build(deps): sync pinned requirements for Dependabot pip PRs

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

.github/workflows/superset-e2e.yml

@@ -78,14 +78,14 @@ jobs:
       USE_DASHBOARD: ${{ github.event.inputs.use_dashboard == 'true' || 'false' }}
     services:
       postgres:
-        image: postgres:17-alpine
+        image: ghcr.io/apache/superset/ci/postgres:17-alpine
         env:
           POSTGRES_USER: superset
           POSTGRES_PASSWORD: superset
         ports:
           - 15432:5432
       redis:
-        image: redis:7-alpine
+        image: ghcr.io/apache/superset/ci/redis:7-alpine
         ports:
           - 16379:6379
     steps:
@@ -186,14 +186,14 @@ jobs:
       GITHUB_TOKEN: ${{ github.token }}
     services:
       postgres:
-        image: postgres:17-alpine
+        image: ghcr.io/apache/superset/ci/postgres:17-alpine
         env:
           POSTGRES_USER: superset
           POSTGRES_PASSWORD: superset
         ports:
           - 15432:5432
       redis:
-        image: redis:7-alpine
+        image: ghcr.io/apache/superset/ci/redis:7-alpine
         ports:
           - 16379:6379
     steps:

.github/workflows/superset-python-integrationtest.yml

@@ -53,9 +53,7 @@ jobs:
         mysql+mysqldb://superset:superset@127.0.0.1:13306/superset?charset=utf8mb4&binary_prefix=true
     services:
       mysql:
-        image: mysql:8.0
-        # Authenticated pulls use our higher Docker Hub rate limit. Empty on
-        # fork PRs (secrets unavailable) -> runner falls back to anonymous.
+        image: ghcr.io/apache/superset/ci/mysql:8.0
         env:
           MYSQL_ROOT_PASSWORD: root
         ports:
@@ -66,7 +64,7 @@ jobs:
           --health-timeout=5s
           --health-retries=5
       redis:
-        image: redis:7-alpine
+        image: ghcr.io/apache/superset/ci/redis:7-alpine
         options: --entrypoint redis-server
         ports:
           - 16379:6379
@@ -143,7 +141,7 @@ jobs:
       SUPERSET__SQLALCHEMY_DATABASE_URI: postgresql+psycopg2://superset:superset@127.0.0.1:15432/superset
     services:
       postgres:
-        image: postgres:17-alpine
+        image: ghcr.io/apache/superset/ci/postgres:17-alpine
         env:
           POSTGRES_USER: superset
           POSTGRES_PASSWORD: superset
@@ -152,7 +150,7 @@ jobs:
           # GitHub action runner's default installations
           - 15432:5432
       redis:
-        image: redis:7-alpine
+        image: ghcr.io/apache/superset/ci/redis:7-alpine
         ports:
           - 16379:6379
     steps:
@@ -202,7 +200,7 @@ jobs:
         sqlite:///${{ github.workspace }}/.temp/examples.db?check_same_thread=true
     services:
       redis:
-        image: redis:7-alpine
+        image: ghcr.io/apache/superset/ci/redis:7-alpine
         ports:
           - 16379:6379
     steps:

.github/workflows/superset-python-presto-hive.yml

@@ -52,7 +52,7 @@ jobs:
       SUPERSET__SQLALCHEMY_EXAMPLES_URI: presto://localhost:15433/memory/default
     services:
       postgres:
-        image: postgres:17-alpine
+        image: ghcr.io/apache/superset/ci/postgres:17-alpine
         env:
           POSTGRES_USER: superset
           POSTGRES_PASSWORD: superset
@@ -61,7 +61,7 @@ jobs:
           # GitHub action runner's default installations
           - 15432:5432
       presto:
-        image: starburstdata/presto:350-e.6
+        image: ghcr.io/apache/superset/ci/presto:350-e.6
         env:
           POSTGRES_USER: superset
           POSTGRES_PASSWORD: superset
@@ -70,7 +70,7 @@ jobs:
           # GitHub action runner's default installations
           - 15433:8080
       redis:
-        image: redis:7-alpine
+        image: ghcr.io/apache/superset/ci/redis:7-alpine
         ports:
           - 16379:6379
     steps:
@@ -116,7 +116,7 @@ jobs:
       UPLOAD_FOLDER: /tmp/.superset/uploads/
     services:
       postgres:
-        image: postgres:17-alpine
+        image: ghcr.io/apache/superset/ci/postgres:17-alpine
         env:
           POSTGRES_USER: superset
           POSTGRES_PASSWORD: superset
@@ -125,7 +125,7 @@ jobs:
           # GitHub action runner's default installations
           - 15432:5432
       redis:
-        image: redis:7-alpine
+        image: ghcr.io/apache/superset/ci/redis:7-alpine
         ports:
           - 16379:6379
     steps:

.github/workflows/superset-python-unittest.yml

@@ -75,13 +75,18 @@ jobs:
           SUPERSET_SECRET_KEY: not-a-secret
         run: |
           pytest --durations-min=0.5 --cov-report= --cov=superset ./tests/common ./tests/unit_tests --cache-clear --maxfail=50 --junit-xml=test-results/junit-unit.xml
+      # COVERAGE_FILE keeps these scoped gates off the default .coverage that
+      # the step above wrote. pytest-cov starts a fresh data file per run, so
+      # without it the last gate replaces the full-suite data and the report
+      # uploaded below contains only that gate's subtree -- every other file
+      # then reads as uncovered, and patch coverage on an unrelated PR is 0%.
       - name: Python 100% coverage unit tests
         env:
           SUPERSET_TESTENV: true
           SUPERSET_SECRET_KEY: not-a-secret
         run: |
-          pytest --durations-min=0.5 --cov=superset/sql/ ./tests/unit_tests/sql/ --cache-clear --cov-fail-under=100 --junit-xml=test-results/junit-sql-coverage.xml
-          pytest --durations-min=0.5 --cov=superset/semantic_layers/ ./tests/unit_tests/semantic_layers/ --cache-clear --cov-fail-under=100 --junit-xml=test-results/junit-semantic-layers-coverage.xml
+          COVERAGE_FILE="${RUNNER_TEMP}/.coverage.sql" pytest --durations-min=0.5 --cov=superset/sql/ ./tests/unit_tests/sql/ --cache-clear --cov-fail-under=100 --junit-xml=test-results/junit-sql-coverage.xml
+          COVERAGE_FILE="${RUNNER_TEMP}/.coverage.semantic_layers" pytest --durations-min=0.5 --cov=superset/semantic_layers/ ./tests/unit_tests/semantic_layers/ --cache-clear --cov-fail-under=100 --junit-xml=test-results/junit-semantic-layers-coverage.xml
       - name: Upload code coverage
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:

UPDATING.md

@@ -125,6 +125,23 @@ dialect; each package's constraint in `pyproject.toml` documents why.
 No application-level configuration changes are required for deployments
 that don't touch SQLAlchemy directly.
 
