fix(mcp): sync per-statement row_count after execute_sql truncation

_bisect_row_limit already trims statements[*].data.rows in lockstep
with the top-level rows field to keep the response under the token
limit, but left each statement's row_count pointing at the
pre-truncation count, so a truncated execute_sql response could claim
more rows than statements[*].data actually contains. Track the
statement dicts (not just their row lists) and update row_count
alongside data.rows.

Also log a full traceback (logger.exception) instead of a plain
warning when data-query truncation hits an unexpected error, so a
real bug isn't indistinguishable from routine size-limit enforcement.

Adds regression tests for: total_rows surviving truncation distinct
from row_count, the no-recognised-row-field fallback path, and the
oversized-excel-export hard-failure path.

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -50,9 +50,8 @@ body:
     attributes:
       label: Python version
       options:
-        - "3.9"
-        - "3.10"
         - "3.11"
+        - "3.12"
         - Not applicable
         - I don't know
     validations:

.github/actions/setup-backend/action.yml

@@ -32,8 +32,6 @@ runs:
         elif [ "$INPUT_PYTHON_VERSION" = "next" ]; then
           # currently disabled in GHA matrixes because of library compatibility issues
           RESOLVED_VERSION="3.12"
-        elif [ "$INPUT_PYTHON_VERSION" = "previous" ]; then
-          RESOLVED_VERSION="3.10"
         elif printf '%s' "$INPUT_PYTHON_VERSION" | grep -Eq '^[0-9]+\.[0-9]+(\.[0-9]+)?$'; then
           RESOLVED_VERSION="$INPUT_PYTHON_VERSION"
         else

.github/dependabot.yml

@@ -10,8 +10,15 @@ updates:
 
   - package-ecosystem: "npm"
     ignore:
-      - dependency-name: "@rjsf/*"
-      # TODO: remove below entries until React >= 19.0.0
+      # TODO: remove below entries once the application supports React >= 19.0.0
+      - dependency-name: "react"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "react-dom"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@types/react"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@types/react-dom"
+        update-types: ["version-update:semver-major"]
       - dependency-name: "react-icons"
       # JSDOM v30 doesn't play well with Jest v30
       # Source: https://jestjs.io/blog#known-issues
@@ -41,6 +48,28 @@ updates:
     labels:
       - npm
       - dependabot
+    groups:
+      rjsf:
+        patterns:
+          - "@rjsf/*"
+      typescript-eslint:
+        patterns:
+          - "@typescript-eslint/*"
+          - "typescript-eslint"
+      babel:
+        patterns:
+          - "@babel/*"
+      deckgl:
+        patterns:
+          - "@deck.gl/*"
+      lumagl:
+        patterns:
+          - "@luma.gl/*"
+      storybook:
+        patterns:
+          - "@storybook/*"
+          - "storybook"
+          - "eslint-plugin-storybook"
     open-pull-requests-limit: 30
     versioning-strategy: increase
     cooldown:
@@ -75,6 +104,22 @@ updates:
     directory: "/docs/"
     schedule:
       interval: "daily"
+    groups:
+      storybook:
+        patterns:
+          - "@storybook/*"
+          - "storybook"
+      docusaurus:
+        patterns:
+          - "@docusaurus/*"
+      docusaurus-openapi:
+        patterns:
+          - "docusaurus-plugin-openapi-docs"
+          - "docusaurus-theme-openapi-docs"
+      typescript-eslint:
+        patterns:
+          - "@typescript-eslint/*"
+          - "typescript-eslint"
     open-pull-requests-limit: 10
     versioning-strategy: increase
     cooldown:

.github/workflows/bump-python-package.yml

@@ -23,7 +23,7 @@ on:
 
 jobs:
   bump-python-package:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       actions: write
       contents: write
@@ -42,7 +42,7 @@ jobs:
       - name: Set up Python ${{ inputs.python-version }}
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
-          python-version: "3.10"
+          python-version: "3.11"
 
       - name: Install uv
         run: pip install uv

.github/workflows/check-python-deps.yml

@@ -19,7 +19,7 @@ concurrency:
 
 jobs:
   check-python-deps:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -46,7 +46,7 @@ jobs:
       - name: Login to Docker Hub
         if: steps.check.outputs.python
         continue-on-error: true
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKERHUB_USER }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}

.github/workflows/check_db_migration_confict.yml

@@ -19,7 +19,7 @@ concurrency:
 jobs:
   check_db_migration_conflict:
     name: Check DB migration conflict
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       pull-requests: write

.github/workflows/codeql-analysis.yml

@@ -16,7 +16,7 @@ concurrency:
 
 jobs:
   changes:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     permissions:
       contents: read
@@ -42,7 +42,7 @@ jobs:
     # analysis runners don't spin up. push/schedule runs always proceed:
     # the change-detector returns "all changed" for non-PR events.
     if: needs.changes.outputs.python == 'true' || needs.changes.outputs.frontend == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     permissions:
       actions: read
@@ -64,7 +64,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -75,6 +75,6 @@ jobs:
           # queries: security-extended,security-and-quality
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/dependency-review.yml

@@ -24,7 +24,7 @@ permissions:
 jobs:
   dependency-review:
     if: github.event_name == 'pull_request'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: "Checkout Repository"
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -48,7 +48,7 @@ jobs:
   python-dependency-liccheck:
     # NOTE: Configuration for liccheck lives in our pyproject.yml.
     # You cannot use a liccheck.ini file in this workflow.
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     steps:
       - name: "Checkout Repository"
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

.github/workflows/docker.yml

@@ -19,7 +19,7 @@ concurrency:
 
 jobs:
   changes:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     permissions:
       contents: read
@@ -40,14 +40,14 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
   setup_matrix:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     outputs:
       matrix_config: ${{ steps.set_matrix.outputs.matrix_config }}
     steps:
       - id: set_matrix
         run: |
-          MATRIX_CONFIG=$(if [ "${{ github.event_name }}" == "pull_request" ]; then echo '["dev", "lean"]'; else echo '["dev", "lean", "py310", "websocket", "dockerize", "py311", "py312"]'; fi)
+          MATRIX_CONFIG=$(if [ "${{ github.event_name }}" == "pull_request" ]; then echo '["dev", "lean"]'; else echo '["dev", "lean", "websocket", "dockerize", "py311", "py312"]'; fi)
           echo "matrix_config=${MATRIX_CONFIG}" >> $GITHUB_OUTPUT
           echo $GITHUB_OUTPUT
 
@@ -58,7 +58,7 @@ jobs:
       needs.changes.outputs.python == 'true' ||
       needs.changes.outputs.frontend == 'true' ||
       needs.changes.outputs.docker == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     strategy:
       matrix:
@@ -123,13 +123,20 @@ jobs:
           # pull timeouts, 504/401 on push, ECONNRESET) that otherwise fail
           # the whole job. buildx reuses the buildkit layer cache from the
           # failed attempt, so a retry mostly re-does just the failed push.
+          #
+          # supersetbot's "dev"/"lean" presets pin their own --build-arg
+          # PY_VER, which lands ahead of --extra-flags on the assembled
+          # buildx command line; docker/buildx keeps the last value for a
+          # repeated --build-arg key, so appending PY_VER here overrides
+          # supersetbot's pin and keeps the build on the Dockerfile's own
+          # supported Python version.
           for attempt in 1 2 3; do
             if supersetbot docker \
               $PUSH_OR_LOAD \
               --preset "$BUILD_PRESET" \
               --context "$EVENT" \
               --context-ref "$RELEASE" $FORCE_LATEST \
-              --extra-flags "--build-arg INCLUDE_CHROMIUM=false --tag $IMAGE_TAG" \
+              --extra-flags "--build-arg PY_VER=3.11.14-slim-trixie --build-arg INCLUDE_CHROMIUM=false --tag $IMAGE_TAG" \
               $PLATFORM_ARG; then
               break
             fi
@@ -173,7 +180,7 @@ jobs:
     # goal is to check that building the latest image works, not required for all PR pushes
     needs: changes
     if: github.event_name == 'push' && github.ref == 'refs/heads/master' && needs.changes.outputs.docker == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"

.github/workflows/embedded-sdk-release.yml

@@ -15,7 +15,7 @@ jobs:
     # gate on. Restrict to the canonical repo: forks cannot mint a valid OIDC
     # token for this package and must not publish.
     if: github.repository == 'apache/superset'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       id-token: write # required for npm trusted publishing (OIDC)
@@ -31,7 +31,7 @@ jobs:
       # token, which makes npm attempt token auth and skip the OIDC
       # trusted-publishing exchange. With no .npmrc auth line, npm authenticates
       # via OIDC against the default registry (registry.npmjs.org).
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: "./superset-embedded-sdk/.nvmrc"
       - run: npm ci

.github/workflows/embedded-sdk-test.yml

@@ -16,7 +16,7 @@ concurrency:
 
 jobs:
   embedded-sdk-test:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     defaults:
       run:
         working-directory: superset-embedded-sdk
@@ -24,7 +24,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: "./superset-embedded-sdk/.nvmrc"
           registry-url: "https://registry.npmjs.org"

.github/workflows/generate-FOSSA-report.yml

@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   config:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       has-secrets: ${{ steps.check.outputs.has-secrets }}
     steps:
@@ -29,7 +29,7 @@ jobs:
     needs: config
     if: needs.config.outputs.has-secrets
     name: Generate Report
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -37,7 +37,7 @@ jobs:
           persist-credentials: false
           submodules: recursive
       - name: Setup Java
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: "temurin"
           java-version: "11"

.github/workflows/github-action-validator.yml

@@ -19,7 +19,7 @@ concurrency:
 
 jobs:
   validate-all-ghas:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       # Required for the zizmor action to upload its SARIF results to
@@ -32,7 +32,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "20"
 

.github/workflows/hold-label-ci-gate.yml

@@ -0,0 +1,115 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+name: Hold Label CI Gate
+
+on:
+  pull_request:
+    types: [labeled, unlabeled]
+
+permissions: {}
+
+jobs:
+  cancel-on-hold:
+    name: Cancel CI runs when hold label applied
+    if: github.event.action == 'labeled' && startsWith(github.event.label.name, 'hold')
+    runs-on: ubuntu-26.04
+    permissions:
+      actions: write
+      pull-requests: read
+    steps:
+      - name: Cancel in-progress workflow runs
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const { owner, repo } = context.repo;
+            const sha = context.payload.pull_request.head.sha;
+
+            const { data: { workflow_runs: runs } } =
+              await github.rest.actions.listWorkflowRunsForRepo({
+                owner,
+                repo,
+                head_sha: sha,
+                per_page: 100,
+              });
+
+            const active = runs.filter(r =>
+              ['in_progress', 'queued', 'waiting', 'requested', 'pending'].includes(r.status)
+            );
+
+            core.info(`Found ${active.length} active run(s) to cancel for SHA ${sha}`);
+
+            for (const run of active) {
+              try {
+                await github.rest.actions.cancelWorkflowRun({
+                  owner,
+                  repo,
+                  run_id: run.id,
+                });
+                core.info(`Cancelled run ${run.id} (${run.name})`);
+              } catch (err) {
+                core.warning(`Could not cancel run ${run.id}: ${err.message}`);
+              }
+            }
+
+  rerun-on-unhold:
+    name: Re-run CI when hold label removed
+    if: github.event.action == 'unlabeled' && startsWith(github.event.label.name, 'hold')
+    runs-on: ubuntu-24.04
+    permissions:
+      actions: write
+      pull-requests: read
+    steps:
+      - name: Re-trigger cancelled workflow runs
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const { owner, repo } = context.repo;
+            const sha = context.payload.pull_request.head.sha;
+
+            // Check that no other hold* labels remain on the PR
+            const labels = context.payload.pull_request.labels.map(l => l.name);
+            const stillHeld = labels.some(l => l.startsWith('hold'));
+            if (stillHeld) {
+              core.info('PR still has a hold label — skipping re-run.');
+              return;
+            }
+
+            const { data: { workflow_runs: runs } } =
+              await github.rest.actions.listWorkflowRunsForRepo({
+                owner,
+                repo,
+                head_sha: sha,
+                per_page: 100,
+              });
+
+            const cancelled = runs.filter(r => r.conclusion === 'cancelled');
+            core.info(`Found ${cancelled.length} cancelled run(s) to re-trigger for SHA ${sha}`);
+
+            for (const run of cancelled) {
+              try {
+                await github.rest.actions.reRunWorkflow({
+                  owner,
+                  repo,
+                  run_id: run.id,
+                });
+                core.info(`Re-triggered run ${run.id} (${run.name})`);
+              } catch (err) {
+                core.warning(`Could not re-run ${run.id}: ${err.message}`);
+              }
+            }

.github/workflows/issue_creation.yml

@@ -9,7 +9,7 @@ on:
 
 jobs:
   superbot-orglabel:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       pull-requests: write

.github/workflows/labeler.yml

@@ -12,9 +12,9 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
-    - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
+    - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
       with:
         sync-labels: true
 

.github/workflows/latest-release-tag.yml

@@ -6,7 +6,7 @@ on:
 jobs:
   latest-release:
     name: Add/update tag to new release
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: write
 

.github/workflows/license-check.yml

@@ -15,7 +15,7 @@ concurrency:
 jobs:
   license_check:
     name: License Check
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -23,7 +23,7 @@ jobs:
           persist-credentials: false
           submodules: recursive
       - name: Setup Java
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: "temurin"
           java-version: "11"

.github/workflows/no-hold-label.yml

@@ -17,7 +17,7 @@ concurrency:
 
 jobs:
   check-hold-label:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
     - name: Check for 'hold' label
       uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

.github/workflows/pr-lint.yml

@@ -8,14 +8,20 @@ on:
     # Possible values: https://help.github.com/en/actions/reference/events-that-trigger-workflows#pull-request-event-pull_request
     types: [opened, edited, reopened, synchronize]
 
-# cancel previous workflow jobs for PRs
+# Serialize runs per PR without cancelling: the `edited` trigger means a PR
+# opened and then edited has two queued runs for the same head SHA. On
+# first-time-contributor PRs those runs start together when a maintainer
+# approves workflows, and cancel-in-progress lets the older run cancel the
+# newer one — leaving a permanently-cancelled required check on the head SHA
+# that blocks merging until manually re-run. This job takes seconds, so let
+# queued runs complete instead.
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
+  cancel-in-progress: false
 
 jobs:
   lint-check:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       pull-requests: write

.github/workflows/pre-commit.yml

@@ -7,6 +7,11 @@ on:
       - "[0-9].[0-9]*"
   pull_request:
     types: [synchronize, opened, reopened, ready_for_review]
+  # Nightly full-tree sweep. Per-PR runs only lint changed files, so a change
+  # that invalidates an untouched file (e.g. a type change that breaks an
+  # importing test) can pass every PR yet leave master red. This catches that.
+  schedule:
+    - cron: "0 6 * * *"
 
 permissions:
   contents: read
@@ -18,20 +23,23 @@ concurrency:
 
 jobs:
   pre-commit:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 20
     strategy:
       matrix:
         # Run the full version spread on push (master/release) and nightly,
         # but only the current version on PRs — lint/format/type results
         # rarely differ across patch versions, so 3x per PR is wasteful.
-        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["current"]') || fromJSON('["current", "previous", "next"]') }}
+        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["current"]') || fromJSON('["current", "next"]') }}
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
+          # Full history so we can diff a PR/push against its base commit to
+          # determine changed files (see "Determine changed files" below).
+          fetch-depth: 0
 
       - name: Setup Python
         uses: ./.github/actions/setup-backend/
@@ -45,7 +53,7 @@ jobs:
         run: go install github.com/norwoodj/helm-docs/cmd/helm-docs@v1.14.2
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: "superset-frontend/.nvmrc"
           cache: "npm"
@@ -69,19 +77,98 @@ jobs:
           restore-keys: |
             pre-commit-v2-${{ runner.os }}-py${{ matrix.python-version }}-
 
-      - name: Get changed files
+      - name: Determine changed files
         id: changed_files
-        uses: ./.github/actions/file-changes-action
-        with:
-          output: " "
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BEFORE_SHA: ${{ github.event.before }}
+        run: |
+          set -euo pipefail
+
+          # Scheduled runs check the whole tree (see the pre-commit step).
+          if [ "${EVENT_NAME}" = "schedule" ]; then
+            echo "mode=all" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Resolve the commit to diff against.
+          base=""
+          if [ "${EVENT_NAME}" = "pull_request" ]; then
+            # HEAD is the PR merge commit, so its first parent is the current
+            # tip of the base branch. github.event.pull_request.base.sha is
+            # NOT that: GitHub freezes it at PR creation, so on a long-lived
+            # PR it points at the original branch point and the diff picks up
+            # all of the base branch's churn since then — thousands of paths,
+            # enough for the CHANGED_FILES env var below to exceed the
+            # kernel's per-variable size limit and kill the step with
+            # "Argument list too long" before bash even starts.
+            base="$(git rev-parse HEAD^1 2>/dev/null || true)"
+          elif [ -n "${BEFORE_SHA:-}" ] && \
+               [ "${BEFORE_SHA}" != "0000000000000000000000000000000000000000" ]; then
+            base="${BEFORE_SHA}"
+          fi
+
+          # Fail closed: if the diff base can't be resolved, check every file
+          # instead of silently checking nothing. Previously an empty file list
+          # made `pre-commit run --files` a no-op that still reported success,
+          # which let unlinted code reach master.
+          if [ -z "${base}" ] || ! git cat-file -e "${base}^{commit}" 2>/dev/null; then
+            echo "::notice::Could not resolve a diff base; falling back to --all-files."
+            echo "mode=all" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Files present in HEAD that changed since the base (drop deletions).
+          files="$(git diff --name-only --diff-filter=ACMRT "${base}...HEAD")"
+
+          # Env vars have a hard per-variable size limit (E2BIG at step
+          # start). A PR that legitimately touches thousands of files is
+          # better served by --all-files anyway.
+          if [ "$(printf '%s' "${files}" | wc -c)" -gt 100000 ]; then
+            echo "::notice::Changed-file list too large to pass via env; falling back to --all-files."
+            echo "mode=all" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if [ -z "${files}" ]; then
+            echo "mode=none" >> "$GITHUB_OUTPUT"
+          else
+            echo "mode=files" >> "$GITHUB_OUTPUT"
+            {
+              echo "files<<__CHANGED_FILES_EOF__"
+              echo "${files}"
+              echo "__CHANGED_FILES_EOF__"
+            } >> "$GITHUB_OUTPUT"
+          fi
 
       - name: pre-commit
         env:
+          MODE: ${{ steps.changed_files.outputs.mode }}
           CHANGED_FILES: ${{ steps.changed_files.outputs.files }}
         run: |
           set +e  # Don't exit immediately on failure
           export SKIP=type-checking-frontend
-          pre-commit run --files $CHANGED_FILES
+
+          case "${MODE}" in
+            all)
+              echo "ℹ️ Running pre-commit on all files."
+              pre-commit run --all-files
+              ;;
+            files)
+              echo "ℹ️ Running pre-commit on changed files:"
+              echo "${CHANGED_FILES}"
+              # shellcheck disable=SC2086
+              pre-commit run --files ${CHANGED_FILES}
+              ;;
+            none)
+              echo "ℹ️ No source files changed; nothing for pre-commit to check."
+              exit 0
+              ;;
+            *)
+              echo "⚠️ Unrecognized changed-files mode '${MODE}'; checking all files."
+              pre-commit run --all-files
+              ;;
+          esac
           PRE_COMMIT_EXIT_CODE=$?
           git diff --quiet --exit-code
           GIT_DIFF_EXIT_CODE=$?

.github/workflows/release.yml

@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   config:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       has-secrets: ${{ steps.check.outputs.has-secrets }}
     steps:
@@ -29,7 +29,7 @@ jobs:
     needs: config
     if: needs.config.outputs.has-secrets
     name: Bump version and publish package(s)
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: write
     steps:
@@ -50,7 +50,7 @@ jobs:
 
       - name: Install Node.js
         if: env.HAS_TAGS
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: "./superset-frontend/.nvmrc"
 

.github/workflows/scheduled-docker-image-refresh.yml

@@ -40,7 +40,7 @@ concurrency:
 
 jobs:
   config:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       has-secrets: ${{ steps.check.outputs.has-secrets }}
       latest-release: ${{ steps.latest.outputs.tag }}
@@ -93,12 +93,12 @@ jobs:
     needs: config
     if: needs.config.outputs.has-secrets == '1'
     name: docker-rebuild
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     strategy:
       # Mirror the same matrix the release publisher uses so every variant
       # operators consume from Docker Hub gets the refreshed base.
       matrix:
-        build_preset: ["dev", "lean", "py310", "websocket", "dockerize", "py311", "py312"]
+        build_preset: ["dev", "lean", "websocket", "dockerize", "py311", "py312"]
       fail-fast: false
     steps:
       - name: "Checkout release tag: ${{ needs.config.outputs.latest-release }}"
@@ -117,7 +117,7 @@ jobs:
           build: "true"
 
       - name: Use Node.js 20
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 20
 
@@ -155,7 +155,7 @@ jobs:
   notify-on-failure:
     needs: [config, docker-rebuild]
     if: failure() && needs.config.outputs.has-secrets == '1'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       issues: write

.github/workflows/superset-app-cli.yml

@@ -19,7 +19,7 @@ concurrency:
 
 jobs:
   test-load-examples:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     env:
       PYTHONPATH: ${{ github.workspace }}
       SUPERSET_CONFIG: tests.integration_tests.superset_test_config

.github/workflows/superset-docs-deploy.yml

@@ -33,7 +33,7 @@ permissions:
 
 jobs:
   config:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       has-secrets: ${{ steps.check.outputs.has-secrets }}
     steps:
@@ -57,7 +57,7 @@ jobs:
       (github.event_name != 'workflow_run' ||
        github.event.workflow_run.head_repository.full_name == github.repository)
     name: Build & Deploy
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: "Checkout ${{ github.event.workflow_run.head_sha || github.sha }}"
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -66,12 +66,12 @@ jobs:
           persist-credentials: false
           submodules: recursive
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: "./docs/.nvmrc"
       - name: Setup Python
         uses: ./.github/actions/setup-backend/
-      - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: "zulu"
           java-version: "21"

.github/workflows/superset-docs-verify.yml

@@ -67,7 +67,7 @@ jobs:
     # Build docs when PR changes docs/** (uses committed databases.json)
     if: github.event_name == 'pull_request'
     name: Build (PR trigger)
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     defaults:
       run:
         working-directory: docs
@@ -78,7 +78,7 @@ jobs:
           persist-credentials: false
           submodules: recursive
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: "./docs/.nvmrc"
       - name: yarn install
@@ -106,7 +106,7 @@ jobs:
       github.event.workflow_run.conclusion == 'success' &&
       github.event.workflow_run.head_repository.full_name == github.repository
     name: Build (after integration tests)
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     defaults:
       run:
         working-directory: docs
@@ -118,7 +118,7 @@ jobs:
           persist-credentials: false
           submodules: recursive
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: "./docs/.nvmrc"
       - name: yarn install

.github/workflows/superset-e2e.yml

@@ -28,7 +28,7 @@ concurrency:
 
 jobs:
   changes:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     permissions:
       contents: read
@@ -50,8 +50,7 @@ jobs:
   cypress-matrix:
     needs: changes
     if: (needs.changes.outputs.python == 'true' || needs.changes.outputs.frontend == 'true') && github.event.pull_request.draft == false
-    # Somehow one test flakes on 24.04 for unknown reasons, this is the only GHA left on 22.04
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     permissions:
       contents: read
@@ -128,7 +127,7 @@ jobs:
         with:
           run: testdata
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: "./superset-frontend/.nvmrc"
           cache: "npm"
@@ -173,7 +172,7 @@ jobs:
   playwright-tests:
     needs: changes
     if: needs.changes.outputs.python == 'true' || needs.changes.outputs.frontend == 'true'
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     permissions:
       contents: read
@@ -238,7 +237,7 @@ jobs:
         with:
           run: playwright_testdata
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: "./superset-frontend/.nvmrc"
           cache: "npm"
@@ -301,7 +300,7 @@ jobs:
   cypress-matrix-required:
     needs: [changes, cypress-matrix]
     if: always()
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     permissions: {}
     steps:
@@ -323,7 +322,7 @@ jobs:
   playwright-tests-required:
     needs: [changes, playwright-tests]
     if: always()
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     permissions: {}
     steps:

.github/workflows/superset-extensions-cli.yml

@@ -19,13 +19,13 @@ concurrency:
 
 jobs:
   test-superset-extensions-cli-package:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     strategy:
       matrix:
         # Full version spread on push (master/release) + nightly; current only
         # on PRs to cut runner cost (cross-version breaks are caught at merge).
-        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["current"]') || fromJSON('["previous", "current", "next"]') }}
+        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["current"]') || fromJSON('["current", "next"]') }}
     defaults:
       run:
         working-directory: superset-extensions-cli

.github/workflows/superset-frontend.yml

@@ -21,7 +21,7 @@ permissions:
 
 jobs:
   frontend-build:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     outputs:
       should-run: ${{ steps.check.outputs.frontend }}
@@ -51,7 +51,7 @@ jobs:
           git show -s --format=raw HEAD
           docker buildx build \
             -t $TAG \
-            --cache-from=type=registry,ref=apache/superset-cache:3.10-slim-trixie \
+            --cache-from=type=registry,ref=apache/superset-cache:3.11-slim-trixie \
             --target superset-node-ci \
             .
 
