@ -19,6 +19,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: false
 
+permissions:
+  contents: read
+
 jobs:
   lint-check:
     runs-on: ubuntu-slim

.github/workflows/showtime-cleanup.yml

@@ -17,6 +17,9 @@ env:
   GITHUB_ORG: ${{ github.repository_owner }}
   GITHUB_REPO: ${{ github.event.repository.name }}
 
+permissions:
+  contents: read
+
 jobs:
   cleanup-expired:
     name: Clean up expired showtime environments

.github/workflows/showtime-trigger.yml

@@ -26,6 +26,9 @@ env:
   GITHUB_REPO: ${{ github.event.repository.name }}
   GITHUB_ACTOR: ${{ github.actor }}
 
+permissions:
+  contents: read
+
 jobs:
   sync:
     name: 🎪 Sync PR to desired state

.github/workflows/superset-e2e.yml

@@ -26,6 +26,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   changes:
     runs-on: ubuntu-26.04

.github/workflows/superset-helm-release.yml

@@ -27,6 +27,9 @@ concurrency:
   group: helm-release
   cancel-in-progress: false
 
+permissions:
+  contents: read
+
 jobs:
   release:
     runs-on: ubuntu-26.04

.github/workflows/superset-playwright.yml

@@ -22,6 +22,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   changes:
     runs-on: ubuntu-26.04

.github/workflows/superset-python-presto-hive.yml

@@ -14,6 +14,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   changes:
     runs-on: ubuntu-26.04

.github/workflows/supersetbot.yml

@@ -13,6 +13,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   supersetbot:
     runs-on: ubuntu-26.04

.github/workflows/welcome-new-users.yml

@@ -5,6 +5,9 @@ on:
   pull_request_target:
     types: [opened]
 
+permissions:
+  contents: read
+
 jobs:
   welcome:
     runs-on: ubuntu-slim

pyproject.toml

@@ -135,10 +135,10 @@ athena = ["pyathena[pandas]>=3.35.4, <4"]
 # superset/db_engine_specs/aurora.py's known_incompatibilities metadata.
 aurora-data-api = ["preset-sqlalchemy-aurora-data-api>=0.2.8,<0.3"]
 bigquery = [
-    "pandas-gbq>=0.35.0",
+    "pandas-gbq>=0.35.1",
     # 1.17.1 is likely the final release: googleapis/python-bigquery-sqlalchemy
     # was archived 2026-05-16. Both 1.17.0 and 1.17.1 support SQLAlchemy 1.4/2.0.
-    "sqlalchemy-bigquery>=1.17.1",
+    "sqlalchemy-bigquery>=1.17.2",
     "google-cloud-bigquery>=3.42.3",
 ]
 clickhouse = ["clickhouse-connect>=1.6.0, <2.0"]
@@ -185,7 +185,7 @@ excel = ["xlrd>=2.0.2, <2.1"]
 # installing this extra is only required to actually run exports.
 excel-export = ["boto3"]
 fastmcp = [
-    "fastmcp>=3.4.5,<4.0",
+    "fastmcp>=3.4.6,<4.0",
     # tiktoken backs the response-size-guard token estimator. Without
     # it, the middleware falls back to a coarser character-based
     # heuristic that under-counts JSON-heavy MCP responses.

requirements/development.txt

@@ -239,9 +239,9 @@ et-xmlfile==2.0.0
     #   openpyxl
 exceptiongroup==1.3.0
     # via fastmcp-slim
-fastmcp==3.4.5
+fastmcp==3.4.7
     # via apache-superset
-fastmcp-slim==3.4.5
+fastmcp-slim==3.4.7
     # via fastmcp
 filelock==3.20.3
     # via
@@ -640,7 +640,7 @@ pandas==2.3.3
     #   db-dtypes
     #   pandas-gbq
     #   prophet
-pandas-gbq==0.35.0
+pandas-gbq==0.35.1
     # via apache-superset
 parameterized==0.9.0
     # via apache-superset
@@ -964,7 +964,7 @@ sqlalchemy==2.0.51
     #   sqlalchemy-bigquery
     #   sqlalchemy-continuum
     #   sqlalchemy-utils
-sqlalchemy-bigquery==1.17.1
+sqlalchemy-bigquery==1.17.2
     # via apache-superset
 sqlalchemy-continuum==1.7.0
     # via

superset-frontend/playwright.config.ts

@@ -47,10 +47,6 @@ export default defineConfig({
   // Retry logic - 2 retries in CI, 0 locally
   retries: process.env.CI ? 2 : 0,
 
-  // Disable capturing Git commit info as the project's history is increasingly dense
-  // and breach Playwright's default 3-seconds `git` command timeout limit
-  captureGitInfo: { commit: false, diff: false },
-
   // Reporter configuration - multiple reporters for better visibility
   reporter: process.env.CI
     ? [