+### New metric aggregates: MEDIAN, Sample Standard Deviation, Sample Variance
+
+`MEDIAN`, `STDDEV_SAMP`, and `VAR_SAMP` are now available anywhere a metric
+aggregate is chosen (every chart type, SQL Lab, MCP), not only in Pivot
+Table's controls. Support is opt-in per database engine *spec class*,
+verified against a live instance before being enabled: Postgres, MySQL
+(`STDDEV_SAMP`/`VAR_SAMP` only, no `MEDIAN`), DuckDB, and Redshift (inherits
+Postgres's support, not yet separately verified) ship enabled in this
+release. Engine specs that subclass one of those (e.g. MariaDB, Aurora
+MySQL/Postgres, TimescaleDB) inherit the same support, on the same
+not-yet-independently-verified basis. Picking one of these aggregates on a
+database that has not opted in returns a clear "not supported on this
+database" error rather than a failed query. See
+`docs/sip/median-stddev-variance-aggregates.md` for the full design
+rationale, including why this is safe to add without reintroducing the
+totals/subtotals correctness bug fixed by #41184 (SIP-216).
+
 ### Soft delete is on by default, and purging is live
 
 `SOFT_DELETE` now ships **on** (`DEFAULT_FEATURE_FLAGS`), so deleting a

docs/docs/using-superset/recently-archived.mdx

@@ -11,6 +11,11 @@ When soft-delete is enabled, deleting a chart, dashboard, or dataset archives it
 instead of removing it permanently. The **Recently Archived** view lets owners
 and admins find archived objects and restore them.
 
+A chart used by an alert or report cannot be archived while that dependency
+exists. In the chart list view, the archive confirmation lists the alerts and
+reports that use the chart; a blocked attempt names them and asks you to
+detach or delete them first.
+
 :::note
 