@@ -74,7 +74,7 @@ jobs:
       matrix:
         shard: [1, 2, 3, 4, 5, 6, 7, 8]
       fail-fast: false
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 20
     steps:
       - name: Download Docker Image Artifact
@@ -104,7 +104,7 @@ jobs:
   report-coverage:
     needs: [sharded-jest-tests]
     if: needs.frontend-build.outputs.should-run == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     permissions:
       id-token: write
@@ -146,7 +146,7 @@ jobs:
   lint-frontend:
     needs: frontend-build
     if: needs.frontend-build.outputs.should-run == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 20
     steps:
       - name: Download Docker Image Artifact
@@ -171,7 +171,7 @@ jobs:
   validate-frontend:
     needs: frontend-build
     if: needs.frontend-build.outputs.should-run == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 20
     steps:
       - name: Download Docker Image Artifact
@@ -191,7 +191,7 @@ jobs:
   test-storybook:
     needs: frontend-build
     if: needs.frontend-build.outputs.should-run == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 25
     steps:
       - name: Download Docker Image Artifact

.github/workflows/superset-helm-lint-test.yml

@@ -2,21 +2,24 @@ name: "Helm: lint and test charts"
 
 on:
   pull_request:
-    types: [opened, edited, reopened, synchronize]
+    types: [opened, reopened, synchronize]
     paths:
       - "helm/**"
 
 permissions:
   contents: read
 
-# cancel previous workflow jobs for PRs
+# Serialize runs per PR without cancelling: when a first-time contributor's
+# queued runs are approved together, cancel-in-progress lets an older run
+# cancel a newer one, leaving a permanently-cancelled required check on the
+# head SHA. Queued runs are cheap here, so let them all complete.
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
+  cancel-in-progress: false
 
 jobs:
   lint-test:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -28,7 +31,7 @@ jobs:
       - name: Set up Helm
         uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
         with:
-          version: v3.16.4
+          version: v3.21.3
 
       - name: Setup Python
         uses: ./.github/actions/setup-backend/
@@ -56,3 +59,9 @@ jobs:
           CT_LINT_CONF: lintconf.yaml
           CT_SINCE: HEAD
           CT_CHART_REPOS: bitnami=https://charts.bitnami.com/bitnami
+
+      - name: Set up helm-unittest
+        run: helm plugin install https://github.com/helm-unittest/helm-unittest --version v1.1.1
+
+      - name: Run helm-unittest
+        run: helm unittest helm/superset

.github/workflows/superset-helm-release.yml

@@ -20,7 +20,7 @@ on:
 
 jobs:
   release:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: write
       pull-requests: write

.github/workflows/superset-playwright.yml

@@ -24,7 +24,7 @@ concurrency:
 
 jobs:
   changes:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     permissions:
       contents: read
@@ -48,7 +48,7 @@ jobs:
   playwright-tests-experimental:
     needs: changes
     if: needs.changes.outputs.python == 'true' || needs.changes.outputs.frontend == 'true'
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     continue-on-error: true
     permissions:
@@ -114,7 +114,7 @@ jobs:
         with:
           run: playwright_testdata
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: "./superset-frontend/.nvmrc"
           cache: "npm"

.github/workflows/superset-python-integrationtest.yml

@@ -20,7 +20,7 @@ concurrency:
 
 jobs:
   changes:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     permissions:
       contents: read
@@ -41,7 +41,7 @@ jobs:
   test-mysql:
     needs: changes
     if: needs.changes.outputs.python == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 45
     permissions:
       id-token: write
@@ -127,7 +127,7 @@ jobs:
   test-postgres:
     needs: changes
     if: needs.changes.outputs.python == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 45
     permissions:
       id-token: write
@@ -135,7 +135,7 @@ jobs:
       matrix:
         # Full version spread on push (master/release) + nightly; current only
         # on PRs to cut runner cost (cross-version breaks are caught at merge).
-        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["current"]') || fromJSON('["current", "previous", "next"]') }}
+        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["current"]') || fromJSON('["current", "next"]') }}
     env:
       PYTHONPATH: ${{ github.workspace }}
       SUPERSET_CONFIG: tests.integration_tests.superset_test_config
@@ -188,7 +188,7 @@ jobs:
   test-sqlite:
     needs: changes
     if: needs.changes.outputs.python == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 45
     permissions:
       id-token: write
@@ -243,7 +243,7 @@ jobs:
   test-postgres-required:
     needs: [changes, test-postgres]
     if: always()
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     steps:
       - name: Check test-postgres result

.github/workflows/superset-python-presto-hive.yml

@@ -16,7 +16,7 @@ concurrency:
 
 jobs:
   changes:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     permissions:
       contents: read
@@ -37,7 +37,7 @@ jobs:
   test-postgres-presto:
     needs: changes
     if: needs.changes.outputs.python == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 45
     permissions:
       id-token: write
@@ -100,7 +100,7 @@ jobs:
   test-postgres-hive:
     needs: changes
     if: needs.changes.outputs.python == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 45
     permissions:
       id-token: write

.github/workflows/superset-python-unittest.yml

@@ -21,7 +21,7 @@ concurrency:
 
 jobs:
   changes:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     permissions:
       contents: read
@@ -42,7 +42,7 @@ jobs:
   unit-tests:
     needs: changes
     if: needs.changes.outputs.python == 'true'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     permissions:
       id-token: write
@@ -50,9 +50,15 @@ jobs:
       matrix:
         # Full version spread on push (master/release) + nightly; current only
         # on PRs to cut runner cost (cross-version breaks are caught at merge).
-        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["current"]') || fromJSON('["previous", "current", "next"]') }}
+        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["current"]') || fromJSON('["current", "next"]') }}
     env:
       PYTHONPATH: ${{ github.workspace }}
+      # Promotes the SQLAlchemy 2.0 deprecation warnings already locked in as
+      # errors via pytest.ini's `filterwarnings` to actually run in CI, so a
+      # regression on those fails the build instead of relying on a
+      # contributor remembering to set this locally. See the migration
+      # battleplan: https://github.com/apache/superset/discussions/40273
+      SQLALCHEMY_WARN_20: "1"
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -93,7 +99,7 @@ jobs:
   unit-tests-required:
     needs: [changes, unit-tests]
     if: always()
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     steps:
       - name: Check unit-tests result

.github/workflows/superset-translations-comment.yml

@@ -20,7 +20,7 @@ permissions:
 
 jobs:
   post-comment:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     # Only act when the Translations workflow failed (which means a regression
     # was detected — the workflow exits 1 on regression).
     if: github.event.workflow_run.conclusion == 'failure'

.github/workflows/superset-translations.yml

@@ -19,7 +19,7 @@ concurrency:
 
 jobs:
   frontend-check-translations:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       pull-requests: read
@@ -38,7 +38,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.check.outputs.frontend
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: "./superset-frontend/.nvmrc"
           cache: "npm"
@@ -55,7 +55,7 @@ jobs:
           npm run build-translation
 
   babel-extract:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       pull-requests: read

.github/workflows/superset-websocket.yml

@@ -21,7 +21,7 @@ concurrency:
 
 jobs:
   app-checks:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 20
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
@@ -29,7 +29,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: './superset-websocket/.nvmrc'
       - name: Install dependencies

.github/workflows/supersetbot.yml

@@ -15,7 +15,7 @@ on:
 
 jobs:
   supersetbot:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     if: >
       github.event_name == 'workflow_dispatch' ||
       (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@supersetbot'))

.github/workflows/sync-requirements-for-python-dep-upgrade-pr.yml

@@ -38,7 +38,7 @@ jobs:
       - name: Login to Docker Hub
         if: ${{ steps.dependabot-metadata.outputs.package-ecosystem == 'pip' }}
         continue-on-error: true
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKERHUB_USER }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}

.github/workflows/tag-release.yml

@@ -32,7 +32,7 @@ concurrency:
 
 jobs:
   config:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       has-secrets: ${{ steps.check.outputs.has-secrets }}
     steps:
@@ -50,13 +50,13 @@ jobs:
     needs: config
     if: needs.config.outputs.has-secrets
     name: docker-release
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: write
     strategy:
       matrix:
         build_preset:
-          ["dev", "lean", "py310", "websocket", "dockerize", "py311", "py312"]
+          ["dev", "lean", "websocket", "dockerize", "py311", "py312"]
       fail-fast: false
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
@@ -75,7 +75,7 @@ jobs:
 
       - name: Use Node.js 20
         # zizmor: ignore[cache-poisoning] - node only runs the supersetbot CLI; no dependency cache is enabled
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 20
           package-manager-cache: false
@@ -120,7 +120,7 @@ jobs:
   update-prs-with-release-info:
     needs: config
     if: needs.config.outputs.has-secrets
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       pull-requests: write
@@ -133,7 +133,7 @@ jobs:
 
       - name: Use Node.js 20
         # zizmor: ignore[cache-poisoning] - node only runs the supersetbot CLI; no dependency cache is enabled
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 20
           package-manager-cache: false

.github/workflows/tech-debt.yml

@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   config:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       has-secrets: ${{ steps.check.outputs.has-secrets }}
     steps:
@@ -28,7 +28,7 @@ jobs:
   process-and-upload:
     needs: config
     if: needs.config.outputs.has-secrets
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     name: Generate Reports
     steps:
       - name: Checkout Repository
@@ -37,7 +37,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: "./superset-frontend/.nvmrc"
 

.github/workflows/welcome-new-users.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   welcome:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     if: github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
     permissions:
       pull-requests: write

.gitmodules

@@ -21,9 +21,6 @@
 [submodule ".github/actions/pr-lint-action"]
 	path = .github/actions/pr-lint-action
 	url = https://github.com/morrisoncole/pr-lint-action
-[submodule ".github/actions/file-changes-action"]
-	path = .github/actions/file-changes-action
-	url = https://github.com/trilom/file-changes-action
 [submodule ".github/actions/cached-dependencies"]
 	path = .github/actions/cached-dependencies
 	url = https://github.com/apache-superset/cached-dependencies

.pre-commit-config.yaml

@@ -31,9 +31,10 @@ repos:
             types-simplejson,
             types-python-dateutil,
             types-requests,
-            # types-redis 4.6.0.5 is failing mypy
-            # because of https://github.com/python/typeshed/pull/10531
-            types-redis==4.6.0.4,
+            # types-redis is intentionally absent: redis-py ships its own
+            # bundled types (py.typed, since 4.6+/5.x), while the stub
+            # package is unmaintained (frozen at the 4.6.0.x API surface).
+            # Installing the stub would shadow the accurate inline types.
             types-pytz,
             types-croniter,
             types-PyYAML,
@@ -63,7 +64,7 @@ repos:
     hooks:
       - id: prettier-frontend
         name: prettier (frontend)
-        entry: bash -c 'cd superset-frontend && for file in "$@"; do npx prettier --write "${file#superset-frontend/}"; done'
+        entry: bash -c 'cd superset-frontend && files=(); for f in "$@"; do files+=("${f#superset-frontend/}"); done; npx prettier --write -- "${files[@]}"' --
         language: system
         pass_filenames: true
         files: ^superset-frontend/.*\.(js|jsx|ts|tsx|css|scss|sass|json)$
@@ -81,6 +82,12 @@ repos:
         language: system
         pass_filenames: true
         files: ^superset-frontend/.*\.(js|jsx|ts|tsx)$
+      - id: stylelint-frontend
+        name: stylelint (frontend css-in-js)
+        entry: ./scripts/stylelint.sh
+        language: system
+        pass_filenames: true
+        files: ^superset-frontend/.*\.(js|jsx|ts|tsx)$
       - id: eslint-docs
         name: eslint (docs)
         entry: bash -c 'cd docs && FILES=$(printf "%s\n" "$@" | sed "s|^docs/||" | tr "\n" " ") && yarn eslint --fix --quiet $FILES'

.rat-excludes

@@ -7,6 +7,7 @@
 .codecov.yml
 .eslintrc
 .eslintignore
+.stylelintignore
 .flake8
 .nvmrc
 .prettierrc

Makefile

@@ -15,8 +15,8 @@
 # limitations under the License.
 #
 
-# Python version installed; we need 3.10-3.11
-PYTHON=`command -v python3.11 || command -v python3.10`
+# Python version installed; we need 3.11-3.12
+PYTHON=`command -v python3.11 || command -v python3.12`
 
 .PHONY: install superset venv pre-commit up down logs ps nuke ports open
 
@@ -76,7 +76,7 @@ update-js:
 
 venv:
 	# Create a virtual environment and activate it (recommended)
-	if ! [ -x "${PYTHON}" ]; then echo "You need Python 3.10 or 3.11 installed"; exit 1; fi
+	if ! [ -x "${PYTHON}" ]; then echo "You need Python 3.11 or 3.12 installed"; exit 1; fi
 	test -d venv || ${PYTHON} -m venv venv # setup a python3 virtualenv
 	. venv/bin/activate
 

RELEASING/Dockerfile.from_local_tarball

@@ -14,7 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-FROM python:3.10-slim-trixie
+FROM python:3.11-slim-trixie
 
 RUN useradd --user-group --create-home --no-log-init --shell /bin/bash superset
 

RELEASING/Dockerfile.from_svn_tarball

@@ -14,7 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-FROM python:3.10-slim-trixie
+FROM python:3.11-slim-trixie
 
 RUN useradd --user-group --create-home --no-log-init --shell /bin/bash superset
 

RELEASING/Dockerfile.make_docs

@@ -14,7 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-FROM python:3.10-slim-trixie
+FROM python:3.11-slim-trixie
 ARG VERSION
 
 RUN git clone --depth 1 --branch ${VERSION} https://github.com/apache/superset.git /superset

RELEASING/Dockerfile.make_tarball

@@ -14,7 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-FROM python:3.10-slim-trixie
+FROM python:3.11-slim-trixie
 
 RUN apt-get update -y
 RUN apt-get install -y \

RESOURCES/INTHEWILD.yaml

@@ -641,7 +641,7 @@ categories:
 
     - name: Région Hauts-de-France (France)
       url: https://www.geo2france.fr/
-      logo: geo2france.svg
+      logo: geo2france.png
 
     - name: Rennes Métropole (France)
       url: https://metropole.rennes.fr/

UPDATING.md

@@ -24,6 +24,88 @@ assists people when migrating to a new version.
 
 ## Next
 
+### Dashboard "Export Data to Excel" requires a Celery worker and S3 bucket
+
+A new dashboard action exports every chart's data to a single multi-sheet
+`.xlsx` asynchronously. It is disabled by default and turns on only when
+`EXCEL_EXPORT_S3_BUCKET` is set (the endpoint returns `501` otherwise). It also
+requires a running Celery worker and a configured SMTP transport, since the task
+emails the requesting user a pre-signed download link. New config keys:
+`EXCEL_EXPORT_S3_BUCKET`, `EXCEL_EXPORT_S3_KEY_PREFIX`,
+`EXCEL_EXPORT_LINK_TTL_SECONDS`, `EXCEL_EXPORT_S3_CLIENT_KWARGS`, and
+`EXCEL_EXPORT_TABLE_VIZ_TYPES`.
+
+The feature depends on `boto3`, which is **not** installed by default; install it
+with `pip install apache-superset[excel-export]`.
+
+A second mode, **Export Images to Excel**, embeds non-table charts as rendered
+images (which viz types stay tabular is controlled by
+`EXCEL_EXPORT_TABLE_VIZ_TYPES`). It renders through the headless webdriver, so the
+menu option only appears when the webdriver screenshot feature flags
+(`ENABLE_DASHBOARD_SCREENSHOT_ENDPOINTS`,
+`ENABLE_DASHBOARD_DOWNLOAD_WEBDRIVER_SCREENSHOT`) are enabled.
+
+Deployments that override `CELERY_CONFIG` must add
+`"superset.tasks.export_dashboard_excel"` to their `imports` tuple, or the task
+will not register and exports will silently never run.
+
+### SQL_QUERY_MUTATOR now honors MUTATE_AFTER_SPLIT in SQL Lab
+
+SQL Lab now applies `SQL_QUERY_MUTATOR` according to `MUTATE_AFTER_SPLIT`, matching the documented semantics and the chart/query path. This only affects deployments that define `SQL_QUERY_MUTATOR` in `superset_config.py`:
+
+- With `MUTATE_AFTER_SPLIT = True`, the mutator previously never ran in SQL Lab; it now runs on each individual statement (including on engines like BigQuery and Kusto that execute multiple statements as one block, where each statement is mutated before the statements are joined).
+- With `MUTATE_AFTER_SPLIT = False` (the default), multi-statement SQL Lab queries previously applied the mutator to each statement separately; the mutator now runs once on the whole un-split query, as documented. Single-statement queries are unaffected.
+- With `MUTATE_AFTER_SPLIT = False` on engines that execute statements individually, the mutator's output is re-parsed to split it into statements. A mutator that emits SQL Superset's parser cannot parse will now fail with a clear parse error before execution, and one that strips a query down to nothing raises an invalid-SQL error instead of executing an empty query.
+
+### Python 3.10 support removed
+
+Python 3.10 is no longer supported. Superset now requires **Python 3.11 or higher**.
+Update your environment (virtualenv, Docker base image, CI configuration, etc.) to
+Python 3.11+ before upgrading. The `apache/superset-cache:3.10-slim-trixie` and
+`py310` Docker image variants are no longer published.
+
+### `from_dttm` and `to_dttm` Jinja template variables removed
+
+The `{{ from_dttm }}` and `{{ to_dttm }}` Jinja template variables, deprecated since
+v5.0, have been removed from the Jinja context and are no longer available in virtual
+dataset SQL or custom SQL expressions.
+
+Replace usages with the `get_time_filter()` function. For example:
+
+```sql
+-- Before
+SELECT * FROM tbl
+WHERE dttm_col > '{{ from_dttm }}' AND dttm_col < '{{ to_dttm }}'
+
+-- After
+{% set tf = get_time_filter("dttm_col") %}
+SELECT * FROM tbl
+WHERE dttm_col > {{ tf.from_expr }} AND dttm_col <= {{ tf.to_expr }}
+```
+
+Note that `from_expr` and `to_expr` are already fully-formatted SQL expressions (e.g.
+`TO_TIMESTAMP('2024-01-01', ...)`) — do not wrap them in single quotes.
+
+### Removed deck.gl JavaScript tooltip/data-mutator controls and ENABLE_JAVASCRIPT_CONTROLS
+
+The `ENABLE_JAVASCRIPT_CONTROLS` feature flag and the deck.gl chart controls it gated
+(`js_tooltip`, `js_onclick_href`, `js_data_mutator`, and the GeoJSON layer's label/icon
+JavaScript-mode generators) have been removed. These controls let users write arbitrary
+JavaScript, sandboxed via Node's `vm` module, to customize deck.gl tooltips, click
+behavior, and data transforms; the flag defaulted off and the feature saw negligible use.
+
+The deck.gl "Extra data for JS" control (`js_columns`) has also been removed. It only
+ever existed to feed extra columns into the JavaScript controls above; deck.gl's
+built-in field-based tooltips and cross-filtering already pull in any columns they need
+via `tooltip_contents`/`cross_filter_column`, so this control had no remaining purpose.
+Any chart layer whose "Advanced" control panel section only contained this control no
+longer has an "Advanced" section.
+
+Any saved charts with these fields set will simply ignore them going forward and fall back
+to deck.gl's built-in field-based tooltips (`tooltip_contents`/`tooltip_template`) and
+native click/cross-filter behavior. No migration is required; the fields are dropped
+silently on next save.
+
 ### Owners, dashboard roles, and RLS roles replaced by Subjects
 
 Superset now uses subject-based access assignments for dashboards, charts, datasets,
@@ -112,6 +194,8 @@ in a later major version.
 
 - [41044](https://github.com/apache/superset/issues/41044): Removes the deprecated `AVOID_COLORS_COLLISION` feature flag (it defaulted to `True`). Color-collision avoidance is now permanently enabled; any config override setting it to `False` is ignored.
 
+- [41813](https://github.com/apache/superset/pull/41813): `redis` (the Python client, `redis-py`) is bumped from 5.3.1 to 8.0.1. redis-py 8 changes several connection defaults; Superset's own Redis-backed features (`GLOBAL_ASYNC_QUERIES_CACHE_BACKEND`, `DISTRIBUTED_COORDINATION_CONFIG`, and the MCP Redis store) explicitly pin the pre-upgrade behavior so this bump is a no-op for them: the wire protocol stays RESP2 (not the new RESP3 default, which requires Redis/Sentinel 6+ to speak `HELLO`) and there is still no socket timeout by default (redis-py 8 defaults to 5s, which could otherwise newly time out large cached payloads or slow networks). The no-timeout default can now be overridden via two new config keys, `CACHE_REDIS_SOCKET_TIMEOUT` / `CACHE_REDIS_SOCKET_CONNECT_TIMEOUT`, on any `CacheConfig` dict using `CACHE_TYPE: RedisCache` or `RedisSentinelCache`. Separately, redis-py 6+ changed the default for `ssl_check_hostname` from `False` to `True` for SSL connections using `ssl_cert_reqs="required"` (the default) — this is a security improvement, so it has **not** been reverted; deployments with `CACHE_REDIS_SSL=True` whose certificates lack a hostname matching the connection address should set `CACHE_REDIS_SSL_CERT_REQS="none"` (disables cert verification entirely, matching hostname-check bypass) or replace the certificate. General-purpose cache/results backends configured via `CACHE_CONFIG` / `DATA_CACHE_CONFIG` / `RESULTS_BACKEND` with `CACHE_TYPE: RedisCache` go through `flask-caching`'s own Redis backend (outside Superset's code) and are subject to the same new defaults; pass `socket_timeout` / `protocol` via `CACHE_OPTIONS` there if needed. Celery broker and result-backend connections (built by `kombu`, also outside Superset's code) keep their no-socket-timeout behavior (`kombu` passes `socket_timeout=None` explicitly) but do **not** pin the wire protocol, so they follow redis-py's RESP3 default — which requires a Redis server new enough to speak `HELLO` (Redis 6+). Deployments using a pre-6.0 Redis server (EOL) as a Celery broker should upgrade the server before taking this bump.
+
 - [39925](https://github.com/apache/superset/pull/39925): URL prefixing for `SUPERSET_APP_ROOT` subdirectory deployments is now handled automatically by helpers in `src/utils/navigationUtils` (`openInNewTab`, `redirect`, `getShareableUrl`, `<AppLink>`). Direct imports of `ensureAppRoot` / `makeUrl` from `src/utils/pathUtils` are forbidden outside `navigationUtils.ts` (enforced by a static-invariant test); contributors writing new code should use the focused helpers instead. No runtime behaviour change for existing callers — all 19 prior call sites have been migrated and four pre-existing double-prefix and missing-prefix bugs are fixed as part of the migration.
 
 - [39925](https://github.com/apache/superset/pull/39925): `SupersetClient.getUrl()` now strips a single leading application-root segment from the supplied `endpoint` before building the request URL, so a caller that accidentally pre-prefixes its endpoint (for example by wrapping it with `ensureAppRoot` before passing it to the client) no longer produces a doubled `/superset/superset/...` URL under subdirectory deployment. The strip is **single-pass** — a genuine `/superset/superset/<slug>` route is preserved, not collapsed — and **silent** (no console warning); the static-invariant test remains the primary signal for pre-prefixing at the call site, and this runtime strip is a safety net beneath it. Code that intentionally targeted a literal `/<app_root>/<app_root>/...` endpoint through `getUrl` (a configuration that has no legitimate use under the prefixing model) would have its first redundant segment removed.
@@ -153,6 +237,16 @@ virtual-dataset SQL) raises a parse error in SQL Lab and dashboard-generated
 queries. Deployments that legitimately run queries above this size should raise
 the value, and `SQL_MAX_PARSE_LENGTH = None` disables the check entirely.
 
+### Ant Design upgraded from v5 to v6
+
+The frontend now builds against Ant Design 6, and `@superset-ui/core` / `@apache-superset/core` peer-depend on `antd ^6`. Custom plugins, extensions, and themes that interact with Ant Design need review:
+
+- **Internal DOM classes were renamed**, so any custom CSS targeting `.ant-*` internals silently stops matching. Notable renames: `.ant-tabs-content-holder` → `.ant-tabs-body-holder`, `.ant-tabs-content` → `.ant-tabs-body`, `.ant-tabs-tabpane` → `.ant-tabs-content`; `.ant-select-selector` → `.ant-select-content`, `.ant-select-selection-placeholder` → `.ant-select-placeholder`, `.ant-select-arrow` → `.ant-select-suffix`; `.ant-tooltip-inner` → `.ant-tooltip-container`; `.ant-popover-inner` → `.ant-popover-container`; `.ant-steps-item-tail` → `.ant-steps-item-rail`.
+- **Some component props changed or were removed** — e.g. `Select` no longer accepts `dropdownAlign`, `visible`/`onVisibleChange` are `open`/`onOpenChange`, `Dropdown` `overlay` is `menu`, `Steps.Step` children are the `items` prop, and `styles.body` on Tooltip/Popover is `styles.container`.
+- **CSS variables are on by default** in antd 6, and `ThemeConfig.cssVar` no longer accepts a boolean; Superset theme configs using `cssVar: true`/`false` are coerced (`true` → `{}`, `false` → omitted).
+
+Theme tokens are unaffected — antd 6 removed none of the tokens Superset exposes, so existing theme configurations continue to work. See the [Ant Design v6 migration guide](https://ant.design/docs/react/migration-v6) for the complete upstream list.
+
 ### Guest-token RLS rules reject unknown fields
 
 The `rls` rules passed to `POST /api/v1/security/guest_token/` are now validated strictly: a rule may only contain `dataset` and `clause`. Previously unknown fields were silently dropped, so a mistyped or legacy scope key (most commonly `datasource` instead of `dataset`) produced a rule with no `dataset`, which is treated as a *global* rule applied to every dataset the embedded resource can reach. Such a request now returns HTTP 400 identifying the offending field instead of issuing a token with an unintended global rule. Integrators that were sending extra fields in RLS rules must remove them; valid dataset-scoped (`{"dataset": 41, "clause": "..."}`) and global (`{"clause": "..."}`) rules are unaffected.
@@ -182,6 +276,10 @@ helm upgrade <release-name> superset/superset
 
 Alternatively, perform a fresh install. This is a one-time migration; subsequent upgrades are unaffected.
 
+### Time-series tooltips follow the selected time grain
+
+Tooltips on the Time-series and Mixed Time-series ECharts plugins now respect the chart's time grain (and any dashboard-level time-grain override delivered via `extra_form_data`) when the tooltip time format is left on Adaptive formatting (the default). Tooltips read grain-appropriate labels such as `Jan 2021` (month), `2021 Q1` (quarter), `2021` (year), and weekly date ranges, becoming grain-aware like the x-axis, though the two are formatted independently and their labels may not always match exactly. Only a custom, explicitly-set tooltip time format (a d3 format string) is unaffected — that always wins over the grain.
+
 ### Pivot table First/Last aggregations follow data order
 
 The pivot table chart's `First` and `Last` aggregations now return the first and last value in data (query result) order, instead of effectively returning the minimum and maximum. Existing pivot tables that use these aggregations for totals/subtotals may show different values after upgrading. For deterministic results, ensure the underlying query has a stable sort order.
@@ -200,6 +298,12 @@ The `thumbnail_url` field has been removed from `GET /api/v1/dashboard/` list re
 
 The thumbnail endpoint redirects to the current digest URL regardless of whether the supplied digest is exact. If the image is not yet cached, that digest URL may return `202` and trigger async generation. Using `changed_on_utc` as the digest is sufficient for cache-busting purposes.
 