 This view is gated by the `SOFT_DELETE` feature flag. When the flag is off the

docs/sip/median-stddev-variance-aggregates.md

@@ -0,0 +1,236 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# SIP: System-wide MEDIAN, Sample Standard Deviation, and Sample Variance metric aggregates
+
+## [DRAFT — proposal for discussion]
+
+This document now has an accompanying implementation in this PR, for the
+proposed mechanism plus a first, empirically-verified engine set (Postgres,
+MySQL, DuckDB, Redshift by inheritance). It is intended to seed discussion on
+whether this is the right shape and scope before it goes up for a formal SIP
+vote, not to pre-empt that discussion, the code exists so reviewers have a
+concrete design to react to rather than a description of one.
+
+## Motivation
+
+Before #41184 (SIP-216, the non-additive-totals fix), the Pivot Table chart
+exposed an "Aggregation function" control with 18 choices, including
+`Median`, `Sample Standard Deviation`, `Sample Variance`, `First`, `Last`,
+`Count Unique Values`, and `List Unique Values`. #41184 deleted that control
+wholesale, and deliberately so: it re-aggregated already-aggregated cell
+values to compute totals/subtotals, which is exactly the class of bug
+SIP-216 fixed (summing per-group averages, averaging per-group medians, etc.
+produces silently wrong totals). #42761 subsequently restored the one piece
+of that control's functionality that was cleanly separable from the
+correctness bug, the "show as % of row/column/total" display option,
+redesigned as a decoupled, post-hoc-only `showValuesAs` control.
+
+A user has since noticed that several of the other pre-#41184 options never
+came back. Checking today's metric aggregate list (`AVG, COUNT,
+COUNT_DISTINCT, MAX, MIN, SUM`, see
+`superset-frontend/packages/superset-ui-core/src/query/types/Metric.ts`),
+most of these have a reasonable equivalent already: `Count Unique Values`
+maps to `COUNT_DISTINCT`; `Count`/`Average`/`Max`/`Min` are already standard
+aggregates; the two "fraction of" variants are already covered by
+`showValuesAs`. But `Median`, `Sample Standard Deviation`, and `Sample
+Variance` have no equivalent today anywhere in Superset, not just in Pivot
+Table, in any chart type, since the aggregate list is shared across the
+whole app.
+
+This is a real, currently-live gap, not a hypothetical one:
+`superset/mcp_service/chart/chart_utils.py`, `schemas.py`, and
+`prompts/create_chart_guided.py` already treat `STDDEV`, `VAR`, `MEDIAN`,
+and `PERCENTILE` as valid aggregate values in their own validation and
+documentation, but those values are never recognized by
+`superset/connectors/sqla/models.py`'s `sqla_aggregations` dict (the actual
+mapping from aggregate name to SQL), so an AI agent using the MCP tool to
+build a chart with `"aggregate": "STDDEV"` today creates a chart that
+**errors at query time** with "Adhoc metric aggregate is invalid." This SIP
+proposes closing that gap for real, at the source, rather than patching
+around it in MCP.
+
+## Proposed change
+
+Add `MEDIAN`, `STDDEV_SAMP`, and `VAR_SAMP` as first-class, system-wide
+metric aggregates, available anywhere a metric aggregate is chosen (every
+chart type, SQL Lab metric picker, MCP), not as a Pivot-Table-specific
+control.
+
+**Why this is safe with respect to SIP-216, and needs no Pivot-Table-specific
+code at all:** Pivot Table's non-additive-totals machinery
+(`superset-frontend/plugins/plugin-chart-pivot-table/src/plugin/utilities.ts`)
+already classifies any metric aggregate not in `ADDITIVE_AGGREGATES = {SUM,
+COUNT, MIN, MAX}` as non-additive, which routes totals/subtotals through the
+correct DB-`GROUPING SETS`-rollup path rather than client-side
+re-aggregation (`AVG` and `COUNT_DISTINCT` already go through this path
+today). `MEDIAN`/`STDDEV_SAMP`/`VAR_SAMP` fall into that bucket
+automatically, with zero changes needed to the additivity logic. So once
+these are valid, buildable SQL aggregates, Pivot Table (and every other
+chart) gets correct behavior for free. This is the version of "restore the
+control" that does not reopen the bug that was just fixed.
+
+**Where the actual change needs to land, and what this PR does:**
+
+1. **Done.** `superset-frontend/packages/superset-ui-core/src/query/types/Metric.ts`,
+   extended the `Aggregate` type.
+2. **Done.** `superset-frontend/src/explore/constants.ts`, added to `AGGREGATES`
+   (drives `AGGREGATES_OPTIONS`, the dropdown in `AdhocMetricEditPopover`).
+3. **Done**, but not consolidated. `superset/connectors/sqla/models.py`
+   (`sqla_aggregations`) and `superset/models/helpers.py`
+   (`ExploreMixin.sqla_aggregations`) are both wired to consult the new
+   `BaseEngineSpec.get_extended_aggregation_func`, in addition to their
+   existing 6-aggregate dict, so neither's original, already-tested behavior
+   changed. They remain two separate dicts, consolidating them into one
+   source of truth is left as a follow-up (see Open questions).
+4. **Done**, and it surfaced a second, smaller bug on top of the one this SIP
+   opened with: MCP's own aggregate names (`STDDEV`, `VAR`) never matched any
+   real Superset aggregate, before or after this PR, they were always going
+   to error regardless of what this SIP does. `superset/mcp_service/chart/*`
+   now accepts the old shorthand as an alias, normalized to the real,
+   unambiguous names (`STDDEV_SAMP`, `VAR_SAMP`) this PR ships, and the guided
+   prompt text points at the correct names going forward. `MEDIAN`/
+   `PERCENTILE` were already spelled correctly in MCP; `PERCENTILE` remains
+   unimplemented (it needs a parameter this schema has no field for) and is
+   unchanged by this PR, out of scope here.
+
+**The part that needs real engineering care, this must not be a blind
+`sa.func.MEDIAN` / `sa.func.STDDEV_SAMP` / `sa.func.VAR_SAMP`:**
+
+`sqla_aggregations` today is a flat, engine-unaware dict (`sa.func.AVG`,
+etc., SQLAlchemy emits whatever function name it is given, with zero
+validation that the target dialect actually has it). Superset already has
+precedent for exactly this class of per-engine capability difference:
+`BaseEngineSpec.supports_grouping_sets` and `_time_grain_expressions`, both
+introduced by #41184 itself. This SIP proposes the same shape, a new
+per-engine-overridable mechanism (for example
+`BaseEngineSpec.get_aggregate_sql(aggregate, column)` with a sensible
+default, overridden per engine spec where the default does not hold),
+rather than a single hardcoded dict.
+
+Verified findings so far (via `sqlglot.transpile`, cross-checked against
+known engine docs; **not** exhaustively tested against live databases, that
+is necessary follow-up work this SIP alone cannot complete):
+
+| Engine | `MEDIAN(x)` | `STDDEV_SAMP(x)` | `VAR_SAMP(x)` |
+|---|---|---|---|
+| Postgres | `PERCENTILE_CONT(0.5) WITHIN GROUP (ORDER BY x)` | native | native |
+| MySQL | no native equivalent, needs explicit "unsupported" handling, not a blind emit | native | MySQL's `VARIANCE()` is an alias for `VAR_POP` (population), not `VAR_SAMP` (sample); a naive dialect-name substitution would silently compute the wrong statistic and needs an explicit, verified expression instead |
+| SQLite | only if the specific build was compiled with the (non-default) `SQLITE_ENABLE_PERCENTILE` extension (added in SQLite 3.43, 2023), cannot be assumed available | not available in core SQLite | not available in core SQLite |
+| BigQuery / Snowflake / DuckDB / Redshift / Oracle / T-SQL / Databricks / Spark | native `MEDIAN(x)` | native | native on BigQuery/Snowflake/Databricks/Spark, where `VARIANCE` is correctly sample variance; T-SQL has no function named `VARIANCE` at all and needs `VAR(x)` instead |
+| Trino / Presto / Hive | `PERCENTILE_CONT` / `approx_percentile` (dialect- and exactness-dependent) | native | `variance` is correctly sample variance per Trino/Presto docs |
+
+This table is deliberately not exhaustive, Superset has roughly 75
+`db_engine_specs` files. The proposed default (`BaseEngineSpec`) should be
+the safe choice (mark unsupported, surface a clear user-facing error) rather
+than an optimistic one, with individual engine specs opting in once
+verified. Ship for the handful of engines above first, extend
+opportunistically.
+
+**`Count Unique Values`, `First`, `Last`, `List Unique Values`, explicitly
+out of scope for this SIP:**
+
+- `Count Unique Values` needs no work, it is already `COUNT_DISTINCT`.
+- `First`/`Last` have no well-defined, unambiguous meaning as a plain
+  `GROUP BY` aggregate without an explicit ordering; most engines only
+  support this via window functions (`FIRST_VALUE`/`LAST_VALUE` `OVER
+  (ORDER BY ...)`) or do not support it as a simple aggregate at all
+  (Postgres has neither built in). Restoring this properly would mean
+  designing an "order by" sub-control on the metric, a real, separate
+  feature, not a one-line aggregate addition. Proposed as a follow-up SIP if
+  there is demand.
+- `List Unique Values` maps to the `STRING_AGG`/`GROUP_CONCAT`/`LISTAGG`/
+  `ARRAY_AGG(DISTINCT ...)` family, real dialect differences, plus an open
+  UX question (unbounded cell content for high-cardinality columns).
+  Proposed as a follow-up SIP.
+
+## New or changed public interfaces
+
+- New `Aggregate` values (`MEDIAN`, `STDDEV_SAMP`, `VAR_SAMP`) selectable
+  anywhere the standard metric control appears, every chart type, not just
+  Pivot Table.
+- New `BaseEngineSpec` extensibility point for per-engine aggregate SQL
+  generation (exact shape TBD in implementation, likely mirrors
+  `_time_grain_expressions`).
+- No REST API surface changes beyond the existing metric aggregate field
+  accepting new values.
+
+## Migration plan and compatibility
+
+No new tables/columns needed for the aggregate addition itself.
+
+Restoring prior chart settings, the way #42761 restored `show_values_as` for
+charts that had it before #41184, is murkier here than it was for that PR
+and needs its own design pass: the old `aggregate_function` was a single
+Pivot-Table-level setting applied uniformly to every metric on the chart,
+not a per-metric property. A chart that had `aggregate_function: Median`
+before #41184, with a metric of `SUM(sales)`, was already silently wrong
+under the old architecture (that is the bug that was fixed); mechanically
+rewriting its metric to `MEDIAN(sales)` on upgrade would change what the
+chart's leaf cells display, not just its totals, which may not match user
+intent. This SIP proposes a best-effort, flagged-for-review migration
+(surface affected charts to admins rather than silently rewriting them)
+rather than a fully automatic one-to-one restoration.
+
+## Rejected alternatives
+
+- **Restoring the old `aggregateFunction` Pivot-Table control as-is.**
+  Rejected: this is the literal mechanism SIP-216 removed because it
+  reintroduces incorrect totals for non-additive metrics. Any fix has to go
+  through the metric's own aggregate, not a separate pivot-level override.
+- **Routing all metric SQL generation through `sqlglot` expression-building
+  instead of SQLAlchemy's `sa.func`.** More architecturally thorough (would
+  give correct dialect syntax for free across more of the roughly 75 engine
+  specs), but a much larger, more invasive change to a hot path used by
+  every chart query. Noted as a possible future direction, not this SIP's
+  scope; this SIP proposes the smaller, `supports_grouping_sets`-shaped
+  extensibility point instead.
+
+## Open questions
+
+- **Resolved for this PR, worth confirming as the community's preferred
+  shape:** implemented as `BaseEngineSpec._extended_aggregations` (a
+  `{aggregate_name: sqla_column -> sqla_column}` dict) plus a
+  `get_extended_aggregation_func` accessor, set on the concrete or shared
+  base engine spec class per engine (e.g. on `PostgresBaseEngineSpec` so
+  Redshift inherits it, but *not* on `PrestoBaseEngineSpec` so Hive/Spark/
+  Databricks don't silently inherit unverified behavior, mirroring how
+  `supports_grouping_sets` is opted into per-concrete-engine there today).
+  Did not route through the `superset/sql/dialects/` sqlglot-based layer;
+  that layer is for SQL Lab parsing, wiring it into chart-metric query
+  building felt like a separate, larger change from this SIP's scope.
+- **Still open, not addressed in this PR:** how aggressively should
+  `MEDIAN` degrade on engines without a native or exact equivalent?
+  Trino/Presto/Hive were left unimplemented (unsupported) specifically to
+  avoid silently answering this with an approximate function
+  (`approx_percentile`) that changes the semantics of what a user asked
+  for. If someone wants `MEDIAN` on those engines, this needs a real
+  decision: require explicit opt-in, show a UI warning, or keep it
+  disallowed.
+- **Resolved for this PR:** left the two `sqla_aggregations` dicts
+  (`connectors/sqla/models.py` and `models/helpers.py`) unconsolidated,
+  both now separately wired to the same new `get_extended_aggregation_func`
+  hook. Consolidating them into one source of truth is real but unrelated
+  cleanup, not bundled here to keep the diff reviewable.
+- **New, from implementation:** only Postgres, MySQL (partial), DuckDB, and
+  Redshift (by inheritance, unverified) ship enabled. BigQuery, Snowflake,
+  Trino, Presto, Hive, Spark, Databricks, Oracle, and T-SQL all have
+  documented (not live-verified) support per the table above but are not
+  yet wired up, each needs the same live-instance verification treatment
+  before being enabled, this PR intentionally didn't guess.