+### Dashboard import can overwrite related charts, datasets, and databases
+
+Re-importing an existing dashboard previously overwrote only the dashboard itself; its related charts, datasets, and databases were never updated (the importer hardcoded `overwrite=False` for them). They can now be overwritten as part of the import.
+
+A new `overwrite_all` form field controls this, and defaults to `false` everywhere, so existing behavior is preserved: passing `overwrite=true` alone still overwrites only the dashboard, exactly as before. To also overwrite the related charts, datasets, and databases on the `/api/v1/dashboard/import/` endpoint, pass `overwrite_all=true` explicitly. The import modal in the UI exposes this as an "also overwrite all assets" checkbox, and the CLI `superset import-dashboards` and the `ImportDashboardsCommand` likewise default `overwrite_all` to `false`.
+
 ### Tagging fix for `create_all`-bootstrapped schemas
 
 Only affects deployments whose metadata schema was created with SQLAlchemy's `create_all` (rather than `superset db upgrade`) on a foreign-key-enforcing backend — PostgreSQL, or MySQL with `FOREIGN_KEY_CHECKS=1`. Such schemas carry three invalid foreign keys on `tagged_object.object_id` that break tagging (`TAGGING_SYSTEM = True`) with a `ForeignKeyViolation`. Schemas built via `superset db upgrade` are unaffected.
@@ -213,6 +317,30 @@ ALTER TABLE tagged_object DROP CONSTRAINT <constraint_name>;
 -- MySQL: find names via `SHOW CREATE TABLE tagged_object;`
 ALTER TABLE tagged_object DROP FOREIGN KEY <constraint_name>;
 ```
+### Entity version-history infrastructure (gated off by default)
+
+Introduces the schema and SQLAlchemy-Continuum wiring that captures version history for charts, dashboards, and datasets, plus read-only `GET /api/v1/{chart,dashboard,dataset}/<uuid>/versions/` endpoints. This ships **inert**: a new config flag `ENABLE_VERSIONING_CAPTURE` defaults to `False`, so no save writes any version rows and the endpoints return empty. It is an operational kill-switch (a release toggle that becomes a permanent ops switch), not a feature flag — set it to `True` to enable capture once validated. The migration is additive; existing entity `PUT` responses gain `old_version_uuid` / `new_version_uuid` body fields and an `ETag` header (both null/absent when capture is off).
+
+A few save- and import-path internals change **unconditionally** (independent of the flag), because the versioned mappers must behave correctly whether or not capture is enabled:
+
+- `DatasetDAO` column/metric updates move from bulk operations to per-row ORM operations, and a metadata refresh now preserves column primary keys via a natural-key (`column_name`) upsert instead of delete-and-reinsert — so charts that reference dataset columns by id keep working across a refresh (previously such references could be invalidated).
+- `ImportExportMixin.reset_ownership` stamps the current user onto `created_by`/`changed_by` when a request context is present (previously left null for the column default to fill).
+- `UpdateDashboardCommand` runs its body under `no_autoflush`.
+
+These are behavior changes that take effect on upgrade regardless of `ENABLE_VERSIONING_CAPTURE`; no operator action is required.
+
+### Cross-entity version activity stream
+
+A read-only companion to the version-history endpoints: each entity type gains a `GET /api/v1/{chart,dashboard,dataset}/<uuid>/activity/` endpoint returning a chronological, access-filtered stream of edits — the entity's own edits plus, for charts and dashboards, transitive edits to related entities during their association windows. Datasets have no related layer in V2, so `include=related` returns an empty stream for a dataset and `include=all` reduces to the dataset's own edits.
+
+| Param | Type | Default | Purpose |
+|---|---|---|---|
+| `since` / `until` | ISO 8601 | — | Bound `issued_at` |
+| `include` | `self` \| `related` \| `all` | `all` | Own edits, related edits, or both |
+| `q` | string | — | Case-insensitive search over the full history, applied before pagination (so `count` reflects matches) |
+| `page` / `page_size` | integer | `0` / `25` | Pagination (`page_size` clamped to 200) |
+
+Authorization reuses the resource's `can_read` permission and per-object `raise_for_access`; related-entity rows are visibility-filtered to what the caller may see. The stream is empty unless version capture is on (`ENABLE_VERSIONING_CAPTURE`).
 
 ### Webhook alerts/reports block private/internal hosts by default
 
@@ -466,6 +594,12 @@ The partial-index replacement is dialect-dependent: PostgreSQL uses a native `WH
 
 **Importer behavior:** importing a dashboard YAML whose UUID matches an existing **soft-deleted** dashboard is treated as an implicit restore-with-update — **and this happens even when `overwrite` is not set**. This is a deliberate asymmetry with active rows: an active dashboard imported without `overwrite=true` is returned unchanged (the import never mutates it), but a soft-deleted UUID match is restored *and* has the upload's contents applied regardless of the `overwrite` argument, on the reasoning that re-importing a deleted dashboard's exact UUID is an explicit request to bring it back. The restore preserves the original PK and all pre-deletion relationship rows (`dashboard_slices` junctions, editor/viewer subjects, tags). Callers whose imports must never mutate existing state should treat bundles that may contain previously deleted UUIDs accordingly. The operation is permission-gated: it requires `can_write` and editorship of the deleted row (or admin) — non-editors get `ImportFailedError`, and callers without `can_write` get `ImportFailedError` instead of silently receiving the soft-deleted row.
 
+### Engine spec capability flag: `supports_offset`
+
+A new `BaseEngineSpec.supports_offset` attribute (default `True`) indicates whether a database engine supports the SQL `OFFSET` clause. Engines that do not support `OFFSET` — such as Elasticsearch SQL and OpenDistro — opt out by setting it to `False`, and Superset uses each engine's cursor API to paginate drill-to-detail samples instead of emitting `OFFSET`. Downstream forks maintaining custom engine specs may set the flag to `False` (and implement `fetch_data_with_cursor`) to avoid crashes when paginated drill-to-detail queries are run against engines without `OFFSET` support.
+
+**Note on deep-pagination cost:** Cursor-based engines (including Elasticsearch and OpenDistro) are forward-only, so reaching page `N` of a drill-to-detail view issues `N` round trips to the cluster. Deep pagination is therefore linear in page number; users paginating into the hundreds or thousands will notice added latency compared to `OFFSET`-capable engines.
+
 ### Granular Export Controls
 
 A new feature flag `GRANULAR_EXPORT_CONTROLS` introduces three fine-grained permissions that replace the legacy `can_csv` permission:
@@ -710,6 +844,7 @@ See `superset/mcp_service/PRODUCTION.md` for deployment guides.
 
 ---
 
+- [38358](https://github.com/apache/superset/pull/38358): Switched CrateDB PyPI package from `crate[sqlalchemy]` to `sqlalchemy-cratedb`.
 - [35621](https://github.com/apache/superset/pull/35621): The default hash algorithm has changed from MD5 to SHA-256 for improved security and FedRAMP compliance. This affects cache keys for thumbnails, dashboard digests, chart digests, and filter option names. Existing cached data will be invalidated upon upgrade. To opt out of this change and maintain backward compatibility, set `HASH_ALGORITHM = "md5"` in your `superset_config.py`.
 - [35062](https://github.com/apache/superset/pull/35062): Changed the function signature of `setupExtensions` to `setupCodeOverrides` with options as arguments.
 

docker-compose-light.yml

@@ -71,7 +71,7 @@ x-common-build: &common-build
   context: .
   target: ${SUPERSET_BUILD_TARGET:-dev} # can use `dev` (default) or `lean`
   cache_from:
-    - apache/superset-cache:3.10-slim-trixie
+    - apache/superset-cache:3.11-slim-trixie
   args:
     DEV_MODE: "true"
     INCLUDE_CHROMIUM: ${INCLUDE_CHROMIUM:-false}

docker-compose-non-dev.yml

@@ -33,7 +33,7 @@ x-common-build: &common-build
   context: .
   target: dev
   cache_from:
-    - apache/superset-cache:3.10-slim-trixie
+    - apache/superset-cache:3.11-slim-trixie
 
 services:
   redis:

docker-compose.yml

@@ -38,7 +38,7 @@ x-common-build: &common-build
   context: .
   target: ${SUPERSET_BUILD_TARGET:-dev} # can use `dev` (default) or `lean`
   cache_from:
-    - apache/superset-cache:3.10-slim-trixie
+    - apache/superset-cache:3.11-slim-trixie
   args:
     DEV_MODE: "true"
     INCLUDE_CHROMIUM: ${INCLUDE_CHROMIUM:-false}

docker/pythonpath_dev/superset_config.py

@@ -87,6 +87,7 @@ class CeleryConfig:
         "superset.tasks.scheduler",
         "superset.tasks.thumbnails",
         "superset.tasks.cache",
+        "superset.tasks.export_dashboard_excel",
     )
     result_backend = f"redis://{REDIS_HOST}:{REDIS_PORT}/{REDIS_RESULTS_DB}"
     worker_prefetch_multiplier = 1

docs/admin_docs/configuration/alerts-reports.mdx

@@ -135,7 +135,7 @@ Superset sends an HTTP POST with `Content-Type: application/json`:
 }
 ```
 
-When a report includes file attachments (CSV, PDF, or PNG screenshots), the request is sent as `multipart/form-data` instead. In that case, each top-level payload field (`name`, `text`, `description`, `url`) becomes its own form field, and nested structures like `header` are serialized as a JSON-encoded string in their own field. Every attachment is added as a repeated form field named `files`:
+When a report includes file attachments (CSV, Excel, PDF, or PNG screenshots), the request is sent as `multipart/form-data` instead. In that case, each top-level payload field (`name`, `text`, `description`, `url`) becomes its own form field, and nested structures like `header` are serialized as a JSON-encoded string in their own field. Every attachment is added as a repeated form field named `files`:
 
 ```
 POST /webhook HTTP/1.1
@@ -361,7 +361,7 @@ This is the best source of information about the problem.  In a docker compose d
 
 ### Check web browser and webdriver installation
 
-To take a screenshot, the worker visits the dashboard or chart using a headless browser, then takes a screenshot. If you are able to send a chart as CSV or text but can't send as PNG, your problem may lie with the browser.
+To take a screenshot, the worker visits the dashboard or chart using a headless browser, then takes a screenshot. If you are able to send a chart as CSV, XLSX, or text but can't send as PNG, your problem may lie with the browser.
 
 If you are handling the installation of the headless browser on your own, do your own verification to ensure that the headless browser opens successfully in the worker environment.
 

docs/admin_docs/configuration/mcp-server.mdx

@@ -99,7 +99,7 @@ See [Connecting AI Clients](#connecting-ai-clients) for Claude Code, Claude Web,
 ## Prerequisites
 
 - Apache Superset 5.0+ running and accessible
-- Python 3.10+
+- Python 3.11+
 - The `fastmcp` package (`pip install fastmcp`)
 
 ---
@@ -529,6 +529,7 @@ MCP_RESPONSE_SIZE_CONFIG = {
     "enabled": True,
     "token_limit": 25000,
     "warn_threshold_pct": 80,
+    "max_list_items": 100,
     "excluded_tools": [
         "health_check",
         "get_chart_preview",
@@ -543,6 +544,7 @@ MCP_RESPONSE_SIZE_CONFIG = {
 | `enabled` | `True` | Enable response size checking |
 | `token_limit` | `25000` | Maximum estimated token count per response |
 | `warn_threshold_pct` | `80` | Warn when response exceeds this percentage of the limit |
+| `max_list_items` | `100` | Cap on list-field length (e.g. `charts`, `native_filters`) applied to the `get_*_info` tools before falling back to more aggressive truncation. Raised from a hardcoded 30 in earlier versions; the higher default only keeps more data before the same token-budget fallback kicks in, so it's not a breaking change, but tenants that tuned workflows around the old 30-item cap should lower this value explicitly. |
 | `excluded_tools` | See above | Tools exempt from size checking (e.g., tools that return URLs, not data) |
 
 ### Caching

docs/admin_docs/configuration/sql-templating.mdx

@@ -39,8 +39,6 @@ made available in the Jinja context:
 
 - `columns`: columns which to group by in the query
 - `filter`: filters applied in the query
-- `from_dttm`: start `datetime` value from the selected time range (`None` if undefined). **Note:** Only available in virtual datasets when a time range filter is applied in Explore/Chart views—not available in standalone SQL Lab queries. (deprecated beginning in version 5.0, use `get_time_filter` instead)
-- `to_dttm`: end `datetime` value from the selected time range (`None` if undefined). **Note:** Only available in virtual datasets when a time range filter is applied in Explore/Chart views—not available in standalone SQL Lab queries. (deprecated beginning in version 5.0, use `get_time_filter` instead)
 - `groupby`: columns which to group by in the query (deprecated)
 - `metrics`: aggregate expressions in the query
 - `row_limit`: row limit of the query
@@ -49,85 +47,26 @@ made available in the Jinja context:
 - `time_column`: temporal column of the query (`None` if undefined)
 - `time_grain`: selected time grain (`None` if undefined)
 
-For example, to add a time range to a virtual dataset, you can write the following:
+For example, to add a time range to a virtual dataset, use the `get_time_filter` macro:
 
 ```sql
+{% set tf = get_time_filter("dttm_col") %}
 SELECT *
 FROM tbl
-WHERE dttm_col > '{{ from_dttm }}' and dttm_col < '{{ to_dttm }}'
+WHERE dttm_col > {{ tf.from_expr }} AND dttm_col <= {{ tf.to_expr }}
 ```
 
-You can also use [Jinja's logic](https://jinja.palletsprojects.com/en/2.11.x/templates/#tests)
-to make your query robust to clearing the timerange filter:
-
-```sql
-SELECT *
-FROM tbl
-WHERE (
-    {% if from_dttm is not none %}
-        dttm_col > '{{ from_dttm }}' AND
-    {% endif %}
-    {% if to_dttm is not none %}
-        dttm_col < '{{ to_dttm }}' AND
-    {% endif %}
-    1 = 1
-)
-```
-
-The `1 = 1` at the end ensures a value is present for the `WHERE` clause even when
-the time filter is not set. For many database engines, this could be replaced with `true`.
-
 Note that the Jinja parameters are called within _double_ brackets in the query and with
 _single_ brackets in the logic blocks.
 
 ### Understanding Context Availability
 
-Some Jinja variables like `from_dttm`, `to_dttm`, and `filter` are **only available when a chart or dashboard provides them**. They are populated from:
+Some Jinja variables like `filter` are **only available when a chart or dashboard provides them**. They are populated from:
 
 - Time range filters applied in Explore/Chart views
 - Dashboard native filters
 - Filter components
 
-**These variables are NOT available in standalone SQL Lab queries** because there's no filter context. If you try to use `{{ from_dttm }}` directly in SQL Lab, you'll get an "undefined parameter" error.
-
-#### Testing Time-Filtered Queries in SQL Lab
-
-To test queries that use time variables in SQL Lab, you have several options:
-
-**Option 1: Use Jinja defaults (recommended)**
-
-```sql
-SELECT *
-FROM tbl
-WHERE dttm_col > '{{ from_dttm | default("2024-01-01", true) }}'
-  AND dttm_col < '{{ to_dttm | default("2024-12-31", true) }}'
-```
-
-**Option 2: Use SQL Lab Parameters**
-
-Set parameters in the SQL Lab UI (Parameters menu):
-```json
-{
-  "from_dttm": "2024-01-01",
-  "to_dttm": "2024-12-31"
-}
-```
-
-**Option 3: Use `{% set %}` for testing**
-
-```sql
-{% set from_dttm = "2024-01-01" %}
-{% set to_dttm = "2024-12-31" %}
-SELECT *
-FROM tbl
-WHERE dttm_col > '{{ from_dttm }}' AND dttm_col < '{{ to_dttm }}'
-```
-
-:::tip
-When you save a SQL Lab query as a virtual dataset and use it in a chart with time filters,
-the actual filter values will override any defaults or test values you set.
-:::
-
 To add custom functionality to the Jinja context, you need to overload the default Jinja
 context in your environment by defining the `JINJA_CONTEXT_ADDONS` in your superset configuration
 (`superset_config.py`). Objects referenced in this dictionary are made available for users to use
@@ -479,10 +418,13 @@ Here's a concrete example:
 
 ### Time Filter
 
-The `{{ get_time_filter() }}` macro returns the time filter applied to a specific column. This is useful if you want
-to handle time filters inside the virtual dataset, as by default the time filter is placed on the outer query. This can
-considerably improve performance, as many databases and query engines are able to optimize the query better
-if the temporal filter is placed on the inner query, as opposed to the outer query.
+The `{{ get_time_filter() }}` macro is the standard way to reference the selected time range
+in a virtual dataset. It returns a `TimeFilter` object whose `from_expr` and `to_expr`
+properties are fully-formatted SQL expressions for the start and end of the range — use them
+directly in your `WHERE` clause without quoting.
+
+Placing the filter inside the virtual dataset (rather than relying on it being applied to
+the outer query) also gives many database engines the opportunity to optimize the query better.
 
 The macro takes the following parameters:
 

docs/developer_docs/contributing/development-setup.md

@@ -379,7 +379,7 @@ functioning across environments.
 Make sure your machine meets the [OS dependencies](https://superset.apache.org/docs/installation/pypi#os-dependencies) before following these steps.
 You also need to install MySQL.
 
-Ensure that you are using Python version 3.9, 3.10 or 3.11, then proceed with:
+Ensure that you are using Python version 3.11 or 3.12, then proceed with:
 
 ```bash
 # Create a virtual environment and activate it (recommended)

docs/developer_docs/contributing/issue-reporting.md

@@ -82,7 +82,7 @@ If applicable, add screenshots or recordings.
 
 ### Environment
 - Superset version: [e.g., 3.0.0]
-- Python version: [e.g., 3.9.7]
+- Python version: [e.g., 3.11.7]
 - Node version: [e.g., 18.17.0]
 - Database: [e.g., PostgreSQL 14]
 - Browser: [e.g., Chrome 120]
@@ -125,7 +125,7 @@ No error messages in browser console or server logs.
 
 ### Environment
 - Superset version: 3.0.0
-- Python version: 3.9.16
+- Python version: 3.11.16
 - Database: PostgreSQL 14.9
 - Browser: Chrome 120.0.6099.71
 - OS: macOS 14.2

docs/developer_docs/extensions/architecture.md

@@ -163,10 +163,6 @@ The architecture leverages Webpack's Module Federation to enable dynamic loading
 Extensions configure Webpack to expose their entry points:
 
 ```javascript
-externalsType: 'window',
-externals: {
-  '@apache-superset/core': 'superset',
-},
 plugins: [
   new ModuleFederationPlugin({
     name: 'my_extension',
@@ -178,6 +174,7 @@ plugins: [
       react: { singleton: true, import: false },
       'react-dom': { singleton: true, import: false },
       antd: { singleton: true, import: false },
+      '@apache-superset/core': { singleton: true, import: false },
     },
   }),
 ]
@@ -187,9 +184,7 @@ This configuration does several important things:
 
 **`exposes`** - Declares which modules are available to the host application. Superset always loads extensions by requesting the `./index` module from the remote container — this is a fixed convention, not a configurable value. Extensions must expose exactly `'./index': './src/index.tsx'` and place all API registrations (views, commands, menus, editors, event listeners) in that file. The module is executed as a side effect when the extension loads, so any call to `views.registerView`, `commands.registerCommand`, etc. made at the top level of `index.tsx` will run automatically.
 
-**`externals` and `externalsType`** - Tell Webpack that when the extension imports `@apache-superset/core`, it should use `window.superset` at runtime instead of bundling its own copy. This ensures extensions use the host's implementation of shared packages.
-
-**`shared`** - Prevents duplication of common libraries like React and Ant Design. The `singleton: true` setting ensures only one instance of each library exists, avoiding version conflicts and reducing bundle size.
+**`shared`** - Prevents duplication of common libraries like React and Ant Design, and, for `@apache-superset/core`, is the mechanism that gives each extension an isolated context (see below). The `singleton: true` setting ensures only one *logical* instance of each library exists — for `react`/`react-dom`/`antd` that means the host's actual instance is reused; for `@apache-superset/core` it means the extension's container defers to whatever module the host's loader supplies for it at init time, which is not the same object for every extension (see [Runtime Resolution](#runtime-resolution)).
 
 ### Runtime Resolution
 
@@ -200,25 +195,30 @@ The following diagram illustrates the module loading process:
 Here's what happens at runtime:
 
 1. **Extension Registration**: When an extension is registered, Superset stores its remote entry URL
-2. **Dynamic Loading**: When the extension is activated, the host fetches the remote entry file
-3. **Module Resolution**: The extension imports `@apache-superset/core`, which resolves to `window.superset`
-4. **Execution**: The extension code runs with access to the host's APIs and shared dependencies
+2. **Dynamic Loading**: When the extension is activated, the host fetches the remote entry file, then initializes Module Federation sharing (`__webpack_init_sharing__`) and looks up the extension's container on `window`
+3. **Per-Extension Scope Injection**: Before calling `container.init()`, the loader builds a **per-container copy** of the webpack share scope in which the `@apache-superset/core` entry is replaced with a synthetic module — a copy of the host's own `window.superset` implementations with `extensions.getContext` bound to that one extension's isolated context object. Because Module Federation caches the resolved module per container, every import of `@apache-superset/core` inside that extension resolves to this pre-bound copy for the lifetime of the container, and because each container gets its own independent scope object, extensions loading in parallel cannot see each other's context.
+4. **Execution**: The extension code runs with access to the host's APIs (via its per-extension `@apache-superset/core` instance) and shared dependencies (`react`, `react-dom`, `antd`)
 
 ### Host API Setup
 
-On the Superset side, the APIs are mapped to `window.superset` during application bootstrap:
+On the Superset side, the real implementations backing `@apache-superset/core` (`commands`, `views`, `menus`, `extensions`, etc.) are assigned onto `window.superset` during application bootstrap, once the current user is known:
 
 ```typescript
+// eslint-disable-next-line no-restricted-syntax
 import * as supersetCore from '@apache-superset/core';
+import { commands, views, menus, extensions /* ... */ } from 'src/core';
 
-export default function setupExtensionsAPI() {
-  window.superset = {
-    ...supersetCore,
-  };
-}
+window.superset = {
+  ...supersetCore,
+  commands,
+  views,
+  menus,
+  extensions,
+  // ...
+};
 ```
 
-This function runs before any extensions are loaded, ensuring the APIs are available when extensions import from `@apache-superset/core`.
+This runs before any extensions are loaded. `window.superset` is not itself what an extension's `@apache-superset/core` import resolves to — it is the source object the loader reads from when building each extension's per-container scoped instance (see [Runtime Resolution](#runtime-resolution)), so every extension ends up sharing the same underlying `commands`/`views`/`menus` singletons but with its own `extensions.getContext()`.
 
 ### Benefits
 

docs/developer_docs/extensions/overview.md

@@ -47,13 +47,14 @@ Extension developers have access to pre-built UI components via `@apache-superse
 
 ## Next Steps
 
-- **[Quick Start](./quick-start.md)** - Build your first extension with a complete walkthrough
-- **[Architecture](./architecture.md)** - Design principles and system overview
-- **[Dependencies](./dependencies.md)** - Managing dependencies and understanding API stability
-- **[Contribution Types](./contribution-types.md)** - Available extension points
-- **[Development](./development.md)** - Project structure, APIs, and development workflow
-- **[Deployment](./deployment.md)** - Packaging and deploying extensions
-- **[MCP Integration](./mcp.md)** - Adding AI agent capabilities using extensions
-- **[Security](./security.md)** - Security considerations and best practices
-- **[Tasks](./tasks.md)** - Framework for creating and managing long running tasks
-- **[Community Extensions](./registry.md)** - Browse extensions shared by the community
+- **[Quick Start](./quick-start)** - Build your first extension with a complete walkthrough
+- **[Architecture](./architecture)** - Design principles and system overview
+- **[Dependencies](./dependencies)** - Managing dependencies and understanding API stability
+- **[Contribution Types](./contribution-types)** - Available extension points
+- **[Development](./development)** - Project structure, APIs, and development workflow
+- **[Deployment](./deployment)** - Packaging and deploying extensions
+- **[MCP Integration](./mcp)** - Adding AI agent capabilities using extensions
+- **[Security](./security)** - Security considerations and best practices
+- **[Storage](./storage)** - Managed storage API for persisting extension data
+- **[Tasks](./tasks)** - Framework for creating and managing long running tasks
+- **[Community Extensions](./registry)** - Browse extensions shared by the community

docs/developer_docs/extensions/quick-start.md

@@ -223,7 +223,7 @@ The `@apache-superset/core` package must be listed in both `peerDependencies` (t
 
 **`frontend/webpack.config.js`**
 
-The webpack configuration requires specific settings for Module Federation. Key settings include `externalsType: "window"` and `externals` to map `@apache-superset/core` to `window.superset` at runtime, `import: false` for shared modules to use the host's React instead of bundling a separate copy, and `remoteEntry.[contenthash].js` for cache busting.
+The webpack configuration requires specific settings for Module Federation. `@apache-superset/core` is declared as a `shared` singleton alongside `react`/`react-dom`/`antd` — Superset injects a per-extension instance of the package into the container's share scope at load time, so the extension's own webpack config only needs to mark it `shared` with `singleton: true`, not resolve it itself. `import: false` on each shared entry means the extension doesn't bundle its own copy and instead uses the instance the host (or, for `@apache-superset/core`, the loader) provides. `remoteEntry.[contenthash].js` gives the built remote entry file a content hash for cache busting.
 
 **Convention**: Superset always loads extensions by requesting the `./index` module from the Module Federation container. The `exposes` entry must be exactly `'./index': './src/index.tsx'` — do not rename or add additional entries. All API registrations must be reachable from that file. See [Architecture](./architecture.md#module-federation) for a full explanation.
 
@@ -255,11 +255,6 @@ module.exports = (env, argv) => {
     resolve: {
       extensions: ['.ts', '.tsx', '.js', '.jsx'],
     },
-    // Map @apache-superset/core imports to window.superset at runtime
-    externalsType: 'window',
-    externals: {
-      '@apache-superset/core': 'superset',
-    },
     module: {
       rules: [
         {
@@ -292,6 +287,10 @@ module.exports = (env, argv) => {
             requiredVersion: packageConfig.peerDependencies['antd'],
             import: false,
           },
+          '@apache-superset/core': {
+            singleton: true,
+            import: false, // Resolved to a per-extension instance by the loader
+          },
         },
       }),
     ],
@@ -498,7 +497,7 @@ Here's what happens when your extension loads:
 1. **Superset starts**: Reads `manifest.json` from the `.supx` bundle and loads the backend entrypoint
 2. **Backend registration**: `entrypoint.py` imports your API class, triggering the [`@api`](https://github.com/apache/superset/blob/master/superset-core/src/superset_core/rest_api/decorators.py) decorator to register it automatically
 3. **Frontend loads**: When SQL Lab opens, Superset fetches the remote entry file
-4. **Module Federation**: Webpack loads your extension module and resolves `@apache-superset/core` to `window.superset`
+4. **Module Federation**: Webpack loads your extension module; the extension's `@apache-superset/core` import resolves to a per-extension instance injected into its container's share scope by the loader
 5. **Registration**: The module executes at load time, calling `views.registerView` to register your panel
 6. **Rendering**: When the user opens your panel, React renders `<HelloWorldPanel />`
 7. **API call**: The component fetches data from `/extensions/my-org/hello-world/message`

docs/developer_docs/extensions/storage.md

@@ -0,0 +1,465 @@
+---
+title: Storage
+sidebar_position: 8
+---
+
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# Storage
+
+Superset Extensions have access to a managed storage API for persisting data. The storage system provides multiple tiers with different persistence characteristics, allowing extensions to choose the right storage for their needs.
+
+Each extension receives its own isolated storage namespace. When Superset loads your extension, it binds storage to your extension's unique identifier, ensuring data privacy—two extensions using the same key will never collide, and extensions cannot access each other's data.
+
+Storage is always accessed through the extension context via `getContext()`. This binding to the context is what ties every operation to the current extension's namespace.
+
+## Storage Tiers
+
+| Tier | Storage Type      | Context Property                           | Use Case                               |
+| ---- | ----------------- | ------------------------------------------ | -------------------------------------- |
+| 1    | Browser storage   | `ctx.storage.local`, `ctx.storage.session` | UI state, wizard progress, draft forms |
+| 2    | Server-side cache | `ctx.storage.ephemeral`                    | Job progress, temporary results        |
+| 3    | Database          | `ctx.storage.persistent`                   | Saved artifacts, durable config        |
+
+## Tier 1: Local State
+
+Browser-based storage that persists on the user's device. Use this for UI state and settings that don't need to sync across devices.
+
+### Why Use the API Instead of localStorage Directly?
+
+You might wonder why extensions should use `ctx.storage.local` instead of directly accessing `window.localStorage`. The managed API provides several benefits:
+
+- **Automatic namespacing**: Each extension's data is isolated. Two extensions using the same key name won't collide.
+- **User isolation**: By default, data is scoped to the current user, preventing data leakage between users on shared devices.
+- **Clean uninstall**: When an extension is uninstalled, all its data can be cleanly removed using prefix-based deletion.
+- **Future sandboxing**: The async API is designed for a future sandboxed execution model where extensions run in isolated contexts without direct DOM access.
+- **Consistent patterns**: The same API shape works across all storage tiers, making it easy to switch between them.
+
+### localState
+
+Data persists across browser sessions until explicitly deleted or the user clears browser storage.
+
+```typescript
+import { extensions } from '@apache-superset/core';
+
+const ctx = extensions.getContext();
+
+// Save sidebar state
+await ctx.storage.local.set('sidebar_collapsed', true);
+
+// Retrieve it later
+const isCollapsed = await ctx.storage.local.get('sidebar_collapsed');
+
+// Remove it
+await ctx.storage.local.remove('sidebar_collapsed');
+```
+
+### sessionState
+
+Data is cleared when the browser tab is closed. Use for transient state within a single session.
+
+```typescript
+import { extensions } from '@apache-superset/core';
+
+const ctx = extensions.getContext();
+
+// Save wizard progress (lost when tab closes)
+await ctx.storage.session.set('wizard_step', 3);
+await ctx.storage.session.set('unsaved_form', { name: 'Draft' });
+
+// Retrieve on page reload within same tab
+const step = await ctx.storage.session.get('wizard_step');
+```
+
+Tier 1 has no `shared` accessor. Browser storage is per-device, so a "shared" value would only be visible to other users of that same browser, not to other users of the extension generally — see `.shared` on [Tier 2](#tier-2-ephemeral-state) or [Tier 3](#tier-3-persistent-state) for storage that's actually shared across users.
+
+### When to Use Tier 1
+
+- UI state (sidebar collapsed, panel sizes)
+- Recently used items
+- Draft form values
+- Any data acceptable to lose if user clears browser
+
+### Limitations
+
+- Per-browser, per-device (not shared across devices)
+- Subject to browser storage quotas (~5-10 MB)
+- Not accessible from backend code
+
+## Tier 2: Ephemeral State
+
+Server-side cache storage with automatic TTL expiration. Use for temporary data that needs to be shared between frontend and backend, or persist across page reloads.
+
+TTL is required for every `set` call. The maximum allowed TTL is controlled by `MAX_TTL` in the server configuration.
+
+### Frontend Usage
+
+```typescript
+import { extensions } from '@apache-superset/core';
+
+const ctx = extensions.getContext();
+
+// Store with a 5-minute TTL
+await ctx.storage.ephemeral.set('job_progress', { pct: 42, status: 'running' }, { ttl: 300 });
+
+// Retrieve
+const progress = await ctx.storage.ephemeral.get('job_progress');
+
+// Remove
+await ctx.storage.ephemeral.remove('job_progress');
+```
+
+### Backend Usage
+
+```python
+from superset_core.extensions.context import get_context
+from superset_core.extensions.storage.ephemeral import EphemeralSetOptions
+
+ctx = get_context()
+
+# Store job progress with a 5-minute TTL
+ctx.storage.ephemeral.set(
+    'job_progress', {'pct': 42, 'status': 'running'}, EphemeralSetOptions(ttl=300)
+)
+
+# Retrieve
+progress = ctx.storage.ephemeral.get('job_progress')
+
+# Remove
+ctx.storage.ephemeral.remove('job_progress')
+```
+
+### Shared State
+
+For data that needs to be visible to all users:
+
+```typescript
+import { extensions } from '@apache-superset/core';
+
+const ctx = extensions.getContext();
+
+await ctx.storage.ephemeral.shared.set('shared_result', { data: [1, 2, 3] }, { ttl: 3600 });
+const result = await ctx.storage.ephemeral.shared.get('shared_result');
+```
+
+```python
+from superset_core.extensions.context import get_context
+from superset_core.extensions.storage.ephemeral import EphemeralSetOptions
+
+ctx = get_context()
+
+ctx.storage.ephemeral.shared.set(
+    'shared_result', {'data': [1, 2, 3]}, EphemeralSetOptions(ttl=3600)
+)
+result = ctx.storage.ephemeral.shared.get('shared_result')
+```
+
+### When to Use Tier 2
+
+- Background job progress indicators
+- Cross-request intermediate state
+- Query result previews
+- Temporary computation results
+- Any data that can be recomputed if lost
+
+### Limitations
+
+- Not guaranteed to survive server restarts
+- Subject to cache eviction under memory pressure
+- TTL-based expiration (data disappears after timeout)
+- TTL is required on every `set` call
+
+## Tier 3: Persistent State
+
+Database-backed storage that survives server restarts, cache evictions, and browser clears. Use for any data that must not be lost.
+
+### Frontend Usage
+
+```typescript
+import { extensions } from '@apache-superset/core';
+
+const ctx = extensions.getContext();
+
+// Store a saved SQL snippet
+await ctx.storage.persistent.set('snippet:top_customers', { sql: 'SELECT ...' });
+
+// Retrieve
+const snippet = await ctx.storage.persistent.get('snippet:top_customers');
+
+// Remove
+await ctx.storage.persistent.remove('snippet:top_customers');
+```
+
+### Backend Usage
+
+```python
+from superset_core.extensions.context import get_context
+
+ctx = get_context()
+
+# Store a saved SQL snippet
+ctx.storage.persistent.set('snippet:top_customers', {'sql': 'SELECT ...'})
+
+# Retrieve
+snippet = ctx.storage.persistent.get('snippet:top_customers')
+
+# Remove
+ctx.storage.persistent.remove('snippet:top_customers')
+```
+
+### Shared State
+
+For data that should be visible to all users of the extension:
+
+```typescript
+import { extensions } from '@apache-superset/core';
+
+const ctx = extensions.getContext();
+
+await ctx.storage.persistent.shared.set('global_config', { version: 2 });
+const config = await ctx.storage.persistent.shared.get('global_config');
+```
+
+```python
+from superset_core.extensions.context import get_context
+
+ctx = get_context()
+
+ctx.storage.persistent.shared.set('global_config', {'version': 2})
+config = ctx.storage.persistent.shared.get('global_config')
+```
+
+### Listing Entries
+
+Both the frontend and backend accessors support listing entries in the caller's scope, without needing to know every key in advance. `page` and `pageSize`/`page_size` are required on every call — `list()` always returns one page of results, never the whole result set, so there's no default that could make that fact easy to miss. Check the returned `count` (total entries matching the scope/filters, across all pages) against `pageSize`/`page_size` to know whether more pages exist.
+
+```typescript
+import { extensions } from '@apache-superset/core';
+
+const ctx = extensions.getContext();
+
+// Filter by resource
+const result = await ctx.storage.persistent.list({
+  resourceType: 'dashboard',
+  resourceUuid: '1234-uuid',
+  page: 0,
+  pageSize: 25,
+});
+result.entries.forEach(entry => {
+  console.log(entry.key, entry.value, entry.codec);
+});
+console.log(result.count); // total matching entries across all pages
+
+// Shared (global) scope
+const shared = await ctx.storage.persistent.shared.list({ page: 0, pageSize: 10 });
+```
+
+```python
+from superset_core.extensions.context import get_context
+from superset_core.extensions.storage.persistent import PersistentListOptions
+
+ctx = get_context()
+
+# Filter by resource
+result = ctx.storage.persistent.list(
+    PersistentListOptions(
+        resource_type="dashboard",
+        resource_uuid="1234-uuid",
+        page=0,
+        page_size=25,
+    )
+)
+for entry in result.entries:
+    print(entry.key, entry.value, entry.codec)
+print(result.count)  # total matching entries across all pages
+
+# Shared (global) scope
+shared = ctx.storage.persistent.shared.list(PersistentListOptions(page=0, page_size=10))
+```
+
+`resource_type`/`resource_uuid` filter to entries linked to one resource — since a single resource can have several keyed entries (e.g. `"layout"`, `"notes"`), this is how an extension enumerates all of them without tracking key names itself.
+
+There is no fixed limit on `page_size`, but the combined size of a requested page's values is checked against `MAX_LIST_PAYLOAD_SIZE` (see [Quotas](#quotas)) before any row's value is read from the database — a page that would exceed it is rejected rather than silently truncated, so reduce `page_size` and retry if that happens.
+
+Backend `list()` decodes every entry's value unconditionally. The REST API backing the frontend's `list()` call is more restrictive: an entry written with a codec that isn't safe to decode over the wire (e.g. `pickle`) comes back with `value: null` (its `codec` is still reported) rather than being decoded.
+
+### Enumerating and Managing Storage from the Backend
+
+`ctx.storage.persistent.list()` covers the common case of listing an extension's own entries. Backend extension code that needs lower-level bulk operations — for example, a cleanup routine that removes storage linked to resources that no longer exist, using filters `list()` doesn't expose — can use `superset_core.extensions.storage.dao.ExtensionStorageDAO` instead:
+
+```python
+from superset_core.extensions.storage.dao import ExtensionStorageDAO
+
+# All entries this extension has linked to a given resource type
+entries = ExtensionStorageDAO.filter_by(resource_type="my-resource-type")
+
+# Bulk-delete rows for resources that no longer exist
+orphaned = [e for e in entries if e.resource_uuid not in my_extension_live_resource_ids()]
+ExtensionStorageDAO.delete(orphaned)
+```
+
+`ExtensionStorageDAO` is automatically scoped to the calling extension's own rows — `extension_id` is never a parameter you pass, so there is no way to reach another extension's storage through this API. It supports the standard DAO operations `find_all`, `find_one_or_none`, `filter_by`, `query`, `update`, and `delete`. `create()` is not supported — it's a raw insert with no upsert dedup, quota check, or locking against the key `.set()` writes to, so use `ctx.storage.persistent.set()` to write a value instead.
+
+### When to Use Tier 3
+
+- Extension configuration that must survive restarts
+- User-specific saved artifacts that need to roam across devices and browsers (e.g. saved SQL snippets, annotations)
+- Any data where loss is unacceptable
+
+### Limitations
+
+- Higher latency than Tiers 1–2 (database round-trip per operation)
+- Subject to the per-value size limit configured via `EXTENSIONS_PERSISTENT_STORAGE.MAX_VALUE_SIZE` (see [Quotas](#quotas))
+- Subject to the per-extension quota configured via `EXTENSIONS_PERSISTENT_STORAGE.QUOTA_PER_EXTENSION` (see [Quotas](#quotas))
+- Requires a database migration when first deployed
+
+## Working with Binary Data
+
+Tiers 2 and 3 accept a `codec` option describing how `value` is encoded — `"json"` (the default) for JSON-native values, or `"binary"` for raw bytes. `list()` and `get()` report which codec an entry was written with via `entry.codec`.
+
+### Backend
+
+Backend code talks to the storage DAO directly and works with real Python `bytes` — no extra flag is needed:
+
+```python
+from superset_core.extensions.context import get_context
+from superset_core.extensions.storage.persistent import PersistentSetOptions
+
+ctx = get_context()
+
+with open('logo.png', 'rb') as f:
+    png_bytes = f.read()
+
+ctx.storage.persistent.set('logo', png_bytes, PersistentSetOptions(codec='binary'))
+
+stored = ctx.storage.persistent.get('logo')  # raw bytes back, unchanged
+```
+
+### Frontend
+
+The frontend SDK talks to the backend over a JSON REST API, which has no byte type — a binary value must be base64-encoded to travel in a JSON request body. There is no way for the SDK to infer this from a JS value's type, so it is never detected automatically: set `isBinary: true` explicitly whenever `value` is binary.
+
+```typescript
+import { extensions } from '@apache-superset/core';
+
+const ctx = extensions.getContext();
+
+const pngBytes = new Uint8Array([0x89, 0x50, 0x4e, 0x47 /* ... */]);
+await ctx.storage.persistent.set('logo', pngBytes, { isBinary: true });
+```
+
+`get()` returns a binary entry's value exactly as stored on the wire — a base64 string, not a `Uint8Array` — so decode it yourself:
+
+```typescript
+const base64 = await ctx.storage.persistent.get<string>('logo');
+const bytes = Uint8Array.from(atob(base64), c => c.charCodeAt(0));
+```
+
+`list()` entries report `isBinary` alongside `codec`, so you know which entries need decoding before you read `value`:
+
+```typescript
+const result = await ctx.storage.persistent.list({ page: 0, pageSize: 10 });
+result.entries.forEach(entry => {
+  const value = entry.isBinary
+    ? Uint8Array.from(atob(entry.value as string), c => c.charCodeAt(0))
+    : entry.value;
+});
+```
+
+## Key Patterns
+
+All storage keys are automatically namespaced:
+
+| Scope                  | Key Pattern                                        |
+| ---------------------- | -------------------------------------------------- |
+| User-scoped            | `superset-ext:{extension_id}:user:{user_id}:{key}` |
+| Shared (Tiers 2 and 3) | `superset-ext:{extension_id}:shared:{key}`         |
+
+This ensures:
+
+- Extensions cannot accidentally access each other's data
+- Users cannot see other users' data (by default)
+- Clean prefix-based deletion on uninstall
+
+## Configuration
+
+### Tier 2: Ephemeral Storage
+
+Administrators can configure the server-side cache backend in `superset_config.py`:
+
+```python
+EXTENSIONS_EPHEMERAL_STORAGE = {
+    # Use Redis for better performance in production
+    "CACHE_TYPE": "RedisCache",
+    "CACHE_REDIS_URL": "redis://localhost:6379/2",
+    "MAX_TTL": 604800,  # 7 days maximum TTL
+    "MAX_VALUE_SIZE": 100 * 1024,  # 100 KB maximum per stored value
+}
+```
+
+For development, the default `SupersetMetastoreCache` stores data in the metadata database.
+
+### Tier 3: Persistent Storage
+
+Tier 3 values are stored in the `extension_storage` database table. Values are stored unencrypted by default; encryption is opt-in per write, available via a `PersistentSetOptions`-shaped `encrypt` option:
+
+```typescript
+import { extensions } from '@apache-superset/core';
+
+const ctx = extensions.getContext();
+
+await ctx.storage.persistent.set('api_token', 'sk-...', { encrypt: true });
+const token = await ctx.storage.persistent.get('api_token');
+```
+
+```python
+from superset_core.extensions.context import get_context
+from superset_core.extensions.storage.persistent import PersistentSetOptions
+
+ctx = get_context()
+
+ctx.storage.persistent.set('api_token', 'sk-...', PersistentSetOptions(encrypt=True))
+token = ctx.storage.persistent.get('api_token')
+```
+
+Encryption reuses Superset's existing `EncryptedType` (from `sqlalchemy-utils`) rather than a separate mechanism — the same infrastructure used for database connection credentials. The key is not configured directly: user-scoped values are encrypted with a key derived per-user via HMAC-SHA256 from the deployment's `SECRET_KEY`, so ciphertext for one user cannot be decrypted as another's; shared/global values (written via `.shared`) use `SECRET_KEY` directly. The encryption engine (AES-CBC by default) can be changed for the whole deployment via the existing `SQLALCHEMY_ENCRYPTED_FIELD_ENGINE` config, the same setting that controls encryption for database credentials elsewhere in Superset — there is no separate key list or rotation mechanism specific to extension storage. When `SECRET_KEY` is rotated, extension storage rows are re-encrypted by the existing `SecretsMigrator` tooling alongside database credentials, with no extension-specific steps required.
+
+### Quotas
+
+Persistent storage is subject to per-value, per-list-page, and per-extension size limits, configured in `superset_config.py`:
+
+```python
+EXTENSIONS_PERSISTENT_STORAGE = {
+    # Maximum total bytes an extension may store across all of its rows
+    # (global, every user's, and shared). Defaults to 100 MB.
+    "QUOTA_PER_EXTENSION": 100 * 1024 * 1024,
+    # Maximum size (in bytes) of a single stored value. Defaults to 1 MB.
+    "MAX_VALUE_SIZE": 1024 * 1024,
+    # Maximum combined value size (in bytes) that a single list() page may
+    # return. Defaults to 10 MB.
+    "MAX_LIST_PAYLOAD_SIZE": 10 * 1024 * 1024,
+}
+```
+
+A write that would push the extension's total stored size over `QUOTA_PER_EXTENSION` is rejected — the frontend SDK's `set()` call rejects with an HTTP 413 response, and backend code calling `ctx.storage.persistent.set()` sees the corresponding exception raised. Overwriting an existing key nets out that key's own current size against usage first, so replacing a value with one of the same or smaller size never spuriously fails even when the extension is already near its quota.
+
+A write whose encoded value exceeds `MAX_VALUE_SIZE` is rejected outright, independently of the total quota.
+
+A `list()` call whose requested page would return more than `MAX_LIST_PAYLOAD_SIZE` combined bytes of value data is rejected — reduce `page`/`pageSize` and retry. This check runs against the page's stored sizes before any value is read from the database, so an oversized request fails fast. Because `list()`'s response is consumed as JSON in the browser, raising `MAX_LIST_PAYLOAD_SIZE` substantially above the default risks client-side memory and parse-time issues — treat the default as already generous rather than a floor to build up from.

docs/developer_docs/index.md

@@ -52,7 +52,7 @@ Everything you need to contribute to the Apache Superset project. This section i
 ## Development Resources
 
 ### Prerequisites
-- **Python**: 3.9, 3.10, or 3.11
+- **Python**: 3.11 or 3.12
 - **Node.js**: 18.x or 20.x
 - **npm**: 9.x or 10.x
 - **Git**: Basic understanding

docs/docs/faq.mdx

@@ -181,6 +181,23 @@ value in milliseconds in the JSON Metadata field:
 Here, the entire dashboard will refresh at once if periodic refresh is on. The stagger time of 2.5
 seconds is ignored.
 
+The manual **Refresh dashboard** button can also stagger its chart requests, controlled by the
+`SUPERSET_DASHBOARD_MANUAL_REFRESH_STAGGER_MS` server config in `superset_config.py`. This defaults
+to `0`, which preserves the original behavior where every chart request fires at the same time when
+the button is clicked. To opt in to staggering, set a positive number of milliseconds; the window
+then becomes the larger of this value and the per-dashboard `stagger_time` metadata, which itself
+defaults to `5000` milliseconds when it is not set explicitly. Setting `stagger_refresh` to `false`
+in a dashboard's JSON Metadata also disables staggering on the manual-refresh path, so its charts
+fire all at once even when the server config is positive. If the backend does not provide a value at
+all, for example an older backend that predates this config or a value explicitly set to `None`, the
+frontend falls back to a built-in default of `5000` milliseconds.
+
+```python
+# superset_config.py
+# 0 (the default) fires every chart at once; set a positive value to stagger.
+SUPERSET_DASHBOARD_MANUAL_REFRESH_STAGGER_MS = 0
+```
+
 **Why does ‘flask fab’ or superset freeze/hang/not responding when started (my home directory is
 NFS mounted)?**
 

docs/docs/using-superset/exporting-dashboard-data.mdx

@@ -0,0 +1,99 @@
+---
+title: Exporting Dashboard Data to Excel
+hide_title: true
+sidebar_position: 7
+version: 1
+---
+
+# Exporting Dashboard Data to Excel
+
+Superset can export every chart on a dashboard to a single Excel workbook, with
+each chart's underlying data rendered as its own worksheet. The export reflects
+the dashboard's currently applied filters and runs asynchronously: when it
+finishes, the requesting user receives an email with a time-limited download
+link.
+
+## Using the export
+
+From a dashboard, open the **... (actions) → Download** submenu and choose
+**Export Data to Excel**. The action appears for users who have the dashboard
+`can_export` permission. You'll see a confirmation that the export is being
+prepared; the workbook arrives by email when it's ready.
+
+A second option, **Export Images to Excel**, embeds each non-table chart as a
+rendered image (tables stay tabular) instead of exporting raw data. Because it
+renders charts through the headless webdriver, this option only appears when the
+webdriver screenshot feature flags are enabled (see the prerequisites below);
+which viz types stay tabular is controlled by `EXCEL_EXPORT_TABLE_VIZ_TYPES`.
+
+Notes on the generated workbook:
+
+- One worksheet per chart, named `{chart_id} - {chart title}` (truncated to
+  Excel's 31-character limit; the chart id keeps names unique).
+- Charts nested in tabs are included.
+- Data reflects the dashboard's active filter state at the time of export.
+- A chart with no saved query context is skipped and listed in the email; open
+  the chart in Explore and re-save it to include it next time.
+- Row counts per sheet are capped the same way as the chart-level CSV/Excel
+  export (`ROW_LIMIT`, bounded by `SQL_MAX_ROW`), and never exceed Excel's
+  per-sheet maximum.
+
+## Prerequisites
+
+This feature is **disabled by default**. It requires:
+
+1. **The `boto3` dependency.** It is not installed by default; install it with
+   `pip install apache-superset[excel-export]`. Without it, exports fail and the
+   user receives a failure email.
+2. **An S3 bucket.** Set `EXCEL_EXPORT_S3_BUCKET`. Until it is set, the export
+   endpoint returns `501` and the menu action surfaces a "not configured"
+   message.
+3. **A running Celery worker.** The export runs as a Celery task. If no worker
+   is running, the request is accepted but nothing is produced.
+4. **A configured SMTP transport.** The download link is delivered by email
+   using the same settings as alerts & reports (`SMTP_*`,
+   `EMAIL_REPORTS_SUBJECT_PREFIX`).
+
+**Export Images to Excel** additionally requires a working headless webdriver —
+the same infrastructure scheduled reports and thumbnails use (`WEBDRIVER_*`,
+plus the `ENABLE_DASHBOARD_SCREENSHOT_ENDPOINTS` and
+`ENABLE_DASHBOARD_DOWNLOAD_WEBDRIVER_SCREENSHOT` feature flags). The menu option
+is hidden when those flags are off; if the webdriver is unreachable, image
+charts come back empty even though the data export path still works.
+
+Deployments that override `CELERY_CONFIG` must add
+`"superset.tasks.export_dashboard_excel"` to the `imports` tuple, or the task
+will not register.
+
+## Configuration keys
+
+| Key | Default | Description |
+| --- | --- | --- |
+| `EXCEL_EXPORT_S3_BUCKET` | `None` | Destination bucket. Required; `501` if unset. |
+| `EXCEL_EXPORT_S3_KEY_PREFIX` | `"dashboard-exports/"` | Key prefix: `{prefix}{dashboard_id}/{job_id}.xlsx`. |
+| `EXCEL_EXPORT_LINK_TTL_SECONDS` | `86400` | Lifetime of the pre-signed download URL (24h). |
+| `EXCEL_EXPORT_S3_CLIENT_KWARGS` | `{}` | Extra kwargs for `boto3.client("s3", ...)` — e.g. `region_name`, or `endpoint_url` for MinIO/LocalStack. |
+| `EXCEL_EXPORT_TABLE_VIZ_TYPES` | `None` | Viz types kept tabular in **Export Images to Excel** mode; every other type is embedded as an image. `None` uses the built-in default (`table`, `pivot_table`, `pivot_table_v2`). |
+
+Credentials and region resolve through the standard boto3 chain (environment
+variables, shared config, or instance role) unless overridden via
+`EXCEL_EXPORT_S3_CLIENT_KWARGS`. The worker needs `s3:PutObject` on the bucket.
+
+## Security considerations
+
+- The emailed link is a **pre-signed S3 URL**: anyone who holds it can download
+  the workbook until it expires. Keep the bucket **private**, enable
+  encryption, and consider a lifecycle rule to delete objects after a few days.
+  Lower `EXCEL_EXPORT_LINK_TTL_SECONDS` if 24 hours is too long for your data.
+- The export runs with the requesting user's permissions; each chart's query is
+  access-checked, so users only ever receive data they are entitled to.
+
+## Limitations
+
+- **Embedded dashboards / guest tokens are not supported** in this version,
+  because guest users have no email address to deliver the link to. Logged-in
+  users viewing an embedded dashboard can still use the export.
+- The default **Export Data to Excel** mode exports data only (no visual
+  styling). Use **Export Images to Excel** to embed rendered chart images, which
+  requires the webdriver infrastructure described in the prerequisites.
+- Scheduled/automated exports are not part of this feature.

docs/docs/using-superset/sql-templating.mdx

@@ -146,7 +146,9 @@ The `where_in` filter converts the list to SQL format: `('value1', 'value2', 'va
 
 ### Time Filters
 
-For charts with time range filters:
+`get_time_filter()` is the standard way to reference the selected time range in a virtual dataset.
+It returns a `TimeFilter` object with `from_expr` and `to_expr` — fully-formatted SQL expressions
+that should be used directly in `WHERE` clauses without quoting.
 
 | Macro | Description |
 |-------|-------------|
@@ -198,17 +200,9 @@ GROUP BY category
 
 ## Testing Templates in SQL Lab
 
-Some variables like `from_dttm` and `filter_values()` only work when filters are applied from dashboards or charts. To test in SQL Lab:
+Some variables like `filter_values()` only work when filters are applied from dashboards or charts. To test in SQL Lab:
 
-**Option 1: Use defaults**
-
-```sql
-SELECT *
-FROM orders
-WHERE date >= '{{ from_dttm | default("2024-01-01", true) }}'
-```
-
-**Option 2: Set test parameters**
+**Option 1: Set test parameters**
 
 Add to the Parameters menu:
 
@@ -220,7 +214,7 @@ Add to the Parameters menu:
 }
 ```
 