pyproject.toml

@@ -111,7 +111,7 @@ dependencies = [
     "sshtunnel>=0.4.0, <0.5",
     "simplejson>=4.1.1",
     "slack_sdk>=3.43.0, <4",
-    "sqlalchemy>=2.0.0, <2.1",
+    "sqlalchemy>=2.0.52, <2.1",
     "sqlalchemy-continuum>=1.6.0, <2.0.0",
     "sqlalchemy-utils>=0.42.1, <0.43", # expanding lowerbound to work with pydoris
     "sqlglot>=30.16.0, <31", # 30.16.0 adds Trino inline UDF IF/CASE routine statement parsing

requirements/base.txt

@@ -381,7 +381,7 @@ six==1.17.0
     #   wtforms-json
 slack-sdk==3.43.0
     # via apache-superset (pyproject.toml)
-sqlalchemy==2.0.51
+sqlalchemy==2.0.52
     # via
     #   apache-superset (pyproject.toml)
     #   alembic

requirements/development.txt

@@ -950,7 +950,7 @@ slack-sdk==3.43.0
     #   apache-superset
 sniffio==1.3.1
     # via anyio
-sqlalchemy==2.0.51
+sqlalchemy==2.0.52
     # via
     #   -c requirements/base-constraint.txt
     #   alembic

superset-frontend/packages/superset-ui-chart-controls/src/components/MetricOption.tsx

@@ -51,6 +51,20 @@ export interface MetricOptionProps {
   shouldShowTooltip?: boolean;
 }
 
+/**
+ * `url` is an arbitrary caller-supplied string rendered as an href. Only
+ * http(s) and relative URLs become links; other schemes degrade to plain
+ * text.
+ */
+function isSafeHref(url: string): boolean {
+  try {
+    const { protocol } = new URL(url, window.location.origin);
+    return protocol === 'http:' || protocol === 'https:';
+  } catch {
+    return false;
+  }
+}
+
 export function MetricOption({
   metric,
   labelRef,
@@ -70,7 +84,7 @@ export function MetricOption({
       `}
       ref={labelRef}
     >
-      {url ? (
+      {url && isSafeHref(url) ? (
         <Typography.Link
           href={url}
           target={openInNewWindow ? '_blank' : ''}

superset-frontend/packages/superset-ui-chart-controls/test/components/MetricOption.test.tsx