-**Option 3: Use `{% set %}`**
+**Option 2: Use `{% set %}`**
 
 ```sql
 {% set start_date = "2024-01-01" %}

docs/package.json

@@ -44,12 +44,12 @@
   },
   "dependencies": {
     "@ant-design/icons": "^6.2.5",
-    "@docusaurus/core": "^3.10.1",
-    "@docusaurus/faster": "^3.10.1",
-    "@docusaurus/plugin-client-redirects": "^3.10.1",
-    "@docusaurus/preset-classic": "3.10.1",
-    "@docusaurus/theme-live-codeblock": "^3.10.1",
-    "@docusaurus/theme-mermaid": "^3.10.1",
+    "@docusaurus/core": "^3.10.2",
+    "@docusaurus/faster": "^3.10.2",
+    "@docusaurus/plugin-client-redirects": "^3.10.2",
+    "@docusaurus/preset-classic": "3.10.2",
+    "@docusaurus/theme-live-codeblock": "^3.10.2",
+    "@docusaurus/theme-mermaid": "^3.10.2",
     "@emotion/core": "^11.0.0",
     "@emotion/react": "^11.13.3",
     "@emotion/styled": "^11.14.1",
@@ -58,14 +58,14 @@
     "@fontsource/inter": "^5.2.8",
     "@mdx-js/react": "^3.1.1",
     "@saucelabs/theme-github-codeblock": "^0.3.0",
-    "@storybook/addon-docs": "^10.4.5",
+    "@storybook/addon-docs": "^10.5.0",
     "@superset-ui/core": "^0.20.4",
     "@swc/core": "^1.15.43",
-    "antd": "^6.5.0",
-    "baseline-browser-mapping": "^2.10.40",
-    "caniuse-lite": "^1.0.30001799",
-    "docusaurus-plugin-openapi-docs": "^5.1.0",
-    "docusaurus-theme-openapi-docs": "^5.1.0",
+    "antd": "^6.5.1",
+    "baseline-browser-mapping": "^2.10.43",
+    "caniuse-lite": "^1.0.30001805",
+    "docusaurus-plugin-openapi-docs": "^5.1.2",
+    "docusaurus-theme-openapi-docs": "^5.1.2",
     "js-yaml": "^5.2.0",
     "json-bigint": "^1.0.0",
     "prism-react-renderer": "^2.4.1",
@@ -77,28 +77,28 @@
     "react-table": "^7.8.0",
     "remark-import-partial": "^0.0.2",
     "reselect": "^5.2.0",
-    "storybook": "^10.4.5",
+    "storybook": "^10.5.0",
     "swagger-ui-react": "^5.32.8",
     "swc-loader": "^0.2.7",
     "tinycolor2": "^1.4.2",
     "unist-util-visit": "^5.1.0"
   },
   "devDependencies": {
-    "@docusaurus/module-type-aliases": "^3.10.1",
-    "@docusaurus/tsconfig": "^3.10.1",
+    "@docusaurus/module-type-aliases": "^3.10.2",
+    "@docusaurus/tsconfig": "^3.10.2",
     "@eslint/js": "^9.39.2",
     "@types/js-yaml": "^4.0.9",
     "@types/react": "^19.1.8",
-    "@typescript-eslint/eslint-plugin": "^8.59.3",
-    "@typescript-eslint/parser": "^8.61.0",
+    "@typescript-eslint/eslint-plugin": "^8.64.0",
+    "@typescript-eslint/parser": "^8.64.0",
     "eslint": "^9.39.2",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-prettier": "^5.5.6",
     "eslint-plugin-react": "^7.37.5",
     "globals": "^17.7.0",
-    "prettier": "^3.9.1",
+    "prettier": "^3.9.5",
     "typescript": "~6.0.3",
-    "typescript-eslint": "^8.62.0",
+    "typescript-eslint": "^8.64.0",
     "webpack": "^5.108.2"
   },
   "browserslist": {
@@ -124,8 +124,6 @@
     "serialize-javascript": "7.0.5",
     "d3-color": "3.1.0",
     "ws": "^8.21.0",
-    "@docusaurus/core/@docusaurus/utils/gray-matter/js-yaml": "^3.15.0",
-    "@docusaurus/core/**/js-yaml": "^4.3.0",
     "docusaurus-plugin-openapi-docs/**/js-yaml": "^4.3.0"
   },
   "packageManager": "yarn@1.22.22+sha1.ac34549e6aa8e7ead463a7407e1c7390f61a6610"

docs/sidebarTutorials.js

@@ -82,12 +82,14 @@ const sidebars = {
           items: [
             'extensions/extension-points/sqllab',
             'extensions/extension-points/editors',
+            'extensions/extension-points/chat',
           ],
         },
         'extensions/development',
         'extensions/deployment',
         'extensions/mcp',
         'extensions/security',
+        'extensions/storage',
         'extensions/tasks',
         'extensions/registry',
       ],

docs/src/data/databases.json

@@ -3672,7 +3672,7 @@
         "drivers": [
           {
             "name": "crate",
-            "pypi_package": "crate[sqlalchemy]",
+            "pypi_package": "sqlalchemy-cratedb",
             "connection_string": "crate://{host}:{port}",
             "is_recommended": true
           }

docs/static/.htaccess

@@ -28,8 +28,9 @@ RewriteRule ^(.*)$ https://superset.apache.org/$1 [R=301,L]
 # - *.googleapis.com, *.google.com, *.gstatic.com: Google Calendar embed, kapa.ai reCAPTCHA - all of these loaded with user consent, following policy laid out in https://privacy.apache.org/faq/committers.html
 # - github.com, *.github.com, *.githubusercontent.com: GitHub user-attachment images in docs (apex github.com serves user-attachments/* assets). Discussed/resolved in this thread: https://issues.apache.org/jira/browse/INFRA-25701?filter=-2 (DPA in place with GitHub)
 # - *.algolia.net, *.algolianet.com: Algolia DocSearch. Approved here: https://privacy.apache.org/faq/committers.html
+# - *.run.app: Google-owned domain (Google Cloud Run) used by the kapa.ai widget backend - only reached after explicit user acceptance when opening the widget, allowable per the policy laid out in https://privacy.apache.org/faq/committers.html
 # See: https://infra.apache.org/tools/csp.html
-SetEnv CSP_PROJECT_DOMAINS "widget.kapa.ai https://*.googleapis.com/ https://*.google.com/ https://*.gstatic.com/ https://github.com/ https://*.github.com/ https://*.githubusercontent.com/ https://*.algolia.net/ https://*.algolianet.com/"
+SetEnv CSP_PROJECT_DOMAINS "widget.kapa.ai https://*.googleapis.com/ https://*.google.com/ https://*.gstatic.com/ https://github.com/ https://*.github.com/ https://*.githubusercontent.com/ https://*.algolia.net/ https://*.algolianet.com/ https://*.run.app/"
 
 # REDIRECTS
 

docs/static/feature-flags.json

@@ -405,12 +405,6 @@
         "default": true,
         "lifecycle": "deprecated",
         "description": "Enable drill-to-detail functionality in charts"
-      },
-      {
-        "name": "ENABLE_JAVASCRIPT_CONTROLS",
-        "default": false,
-        "lifecycle": "deprecated",
-        "description": "Allow JavaScript in chart controls. WARNING: XSS security vulnerability!"
       }
     ]
   }

docs/user_docs_versioned_docs/version-6.0.0/configuration/alerts-reports.mdx

@@ -291,7 +291,7 @@ This is the best source of information about the problem.  In a docker compose d
 
 ### Check web browser and webdriver installation
 
-To take a screenshot, the worker visits the dashboard or chart using a headless browser, then takes a screenshot. If you are able to send a chart as CSV or text but can't send as PNG, your problem may lie with the browser.
+To take a screenshot, the worker visits the dashboard or chart using a headless browser, then takes a screenshot. If you are able to send a chart as CSV, XLSX, or text but can't send as PNG, your problem may lie with the browser.
 
 Superset docker images that have a tag ending with `-dev` have the Firefox headless browser and geckodriver already installed. You can test that these are installed and in the proper path by entering your Superset worker and running `firefox --headless` and then `geckodriver`. Both commands should start those applications.
 

helm/superset/Chart.yaml

@@ -29,7 +29,7 @@ maintainers:
   - name: craig-rueda
     email: craig@craigrueda.com
     url: https://github.com/craig-rueda
-version: 0.19.0 # See [README](https://github.com/apache/superset/blob/master/helm/superset/README.md#versioning) for version details.
+version: 0.22.1 # See [README](https://github.com/apache/superset/blob/master/helm/superset/README.md#versioning) for version details.
 dependencies:
   - name: postgresql
     version: 16.7.27

helm/superset/README.md

@@ -23,7 +23,7 @@ NOTE: This file is generated by helm-docs: https://github.com/norwoodj/helm-docs
 
 # superset
 
-![Version: 0.19.0](https://img.shields.io/badge/Version-0.19.0-informational?style=flat-square)
+![Version: 0.22.1](https://img.shields.io/badge/Version-0.22.1-informational?style=flat-square)
 
 Apache Superset is a modern, enterprise-ready business intelligence web application
 
@@ -74,10 +74,42 @@ Alternatively, perform a fresh install. This is a one-time migration; subsequent
 |-----|------|---------|-------------|
 | affinity | object | `{}` |  |
 | bootstrapScript | string | see `values.yaml` | Install additional packages and do any other bootstrap configuration in this script For production clusters it's recommended to build own image with this step done in CI |
+| cache | object | `{"asyncQueries":{"keyPrefix":"qc-","timeout":86400},"cacheDb":null,"cacheUrl":null,"celeryDb":null,"celeryUrl":null,"defaultTimeout":86400,"driver":"","enabled":true,"host":null,"keyPrefix":"superset_","password":null,"port":null,"resultsBackendKeyPrefix":"superset_results","sentinel":null,"ssl":{"ca_certs":null,"certfile":null,"enabled":false,"keyfile":null,"ssl_cert_reqs":"required"},"user":""}` | Redis cache configuration for Superset Redis is optional but recommended for caching and Celery. If redis.enabled (chart dependency) is true, defaults point to the chart's Redis instance. |
+| cache.asyncQueries | object | `{"keyPrefix":"qc-","timeout":86400}` | Async queries configuration |
+| cache.cacheDb | string | `nil` | Redis database number for cache (default: 1 when unset; legacy redis_cache_db is honored) |
+| cache.cacheUrl | string | `nil` | Full Redis cache URL (overrides host/port/user/pass if set) |
+| cache.celeryDb | string | `nil` | Redis database number for Celery (default: 0 when unset; legacy redis_celery_db is honored) |
+| cache.celeryUrl | string | `nil` | Full Redis Celery URL (overrides host/port/user/pass if set) |
+| cache.defaultTimeout | int | `86400` | Default cache timeout in seconds |
+| cache.driver | string | `""` | Custom Redis driver (e.g. TLS/managed variants); overrides the redis proto in URLs when set. Ports the legacy supersetNode.connections.redis_driver escape hatch. |
+| cache.enabled | bool | `true` | Enable Redis-based features (cache, Celery). Set to false to disable Redis usage entirely. |
+| cache.host | string | `nil` | Redis host (default: {{ .Release.Name }}-redis-headless) |
+| cache.keyPrefix | string | `"superset_"` | Cache key prefix |
+| cache.password | string | `nil` | Redis password |
+| cache.port | string | `nil` | Redis port (default: 6379 when unset; legacy supersetNode.connections.redis_port is honored) |
+| cache.resultsBackendKeyPrefix | string | `"superset_results"` | Results backend key prefix |
+| cache.sentinel | string | `nil` | Redis Sentinel configuration (optional) |
+| cache.ssl | object | `{"ca_certs":null,"certfile":null,"enabled":false,"keyfile":null,"ssl_cert_reqs":"required"}` | Redis SSL configuration |
+| cache.user | string | `""` | Redis user (optional, for Redis ACL) |
+| cluster | object | `{"databaseServiceName":null,"domain":".svc.cluster.local","redisServiceName":null,"websocketServiceName":null}` | Kubernetes cluster configuration Used for constructing service URLs between chart components |
+| cluster.databaseServiceName | string | `nil` | Database service name (default: {{ .Release.Name }}-postgresql) Override if using a different service name for the database |
+| cluster.domain | string | `".svc.cluster.local"` | Kubernetes cluster domain (default: .svc.cluster.local) Override if using a custom cluster domain |
+| cluster.redisServiceName | string | `nil` | Redis service name (default: {{ .Release.Name }}-redis-headless) Override if using a different service name for Redis |
+| cluster.websocketServiceName | string | `nil` | WebSocket service name (default: {{ .Release.Name }}-ws) Override if using a different service name for the WebSocket service |
+| config | object | `{}` | Superset configuration properties Set any configuration property from superset/config.py here See https://github.com/apache/superset/blob/master/superset/config.py for all available options |
 | configFromSecret | string | `"{{ template \"superset.fullname\" . }}-config"` | The name of the secret which we will use to generate a superset_config.py file Note: this secret must have the key superset_config.py in it and can include other files as well |
 | configMountPath | string | `"/app/pythonpath"` |  |
 | configOverrides | object | `{}` | A dictionary of overrides to append at the end of superset_config.py - the name does not matter WARNING: the order is not guaranteed Files can be passed as helm --set-file configOverrides.my-override=my-file.py |
 | configOverridesFiles | object | `{}` | Same as above but the values are files |
+| database | object | `{"driver":null,"host":null,"name":null,"password":null,"port":null,"ssl":{"enabled":false,"mode":"require"},"uri":null,"user":null}` | Database connection configuration for the Superset metadata database |
+| database.driver | string | `nil` | Database driver used when uri is not set (default: postgresql+psycopg2 when unset; legacy supersetNode.connections.db_type is honored when this is unset) |
+| database.host | string | `nil` | Database host (default: {{ .Release.Name }}-postgresql) |
+| database.name | string | `nil` | Database name (default: superset, resolved via superset.db.name) |
+| database.password | string | `nil` | Database password (default: superset, resolved via superset.db.password) ⚠️ CHANGE THIS for production |
+| database.port | string | `nil` | Database port (default: 5432 when unset; legacy supersetNode.connections.db_port is honored) |
+| database.ssl | object | `{"enabled":false,"mode":"require"}` | Database SSL configuration |
+| database.uri | string | `nil` | Full database URI (overrides host/port/user/pass/name if set) Example: "postgresql+psycopg2://user:pass@host:5432/dbname" |
+| database.user | string | `nil` | Database user (default: superset, resolved via superset.db.user) |
 | envFromSecret | string | `"{{ template \"superset.fullname\" . }}-env"` | The name of the secret which we will use to populate env vars in deployed pods This can be useful for secret keys, etc. |
 | envFromSecrets | list | `[]` | This can be a list of templated strings |
 | extraConfigMountPath | string | `"/app/configs"` |  |
@@ -89,8 +121,17 @@ Alternatively, perform a fresh install. This is a one-time migration; subsequent
 | extraSecrets | object | `{}` | Extra files to be mounted as Secrets on the path specified in `configMountPath` |
 | extraVolumeMounts | list | `[]` |  |
 | extraVolumes | list | `[]` |  |
+| featureFlags | object | `{}` | Feature flags configuration See https://github.com/apache/superset/blob/master/RESOURCES/FEATURE_FLAGS.md |
 | fullnameOverride | string | `nil` | Provide a name to override the full names of resources |
+| globalPodAnnotations | object | `{}` | Global pod annotations to be added to all pods Use this to set annotations that apply to all Superset components Component-specific podAnnotations will be merged with these global annotations |
 | hostAliases | list | `[]` | Custom hostAliases for all superset pods # https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ |
+| httproute | object | see `values.yaml` | Gateway API HTTPRoute for exposing Superset via a Gateway. Requires the Gateway API CRDs (gateway.networking.k8s.io/v1) installed in the cluster. |
+| httproute.annotations | object | `{}` | Annotations to add to the HTTPRoute |
+| httproute.apiVersion | string | `"gateway.networking.k8s.io/v1"` | HTTPRoute apiVersion. Override to gateway.networking.k8s.io/v1beta1 for older Gateway API installations that have not promoted HTTPRoute to v1. |
+| httproute.hostnames | list | `[]` | Hostnames that match against the HTTP Host header (templated) |
+| httproute.labels | object | `{}` | Additional labels to add to the HTTPRoute |
+| httproute.parentRefs | list | `[]` | Gateways this HTTPRoute attaches to |
+| httproute.rules | list | `[{"matches":[{"path":{"type":"PathPrefix","value":"/"}}]}]` | Routing rules. Each rule is backed by the Superset service. Set `weight` per rule to leave room for traffic splitting (defaults to 1). When `supersetWebsockets.enabled` is true, an extra rule routing `supersetWebsockets.ingress.path` to the `-ws` service is appended automatically, mirroring the ingress behavior. |
 | image.pullPolicy | string | `"IfNotPresent"` |  |
 | image.repository | string | `"apachesuperset.docker.scarf.sh/apache/superset"` |  |
 | image.tag | string | `nil` |  |
@@ -115,8 +156,9 @@ Alternatively, perform a fresh install. This is a one-time migration; subsequent
 | init.createAdmin | bool | `true` |  |
 | init.enabled | bool | `true` |  |
 | init.extraContainers | list | `[]` | Launch additional containers into init job pod |
+| init.extraInitContainers | list | `[]` | Extra init containers appended after init job initContainers |
 | init.initContainers | list | a container waiting for postgres | List of initContainers |
-| init.initscript | string | a script to create admin user and initialize roles | A Superset init script |
+| init.initscript | string | unused; kept for backwards-compatibility only | DEPRECATED: this field is no longer used by the chart. The init script is rendered entirely from the internal `superset.initScript` template (which runs `superset db upgrade`, `superset init`, admin creation, and examples). Any customization placed here is silently ignored. See UPGRADING.md. |
 | init.jobAnnotations."helm.sh/hook" | string | `"post-install,post-upgrade"` |  |
 | init.jobAnnotations."helm.sh/hook-delete-policy" | string | `"before-hook-creation"` |  |
 | init.loadExamples | bool | `false` |  |
@@ -134,7 +176,10 @@ Alternatively, perform a fresh install. This is a one-time migration; subsequent
 | redis | object | see `values.yaml` | Configuration values for the Redis dependency. ref: https://github.com/bitnami/charts/blob/master/bitnami/redis More documentation can be found here: https://artifacthub.io/packages/helm/bitnami/redis |
 | resources | object | `{}` |  |
 | runAsUser | int | `0` | User ID directive. This user must have enough permissions to run the bootstrap script Running containers as root is not recommended in production. Change this to another UID - e.g. 1000 to be more secure |
-| secretEnv | object | `{"create":true}` | Specify rather or not helm should create the secret described in `secret-env.yaml` template |
+| secretConfig | object | `{"annotations":{}}` | Specify whether Helm should apply additional settings to a secret containing configuration files |
+| secretConfig.annotations | object | `{}` | Annotations to be added to the secret which contains configuration files |
+| secretEnv | object | `{"annotations":{},"create":true}` | Specify rather or not helm should create the secret described in `secret-env.yaml` template |
+| secretEnv.annotations | object | `{}` | Annotations to be added to the secret |
 | secretEnv.create | bool | `true` | Change to false in order to support externally created secret (Binami "Sealed Secrets" for Kubernetes or External Secrets Operator) note: when externally creating the secret, the chart still expects to pull values from a secret with the name of the release defaults to `release-name-superset-env` - full logic located in _helpers.tpl file: `define "superset.fullname"` |
 | service.annotations | object | `{}` |  |
 | service.loadBalancerIP | string | `nil` |  |
@@ -143,6 +188,7 @@ Alternatively, perform a fresh install. This is a one-time migration; subsequent
 | service.type | string | `"ClusterIP"` |  |
 | serviceAccount.annotations | object | `{}` |  |
 | serviceAccount.create | bool | `false` | Create custom service account for Superset. If create: true and serviceAccountName is not provided, `superset.fullname` will be used. |
+| serviceAccount.name | string | `""` | Service account name to use (if not specified, defaults to release name + chart name) |
 | serviceAccountName | string | `nil` | Specify service account name to be used |
 | supersetCeleryBeat.affinity | object | `{}` | Affinity to be added to supersetCeleryBeat deployment |
 | supersetCeleryBeat.command | list | a `celery beat` command | Command |
@@ -151,6 +197,7 @@ Alternatively, perform a fresh install. This is a one-time migration; subsequent
 | supersetCeleryBeat.deploymentAnnotations | object | `{}` | Annotations to be added to supersetCeleryBeat deployment |
 | supersetCeleryBeat.enabled | bool | `false` | This is only required if you intend to use alerts and reports |
 | supersetCeleryBeat.extraContainers | list | `[]` | Launch additional containers into supersetCeleryBeat pods |
+| supersetCeleryBeat.extraInitContainers | list | `[]` | Extra init containers appended after supersetCeleryBeat initContainers |
 | supersetCeleryBeat.forceReload | bool | `false` | If true, forces deployment to reload on each upgrade |
 | supersetCeleryBeat.initContainers | list | a container waiting for postgres | List of init containers |
 | supersetCeleryBeat.podAnnotations | object | `{}` | Annotations to be added to supersetCeleryBeat pods |
@@ -170,6 +217,7 @@ Alternatively, perform a fresh install. This is a one-time migration; subsequent
 | supersetCeleryFlower.deploymentAnnotations | object | `{}` | Annotations to be added to supersetCeleryFlower deployment |
 | supersetCeleryFlower.enabled | bool | `false` | Enables a Celery flower deployment (management UI to monitor celery jobs) WARNING: on superset 1.x, this requires a Superset image that has `flower<1.0.0` installed (which is NOT the case of the default images) flower>=1.0.0 requires Celery 5+ which Superset 1.5 does not support |
 | supersetCeleryFlower.extraContainers | list | `[]` | Launch additional containers into supersetCeleryFlower pods |
+| supersetCeleryFlower.extraInitContainers | list | `[]` | Extra init containers appended after supersetCeleryFlower initContainers |
 | supersetCeleryFlower.initContainers | list | a container waiting for postgres and redis | List of init containers |
 | supersetCeleryFlower.livenessProbe.failureThreshold | int | `3` |  |
 | supersetCeleryFlower.livenessProbe.httpGet.path | string | `"/api/workers"` |  |
@@ -208,32 +256,74 @@ Alternatively, perform a fresh install. This is a one-time migration; subsequent
 | supersetCeleryFlower.startupProbe.successThreshold | int | `1` |  |
 | supersetCeleryFlower.startupProbe.timeoutSeconds | int | `1` |  |
 | supersetCeleryFlower.topologySpreadConstraints | list | `[]` | TopologySpreadConstrains to be added to supersetCeleryFlower deployments |
+| supersetMcp.affinity | object | `{}` | Affinity to be added to supersetMcp deployment |
+| supersetMcp.command | list | a `superset mcp run` command | Command |
+| supersetMcp.containerSecurityContext | object | `{}` |  |
+| supersetMcp.deploymentAdditionalPodSpec | object | `{}` | Custom pod spec to be added to supersetMcp deployment |
+| supersetMcp.deploymentAnnotations | object | `{}` | Annotations to be added to supersetMcp deployment |
+| supersetMcp.deploymentLabels | object | `{}` | Labels to be added to supersetMcp deployment |
+| supersetMcp.enabled | bool | `false` | Enables the Superset MCP Server. To expose it via the shared ingress at /mcp, also set supersetMcp.ingress.enabled=true. WARNING: this requires fastMCP to be installed, which can be done by installing `apache-superset[fastmcp]` |
+| supersetMcp.extraContainers | list | `[]` | Launch additional containers into supersetMcp pods |
+| supersetMcp.extraInitContainers | list | `[]` | Extra init containers appended after supersetMcp initContainers |
+| supersetMcp.forceReload | bool | `false` | If true, forces deployment to reload on each upgrade |
+| supersetMcp.ingress.enabled | bool | `false` | If true, the MCP server will be exposed via the ingress /mcp subpath |
+| supersetMcp.ingress.path | string | `"/mcp"` |  |
+| supersetMcp.ingress.pathType | string | `"Prefix"` |  |
+| supersetMcp.initContainers | list | a container waiting for postgres and redis | List of init containers |
+| supersetMcp.lifecycle | object | `{}` | Container lifecycle hooks for the worker pod |
+| supersetMcp.livenessProbe.failureThreshold | int | `3` |  |
+| supersetMcp.livenessProbe.httpGet.path | string | `"/health"` |  |
+| supersetMcp.livenessProbe.httpGet.port | string | `"mcp"` |  |
+| supersetMcp.livenessProbe.initialDelaySeconds | int | `15` |  |
+| supersetMcp.livenessProbe.periodSeconds | int | `15` |  |
+| supersetMcp.livenessProbe.successThreshold | int | `1` |  |
+| supersetMcp.livenessProbe.timeoutSeconds | int | `3` |  |
+| supersetMcp.podAnnotations | object | `{}` | Annotations to be added to supersetMcp pods |
+| supersetMcp.podDisruptionBudget | object | `{"enabled":false,"maxUnavailable":1,"minAvailable":1}` | Sets the [pod disruption budget](https://kubernetes.io/docs/tasks/run-application/configure-pdb/) for supersetMcp pods |
+| supersetMcp.podDisruptionBudget.enabled | bool | `false` | Whether the pod disruption budget should be created |
+| supersetMcp.podDisruptionBudget.maxUnavailable | int | `1` | If set, minAvailable must not be set - see https://kubernetes.io/docs/tasks/run-application/configure-pdb/\#specifying-a-poddisruptionbudget |
+| supersetMcp.podDisruptionBudget.minAvailable | int | `1` | If set, maxUnavailable must not be set - see https://kubernetes.io/docs/tasks/run-application/configure-pdb/\#specifying-a-poddisruptionbudget |
+| supersetMcp.podLabels | object | `{}` | Labels to be added to supersetMcp pods |
+| supersetMcp.podSecurityContext | object | `{}` |  |
+| supersetMcp.priorityClassName | string | `nil` | Set priorityClassName for supersetMcp pods |
+| supersetMcp.readinessProbe.failureThreshold | int | `3` |  |
+| supersetMcp.readinessProbe.httpGet.path | string | `"/health"` |  |
+| supersetMcp.readinessProbe.httpGet.port | string | `"mcp"` |  |
+| supersetMcp.readinessProbe.initialDelaySeconds | int | `15` |  |
+| supersetMcp.readinessProbe.periodSeconds | int | `15` |  |
+| supersetMcp.readinessProbe.successThreshold | int | `1` |  |
+| supersetMcp.readinessProbe.timeoutSeconds | int | `3` |  |
+| supersetMcp.replicaCount | int | `1` |  |
+| supersetMcp.resources | object | `{}` | Resource settings for the supersetMcp pods - these settings overwrite might existing values from the global resources object defined above. |
+| supersetMcp.service.annotations | object | `{}` |  |
+| supersetMcp.service.loadBalancerIP | string | `nil` |  |
+| supersetMcp.service.nodePort.http | int | `"nil"` |  |
+| supersetMcp.service.port | int | `5008` |  |
+| supersetMcp.service.type | string | `"ClusterIP"` |  |