@@ -112,3 +112,26 @@ test('shows a Tooltip for the verbose metric name', () => {
   const { getByTestId } = setup();
   expect(getByTestId('mock-tooltip')).toBeInTheDocument();
 });
+test('does not render javascript: URLs as links', () => {
+  // Regression test: the url prop can be creator-authored and must
+  // never become a script-bearing href for other viewers.
+  const { queryByRole, getByText } = setup({
+    url: 'javascript:alert(document.domain)', // eslint-disable-line no-script-url
+  });
+  expect(queryByRole('link')).not.toBeInTheDocument();
+  expect(getByText(defaultProps.metric.verbose_name)).toBeInTheDocument();
+});
+test('does not render data: URLs as links', () => {
+  const { queryByRole } = setup({
+    url: 'data:text/html,<script>alert(1)</script>',
+  });
+  expect(queryByRole('link')).not.toBeInTheDocument();
+});
+test('renders relative URLs as links', () => {
+  const { getByRole } = setup({
+    url: '/superset/dashboard/1/',
+  });
+  expect(
+    getByRole('link', { name: defaultProps.metric.verbose_name }),
+  ).toHaveAttribute('href', '/superset/dashboard/1/');
+});

superset-frontend/packages/superset-ui-core/src/query/types/Metric.ts

@@ -25,8 +25,11 @@ export type Aggregate =
   | 'COUNT'
   | 'COUNT_DISTINCT'
   | 'MAX'
+  | 'MEDIAN'
   | 'MIN'
-  | 'SUM';
+  | 'STDDEV_SAMP'
+  | 'SUM'
+  | 'VAR_SAMP';
 
 export interface AdhocMetricBase {
   hasCustomLabel?: boolean;

superset-frontend/packages/superset-ui-core/src/time-format/index.ts

@@ -49,5 +49,6 @@ export { default as finestTemporalGrainFormatter } from './formatters/finestTemp
 
 export { default as normalizeTimestamp } from './utils/normalizeTimestamp';
 export { default as denormalizeTimestamp } from './utils/denormalizeTimestamp';
+export { default as createTimeRangeFromGranularity } from './utils/createTimeRangeFromGranularity';
 
 export * from './types';

superset-frontend/packages/superset-ui-core/src/utils/html.test.tsx

@@ -123,6 +123,25 @@ describe('isProbablyHTML', () => {
     expect(isProbablyHTML('<canvas></canvas>')).toBe(true);
     expect(isProbablyHTML('<iframe src="page.html"></iframe>')).toBe(true);
   });
+
+  test('should return true for script-capable and foreign-content tags', () => {
+    expect(isProbablyHTML('<svg onload="alert(1)"></svg>')).toBe(true);
+    expect(isProbablyHTML('<math><mi>x</mi></math>')).toBe(true);
+    expect(
+      isProbablyHTML('<details open ontoggle="alert(1)">x</details>'),
+    ).toBe(true);
+    expect(isProbablyHTML('<summary>x</summary>')).toBe(true);
+    expect(isProbablyHTML('<object data="x"></object>')).toBe(true);
+    expect(isProbablyHTML('<embed src="x">')).toBe(true);
+    expect(isProbablyHTML('<marquee>x</marquee>')).toBe(true);
+    expect(isProbablyHTML('<template>x</template>')).toBe(true);
+    expect(isProbablyHTML('<dialog open>x</dialog>')).toBe(true);
+  });
+
+  test('should return true for elements that parse into document.head', () => {
+    expect(isProbablyHTML('<style>body { display: none; }</style>')).toBe(true);
+    expect(isProbablyHTML('<title>injected</title>')).toBe(true);
+  });
 });
 
 describe('sanitizeHtmlIfNeeded', () => {
@@ -137,6 +156,24 @@ describe('sanitizeHtmlIfNeeded', () => {
     const sanitizedString = sanitizeHtmlIfNeeded(plainText);
     expect(sanitizedString).toEqual(plainText);
   });
+
+  test('should sanitize svg/details/style payloads instead of passing them through', () => {
+    const svgPayload = '<svg onload="alert(document.cookie)"></svg>';
+    const sanitizedSvg = sanitizeHtmlIfNeeded(svgPayload);
+    expect(sanitizedSvg).not.toContain('<svg');
+    expect(sanitizedSvg).not.toContain('onload');
+
+    // `details` (with its `open` attribute) is in js-xss's default
+    // whitelist, so the tag itself survives sanitization; the fix is that
+    // the payload is now routed through FilterXSS at all, which strips the
+    // non-whitelisted `ontoggle` handler instead of returning it verbatim.
+    const detailsPayload = '<details open ontoggle="alert(1)">x</details>';
+    const sanitizedDetails = sanitizeHtmlIfNeeded(detailsPayload);
+    expect(sanitizedDetails).toEqual('<details open>x</details>');
+
+    const stylePayload = '<style>body { display: none; }</style>';
+    expect(sanitizeHtmlIfNeeded(stylePayload)).not.toContain('<style');
+  });
 });
 
 describe('safeHtmlSpan', () => {

superset-frontend/packages/superset-ui-core/src/utils/html.tsx

@@ -154,6 +154,20 @@ const KNOWN_HTML_TAGS = new Set([
   'html',
   'head',
   'body',
+  // Script-capable elements and foreign-content roots (SVG/MathML). These
+  // must be classified as HTML so that downstream sanitization is applied;
+  // omitting them makes the heuristic fail open — payloads such as
+  // `<svg onload=...>` or `<details open ontoggle=...>` would be classified
+  // "not HTML" and returned verbatim by sanitizeHtmlIfNeeded.
+  'svg',
+  'math',
+  'details',
+  'summary',
+  'object',
+  'embed',
+  'marquee',
+  'template',
+  'dialog',
 ]);
 
 const HTML_TAG_PATTERN = new RegExp(
@@ -183,10 +197,15 @@ export function isProbablyHTML(text: string) {
   const parser = new DOMParser();
   const doc = parser.parseFromString(cleanedStr, 'text/html');
 
-  // Check if parsing created actual HTML elements (not just text nodes)
-  const elements = Array.from(doc.body.childNodes).filter(
-    node => node.nodeType === 1,
-  ) as Element[];
+  // Check if parsing created actual HTML elements (not just text nodes).
+  // Some elements (e.g. <style>, <title>, <meta>, <link>) parse into
+  // document.head rather than document.body, so both must be inspected —
+  // otherwise a bare <style> payload is classified "not HTML" and skips
+  // sanitization.
+  const elements = [
+    ...Array.from(doc.head.childNodes),
+    ...Array.from(doc.body.childNodes),
+  ].filter(node => node.nodeType === 1) as Element[];
 
   // If no elements were created, it's not HTML
   if (elements.length === 0) {

superset-frontend/plugins/plugin-chart-ag-grid-table/src/renderers/NumericCellRenderer.tsx

@@ -27,11 +27,21 @@ const StyledTotalCell = styled.div`
   `}
 `;
 