+| supersetMcp.startupProbe.failureThreshold | int | `60` |  |
+| supersetMcp.startupProbe.httpGet.path | string | `"/health"` |  |
+| supersetMcp.startupProbe.httpGet.port | string | `"mcp"` |  |
+| supersetMcp.startupProbe.initialDelaySeconds | int | `15` |  |
+| supersetMcp.startupProbe.periodSeconds | int | `5` |  |
+| supersetMcp.startupProbe.successThreshold | int | `1` |  |
+| supersetMcp.startupProbe.timeoutSeconds | int | `3` |  |
+| supersetMcp.strategy | object | `{}` |  |
+| supersetMcp.terminationGracePeriodSeconds | string | `nil` | Pod termination grace period (seconds) for the worker pod so in-flight tasks can drain before SIGKILL |
+| supersetMcp.topologySpreadConstraints | list | `[]` | TopologySpreadConstrains to be added to supersetMcp deployments |
 | supersetNode.affinity | object | `{}` | Affinity to be added to supersetNode deployment |
 | supersetNode.autoscaling.enabled | bool | `false` |  |
 | supersetNode.autoscaling.maxReplicas | int | `100` |  |
 | supersetNode.autoscaling.minReplicas | int | `1` |  |
 | supersetNode.autoscaling.targetCPUUtilizationPercentage | int | `80` |  |
 | supersetNode.command | list | See `values.yaml` | Startup command |
-| supersetNode.connections.db_host | string | `"{{ .Release.Name }}-postgresql"` |  |
-| supersetNode.connections.db_name | string | `"superset"` |  |
-| supersetNode.connections.db_pass | string | `"superset"` |  |
-| supersetNode.connections.db_port | string | `"5432"` |  |
-| supersetNode.connections.db_type | string | `"postgresql"` | Database type for Superset metadata (Supported types: "postgresql", "mysql") |
-| supersetNode.connections.db_user | string | `"superset"` |  |
-| supersetNode.connections.redis_cache_db | string | `"1"` |  |
-| supersetNode.connections.redis_celery_db | string | `"0"` |  |
-| supersetNode.connections.redis_driver | string | `""` |  |
-| supersetNode.connections.redis_host | string | `"{{ .Release.Name }}-redis-headless"` | Change in case of bringing your own redis and then also set redis.enabled:false |
-| supersetNode.connections.redis_port | string | `"6379"` |  |
-| supersetNode.connections.redis_ssl.enabled | bool | `false` |  |
-| supersetNode.connections.redis_ssl.ssl_cert_reqs | string | `"CERT_NONE"` |  |
-| supersetNode.connections.redis_user | string | `""` |  |
+| supersetNode.connections | object | `{}` |  |
 | supersetNode.containerSecurityContext | object | `{}` |  |
 | supersetNode.deploymentAdditionalPodSpec | object | `{}` | Custom pod spec to be added to supersetNode deployment |
 | supersetNode.deploymentAnnotations | object | `{}` | Annotations to be added to supersetNode deployment |
 | supersetNode.deploymentLabels | object | `{}` | Labels to be added to supersetNode deployment |
 | supersetNode.env | object | `{}` |  |
 | supersetNode.extraContainers | list | `[]` | Launch additional containers into supersetNode pod |
+| supersetNode.extraInitContainers | list | `[]` | Extra init containers appended after supersetNode initContainers |
 | supersetNode.forceReload | bool | `false` | If true, forces deployment to reload on each upgrade |
 | supersetNode.initContainers | list | a container waiting for postgres | Init containers |
 | supersetNode.lifecycle | object | `{}` | Container lifecycle hooks, e.g. a preStop sleep so the Service/Ingress stops routing to the pod before gunicorn receives SIGTERM |
@@ -274,16 +364,19 @@ Alternatively, perform a fresh install. This is a one-time migration; subsequent
 | supersetWebsockets.affinity | object | `{}` | Affinity to be added to supersetWebsockets deployment |
 | supersetWebsockets.command | list | `[]` |  |
 | supersetWebsockets.config | object | see `values.yaml` | The config.json to pass to the server, see https://github.com/apache/superset/tree/master/superset-websocket Note that the configuration can also read from environment variables (which will have priority), see https://github.com/apache/superset/blob/master/superset-websocket/src/config.ts for a list of supported variables |
+| supersetWebsockets.configAnnotations | object | `{}` | Annotations to be added to the secret which contains config.json |
 | supersetWebsockets.containerSecurityContext | object | `{}` |  |
 | supersetWebsockets.deploymentAdditionalPodSpec | object | `{}` | Custom pod spec to be added to supersetWebsockets deployment |
 | supersetWebsockets.deploymentAnnotations | object | `{}` |  |
 | supersetWebsockets.enabled | bool | `false` | This is only required if you intend to use `GLOBAL_ASYNC_QUERIES` in `ws` mode see https://superset.apache.org/docs/contributing/misc#async-chart-queries |
 | supersetWebsockets.extraContainers | list | `[]` | Launch additional containers into supersetWebsockets pods |
+| supersetWebsockets.extraInitContainers | list | `[]` | Extra init containers appended after supersetWebsockets initContainers |
 | supersetWebsockets.image.pullPolicy | string | `"IfNotPresent"` |  |
 | supersetWebsockets.image.repository | string | `"oneacrefund/superset-websocket"` | There is no official image (yet), this one is community-supported |
 | supersetWebsockets.image.tag | string | `"latest"` |  |
 | supersetWebsockets.ingress.path | string | `"/ws"` |  |
 | supersetWebsockets.ingress.pathType | string | `"Prefix"` |  |
+| supersetWebsockets.initContainers | list | a container waiting for redis | List of initContainers |
 | supersetWebsockets.livenessProbe.failureThreshold | int | `3` |  |
 | supersetWebsockets.livenessProbe.httpGet.path | string | `"/health"` |  |
 | supersetWebsockets.livenessProbe.httpGet.port | string | `"ws"` |  |
@@ -333,7 +426,13 @@ Alternatively, perform a fresh install. This is a one-time migration; subsequent
 | supersetWorker.deploymentAnnotations | object | `{}` | Annotations to be added to supersetWorker deployment |
 | supersetWorker.deploymentLabels | object | `{}` | Labels to be added to supersetWorker deployment |
 | supersetWorker.extraContainers | list | `[]` | Launch additional containers into supersetWorker pod |
+| supersetWorker.extraInitContainers | list | `[]` | Extra init containers appended after supersetWorker initContainers |
 | supersetWorker.forceReload | bool | `false` | If true, forces deployment to reload on each upgrade |
+| supersetWorker.healthCheck | object | `{"enabled":false,"livenessFile":"/tmp/celery_worker_alive","livenessHeartbeatInterval":10,"readinessFile":"/tmp/celery_worker_ready"}` | Celery worker file-based health check (worker writes readiness/liveness files via signals;    point supersetWorker.readinessProbe/livenessProbe at these files to use them) |
+| supersetWorker.healthCheck.enabled | bool | `false` | Enable the file-based Celery worker health check |
+| supersetWorker.healthCheck.livenessFile | string | `"/tmp/celery_worker_alive"` | Liveness file (touched periodically by a heartbeat thread) |
+| supersetWorker.healthCheck.livenessHeartbeatInterval | int | `10` | Seconds between liveness heartbeats |
+| supersetWorker.healthCheck.readinessFile | string | `"/tmp/celery_worker_ready"` | Readiness file (created when the worker is ready, removed on shutdown) |
 | supersetWorker.initContainers | list | a container waiting for postgres and redis | Init container |
 | supersetWorker.lifecycle | object | `{}` | Container lifecycle hooks for the worker pod |
 | supersetWorker.livenessProbe.exec.command | list | a `celery inspect ping` command | Liveness probe command |

helm/superset/UPGRADING.md

@@ -0,0 +1,161 @@
+<!--
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+-->
+
+# Upgrading the Superset Helm Chart
+
+## Upgrading to chart 0.20.0
+
+Chart 0.20.0 introduces a structured connection schema. The old keys listed below are **DEPRECATED** — they still work (auto-mapped to the new keys at render time) and a deprecation warning is printed in `helm install`/`helm upgrade` NOTES, but they will be removed in a future release. Migrate as soon as possible.
+
+### 1. Connection schema: `supersetNode.connections.*` → `database.*` / `cache.*`
+
+**Before (deprecated — still honored):**
+
+```yaml
+supersetNode:
+  connections:
+    db_host: "pg-host"
+    db_port: "5432"
+    db_user: "superset"
+    db_pass: "superset"
+    db_name: "superset"
+    redis_host: "redis-host"
+    redis_port: "6379"
+    redis_cache_db: "1"
+    redis_celery_db: "0"
+    redis_driver: "rediss"
+```
+
+**After (new structured keys — recommended):**
+
+```yaml
+database:
+  host: "pg-host"
+  port: 5432
+  user: "superset"
+  password: "superset"
+  name: "superset"
+
+cache:
+  host: "redis-host"
+  port: 6379
+  cacheDb: 1
+  celeryDb: 0
+  driver: "rediss"   # optional: custom Redis driver / TLS variant
+```
+
+Key-by-key mapping summary:
+
+| Old key | New key |
+|---|---|
+| `supersetNode.connections.db_host` | `database.host` |
+| `supersetNode.connections.db_port` | `database.port` |
+| `supersetNode.connections.db_user` | `database.user` |
+| `supersetNode.connections.db_pass` | `database.password` |
+| `supersetNode.connections.db_name` | `database.name` |
+| `supersetNode.connections.redis_host` | `cache.host` |
+| `supersetNode.connections.redis_port` | `cache.port` |
+| `supersetNode.connections.redis_cache_db` | `cache.cacheDb` |
+| `supersetNode.connections.redis_celery_db` | `cache.celeryDb` |
+| `supersetNode.connections.redis_driver` | `cache.driver` |
+
+### 2. Service account: root `serviceAccountName` → `serviceAccount.name`
+
+**Before (deprecated — still honored):**
+
+```yaml
+serviceAccountName: my-sa
+```
+
+**After (new key — recommended):**
+
+```yaml
+serviceAccount:
+  name: my-sa
+```
+
+### 3. Init script: `init.initscript` is deprecated and replaced by the built-in template
+
+> **This is a behavior change.** The chart no longer uses `init.initscript`. The init script is rendered
+> entirely from an internal chart template (`superset.initScript`), which runs the full initialization
+> sequence:
+>
+> 1. `superset db upgrade` — applies all pending database schema migrations
+> 2. `superset init` — initializes roles and permissions
+> 3. Admin user creation (when `init.createAdmin: true`)
+> 4. Example data loading (when `init.loadExamples: true`)
+> 5. Datasource import (when `import_datasources.yaml` is present)
+>
+> A future PR will optionally split the database migration step into a dedicated upgrade Job for
+> zero-downtime deployments. Until that PR lands, migrations run as part of the init Job above.
+
+If you customized `init.initscript` in your `values.yaml`, that customization is silently ignored.
+Move any customizations to `config` or `configOverrides`:
+
+```yaml
+# Move custom Python config here:
+config:
+  MY_SETTING: "value"
+
+configOverrides:
+  my_custom_override: |
+    # Python snippet appended to superset_config.py
+    MY_SETTING = "value"
+```
+
+If your use case cannot be covered by `config` or `configOverrides`, please open an issue so the maintainers
+can evaluate extending the template.
+
+### 4. New top-level sections: `config.*` and `featureFlags.*`
+
+Two new sections provide direct Superset configuration passthrough without needing raw `configOverrides`.
+
+**`config.*` — direct Superset config properties:**
+
+```yaml
+config:
+  SECRET_KEY: "$(SUPERSET_SECRET_KEY)"
+  ROW_LIMIT: 50000
+  WTF_CSRF_ENABLED: true
+  SQLALCHEMY_POOL_SIZE: 10
+```
+
+Each key is injected verbatim into `superset_config.py`. String values are quoted; non-string values
+(integers, booleans) are rendered as-is.
+
+**`featureFlags.*` — feature flag overrides:**
+
+```yaml
+featureFlags:
+  ALERT_REPORTS: true
+  DASHBOARD_RBAC: true
+  ENABLE_TEMPLATE_PROCESSING: false
+```
+
+This is equivalent to setting `FEATURE_FLAGS = {...}` in `superset_config.py`, but is more readable and
+schema-validated.
+
+### 5. `values.schema.json` — early validation
+
+The chart now ships a `values.schema.json` that validates the values you provide. Wrong types (e.g., a string
+where an integer is expected) or unknown keys in structured sections will cause `helm install`/`helm upgrade`
+to fail immediately with a descriptive error instead of producing a broken deployment.
+
+If you get a validation error after upgrading, check that your overridden values match the types documented in
+`values.yaml` and the schema.

helm/superset/templates/NOTES.txt

@@ -35,3 +35,9 @@
   echo "Visit http://127.0.0.1:8088 to use your application"
   kubectl port-forward service/superset 8088:8088 --namespace {{ .Release.Namespace }}
 {{- end }}
+{{- $warnings := include "superset.deprecationWarnings" . }}
+{{- if trim $warnings }}
+
+⚠️  DEPRECATION WARNINGS
+{{ $warnings }}
+{{- end }}

helm/superset/templates/_helpers.tpl

@@ -47,11 +47,12 @@ If release name contains chart name it will be used as a full name.
 Create the name of the service account to use
 */}}
 {{- define "superset.serviceAccountName" -}}
-  {{- if .Values.serviceAccount.create -}}
-    {{- default (include "superset.fullname" .) .Values.serviceAccountName -}}
-  {{- else -}}
-    {{- default "default" .Values.serviceAccountName -}}
-  {{- end -}}
+{{- $name := coalesce .Values.serviceAccount.name .Values.serviceAccountName -}}
+{{- if .Values.serviceAccount.create -}}
+{{- default (include "superset.fullname" .) $name -}}
+{{- else -}}
+{{- default "default" $name -}}
+{{- end -}}
 {{- end -}}
 
 {{/*
@@ -105,80 +106,572 @@ app.kubernetes.io/component: {{ .component }}
 {{- end -}}
 
 
-{{- define "superset-config" }}
+{{/*
+Coalescing resolvers for DB and Redis connection parameters.
+Each resolver checks (in order):
+  1. New top-level database.* / cache.* values
+  2. Legacy supersetNode.connections.* keys (deprecation path, using safe index to avoid errors on absent maps)
+  3. cluster.* service name overrides
+  4. Hard-coded defaults derived from the release name
+Call with root context: {{ include "superset.db.host" . }}
+*/}}
+
+{{/*
+Helper to safely read .Values.supersetNode.connections.<key> without erroring when maps are absent.
+*/}}
+{{- define "_superset.legacyConn" -}}
+{{- $sn := index .Values "supersetNode" | default dict -}}
+{{- $conn := index $sn "connections" | default dict -}}
+{{- $conn | toJson -}}
+{{- end -}}
+
+{{- define "superset.db.host" -}}
+{{- $conn := include "_superset.legacyConn" . | fromJson -}}
+{{- tpl (coalesce .Values.database.host (index $conn "db_host") .Values.cluster.databaseServiceName (printf "%s-postgresql" .Release.Name)) $ -}}
+{{- end -}}
+
+{{- define "superset.db.port" -}}
+{{- $conn := include "_superset.legacyConn" . | fromJson -}}
+{{- if .Values.database.port -}}
+{{- .Values.database.port | toString -}}
+{{- else -}}
+{{- coalesce (index $conn "db_port") "5432" -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "superset.db.user" -}}
+{{- $conn := include "_superset.legacyConn" . | fromJson -}}
+{{- coalesce .Values.database.user (index $conn "db_user") "superset" -}}
+{{- end -}}
+
+{{- define "superset.db.password" -}}
+{{- $conn := include "_superset.legacyConn" . | fromJson -}}
+{{- coalesce .Values.database.password (index $conn "db_pass") "superset" -}}
+{{- end -}}
+
+{{- define "superset.db.name" -}}
+{{- $conn := include "_superset.legacyConn" . | fromJson -}}
+{{- coalesce .Values.database.name (index $conn "db_name") "superset" -}}
+{{- end -}}
+
+{{- define "superset.db.driver" -}}
+{{- $conn := include "_superset.legacyConn" . | fromJson -}}
+{{- coalesce .Values.database.driver (index $conn "db_type") "postgresql+psycopg2" -}}
+{{- end -}}
+
+{{- define "superset.redis.host" -}}
+{{- $conn := include "_superset.legacyConn" . | fromJson -}}
+{{- tpl (coalesce .Values.cache.host (index $conn "redis_host") .Values.cluster.redisServiceName (printf "%s-redis-headless" .Release.Name)) $ -}}
+{{- end -}}
+
+{{- define "superset.redis.port" -}}
+{{- $conn := include "_superset.legacyConn" . | fromJson -}}
+{{- if .Values.cache.port -}}
+{{- .Values.cache.port | toString -}}
+{{- else -}}
+{{- coalesce (index $conn "redis_port") "6379" -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "superset.redis.user" -}}
+{{- $conn := include "_superset.legacyConn" . | fromJson -}}
+{{- coalesce .Values.cache.user (index $conn "redis_user") "" -}}
+{{- end -}}
+
+{{- define "superset.redis.password" -}}
+{{- $conn := include "_superset.legacyConn" . | fromJson -}}
+{{- coalesce .Values.cache.password (index $conn "redis_password") "" -}}
+{{- end -}}
+
+{{- define "superset.redis.cacheDb" -}}
+{{- $conn := include "_superset.legacyConn" . | fromJson -}}
+{{- if not (kindIs "invalid" .Values.cache.cacheDb) -}}
+{{- .Values.cache.cacheDb | toString -}}
+{{- else -}}
+{{- coalesce (index $conn "redis_cache_db") "1" -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "superset.redis.celeryDb" -}}
+{{- $conn := include "_superset.legacyConn" . | fromJson -}}
+{{- if not (kindIs "invalid" .Values.cache.celeryDb) -}}
+{{- .Values.cache.celeryDb | toString -}}
+{{- else -}}
+{{- coalesce (index $conn "redis_celery_db") "0" -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "superset.redis.proto" -}}
+{{- $conn := include "_superset.legacyConn" . | fromJson -}}
+{{- if .Values.cache.driver }}{{ .Values.cache.driver }}{{- else if index $conn "redis_driver" }}{{ index $conn "redis_driver" }}{{- else if .Values.cache.ssl.enabled }}rediss{{- else }}redis{{- end -}}
+{{- end -}}
+
+{{- define "superset.config" }}
+{{- /* SECURITY: Validate admin password is set if admin creation is enabled */}}
+{{- if and .Values.init.createAdmin (or (not .Values.init.adminUser.password) (eq .Values.init.adminUser.password "")) }}
+{{- fail "SECURITY ERROR: init.createAdmin is true but init.adminUser.password is empty. You must set a secure password using --set init.adminUser.password='your-password' or via external secret." }}
+{{- end }}
+
 import os
+import json
+from urllib.parse import quote
+{{- if or .Values.config.cacheConfig .Values.config.dataCacheConfig .Values.config.resultsBackend .Values.config.celeryConfig .Values.cache.enabled }}
 from flask_caching.backends.rediscache import RedisCache
+{{- end }}
 
 def env(key, default=None):
     return os.getenv(key, default)
 
-# Redis Base URL
-{{- if .Values.supersetNode.connections.redis_password }}
-REDIS_BASE_URL=f"{env('REDIS_DRIVER') or env('REDIS_PROTO')}://{env('REDIS_USER', '')}:{env('REDIS_PASSWORD')}@{env('REDIS_HOST')}:{env('REDIS_PORT')}"
+{{- /* Database Configuration - Superset always requires a database */}}
+{{- if .Values.database.uri }}
+SQLALCHEMY_DATABASE_URI = {{ .Values.database.uri | quote }}
 {{- else }}
-REDIS_BASE_URL=f"{env('REDIS_DRIVER') or env('REDIS_PROTO')}://{env('REDIS_HOST')}:{env('REDIS_PORT')}"
+{{- $driver := include "superset.db.driver" . }}
+{{- $sslParams := "" }}
+{{- if and (hasKey .Values.database "ssl") .Values.database.ssl.enabled }}
+{{- $sslMode := .Values.database.ssl.mode | default "require" }}
+{{- $sslParams = printf "?sslmode=%s" $sslMode }}
+{{- end }}
+SQLALCHEMY_DATABASE_URI = f"{{ $driver }}://{quote(env('DB_USER', ''), safe='')}:{quote(env('DB_PASS', ''), safe='')}@{env('DB_HOST')}:{env('DB_PORT')}/{env('DB_NAME')}{{ $sslParams }}"
+{{- end }}
+{{- if hasKey .Values.config "SQLALCHEMY_TRACK_MODIFICATIONS" }}
+SQLALCHEMY_TRACK_MODIFICATIONS = {{ .Values.config.SQLALCHEMY_TRACK_MODIFICATIONS | toString | title }}
+{{- else }}
+SQLALCHEMY_TRACK_MODIFICATIONS = False
 {{- end }}
 
-# Redis URL Params
-{{- if .Values.supersetNode.connections.redis_ssl.enabled }}
-REDIS_URL_PARAMS = f"?ssl_cert_reqs={env('REDIS_SSL_CERT_REQS')}"
+{{- /* Redis Configuration - only if Redis cache is configured */}}
+{{- if .Values.cache.enabled }}
+{{- if .Values.cache.cacheUrl }}
+CACHE_REDIS_URL = {{ .Values.cache.cacheUrl | quote }}
+{{- else }}
+{{- $useSSL := and (hasKey .Values.cache "ssl") .Values.cache.ssl.enabled }}
+_redis_user = quote(env('REDIS_USER', ''), safe='')
+_redis_password = quote(env('REDIS_PASSWORD', ''), safe='')
+_redis_auth = f"{_redis_user}:{_redis_password}@" if (_redis_user or _redis_password) else ""
+REDIS_BASE_URL = f"{{ include "superset.redis.proto" . }}://{_redis_auth}{env('REDIS_HOST')}:{env('REDIS_PORT')}"
+{{- if $useSSL }}
+{{- $sslCertReqs := .Values.cache.ssl.ssl_cert_reqs | default "required" }}
+REDIS_URL_PARAMS = f"?ssl_cert_reqs={{ $sslCertReqs }}"
 {{- else }}
 REDIS_URL_PARAMS = ""
-{{- end}}
+{{- end }}
+{{- $cacheDb := include "superset.redis.cacheDb" . }}
+CACHE_REDIS_URL = f"{REDIS_BASE_URL}/{{ $cacheDb }}{REDIS_URL_PARAMS}"
+{{- end }}
+{{- if .Values.cache.celeryUrl }}
+CELERY_REDIS_URL = {{ .Values.cache.celeryUrl | quote }}
+{{- else if not .Values.cache.cacheUrl }}
+{{- $celeryDb := include "superset.redis.celeryDb" . }}
+CELERY_REDIS_URL = f"{REDIS_BASE_URL}/{{ $celeryDb }}{REDIS_URL_PARAMS}"
+{{- else }}
+{{- if or .Values.config.celeryConfig (not .Values.cache.enabled) }}
+{{- /* Custom celeryConfig provided or cache disabled - OK */}}
+{{- else }}
+{{- fail "CONFIGURATION ERROR: cache.cacheUrl is set but cache.celeryUrl is not set. When using cacheUrl, you must also set celeryUrl for Celery to work. Alternatively, set config.celeryConfig to provide a custom Celery configuration." }}
+{{- end }}
+{{- end }}
+{{- end }}
 
-# Build Redis URLs
-CACHE_REDIS_URL = f"{REDIS_BASE_URL}/{env('REDIS_DB', 1)}{REDIS_URL_PARAMS}"
-CELERY_REDIS_URL = f"{REDIS_BASE_URL}/{env('REDIS_CELERY_DB', 0)}{REDIS_URL_PARAMS}"
-
-MAPBOX_API_KEY = env('MAPBOX_API_KEY', '')
+{{- /* Cache Configuration */}}
+{{- if .Values.config.cacheConfig }}
+CACHE_CONFIG = json.loads({{ .Values.config.cacheConfig | toJson | quote }})
+{{- else if .Values.cache.enabled }}
 CACHE_CONFIG = {
-      'CACHE_TYPE': 'RedisCache',
-      'CACHE_DEFAULT_TIMEOUT': 300,
-      'CACHE_KEY_PREFIX': 'superset_',
-      'CACHE_REDIS_URL': CACHE_REDIS_URL,
+    'CACHE_TYPE': 'RedisCache',
+    'CACHE_DEFAULT_TIMEOUT': {{ .Values.cache.defaultTimeout | default (.Values.config.cacheDefaultTimeout | default 86400) | int }},
+    'CACHE_KEY_PREFIX': {{ .Values.cache.keyPrefix | default "superset_" | quote }},
+    'CACHE_REDIS_URL': CACHE_REDIS_URL,
 }
+{{- end }}
+
+{{- if .Values.config.dataCacheConfig }}
+DATA_CACHE_CONFIG = json.loads({{ .Values.config.dataCacheConfig | toJson | quote }})
+{{- else if .Values.config.cacheConfig }}
 DATA_CACHE_CONFIG = CACHE_CONFIG
+{{- else if .Values.cache.enabled }}
+DATA_CACHE_CONFIG = CACHE_CONFIG
+{{- end }}
 
+{{- /* SQLLAB_ASYNC_TIME_LIMIT_SEC - Required for async_queries module import (default: 6 hours) */}}
+{{- if .Values.config.SQLLAB_ASYNC_TIME_LIMIT_SEC }}
+SQLLAB_ASYNC_TIME_LIMIT_SEC = {{ .Values.config.SQLLAB_ASYNC_TIME_LIMIT_SEC | int }}
+{{- else }}
+from datetime import timedelta
+SQLLAB_ASYNC_TIME_LIMIT_SEC = int(timedelta(hours=6).total_seconds())
+{{- end }}
 
-if os.getenv("SQLALCHEMY_DATABASE_URI"):
-    SQLALCHEMY_DATABASE_URI = os.getenv("SQLALCHEMY_DATABASE_URI")
-else:
-    {{- if eq .Values.supersetNode.connections.db_type "postgresql" }}
-    SQLALCHEMY_DATABASE_URI = f"postgresql+psycopg2://{os.getenv('DB_USER')}:{os.getenv('DB_PASS')}@{os.getenv('DB_HOST')}:{os.getenv('DB_PORT')}/{os.getenv('DB_NAME')}"
-    {{- else if eq .Values.supersetNode.connections.db_type "mysql" }}
-    SQLALCHEMY_DATABASE_URI = f"mysql+mysqldb://{os.getenv('DB_USER')}:{os.getenv('DB_PASS')}@{os.getenv('DB_HOST')}:{os.getenv('DB_PORT')}/{os.getenv('DB_NAME')}"
-    {{- else }}
-    {{ fail (printf "Unsupported database type: %s. Please use 'postgresql' or 'mysql'." .Values.supersetNode.connections.db_type) }}
-    {{- end }}
+{{- /* Celery Configuration */}}
+{{- if .Values.config.celeryConfig }}
+{{- if kindIs "string" .Values.config.celeryConfig }}
+{{ .Values.config.celeryConfig }}
+{{- else }}
+class CeleryConfig:
+{{- range $key, $value := .Values.config.celeryConfig }}
+    {{ $key }} = json.loads({{ $value | toJson | quote }})
+{{- end }}
+
+{{- if hasKey .Values.config.celeryConfig "imports" }}
+CELERY_IMPORTS = CeleryConfig.imports
+{{- else }}
+CELERY_IMPORTS = ()
+{{- end }}
+CELERY_CONFIG = CeleryConfig
+{{- end }}
+{{- else if .Values.cache.enabled }}
+from celery.schedules import crontab
+from datetime import timedelta
 
 class CeleryConfig:
-  imports  = ("superset.sql_lab", )
-  broker_url = CELERY_REDIS_URL
-  result_backend = CELERY_REDIS_URL
+    imports = (
+        "superset.sql_lab",
+        "superset.tasks.scheduler",
+        "superset.tasks.thumbnails",
+        "superset.tasks.cache",
+    )
+    broker_connection_retry_on_startup = True
+    worker_prefetch_multiplier = 10
+    task_acks_late = True
+    broker_url = CELERY_REDIS_URL
+    result_backend = CELERY_REDIS_URL
+    task_annotations = {
+        "sql_lab.get_sql_results": {
+            "rate_limit": "100/s",
+        },
+    }
+    beat_schedule = {
+        "reports.scheduler": {
+            "task": "reports.scheduler",
+            "schedule": crontab(minute="*", hour="*"),
+            "options": {"expires": int(timedelta(weeks=1).total_seconds())},
+        },
+        "reports.prune_log": {
+            "task": "reports.prune_log",
+            "schedule": crontab(minute=0, hour=0),
+        },
+    }
 
+CELERY_IMPORTS = CeleryConfig.imports
 CELERY_CONFIG = CeleryConfig
-RESULTS_BACKEND = RedisCache(
-      host=env('REDIS_HOST'),
-      {{- if .Values.supersetNode.connections.redis_password }}
-      password=env('REDIS_PASSWORD'),
-      {{- end }}
-      port=env('REDIS_PORT'),
-      key_prefix='superset_results',
-      {{- if .Values.supersetNode.connections.redis_ssl.enabled }}
-      ssl=True,
-      ssl_cert_reqs=env('REDIS_SSL_CERT_REQS'),
-      {{- end }}
-)
+{{- end }}
 
-{{ if .Values.configOverrides }}
-# Overrides
+{{- /* Celery Worker Health Check - File-based health probes for Kubernetes */}}
+{{- if and .Values.supersetWorker.healthCheck .Values.supersetWorker.healthCheck.enabled }}
+# Celery Worker Health Check Configuration
+import threading
+from celery import bootsteps
+from celery.signals import worker_ready, worker_shutdown, worker_init
+
+_readiness_file = {{ .Values.supersetWorker.healthCheck.readinessFile | default "/tmp/celery_worker_ready" | quote }}
+_liveness_file = {{ .Values.supersetWorker.healthCheck.livenessFile | default "/tmp/celery_worker_alive" | quote }}
+_heartbeat_interval = {{ .Values.supersetWorker.healthCheck.livenessHeartbeatInterval | default 10 | int }}