+// `align` originates from the chart's stored column_config
+// (col.config.horizontalAlign), which can be set to an arbitrary string via
+// a direct chart-params API write. Emotion compiles interpolated strings as
+// CSS source, so the value must be clamped to a closed set of keywords
+// before it reaches the stylesheet — never interpolated raw.
+const ALLOWED_ALIGN_VALUES = new Set(['left', 'right', 'center']);
+
+const safeAlign = (align?: string) =>
+  align && ALLOWED_ALIGN_VALUES.has(align) ? align : 'left';
+
 const CellContainer = styled.div<{ backgroundColor?: string; align?: string }>`
   display: flex;
   background-color: ${({ backgroundColor }) =>
     backgroundColor || 'transparent'};
-  justify-content: ${({ align }) => align || 'left'};
+  justify-content: ${({ align }) => safeAlign(align)};
 `;
 
 const ArrowContainer = styled.div<{ arrowColor?: string }>`

superset-frontend/plugins/plugin-chart-ag-grid-table/test/NumericCellRenderer.test.tsx

@@ -0,0 +1,59 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import '@testing-library/jest-dom';
+import { render } from '@superset-ui/core/spec';
+import { NumericCellRenderer } from '../src/renderers/NumericCellRenderer';
+
+const renderCell = (horizontalAlign?: string) => {
+  const params = {
+    value: 42,
+    valueFormatted: '42',
+    node: { rowPinned: undefined, rowIndex: 0 },
+    hasBasicColorFormatters: false,
+    basicColorFormatters: [],
+    col: {
+      isNumeric: true,
+      config: horizontalAlign ? { horizontalAlign } : {},
+    },
+    valueRange: undefined,
+    alignPositiveNegative: false,
+    colorPositiveNegative: false,
+  } as unknown as Parameters<typeof NumericCellRenderer>[0];
+  return render(<NumericCellRenderer {...params} />);
+};
+
+const collectInjectedCss = () =>
+  Array.from(document.querySelectorAll('style'))
+    .map(style => style.textContent ?? '')
+    .join('\n');
+
+test('applies an allowed horizontalAlign value from column config', () => {
+  const { container } = renderCell('center');
+  expect(container.firstChild).toHaveStyle({ justifyContent: 'center' });
+});
+
+test('does not compile a malicious horizontalAlign into the stylesheet', () => {
+  const payload =
+    'right;} & { position:fixed; top:0; left:0; width:100vw; height:100vh; z-index:99999; background:#fff url(https://attacker.example/beacon) }';
+  const { container } = renderCell(payload);
+  const css = collectInjectedCss();
+  expect(css).not.toContain('position:fixed');
+  expect(css).not.toContain('attacker.example');
+  expect(container.firstChild).toHaveStyle({ justifyContent: 'left' });
+});

superset-frontend/plugins/plugin-chart-calendar/src/utils.ts

@@ -38,3 +38,11 @@ export const convertUTCTimestampToLocal = (utcTimestamp: number): number => {
   const offsetMs = date.getTimezoneOffset() * 60 * 1000;
   return utcTimestamp + offsetMs;
 };
+
+// Escapes HTML special characters before formatter output reaches an
+// innerHTML sink. Mirrors plugin-chart-country-map's escapeHtml.
+export const escapeHtml = (text: unknown): string => {
+  const div = document.createElement('div');
+  div.textContent = String(text);
+  return div.innerHTML;
+};

superset-frontend/plugins/plugin-chart-calendar/src/vendor/cal-heatmap.ts

@@ -13,6 +13,7 @@ import d3tip from 'd3-tip';
 import { t } from '@apache-superset/core/translation';
 import { getContrastingColor } from '@superset-ui/core';
 import { CALENDAR_TOOLTIP_CLASS } from '../tooltip';
+import { escapeHtml } from '../utils';
 
 var d3 = typeof require === 'function' ? require('d3') : window.d3;
 
@@ -22,14 +23,16 @@ var CalHeatMap = function () {
   'use strict';
 
   var self = this;
+  // d3-tip assigns the .html() return value to the tip node via
+  // innerHTML, so formatter output is HTML-escaped first.
   self.tip = d3tip()
     .attr('class', `d3-tip ${CALENDAR_TOOLTIP_CLASS}`)
     .direction('n')
     .offset([-5, 0])
     .html(
       d => `
-      ${self.options.timeFormatter(d.t)}: <strong>${self.options.valueFormatter(
-        d.v,
+      ${escapeHtml(self.options.timeFormatter(d.t))}: <strong>${escapeHtml(
+        self.options.valueFormatter(d.v),
       )}</strong>
     `,
     );
@@ -37,7 +40,7 @@ var CalHeatMap = function () {
     .attr('class', `d3-tip ${CALENDAR_TOOLTIP_CLASS}`)
     .direction('n')
     .offset([-5, 0])
-    .html(d => self.options.valueFormatter(d));
+    .html(d => escapeHtml(self.options.valueFormatter(d)));
 
   this.allowedDataType = ['json', 'csv', 'tsv', 'txt'];
 

superset-frontend/plugins/plugin-chart-calendar/test/cal-heatmap.test.ts

@@ -25,8 +25,12 @@ type FunctionalDateFormat = (date: Date) => string;
 interface CalHeatMapInstance {
   options: {
     dateFormatter: DateFormatter | null;
+    timeFormatter: (t: number) => string;
+    valueFormatter: (v: number) => string;
   };
   formatDate(date: Date, format: string | FunctionalDateFormat): string;
+  tip: { html(): (d: { t: number; v: number }) => string };
+  legendTip: { html(): (d: number) => string };
 }
 
 const CalHeatMap = CalHeatMapImport as unknown as new () => CalHeatMapInstance;
@@ -59,3 +63,29 @@ test('CalHeatMap keeps the D3 formatter fallback', () => {
 
   expect(calendar.formatDate(date, '%B')).toBe('January');
 });
+
+test('cell tooltip HTML escapes creator-controlled formatter output', () => {
+  // Regression test: the tip's .html() callback is assigned to the
+  // tooltip node via innerHTML (d3-tip), so formatter output must be
+  // escaped before it's returned.
+  const calendar = new CalHeatMap();
+  calendar.options.timeFormatter = () => '<img src=x onerror=alert(1)>';
+  calendar.options.valueFormatter = () => '<svg onload=alert(2)>';
+
+  const html = calendar.tip.html()({ t: 0, v: 1 });
+
+  expect(html).not.toContain('<img');
+  expect(html).not.toContain('<svg');
+  expect(html).toContain('&lt;img');
+  expect(html).toContain('&lt;svg');
+});
+
+test('legend tooltip HTML escapes creator-controlled formatter output', () => {
+  const calendar = new CalHeatMap();
+  calendar.options.valueFormatter = () => '<img src=x onerror=alert(1)>';
+
+  const html = calendar.legendTip.html()(1);
+
+  expect(html).not.toContain('<img');
+  expect(html).toContain('&lt;img');
+});