+_liveness_thread = None
+_liveness_stop_event = None
+
+@worker_ready.connect
+def create_ready_file(sender, **kwargs):
+    try:
+        open(_readiness_file, 'w').close()
+    except Exception as e:
+        print(f"Warning: Could not create readiness file: {e}")
+
+@worker_shutdown.connect
+def remove_ready_file(sender, **kwargs):
+    global _liveness_thread, _liveness_stop_event
+    if _liveness_stop_event:
+        _liveness_stop_event.set()
+    if _liveness_thread:
+        _liveness_thread.join(timeout=5)
+    try:
+        if os.path.exists(_readiness_file):
+            os.remove(_readiness_file)
+        if os.path.exists(_liveness_file):
+            os.remove(_liveness_file)
+    except Exception as e:
+        print(f"Warning: Could not remove health check files: {e}")
+
+@worker_init.connect
+def start_liveness_heartbeat(sender, **kwargs):
+    global _liveness_thread, _liveness_stop_event
+    _liveness_stop_event = threading.Event()
+
+    def update_liveness():
+        while not _liveness_stop_event.is_set():
+            try:
+                with open(_liveness_file, 'w') as f:
+                    f.write(str(os.getpid()))
+            except Exception as e:
+                print(f"Warning: Could not update liveness file: {e}")
+            _liveness_stop_event.wait(_heartbeat_interval)
+
+    _liveness_thread = threading.Thread(target=update_liveness, daemon=True)
+    _liveness_thread.start()
+{{- else }}
+CELERY_WORKER_HEALTH_CHECK_ENABLED = False
+{{- end }}
+
+{{- /* Results Backend */}}
+{{- $redisHostForBackend := include "superset.redis.host" . }}
+{{- $redisPortForBackend := include "superset.redis.port" . }}
+{{- $redisPasswordForBackend := include "superset.redis.password" . }}
+{{- if .Values.config.resultsBackend }}
+{{- if kindIs "string" .Values.config.resultsBackend }}
+RESULTS_BACKEND = {{ .Values.config.resultsBackend }}
+{{- else }}
+RESULTS_BACKEND = RedisCache(
+    host={{ $redisHostForBackend | quote }},
+    {{- if $redisPasswordForBackend }}
+    password={{ $redisPasswordForBackend | quote }},
+    {{- end }}
+    port={{ $redisPortForBackend | int }},
+    key_prefix={{ .Values.cache.resultsBackendKeyPrefix | default "superset_results" | quote }},
+    {{- if and (hasKey .Values.cache "ssl") .Values.cache.ssl.enabled }}
+    ssl=True,
+    ssl_cert_reqs={{ .Values.cache.ssl.ssl_cert_reqs | default "required" | quote }},
+    {{- end }}
+)
+{{- end }}
+{{- else if .Values.cache.enabled }}
+RESULTS_BACKEND = RedisCache(
+    host={{ $redisHostForBackend | quote }},
+    {{- if $redisPasswordForBackend }}
+    password={{ $redisPasswordForBackend | quote }},
+    {{- end }}
+    port={{ $redisPortForBackend | int }},
+    key_prefix={{ .Values.cache.resultsBackendKeyPrefix | default "superset_results" | quote }},
+    {{- if and (hasKey .Values.cache "ssl") .Values.cache.ssl.enabled }}
+    ssl=True,
+    ssl_cert_reqs={{ .Values.cache.ssl.ssl_cert_reqs | default "required" | quote }},
+    {{- end }}
+)
+{{- end }}
+
+{{- /* Global Async Queries Cache Backend */}}
+{{- $redisUserForGaq := include "superset.redis.user" . }}
+{{- if .Values.config.GLOBAL_ASYNC_QUERIES_CACHE_BACKEND }}
+GLOBAL_ASYNC_QUERIES_CACHE_BACKEND = json.loads({{ .Values.config.GLOBAL_ASYNC_QUERIES_CACHE_BACKEND | toJson | quote }})
+{{- else if .Values.cache.enabled }}
+GLOBAL_ASYNC_QUERIES_CACHE_BACKEND = {
+    "CACHE_TYPE": "RedisCache",
+    "CACHE_REDIS_HOST": {{ $redisHostForBackend | quote }},
+    "CACHE_REDIS_PORT": {{ $redisPortForBackend | int }},
+    {{- if $redisUserForGaq }}
+    "CACHE_REDIS_USER": {{ $redisUserForGaq | quote }},
+    {{- end }}
+    {{- if $redisPasswordForBackend }}
+    "CACHE_REDIS_PASSWORD": {{ $redisPasswordForBackend | quote }},
+    {{- else }}
+    "CACHE_REDIS_PASSWORD": "",
+    {{- end }}
+    "CACHE_REDIS_DB": {{ .Values.cache.asyncQueries.db | default .Values.cache.cacheDb | default 0 | int }},
+    "CACHE_KEY_PREFIX": {{ .Values.cache.asyncQueries.keyPrefix | default "qc-" | quote }},
+    "CACHE_DEFAULT_TIMEOUT": {{ .Values.cache.asyncQueries.timeout | default 86400 | int }},
+    {{- if and .Values.cache.sentinel .Values.cache.sentinel.enabled }}
+    {{- if .Values.cache.sentinel.sentinels }}
+    "CACHE_REDIS_SENTINELS": {{ .Values.cache.sentinel.sentinels | toJson }},
+    {{- else }}
+    {{- fail "CONFIGURATION ERROR: cache.sentinel.enabled is true but cache.sentinel.sentinels is not set. You must provide Sentinel host(s) in cache.sentinel.sentinels (e.g., [['sentinel-host', 26379]])." }}
+    {{- end }}
+    "CACHE_REDIS_SENTINEL_MASTER": {{ .Values.cache.sentinel.master | default "mymaster" | quote }},
+    {{- if .Values.cache.sentinel.password }}
+    "CACHE_REDIS_SENTINEL_PASSWORD": {{ .Values.cache.sentinel.password | quote }},
+    {{- else }}
+    "CACHE_REDIS_SENTINEL_PASSWORD": None,
+    {{- end }}
+    {{- end }}
+    {{- if and (hasKey .Values.cache "ssl") .Values.cache.ssl.enabled }}
+    "CACHE_REDIS_SSL": True,
+    "CACHE_REDIS_SSL_CERTFILE": {{ if .Values.cache.ssl.certfile }}{{ .Values.cache.ssl.certfile | quote }}{{ else }}None{{ end }},
+    "CACHE_REDIS_SSL_KEYFILE": {{ if .Values.cache.ssl.keyfile }}{{ .Values.cache.ssl.keyfile | quote }}{{ else }}None{{ end }},
+    "CACHE_REDIS_SSL_CERT_REQS": {{ .Values.cache.ssl.ssl_cert_reqs | default "required" | quote }},
+    "CACHE_REDIS_SSL_CA_CERTS": {{ if .Values.cache.ssl.ca_certs }}{{ .Values.cache.ssl.ca_certs | quote }}{{ else }}None{{ end }},
+    {{- else }}
+    "CACHE_REDIS_SSL": False,
+    "CACHE_REDIS_SSL_CERTFILE": None,
+    "CACHE_REDIS_SSL_KEYFILE": None,
+    "CACHE_REDIS_SSL_CERT_REQS": {{ .Values.cache.ssl.ssl_cert_reqs | default "required" | quote }},
+    "CACHE_REDIS_SSL_CA_CERTS": None,
+    {{- end }}
+}
+{{- end }}
+
+{{- /* Global Async Queries Results Backend */}}
+{{- if .Values.config.GLOBAL_ASYNC_QUERIES_RESULTS_BACKEND }}
+GLOBAL_ASYNC_QUERIES_RESULTS_BACKEND = json.loads({{ .Values.config.GLOBAL_ASYNC_QUERIES_RESULTS_BACKEND | toJson | quote }})
+{{- else if .Values.cache.enabled }}
+GLOBAL_ASYNC_QUERIES_RESULTS_BACKEND = {
+    "backend": "redis",
+    "host": {{ $redisHostForBackend | quote }},
+    "port": {{ $redisPortForBackend | int }},
+    "prefix": {{ .Values.cache.asyncQueries.keyPrefix | default "qc-" | quote }},
+    "db": {{ .Values.cache.asyncQueries.db | default .Values.cache.cacheDb | default 0 | int }},
+    {{- if $redisPasswordForBackend }}
+    "password": {{ $redisPasswordForBackend | quote }},
+    {{- end }}
+}
+{{- end }}
+
+{{- /* Feature Flags */}}
+{{- if .Values.featureFlags }}
+FEATURE_FLAGS = {
+{{- range $key, $value := .Values.featureFlags }}
+{{- if kindIs "bool" $value }}
+    "{{ $key }}": {{ if $value }}True{{ else }}False{{ end }},
+{{- else if kindIs "string" $value }}
+    "{{ $key }}": {{ $value | quote }},
+{{- else if kindIs "float64" $value }}
+    "{{ $key }}": {{ $value }},
+{{- else if kindIs "int" $value }}
+    "{{ $key }}": {{ $value }},
+{{- else if kindIs "invalid" $value }}
+    "{{ $key }}": None,
+{{- else }}
+    "{{ $key }}": json.loads({{ $value | toJson | quote }}),
+{{- end }}
+{{- end }}
+}
+{{- end }}
+
+{{- /* FAB Security API - Required for List Roles view in 6.0.0+ */}}
+{{- if not (hasKey .Values.config "FAB_ADD_SECURITY_API") }}
+FAB_ADD_SECURITY_API = True
+{{- end }}
+{{- if not (hasKey .Values.config "FAB_ADD_SECURITY_VIEWS") }}
+FAB_ADD_SECURITY_VIEWS = True
+{{- end }}
+
+{{- /* Global Async Queries Transport - Auto-configure for websockets if enabled */}}
+{{- if .Values.config.GLOBAL_ASYNC_QUERIES_TRANSPORT }}
+GLOBAL_ASYNC_QUERIES_TRANSPORT = {{ .Values.config.GLOBAL_ASYNC_QUERIES_TRANSPORT | quote }}
+{{- else if .Values.supersetWebsockets.enabled }}
+GLOBAL_ASYNC_QUERIES_TRANSPORT = "ws"
+{{- else }}
+GLOBAL_ASYNC_QUERIES_TRANSPORT = "polling"
+{{- end }}
+
+{{- /* Global Async Queries WebSocket URL */}}
+{{- $wsUrl := "" }}
+{{- if .Values.config.GLOBAL_ASYNC_QUERIES_WEBSOCKET_URL }}
+{{- $wsUrl = .Values.config.GLOBAL_ASYNC_QUERIES_WEBSOCKET_URL }}
+GLOBAL_ASYNC_QUERIES_WEBSOCKET_URL = {{ $wsUrl | quote }}
+{{- else if and .Values.supersetWebsockets.enabled .Values.supersetWebsockets.websocketUrl }}
+{{- $wsUrl = .Values.supersetWebsockets.websocketUrl }}
+GLOBAL_ASYNC_QUERIES_WEBSOCKET_URL = {{ $wsUrl | quote }}
+{{- else if .Values.supersetWebsockets.enabled }}
+{{- $wsServiceName := .Values.cluster.websocketServiceName }}
+{{- if not $wsServiceName }}
+{{- $wsServiceName = printf "%s-ws" (include "superset.fullname" .) }}
+{{- end }}
+{{- $wsPort := .Values.supersetWebsockets.service.port | default 8080 }}
+{{- $wsPath := "/ws" }}
+{{- $clusterDomain := .Values.cluster.domain | default ".svc.cluster.local" }}
+{{- $wsUrl = printf "ws://%s.%s%s:%d%s" $wsServiceName .Release.Namespace $clusterDomain $wsPort $wsPath }}
+GLOBAL_ASYNC_QUERIES_WEBSOCKET_URL = {{ $wsUrl | quote }}
+{{- end }}
+
+{{- /* Global Async Queries JWT Secret */}}
+{{- if .Values.config.GLOBAL_ASYNC_QUERIES_JWT_SECRET }}
+GLOBAL_ASYNC_QUERIES_JWT_SECRET = {{ .Values.config.GLOBAL_ASYNC_QUERIES_JWT_SECRET | quote }}
+{{- else if and .Values.supersetWebsockets.enabled .Values.supersetWebsockets.config.jwtSecret }}
+GLOBAL_ASYNC_QUERIES_JWT_SECRET = {{ .Values.supersetWebsockets.config.jwtSecret | quote }}
+{{- end }}
+
+{{- /* Global Async Queries JWT Cookie Settings */}}
+{{- if hasKey .Values.config "GLOBAL_ASYNC_QUERIES_JWT_COOKIE_SECURE" }}
+GLOBAL_ASYNC_QUERIES_JWT_COOKIE_SECURE = {{ .Values.config.GLOBAL_ASYNC_QUERIES_JWT_COOKIE_SECURE | toString | title }}
+{{- else if and .Values.supersetWebsockets.enabled (or (hasPrefix "wss://" $wsUrl) .Values.ingress.tls) }}
+GLOBAL_ASYNC_QUERIES_JWT_COOKIE_SECURE = True
+{{- else if .Values.supersetWebsockets.enabled }}
+GLOBAL_ASYNC_QUERIES_JWT_COOKIE_SECURE = False
+{{- end }}
+
+{{- if .Values.config.GLOBAL_ASYNC_QUERIES_JWT_COOKIE_SAMESITE }}
+GLOBAL_ASYNC_QUERIES_JWT_COOKIE_SAMESITE = {{ .Values.config.GLOBAL_ASYNC_QUERIES_JWT_COOKIE_SAMESITE | quote }}
+{{- else if .Values.supersetWebsockets.enabled }}
+GLOBAL_ASYNC_QUERIES_JWT_COOKIE_SAMESITE = "Lax"
+{{- end }}
+
+{{- if .Values.config.GLOBAL_ASYNC_QUERIES_JWT_COOKIE_NAME }}
+GLOBAL_ASYNC_QUERIES_JWT_COOKIE_NAME = {{ .Values.config.GLOBAL_ASYNC_QUERIES_JWT_COOKIE_NAME | quote }}
+{{- else if and .Values.supersetWebsockets.enabled .Values.supersetWebsockets.config.jwtCookieName }}
+GLOBAL_ASYNC_QUERIES_JWT_COOKIE_NAME = {{ .Values.supersetWebsockets.config.jwtCookieName | quote }}
+{{- end }}
+
+{{- /* Content Security Policy (CSP) */}}
+{{- if and .Values.supersetWebsockets.enabled $wsUrl (not (hasKey .Values.config "TALISMAN_CONFIG")) }}
+TALISMAN_CONFIG = {
+    "content_security_policy": {
+        "base-uri": ["'self'"],
+        "default-src": ["'self'"],
+        "img-src": [
+            "'self'",
+            "blob:",
+            "data:",
+            "https://apachesuperset.gateway.scarf.sh",
+            "https://static.scarf.sh/",
+            "ows.terrestris.de",
+            "https://cdn.document360.io",
+        ],
+        "worker-src": ["'self'", "blob:"],
+        "connect-src": [
+            "'self'",
+            {{ $wsUrl | quote }},
+            "https://api.mapbox.com",
+            "https://events.mapbox.com",
+            "https://tile.openstreetmap.org",
+            "https://tile.osm.ch",
+        ],
+        "object-src": "'none'",
+        "style-src": [
+            "'self'",
+            "'unsafe-inline'",
+        ],
+        "script-src": ["'self'", "'strict-dynamic'"],
+    },
+    "content_security_policy_nonce_in": ["script-src"],
+    {{- if or (hasPrefix "wss://" $wsUrl) .Values.ingress.tls }}
+    "force_https": True,
+    "session_cookie_secure": True,
+    {{- else }}
+    "force_https": False,
+    "session_cookie_secure": False,
+    {{- end }}
+}
+{{- end }}
+
+{{- /* General Configuration - iterate through all config values */}}
+{{- range $key, $value := .Values.config }}
+{{- if and (ne $key "cacheConfig") (ne $key "dataCacheConfig") (ne $key "celeryConfig") (ne $key "resultsBackend") (ne $key "GLOBAL_ASYNC_QUERIES_CACHE_BACKEND") (ne $key "GLOBAL_ASYNC_QUERIES_RESULTS_BACKEND") (ne $key "GLOBAL_ASYNC_QUERIES_TRANSPORT") (ne $key "GLOBAL_ASYNC_QUERIES_WEBSOCKET_URL") (ne $key "GLOBAL_ASYNC_QUERIES_JWT_SECRET") (ne $key "GLOBAL_ASYNC_QUERIES_JWT_COOKIE_SECURE") (ne $key "GLOBAL_ASYNC_QUERIES_JWT_COOKIE_SAMESITE") (ne $key "GLOBAL_ASYNC_QUERIES_JWT_COOKIE_NAME") (ne $key "TALISMAN_CONFIG") (ne $key "SQLLAB_ASYNC_TIME_LIMIT_SEC") (ne $key "SQLALCHEMY_TRACK_MODIFICATIONS") }}
+{{- if kindIs "map" $value }}
+{{ $key }} = json.loads({{ $value | toJson | quote }})
+{{- else if kindIs "slice" $value }}
+{{ $key }} = json.loads({{ $value | toJson | quote }})
+{{- else if kindIs "bool" $value }}
+{{ $key }} = {{ if $value }}True{{ else }}False{{ end }}
+{{- else if kindIs "string" $value }}
+{{- if or (hasPrefix "f\"" $value) (hasPrefix "F\"" $value) (hasPrefix "r\"" $value) (hasPrefix "R\"" $value) (hasPrefix "b\"" $value) (hasPrefix "B\"" $value) }}
+{{ $key }} = {{ $value }}
+{{- else }}
+{{ $key }} = {{ $value | quote }}
+{{- end }}
+{{- else if kindIs "invalid" $value }}
+{{ $key }} = None
+{{- else }}
+{{ $key }} = {{ $value | toJson }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{- /* Custom Config Overrides */}}
+{{- if .Values.configOverrides }}
+# Custom Overrides
 {{- range $key, $value := .Values.configOverrides }}
 # {{ $key }}
 {{ tpl $value $ }}
 {{- end }}
 {{- end }}
 
-{{ if .Values.configOverridesFiles }}
+{{- if .Values.configOverridesFiles }}
 # Overrides from files
 {{- $files := .Files }}
 {{- range $key, $value := .Values.configOverridesFiles }}
@@ -187,7 +680,57 @@ RESULTS_BACKEND = RedisCache(
 {{- end }}
 {{- end }}
 
+{{- end -}}
+
+{{- define "superset.initScript" -}}
+#!/bin/sh
+set -eu
+echo "Upgrading DB schema..."
+superset db upgrade
+echo "Initializing roles and permissions..."
+superset init
+echo "Init job: Creating admin user and loading initial data..."
+{{- if .Values.init.createAdmin }}
+echo "Creating admin user (if not present)..."
+if superset fab list-users 2>/dev/null | grep -qF {{ printf "username:%s" .Values.init.adminUser.username | squote }}; then
+  echo "Admin user already exists, skipping."
+else
+  superset fab create-admin \
+      --username {{ .Values.init.adminUser.username | squote }} \
+      --firstname {{ .Values.init.adminUser.firstname | squote }} \
+      --lastname {{ .Values.init.adminUser.lastname | squote }} \
+      --email {{ .Values.init.adminUser.email | squote }} \
+      --password {{ .Values.init.adminUser.password | squote }}
+fi
+{{- else }}
+echo "Skipping admin creation (init.createAdmin=false)"
 {{- end }}
+{{- if .Values.init.loadExamples }}
+echo "Loading examples..."
+superset load_examples
+{{- else }}
+echo "Skipping examples (init.loadExamples=false)"
+{{- end }}
+if [ -f "{{ .Values.extraConfigMountPath }}/import_datasources.yaml" ]; then
+  echo "Importing database connections..."
+  superset import_datasources -p {{ .Values.extraConfigMountPath }}/import_datasources.yaml
+fi
+echo "Init job complete."
+{{- end -}}
+
+{{/*
+Deprecation warnings — returns a newline-separated list of active deprecation messages,
+or empty string when no deprecated keys are set. Rendered in NOTES.txt after install/upgrade.
+*/}}
+{{- define "superset.deprecationWarnings" -}}
+{{- $conn := include "_superset.legacyConn" . | fromJson -}}
+{{- if gt (len (keys $conn)) 0 }}
+- supersetNode.connections.* is deprecated; use database.* and cache.* (auto-mapped for now). See UPGRADING.md
+{{- end }}
+{{- if .Values.serviceAccountName }}
+- root serviceAccountName is deprecated; use serviceAccount.name (auto-mapped for now). See UPGRADING.md
+{{- end }}
+{{- end -}}
 
 {{- define "supersetNode.selectorLabels" -}}
 app.kubernetes.io/name: {{ include "superset.name" . }}
@@ -218,3 +761,9 @@ app.kubernetes.io/name: {{ include "superset.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 app.kubernetes.io/component: worker
 {{- end }}
+
+{{- define "supersetMcp.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "superset.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/component: mcp
+{{- end }}

helm/superset/templates/deployment-beat.yaml

@@ -37,9 +37,12 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/superset_config.py: {{ include "superset-config" . | sha256sum }}
+        checksum/superset_config.py: {{ include "superset.config" . | sha256sum }}
         checksum/superset_bootstrap.sh: {{ tpl .Values.bootstrapScript . | sha256sum }}
-        checksum/connections: {{ .Values.supersetNode.connections | toYaml | sha256sum }}
+        checksum/database: {{ .Values.database | toYaml | sha256sum }}
+        checksum/redis: {{ .Values.cache | toYaml | sha256sum }}
+        checksum/config: {{ .Values.config | toYaml | sha256sum }}
+        checksum/featureFlags: {{ .Values.featureFlags | toYaml | sha256sum }}
         checksum/extraConfigs: {{ .Values.extraConfigs | toYaml | sha256sum }}
         checksum/extraSecrets: {{ .Values.extraSecrets | toYaml | sha256sum }}
         checksum/extraSecretEnv: {{ .Values.extraSecretEnv | toYaml | sha256sum }}
@@ -52,6 +55,9 @@ spec:
         {{- if .Values.supersetCeleryBeat.podAnnotations }}
           {{- toYaml .Values.supersetCeleryBeat.podAnnotations | nindent 8 }}
         {{- end }}
+        {{- with .Values.globalPodAnnotations }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
       labels:
         {{- include "supersetCeleryBeat.selectorLabels" . | nindent 8 }}
         {{- if .Values.supersetCeleryBeat.podLabels }}
@@ -69,8 +75,14 @@ spec:
         {{- if .Values.supersetCeleryBeat.podSecurityContext }}
           {{- toYaml .Values.supersetCeleryBeat.podSecurityContext | nindent 8 }}
         {{- end }}
+      {{- if or .Values.supersetCeleryBeat.initContainers .Values.supersetCeleryBeat.extraInitContainers }}
+      initContainers:
       {{- if .Values.supersetCeleryBeat.initContainers }}
-      initContainers: {{-  tpl (toYaml .Values.supersetCeleryBeat.initContainers) . | nindent 6 }}
+      {{-  tpl (toYaml .Values.supersetCeleryBeat.initContainers) . | nindent 6 }}
+      {{- end }}
+      {{- if .Values.supersetCeleryBeat.extraInitContainers }}
+      {{-  tpl (toYaml .Values.supersetCeleryBeat.extraInitContainers) . | nindent 6 }}
+      {{- end }}
       {{- end }}
       {{- with .Values.hostAliases }}
       hostAliases: {{- toYaml . | nindent 6 }}

helm/superset/templates/deployment-flower.yaml

@@ -36,11 +36,14 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/config: {{ include "superset-config" . | sha256sum }}
+        checksum/config: {{ include "superset.config" . | sha256sum }}
         checksum/secrets: {{ tpl (toJson .Values.extraSecretEnv) . | sha256sum }}
         {{- if .Values.supersetCeleryFlower.podAnnotations }}
           {{- toYaml .Values.supersetCeleryFlower.podAnnotations | nindent 8 }}
         {{- end }}
+        {{- with .Values.globalPodAnnotations }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
       labels:
         {{- include "supersetCeleryFlower.selectorLabels" . | nindent 8 }}
         {{- if .Values.supersetCeleryFlower.podLabels }}
@@ -58,8 +61,14 @@ spec:
         {{- if .Values.supersetCeleryFlower.podSecurityContext }}
           {{- toYaml .Values.supersetCeleryFlower.podSecurityContext | nindent 8 }}
         {{- end }}
+      {{- if or .Values.supersetCeleryFlower.initContainers .Values.supersetCeleryFlower.extraInitContainers }}
+      initContainers:
       {{- if .Values.supersetCeleryFlower.initContainers }}
-      initContainers: {{-  tpl (toYaml .Values.supersetCeleryFlower.initContainers) . | nindent 6 }}
+      {{-  tpl (toYaml .Values.supersetCeleryFlower.initContainers) . | nindent 6 }}
+      {{- end }}
+      {{- if .Values.supersetCeleryFlower.extraInitContainers }}
+      {{-  tpl (toYaml .Values.supersetCeleryFlower.extraInitContainers) . | nindent 6 }}
+      {{- end }}
       {{- end }}
       {{- with .Values.hostAliases }}
       hostAliases: {{- toYaml . | nindent 6 }}

helm/superset/templates/deployment-mcp.yaml

@@ -0,0 +1,197 @@
+{{/*
+
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+*/}}
+
+{{- if .Values.supersetMcp.enabled -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "superset.fullname" . }}-mcp
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "superset.componentLabels" (dict "component" "mcp" "root" .) | nindent 4 }}
+  {{- if .Values.supersetMcp.deploymentAnnotations }}
+  annotations: {{- toYaml .Values.supersetMcp.deploymentAnnotations | nindent 4 }}
+  {{- end }}
+spec:
+  replicas: {{ .Values.supersetMcp.replicaCount }}
+  selector:
+    matchLabels:
+    {{- include "supersetMcp.selectorLabels" . | nindent 6 }}
+  {{- if .Values.supersetMcp.strategy }}
+  strategy: {{- toYaml .Values.supersetMcp.strategy | nindent 4 }}
+  {{- end }}
+  template:
+    metadata:
+      annotations:
+        checksum/superset_config.py: {{ include "superset.config" . | sha256sum }}
+        checksum/superset_bootstrap.sh: {{ tpl .Values.bootstrapScript . | sha256sum }}
+        checksum/database: {{ .Values.database | toYaml | sha256sum }}
+        checksum/redis: {{ .Values.cache | toYaml | sha256sum }}
+        checksum/config: {{ .Values.config | toYaml | sha256sum }}
+        checksum/featureFlags: {{ .Values.featureFlags | toYaml | sha256sum }}
+        checksum/extraConfigs: {{ .Values.extraConfigs | toYaml | sha256sum }}
+        checksum/extraSecrets: {{ .Values.extraSecrets | toYaml | sha256sum }}
+        checksum/extraSecretEnv: {{ .Values.extraSecretEnv | toYaml | sha256sum }}
+        checksum/configOverrides: {{ .Values.configOverrides | toYaml | sha256sum }}
+        checksum/configOverridesFiles: {{ .Values.configOverridesFiles | toYaml | sha256sum }}
+        {{- if .Values.supersetMcp.forceReload }}
+        # Optionally force the thing to reload
+        force-reload: {{ randAlphaNum 5 | quote }}
+        {{- end }}
+        {{- if .Values.supersetMcp.podAnnotations }}
+          {{- toYaml .Values.supersetMcp.podAnnotations | nindent 8 }}
+        {{- end }}
+        {{- with .Values.globalPodAnnotations }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+      labels:
+        {{- include "supersetMcp.selectorLabels" . | nindent 8 }}
+        {{- if .Values.supersetMcp.podLabels }}
+          {{- toYaml .Values.supersetMcp.podLabels | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- if .Values.supersetMcp.deploymentAdditionalPodSpec }}
+      {{- tpl (toYaml .Values.supersetMcp.deploymentAdditionalPodSpec) . | nindent 6 }}
+      {{- end }}
+      {{- if or (.Values.serviceAccount.create) (.Values.serviceAccountName) }}
+      serviceAccountName: {{ template "superset.serviceAccountName" . }}
+      {{- end }}
+      securityContext:
+        runAsUser: {{ .Values.runAsUser }}
+        {{- if .Values.supersetMcp.podSecurityContext }}
+          {{- toYaml .Values.supersetMcp.podSecurityContext | nindent 8 }}
+        {{- end }}
+      {{- if or .Values.supersetMcp.initContainers .Values.supersetMcp.extraInitContainers }}
+      initContainers:
+      {{- if .Values.supersetMcp.initContainers }}
+      {{-  tpl (toYaml .Values.supersetMcp.initContainers) . | nindent 6 }}
+      {{- end }}
+      {{- if .Values.supersetMcp.extraInitContainers }}
+      {{-  tpl (toYaml .Values.supersetMcp.extraInitContainers) . | nindent 6 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.hostAliases }}
+      hostAliases: {{- toYaml . | nindent 6 }}
+      {{- end }}
+      containers:
+        - name: "{{ .Chart.Name }}-mcp"
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          {{- if .Values.supersetMcp.containerSecurityContext }}
+          securityContext: {{- toYaml .Values.supersetMcp.containerSecurityContext | nindent 12 }}
+          {{- end }}
+          command: {{  tpl (toJson .Values.supersetMcp.command) . }}
+          env:
+            {{- range $key, $value := .Values.extraEnv }}
+            - name: {{ $key | quote}}
+              value: {{ $value | quote }}
+            {{- end }}
+            {{- if .Values.extraEnvRaw }}
+            {{- toYaml .Values.extraEnvRaw | nindent 12 }}
+            {{- end }}
+          envFrom:
+            - secretRef:
+                name: {{ tpl .Values.envFromSecret . | quote }}
+            {{- range .Values.envFromSecrets }}
+            - secretRef:
+                name: {{ tpl . $ | quote }}
+            {{- end }}
+          ports:
+            - name: mcp
+              containerPort: {{ .Values.supersetMcp.service.port }}
+              protocol: TCP
+          volumeMounts:
+            - name: superset-config
+              mountPath: {{ .Values.configMountPath | quote }}
+              readOnly: true
+            {{- if .Values.extraConfigs }}
+            - name: superset-extra-config
+              mountPath: {{ .Values.extraConfigMountPath | quote }}
+              readOnly: true
+            {{- end }}
+            {{- with .Values.extraVolumeMounts }}
+              {{- tpl (toYaml .) $ | nindent 12 -}}
+            {{- end }}
+          {{- if .Values.supersetMcp.startupProbe }}
+          startupProbe: {{- .Values.supersetMcp.startupProbe | toYaml | nindent 12 }}
+          {{- end }}
+          {{- if .Values.supersetMcp.readinessProbe }}
+          readinessProbe: {{- .Values.supersetMcp.readinessProbe | toYaml | nindent 12 }}
+          {{- end }}
+          {{- if .Values.supersetMcp.livenessProbe }}
+          livenessProbe: {{- .Values.supersetMcp.livenessProbe | toYaml | nindent 12 }}
+          {{- end }}
+          {{- if .Values.supersetMcp.lifecycle }}
+          lifecycle: {{- .Values.supersetMcp.lifecycle | toYaml | nindent 12 }}
+          {{- end }}
+          resources:
+            {{- if .Values.supersetMcp.resources }}
+              {{- toYaml .Values.supersetMcp.resources | nindent 12 }}
+            {{- else }}
+              {{- toYaml .Values.resources | nindent 12 }}
+            {{- end }}
+        {{- if .Values.supersetMcp.extraContainers }}
+          {{- tpl (toYaml .Values.supersetMcp.extraContainers) . | nindent 8 }}
+        {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector: {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if or .Values.affinity .Values.supersetMcp.affinity }}
+      affinity:
+        {{- with .Values.affinity }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- with .Values.supersetMcp.affinity }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- end }}
+      {{- if .Values.supersetMcp.priorityClassName }}
+      priorityClassName: {{ .Values.supersetMcp.priorityClassName }}
+      {{- end }}
+      {{- if or .Values.topologySpreadConstraints .Values.supersetMcp.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- with .Values.topologySpreadConstraints }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- with .Values.supersetMcp.topologySpreadConstraints }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations: {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if .Values.supersetMcp.terminationGracePeriodSeconds }}
+      terminationGracePeriodSeconds: {{ .Values.supersetMcp.terminationGracePeriodSeconds }}
+      {{- end }}
+      {{- if .Values.imagePullSecrets }}
+      imagePullSecrets: {{- toYaml .Values.imagePullSecrets | nindent 8 }}
+      {{- end }}
+      volumes:
+        - name: superset-config
+          secret:
+            secretName: {{ tpl .Values.configFromSecret . }}
+        {{- if .Values.extraConfigs }}
+        - name: superset-extra-config
+          configMap:
+            name: {{ template "superset.fullname" . }}-extra-config
+        {{- end }}
+        {{- with .Values.extraVolumes }}
+          {{- tpl (toYaml .) $ | nindent 8 -}}
+        {{- end }}
+{{- end -}}

helm/superset/templates/deployment-worker.yaml

@@ -43,9 +43,12 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/superset_config.py: {{ include "superset-config" . | sha256sum }}
+        checksum/superset_config.py: {{ include "superset.config" . | sha256sum }}
         checksum/superset_bootstrap.sh: {{ tpl .Values.bootstrapScript . | sha256sum }}
-        checksum/connections: {{ .Values.supersetNode.connections | toYaml | sha256sum }}
+        checksum/database: {{ .Values.database | toYaml | sha256sum }}
+        checksum/redis: {{ .Values.cache | toYaml | sha256sum }}
+        checksum/config: {{ .Values.config | toYaml | sha256sum }}
+        checksum/featureFlags: {{ .Values.featureFlags | toYaml | sha256sum }}
         checksum/extraConfigs: {{ .Values.extraConfigs | toYaml | sha256sum }}
         checksum/extraSecrets: {{ .Values.extraSecrets | toYaml | sha256sum }}
         checksum/extraSecretEnv: {{ .Values.extraSecretEnv | toYaml | sha256sum }}
@@ -58,6 +61,9 @@ spec:
         {{- if .Values.supersetWorker.podAnnotations }}
           {{- toYaml .Values.supersetWorker.podAnnotations | nindent 8 }}
         {{- end }}
+        {{- with .Values.globalPodAnnotations }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
       labels:
         {{- include "supersetWorker.selectorLabels" . | nindent 8 }}
         {{- if .Values.supersetWorker.podLabels }}
@@ -75,8 +81,14 @@ spec:
         {{- if .Values.supersetWorker.podSecurityContext }}
           {{- toYaml .Values.supersetWorker.podSecurityContext | nindent 8 }}
         {{- end }}
+      {{- if or .Values.supersetWorker.initContainers .Values.supersetWorker.extraInitContainers }}
+      initContainers:
       {{- if .Values.supersetWorker.initContainers }}
-      initContainers: {{- tpl (toYaml .Values.supersetWorker.initContainers) . | nindent 6 }}
+      {{- tpl (toYaml .Values.supersetWorker.initContainers) . | nindent 6 }}
+      {{- end }}
+      {{- if .Values.supersetWorker.extraInitContainers }}
+      {{- tpl (toYaml .Values.supersetWorker.extraInitContainers) . | nindent 6 }}
+      {{- end }}
       {{- end }}
       {{- with .Values.hostAliases }}
       hostAliases: {{- toYaml . | nindent 6 }}

helm/superset/templates/deployment-ws.yaml

@@ -44,6 +44,9 @@ spec:
         {{- if .Values.supersetWebsockets.podAnnotations }}
           {{- toYaml .Values.supersetWebsockets.podAnnotations | nindent 8 }}
         {{- end }}
+        {{- with .Values.globalPodAnnotations }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
       labels:
         {{- include "supersetWebsockets.selectorLabels" . | nindent 8 }}
         {{- if .Values.supersetWebsockets.podLabels }}
@@ -61,6 +64,15 @@ spec:
         {{- if .Values.supersetWebsockets.podSecurityContext }}
           {{- toYaml .Values.supersetWebsockets.podSecurityContext | nindent 8 }}
         {{- end }}
+      {{- if or .Values.supersetWebsockets.initContainers .Values.supersetWebsockets.extraInitContainers }}
+      initContainers:
+      {{- if .Values.supersetWebsockets.initContainers }}
+      {{- tpl (toYaml .Values.supersetWebsockets.initContainers) . | nindent 6 }}
+      {{- end }}
+      {{- if .Values.supersetWebsockets.extraInitContainers }}
+      {{- tpl (toYaml .Values.supersetWebsockets.extraInitContainers) . | nindent 6 }}
+      {{- end }}
+      {{- end }}
       {{- with .Values.hostAliases }}
       hostAliases: {{- toYaml . | nindent 6 }}
       {{- end }}

helm/superset/templates/deployment.yaml

@@ -44,10 +44,13 @@ spec:
     metadata:
       annotations:
         # Force reload on config changes
-        checksum/superset_config.py: {{ include "superset-config" . | sha256sum }}
-        checksum/superset_init.sh: {{ tpl .Values.init.initscript . | sha256sum }}
+        checksum/superset_config.py: {{ include "superset.config" . | sha256sum }}
+        checksum/superset_init.sh: {{ include "superset.initScript" . | sha256sum }}
         checksum/superset_bootstrap.sh: {{ tpl .Values.bootstrapScript . | sha256sum }}
-        checksum/connections: {{ .Values.supersetNode.connections | toYaml | sha256sum }}
+        checksum/database: {{ .Values.database | toYaml | sha256sum }}
+        checksum/redis: {{ .Values.cache | toYaml | sha256sum }}
+        checksum/config: {{ .Values.config | toYaml | sha256sum }}
+        checksum/featureFlags: {{ .Values.featureFlags | toYaml | sha256sum }}
         checksum/extraConfigs: {{ .Values.extraConfigs | toYaml | sha256sum }}
         checksum/extraSecrets: {{ .Values.extraSecrets | toYaml | sha256sum }}
         checksum/extraSecretEnv: {{ .Values.extraSecretEnv | toYaml | sha256sum }}
@@ -60,6 +63,9 @@ spec:
         {{- if .Values.supersetNode.podAnnotations }}
           {{- toYaml .Values.supersetNode.podAnnotations | nindent 8 }}
         {{- end }}
+        {{- with .Values.globalPodAnnotations }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
       labels:
         {{- include "supersetNode.selectorLabels" . | nindent 8 }}
         {{- if .Values.supersetNode.podLabels }}
@@ -77,8 +83,14 @@ spec:
         {{- if .Values.supersetNode.podSecurityContext }}
           {{- toYaml .Values.supersetNode.podSecurityContext | nindent 8 }}
         {{- end }}
+      {{- if or .Values.supersetNode.initContainers .Values.supersetNode.extraInitContainers }}
+      initContainers:
       {{- if .Values.supersetNode.initContainers }}
-      initContainers: {{- tpl (toYaml .Values.supersetNode.initContainers) . | nindent 6 }}
+      {{- tpl (toYaml .Values.supersetNode.initContainers) . | nindent 6 }}
+      {{- end }}
+      {{- if .Values.supersetNode.extraInitContainers }}
+      {{- tpl (toYaml .Values.supersetNode.extraInitContainers) . | nindent 6 }}
+      {{- end }}
       {{- end }}
       {{- with .Values.hostAliases }}
       hostAliases: {{- toYaml . | nindent 6 }}

helm/superset/templates/httproute.yaml

@@ -0,0 +1,83 @@
+{{/*
+
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+*/}}
+
+{{- if .Values.httproute.enabled -}}
+{{- $fullName := include "superset.fullname" . -}}
+apiVersion: {{ .Values.httproute.apiVersion | default "gateway.networking.k8s.io/v1" }}
+kind: HTTPRoute
+metadata:
+  name: {{ $fullName }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "superset.name" . }}
+    chart: {{ template "superset.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+    {{- if .Values.extraLabels }}
+      {{- toYaml .Values.extraLabels | nindent 4 }}
+    {{- end }}
+    {{- with .Values.httproute.labels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.httproute.annotations }}
+  annotations: {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.httproute.parentRefs }}
+  parentRefs:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.httproute.hostnames }}
+  hostnames:
+    {{- tpl (toYaml .) $ | nindent 4 }}
+  {{- end }}
+  rules:
+    {{- range .Values.httproute.rules }}
+    - backendRefs:
+        - group: ''
+          kind: Service
+          name: {{ $fullName }}
+          port: {{ $.Values.service.port }}
+          weight: {{ .weight | default 1 }}
+      {{- with .filters }}
+      filters:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .matches }}
+      matches:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .timeouts }}
+      timeouts:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- end }}
+    {{- if .Values.supersetWebsockets.enabled }}
+    - backendRefs:
+        - group: ''
+          kind: Service
+          name: {{ $fullName }}-ws
+          port: {{ .Values.supersetWebsockets.service.port }}
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: {{ .Values.supersetWebsockets.ingress.path }}
+    {{- end }}
+{{- end }}

helm/superset/templates/ingress.yaml

@@ -64,6 +64,15 @@ spec:
                 port:
                   name: ws
           {{- end }}
+          {{- if and $.Values.supersetMcp.enabled $.Values.supersetMcp.ingress.enabled }}
+          - path: {{ $.Values.supersetMcp.ingress.path }}
+            pathType: {{ $.Values.supersetMcp.ingress.pathType }}
+            backend:
+              service:
+                name: "{{ template "superset.fullname" $ }}-mcp"
+                port:
+                  name: mcp
+          {{- end }}
     {{- end }}
   {{- if .Values.ingress.extraHostsRaw }}
     {{- toYaml .Values.ingress.extraHostsRaw | nindent 4 }}

helm/superset/templates/init-job.yaml

@@ -56,8 +56,14 @@ spec:
         {{- if .Values.init.podSecurityContext }}
           {{- toYaml .Values.init.podSecurityContext | nindent 8 }}
         {{- end }}
+      {{- if or .Values.init.initContainers .Values.init.extraInitContainers }}
+      initContainers:
       {{- if .Values.init.initContainers }}
-      initContainers: {{-  tpl (toYaml .Values.init.initContainers) . | nindent 6 }}
+      {{-  tpl (toYaml .Values.init.initContainers) . | nindent 6 }}
+      {{- end }}
+      {{- if .Values.init.extraInitContainers }}
+      {{-  tpl (toYaml .Values.init.extraInitContainers) . | nindent 6 }}
+      {{- end }}
       {{- end }}
       {{- with .Values.hostAliases }}
       hostAliases: {{- toYaml . | nindent 6 }}

helm/superset/templates/pdb-mcp.yaml

@@ -0,0 +1,42 @@
+{{/*
+
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+*/}}
+
+{{- with .Values.supersetMcp.podDisruptionBudget }}
+{{- if .enabled -}}
+{{- if and .minAvailable .maxUnavailable }}
+  {{- fail "Only one of minAvailable or maxUnavailable should be set" }}
+{{- end}}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "superset.fullname" $ }}-mcp-pdb
+  labels:
+    {{- include "superset.componentLabels" (dict "component" "mcp" "root" $) | nindent 4 }}
+spec:
+  {{- if .minAvailable }}
+  minAvailable: {{ .minAvailable }}
+  {{- end }}
+  {{- if .maxUnavailable }}
+  maxUnavailable: {{ .maxUnavailable }}
+  {{- end }}
+  selector:
+    matchLabels:
+    {{- include "supersetMcp.selectorLabels" $ | nindent 6 }}
+{{- end }}
+{{- end }}

helm/superset/templates/secret-env.yaml

@@ -24,26 +24,33 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "superset.labels" . | nindent 4 }}
+  {{- if .Values.secretEnv.annotations }}
+  annotations: {{- toYaml .Values.secretEnv.annotations | nindent 4 }}
+  {{- end }}
 type: Opaque
 stringData:
-    REDIS_HOST: {{ tpl .Values.supersetNode.connections.redis_host . | quote }}
-    REDIS_USER: {{ .Values.supersetNode.connections.redis_user | quote }}
-    {{- if .Values.supersetNode.connections.redis_password }}
-    REDIS_PASSWORD: {{ .Values.supersetNode.connections.redis_password | quote }}
+    DB_HOST: {{ include "superset.db.host" . | quote }}
+    DB_PORT: {{ include "superset.db.port" . | quote }}
+    DB_USER: {{ include "superset.db.user" . | quote }}
+    DB_PASS: {{ include "superset.db.password" . | quote }}
+    DB_NAME: {{ include "superset.db.name" . | quote }}
+    {{- if .Values.database.ssl.enabled }}
+    DB_SSL_MODE: {{ .Values.database.ssl.mode | default "require" | quote }}
+    {{- end }}
+    {{- if .Values.cache.enabled }}
+    REDIS_HOST: {{ include "superset.redis.host" . | quote }}
+    REDIS_PORT: {{ include "superset.redis.port" . | quote }}
+    REDIS_USER: {{ include "superset.redis.user" . | quote }}
+    {{- if include "superset.redis.password" . }}
+    REDIS_PASSWORD: {{ include "superset.redis.password" . | quote }}
+    {{- end }}
+    REDIS_DB: {{ include "superset.redis.cacheDb" . | quote }}
+    REDIS_CELERY_DB: {{ include "superset.redis.celeryDb" . | quote }}
+    REDIS_PROTO: {{ include "superset.redis.proto" . | quote }}
+    {{- if .Values.cache.driver }}
+    REDIS_DRIVER: {{ .Values.cache.driver | quote }}
     {{- end }}
-    REDIS_PORT: {{ .Values.supersetNode.connections.redis_port | quote }}
-    REDIS_PROTO: {{ if .Values.supersetNode.connections.redis_ssl.enabled }}"rediss"{{ else }}"redis"{{ end }}
-    REDIS_DRIVER: {{ .Values.supersetNode.connections.redis_driver | quote }}
-    REDIS_DB: {{ .Values.supersetNode.connections.redis_cache_db | quote }}
-    REDIS_CELERY_DB: {{ .Values.supersetNode.connections.redis_celery_db | quote }}
-    {{- if .Values.supersetNode.connections.redis_ssl.enabled }}
-    REDIS_SSL_CERT_REQS: {{ .Values.supersetNode.connections.redis_ssl.ssl_cert_reqs | default "CERT_NONE" | quote }}
     {{- end }}
-    DB_HOST: {{ tpl .Values.supersetNode.connections.db_host . | quote }}
-    DB_PORT: {{ .Values.supersetNode.connections.db_port | quote }}
-    DB_USER: {{ .Values.supersetNode.connections.db_user | quote }}
-    DB_PASS: {{ .Values.supersetNode.connections.db_pass | quote }}
-    DB_NAME: {{ .Values.supersetNode.connections.db_name | quote }}
     {{- if .Values.extraSecretEnv }}
     {{- range $key, $value := .Values.extraSecretEnv }}
     {{ $key }}: {{ $value | quote }}

helm/superset/templates/secret-superset-config.yaml

@@ -24,12 +24,15 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "superset.labels" . | nindent 4 }}
+  {{- if .Values.secretConfig.annotations }}
+  annotations: {{- toYaml .Values.secretConfig.annotations | nindent 4 }}
+  {{- end }}
 type: Opaque
 stringData:
   superset_config.py: |
-    {{- include "superset-config" . | nindent 4 }}
+    {{- include "superset.config" . | nindent 4 }}
   superset_init.sh: |
-    {{- tpl .Values.init.initscript . | nindent 4 }}
+    {{- include "superset.initScript" . | nindent 4 }}
   superset_bootstrap.sh: |
     {{- tpl .Values.bootstrapScript . | nindent 4 }}
 

helm/superset/templates/secret-ws.yaml

@@ -25,6 +25,9 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "superset.labels" . | nindent 4 }}
+  {{- if .Values.supersetWebsockets.configAnnotations }}
+  annotations: {{- toYaml .Values.supersetWebsockets.configAnnotations | nindent 4 }}
+  {{- end }}
 type: Opaque
 stringData:
   config.json: |

helm/superset/templates/service-mcp.yaml

@@ -0,0 +1,46 @@
+{{/*
+
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+*/}}
+
+{{- if .Values.supersetMcp.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ template "superset.fullname" . }}-mcp"
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "superset.componentLabels" (dict "component" "mcp" "root" .) | nindent 4 }}
+  {{- with .Values.supersetMcp.service.annotations }}
+  annotations: {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.supersetMcp.service.type }}
+  ports:
+    - port: {{ .Values.supersetMcp.service.port }}
+      targetPort: mcp
+      protocol: TCP
+      name: mcp
+      {{- if and (or (eq .Values.supersetMcp.service.type "NodePort") (eq .Values.supersetMcp.service.type "LoadBalancer")) (not (empty .Values.supersetMcp.service.nodePort.http)) }}
+      nodePort: {{ .Values.supersetMcp.service.nodePort.http }}
+      {{- end }}
+  selector:
+    {{- include "supersetMcp.selectorLabels" . | nindent 4 }}
+  {{- if .Values.supersetMcp.service.loadBalancerIP }}
+  loadBalancerIP: {{ .Values.supersetMcp.service.loadBalancerIP }}
+  {{- end }}
+{{- end }}

helm/superset/tests/checksum_test.yaml

@@ -0,0 +1,154 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+suite: config checksums + global pod annotations
+templates:
+  - deployment.yaml
+  - deployment-worker.yaml
+  - deployment-beat.yaml
+  - deployment-flower.yaml
+  - deployment-ws.yaml
+  - deployment-mcp.yaml
+tests:
+  - it: main deployment has new config checksums, not the old connections checksum
+    template: deployment.yaml
+    asserts:
+      - exists:
+          path: 'spec.template.metadata.annotations["checksum/database"]'
+      - exists:
+          path: 'spec.template.metadata.annotations["checksum/config"]'
+      - notExists:
+          path: 'spec.template.metadata.annotations["checksum/connections"]'
+  - it: main deployment applies globalPodAnnotations
+    template: deployment.yaml
+    set:
+      globalPodAnnotations:
+        team: data
+    asserts:
+      - equal:
+          path: 'spec.template.metadata.annotations.team'
+          value: data
+  - it: globalPodAnnotations coexist with per-component podAnnotations on deployment.yaml
+    template: deployment.yaml
+    set:
+      globalPodAnnotations:
+        global: "yes"
+      supersetNode:
+        podAnnotations:
+          component: "yes"
+    asserts:
+      - equal:
+          path: 'spec.template.metadata.annotations.global'
+          value: "yes"
+      - equal:
+          path: 'spec.template.metadata.annotations.component'
+          value: "yes"
+  - it: worker deployment has config and database checksums
+    template: deployment-worker.yaml
+    asserts:
+      - exists:
+          path: 'spec.template.metadata.annotations["checksum/database"]'
+      - exists:
+          path: 'spec.template.metadata.annotations["checksum/config"]'
+  - it: worker deployment applies globalPodAnnotations
+    template: deployment-worker.yaml
+    set:
+      globalPodAnnotations:
+        team: data
+    asserts:
+      - equal:
+          path: 'spec.template.metadata.annotations.team'
+          value: data
+  - it: beat deployment has config and database checksums
+    template: deployment-beat.yaml
+    set:
+      supersetCeleryBeat:
+        enabled: true
+    asserts:
+      - exists:
+          path: 'spec.template.metadata.annotations["checksum/database"]'
+      - exists:
+          path: 'spec.template.metadata.annotations["checksum/config"]'
+  - it: beat deployment applies globalPodAnnotations
+    template: deployment-beat.yaml
+    set:
+      supersetCeleryBeat:
+        enabled: true
+      globalPodAnnotations:
+        team: data
+    asserts:
+      - equal:
+          path: 'spec.template.metadata.annotations.team'
+          value: data
+  - it: flower deployment has config checksum
+    template: deployment-flower.yaml
+    set:
+      supersetCeleryFlower:
+        enabled: true
+    asserts:
+      - exists:
+          path: 'spec.template.metadata.annotations["checksum/config"]'
+  - it: flower deployment applies globalPodAnnotations
+    template: deployment-flower.yaml
+    set:
+      supersetCeleryFlower:
+        enabled: true
+      globalPodAnnotations:
+        team: data
+    asserts:
+      - equal:
+          path: 'spec.template.metadata.annotations.team'
+          value: data
+  - it: websockets deployment has wsconfig checksum
+    template: deployment-ws.yaml
+    set:
+      supersetWebsockets:
+        enabled: true
+    asserts:
+      - exists:
+          path: 'spec.template.metadata.annotations["checksum/wsconfig"]'
+  - it: websockets deployment applies globalPodAnnotations
+    template: deployment-ws.yaml
+    set:
+      supersetWebsockets:
+        enabled: true
+      globalPodAnnotations:
+        team: data
+    asserts:
+      - equal:
+          path: 'spec.template.metadata.annotations.team'
+          value: data
+  - it: mcp deployment has config and database checksums
+    template: deployment-mcp.yaml
+    set:
+      supersetMcp:
+        enabled: true
+    asserts:
+      - exists:
+          path: 'spec.template.metadata.annotations["checksum/database"]'
+      - exists:
+          path: 'spec.template.metadata.annotations["checksum/config"]'
+  - it: mcp deployment applies globalPodAnnotations
+    template: deployment-mcp.yaml
+    set:
+      supersetMcp:
+        enabled: true
+      globalPodAnnotations:
+        team: data
+    asserts:
+      - equal:
+          path: 'spec.template.metadata.annotations.team'
+          value: data

helm/superset/tests/config_test.yaml

@@ -0,0 +1,94 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+suite: superset_config.py rendering
+templates:
+  - secret-superset-config.yaml
+tests:
+  - it: builds SQLALCHEMY_DATABASE_URI from env with percent-encoded creds
+    set: {database: {host: pg.svc, port: 5432, user: su, password: pw, name: sset}}
+    asserts:
+      - matchRegex: {path: 'stringData["superset_config.py"]', pattern: 'SQLALCHEMY_DATABASE_URI = f"postgresql\+psycopg2://\{quote\(env\(.DB_USER'}
+  - it: honors database.uri override
+    set: {database.uri: "postgresql://x:y@h:5432/d"}
+    asserts:
+      - matchRegex: {path: 'stringData["superset_config.py"]', pattern: 'SQLALCHEMY_DATABASE_URI = "postgresql://x:y@h:5432/d"'}
+  - it: imports required for env/json handling are present
+    asserts:
+      - matchRegex: {path: 'stringData["superset_config.py"]', pattern: 'import json'}
+      - matchRegex: {path: 'stringData["superset_config.py"]', pattern: 'from urllib\.parse import quote'}
+  - it: redis creds are percent-encoded and read from env
+    set: {cache: {enabled: true, password: "p@ss"}}
+    asserts:
+      - matchRegex: {path: 'stringData["superset_config.py"]', pattern: 'quote\(env\(.REDIS_PASSWORD'}
+  - it: config map values render via json.loads
+    set: {config: {MY_MAP: {enabled: true}}}
+    asserts:
+      - matchRegex: {path: 'stringData["superset_config.py"]', pattern: 'MY_MAP = json\.loads\('}
+  - it: config nil values render as None
+    set: {config: {MY_NIL: null}}
+    asserts:
+      - matchRegex: {path: 'stringData["superset_config.py"]', pattern: 'MY_NIL = None'}
+  - it: supersetWorker healthCheck enabled renders readiness file path
+    set: {supersetWorker: {healthCheck: {enabled: true}}}
+    asserts:
+      - matchRegex: {path: 'stringData["superset_config.py"]', pattern: '/tmp/celery_worker_ready'}
+  - it: SQLALCHEMY_TRACK_MODIFICATIONS defaults False
+    asserts:
+      - matchRegex: {path: 'stringData["superset_config.py"]', pattern: 'SQLALCHEMY_TRACK_MODIFICATIONS = False'}
+  - it: renders feature flags
+    set: {featureFlags: {ALERT_REPORTS: true}}
+    asserts:
+      - matchRegex: {path: 'stringData["superset_config.py"]', pattern: '"ALERT_REPORTS": True'}
+  - it: SQLALCHEMY_TRACK_MODIFICATIONS user-set true renders Python True
+    set: {config: {SQLALCHEMY_TRACK_MODIFICATIONS: true}}
+    asserts:
+      - matchRegex: {path: 'stringData["superset_config.py"]', pattern: 'SQLALCHEMY_TRACK_MODIFICATIONS = True'}
+  - it: celeryConfig without imports emits a safe empty CELERY_IMPORTS (no AttributeError)
+    set: {config: {celeryConfig: {broker_url: "redis://x"}}}
+    asserts:
+      - matchRegex: {path: 'stringData["superset_config.py"]', pattern: 'CELERY_IMPORTS = \(\)'}
+      - notMatchRegex: {path: 'stringData["superset_config.py"]', pattern: 'CELERY_IMPORTS = CeleryConfig\.imports'}
+  - it: legacy db_type maps to the SQLAlchemy driver (deprecation path)
+    set: {supersetNode: {connections: {db_type: "postgresql+pg8000"}}}
+    asserts:
+      - matchRegex: {path: 'stringData["superset_config.py"]', pattern: 'SQLALCHEMY_DATABASE_URI = f"postgresql\+pg8000://'}
+  - it: init script single-quotes the admin username (no shell injection)
+    set: {init: {createAdmin: true, adminUser: {password: "x"}}}
+    asserts:
+      - matchRegex: {path: 'stringData["superset_init.sh"]', pattern: "grep -qF 'username:"}
+      - notMatchRegex: {path: 'stringData["superset_init.sh"]', pattern: 'create-admin[\s\S]*\|\| true'}
+  - it: sentinel disabled does not fail render
+    set: {cache: {enabled: true, sentinel: {enabled: false}}}
+    asserts:
+      - hasDocuments:
+          count: 1
+  - it: ssl certfile path is quoted
+    set: {cache: {enabled: true, ssl: {enabled: true, certfile: "/etc/ssl/cert.pem"}}}
+    asserts:
+      - matchRegex: {path: 'stringData["superset_config.py"]', pattern: '"CACHE_REDIS_SSL_CERTFILE": "/etc/ssl/cert.pem"'}
+  - it: explicit JWT cookie secure false is respected
+    set: {supersetWebsockets: {enabled: true}, config: {GLOBAL_ASYNC_QUERIES_JWT_COOKIE_SECURE: false}}
+    asserts:
+      - matchRegex: {path: 'stringData["superset_config.py"]', pattern: 'GLOBAL_ASYNC_QUERIES_JWT_COOKIE_SECURE = False'}
+  - it: celeryConfig non-string values render as valid Python via json.loads
+    set: {config: {celeryConfig: {broker_url: "redis://x", task_acks_late: true}}}
+    asserts:
+      - matchRegex: {path: 'stringData["superset_config.py"]', pattern: 'task_acks_late = json\.loads\('}
+  - it: featureFlags non-scalar values render as valid Python via json.loads
+    set: {featureFlags: {SOME_MAP: {nested: true}}}
+    asserts:
+      - matchRegex: {path: 'stringData["superset_config.py"]', pattern: '"SOME_MAP": json\.loads\('}

helm/superset/tests/deprecation_test.yaml

@@ -0,0 +1,28 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+suite: deprecation path does not fail render
+templates:
+  - secret-superset-config.yaml
+tests:
+  - it: legacy supersetNode.connections still renders (no fail)
+    set: {supersetNode.connections.db_host: legacy}
+    asserts:
+      - hasDocuments: {count: 1}
+  - it: legacy root serviceAccountName still renders (no fail)
+    set: {serviceAccountName: my-sa}
+    asserts:
+      - hasDocuments: {count: 1}