superset-frontend/plugins/plugin-chart-calendar/test/utils.test.ts

@@ -17,7 +17,11 @@
  * under the License.
  */
 
-import { getFormattedUTCTime, convertUTCTimestampToLocal } from '../src/utils';
+import {
+  getFormattedUTCTime,
+  convertUTCTimestampToLocal,
+  escapeHtml,
+} from '../src/utils';
 
 test('getFormattedUTCTime formats local timestamp for display as UTC date', () => {
   const utcTimestamp = 1420070400000; // 2015-01-01 00:00:00 UTC
@@ -87,3 +91,22 @@ test('convertUTCTimestampToLocal and getFormattedUTCTime work together to displa
   const formattedTime = getFormattedUTCTime(localTimestamp, '%Y-%m-%d');
   expect(formattedTime).toContain('2024-01-01');
 });
+
+test('escapeHtml neutralizes markup smuggled through a time format string', () => {
+  // Regression test: d3-time-format passes non-% characters through
+  // verbatim, so escaping must happen before the innerHTML sink.
+  const formatted = getFormattedUTCTime(
+    1704067200000,
+    '%Y <img src=x onerror=alert(1)>',
+  );
+  const escaped = escapeHtml(formatted);
+
+  expect(formatted).toContain('<img');
+  expect(escaped).not.toContain('<img');
+  expect(escaped).toContain('&lt;img');
+});
+
+test('escapeHtml stringifies non-string formatter output safely', () => {
+  expect(escapeHtml(1234)).toEqual('1234');
+  expect(escapeHtml('a & b < c')).toEqual('a &amp; b &lt; c');
+});

superset-frontend/plugins/plugin-chart-cartodiagram/src/util/layerUtil.tsx

@@ -33,6 +33,27 @@ import { WmsLayerConf, WfsLayerConf, LayerConf, XyzLayerConf } from '../types';
 import { isWfsLayerConf, isWmsLayerConf, isXyzLayerConf } from '../typeguards';
 import { isVersionBelow } from './serviceUtil';
 
+/**
+ * Escape HTML special characters in a layer attribution string.
+ *
+ * OpenLayers' Attribution control renders attribution strings via innerHTML,
+ * and the attribution here comes from creator-supplied chart form data, so it
+ * must be treated as untrusted text rather than markup to prevent stored XSS.
+ *
+ * @param attribution The attribution string from the layer configuration
+ *
+ * @returns The attribution with HTML special characters escaped
+ */
+export const escapeAttribution = (attribution?: string): string | undefined =>
+  attribution === undefined
+    ? undefined
+    : attribution
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#039;');
+
 /**
  * Create a WMS layer.
  *
@@ -49,7 +70,7 @@ export const createWmsLayer = (wmsLayerConf: WmsLayerConf) => {
         LAYERS: layersParam,
         VERSION: version,
       },
-      attributions: attribution,
+      attributions: escapeAttribution(attribution),
     }),
   });
 };
@@ -66,7 +87,7 @@ export const createXyzLayer = (xyzLayerConf: XyzLayerConf) => {
   return new TileLayer({
     source: new XyzSource({
       url,
-      attributions: attribution,
+      attributions: escapeAttribution(attribution),
     }),
   });
 };
@@ -90,7 +111,7 @@ export const createWfsLayer = async (wfsLayerConf: WfsLayerConf) => {
 
   const wfsSource = new VectorSource({
     format: new GeoJSON(),
-    attributions: attribution,
+    attributions: escapeAttribution(attribution),
     url: extent => {
       const requestUrl = new URL(url);
       const params = requestUrl.searchParams;

superset-frontend/plugins/plugin-chart-cartodiagram/test/util/layerUtil.test.ts

@@ -17,20 +17,65 @@
  * under the License.
  */
 
-import { WfsLayerConf } from '../../src/types';
+import { WfsLayerConf, WmsLayerConf, XyzLayerConf } from '../../src/types';
 import {
   createLayer,
   createWfsLayer,
   createWmsLayer,
   createXyzLayer,
+  escapeAttribution,
 } from '../../src/util/layerUtil';
 
 describe('layerUtil', () => {
+  describe('escapeAttribution', () => {
+    test('escapes HTML markup in attribution strings', () => {
+      expect(escapeAttribution('(c) OSM <img src=x onerror=alert(1)>')).toBe(
+        '(c) OSM &lt;img src=x onerror=alert(1)&gt;',
+      );
+      expect(escapeAttribution('a & "b" \'c\'')).toBe(
+        'a &amp; &quot;b&quot; &#039;c&#039;',
+      );
+      expect(escapeAttribution(undefined)).toBeUndefined();
+    });
+  });
+
   describe('createWmsLayer', () => {
     test('exists', () => {
       // function is trivial
       expect(createWmsLayer).toBeDefined();
     });
+
+    test('escapes HTML in the layer attribution', () => {
+      const wmsLayerConf: WmsLayerConf = {
+        title: 'wms',
+        type: 'WMS',
+        url: 'https://ows-demo.terrestris.de/geoserver/osm/wms',
+        version: '1.3.0',
+        layersParam: 'osm:osm-fuel',
+        attribution: '(c) OSM <img src=x onerror=alert(1)>',
+      };
+      const layer = createWmsLayer(wmsLayerConf);
+      const attributions = layer.getSource()?.getAttributions();
+      expect(attributions?.(undefined as never)).toEqual([
+        '(c) OSM &lt;img src=x onerror=alert(1)&gt;',
+      ]);
+    });
+  });
+
+  describe('createXyzLayer', () => {
+    test('escapes HTML in the layer attribution', () => {
+      const xyzLayerConf: XyzLayerConf = {
+        title: 'osm',
+        type: 'XYZ',
+        url: 'https://tile.openstreetmap.org/{z}/{x}/{y}.png',
+        attribution: '(c) OSM <img src=x onerror=alert(1)>',
+      };
+      const layer = createXyzLayer(xyzLayerConf);
+      const attributions = layer.getSource()?.getAttributions();
+      expect(attributions?.(undefined as never)).toEqual([
+        '(c) OSM &lt;img src=x onerror=alert(1)&gt;',
+      ]);
+    });
   });
 
   describe('createWfsLayer', () => {

superset-frontend/plugins/plugin-chart-echarts/src/MixedTimeseries/transformProps.ts

@@ -770,7 +770,9 @@ export default function transformProps(
       nameGap: xAxisTitleMarginPx,
       nameLocation: 'middle',
       axisLabel: {
-        hideOverlap: !(xAxisType === AxisType.Time && xAxisLabelRotation !== 0),
+        hideOverlap: showMaxLabel
+          ? false
+          : !(xAxisType === AxisType.Time && xAxisLabelRotation !== 0),
         formatter: deduplicatedFormatter,
         rotate: xAxisLabelRotation,
         interval: xAxisLabelInterval,

superset-frontend/plugins/plugin-chart-echarts/src/Radar/utils.ts

@@ -18,6 +18,7 @@
  */
 import { t } from '@apache-superset/core/translation';
 import { NumberFormatter } from '@superset-ui/core';
+import { sanitizeHtml } from '../utils/series';
 
 /*
  function for finding the max metric values among all series data for Radar Chart
@@ -63,7 +64,7 @@ export const renderNormalizedTooltip = (
   const { color, name = '', value: values } = params;
   const seriesName = name || 'series0';
 
-  const colorDot = `<span style="display:inline-block;margin-right:5px;border-radius:50%;width:5px;height:5px;background-color:${color}"></span>`;
+  const colorDot = `<span style="display:inline-block;margin-right:5px;border-radius:50%;width:5px;height:5px;background-color:${sanitizeHtml(color)}"></span>`;
 
   // Get metric values with denormalization if needed
   const metricValues: TooltipMetricValue[] = metrics.map((metric, index) => {
@@ -85,19 +86,26 @@ export const renderNormalizedTooltip = (
     };
   });
 
+  // Tooltip is rendered via innerHTML (ECharts default renderMode
+  // 'html'), so seriesName/metric/value/color are HTML-escaped, matching
+  // the treatment every other echarts tooltip path applies.
   const tooltipRows = metricValues
     .map(
       ({ metric, value }) => `
         <div style="display:flex;">
-          <div>${colorDot}${metric}:</div>
-          <div style="font-weight:bold;margin-left:auto;">${value}</div>
+          <div>${colorDot}${sanitizeHtml(metric)}:</div>
+          <div style="font-weight:bold;margin-left:auto;">${sanitizeHtml(
+            String(value),
+          )}</div>
         </div>
       `,
     )
     .join('');
 
   return `
-    <div style="font-weight:bold;margin-bottom:5px;">${seriesName}</div>
+    <div style="font-weight:bold;margin-bottom:5px;">${sanitizeHtml(
+      seriesName,
+    )}</div>
     ${tooltipRows}
   `;
 };

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/EchartsTimeseries.test.tsx

@@ -21,8 +21,14 @@ import {
   waitFor,
   cleanup,
 } from '../../../../spec/helpers/testing-library';
-import { AxisType, TimeGranularity } from '@superset-ui/core';
+import {
+  AxisType,
+  createTimeRangeFromGranularity,
+  DTTM_ALIAS,
+  TimeGranularity,
+} from '@superset-ui/core';
 import { GenericDataType } from '@apache-superset/core/common';
+import { logging } from '@apache-superset/core/utils';
 import type { EChartsCoreOption } from 'echarts/core';
 import type { ECElementEvent } from 'echarts/types/src/util/types';
 import type { ReactNode } from 'react';
@@ -93,12 +99,17 @@ afterAll(() => {
 });
 
 afterEach(() => {
+  jest.useRealTimers();
   cleanup();
   mockEchart.mockReset();
   (globalThis as { ResizeObserver?: typeof ResizeObserver }).ResizeObserver =
     originalResizeObserver;
 });
 
+const advanceClickTimer = () => {
+  jest.advanceTimersByTime(300);
+};
+
 const defaultFormData: EchartsTimeseriesFormData & {
   vizType: string;
   dateFormat: string;
@@ -314,7 +325,8 @@ test('falls back to window resize listener when ResizeObserver is unavailable',
 });
 
 // Test for issue #25334: Bar chart cross-filter without dimensions
-test('emits cross-filter on X-axis value when no dimensions and categorical X-axis', async () => {
+test('emits cross-filter on X-axis value when no dimensions and categorical X-axis', () => {
+  jest.useFakeTimers();
   const setDataMaskMock = jest.fn();
 
   const propsWithCategoricalXAxis: TimeseriesChartTransformedProps = {
@@ -348,13 +360,7 @@ test('emits cross-filter on X-axis value when no dimensions and categorical X-ax
       dataIndex: 0,
     });
 
-    // Wait for the timer (TIMER_DURATION = 300ms)
-    await waitFor(
-      () => {
-        expect(setDataMaskMock).toHaveBeenCalled();
-      },
-      { timeout: 500 },
-    );
+    advanceClickTimer();
 
     // Verify the cross-filter uses the X-axis column and value, not the metric
     const dataMaskCall = setDataMaskMock.mock.calls[0][0];
@@ -368,7 +374,8 @@ test('emits cross-filter on X-axis value when no dimensions and categorical X-ax
   }
 });
 
-test('emits cross-filter on category value for horizontal bar clicks', async () => {
+test('emits cross-filter on category value for horizontal bar clicks', () => {
+  jest.useFakeTimers();
   const setDataMaskMock = jest.fn();
 
   render(
@@ -397,12 +404,7 @@ test('emits cross-filter on category value for horizontal bar clicks', async ()
     dataIndex: 0,
   });
 
-  await waitFor(
-    () => {
-      expect(setDataMaskMock).toHaveBeenCalled();
-    },
-    { timeout: 500 },
-  );
+  advanceClickTimer();
 
   expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
     {
@@ -424,9 +426,7 @@ test('uses rendered categorical axis for query event handlers', () => {
     />,
   );
 
-  expect(getLatestEchartProps().queryEventHandlers?.[0].query).toBe(
-    'xAxis.category',
-  );
+  expect(getLatestEchartProps().queryEventHandlers?.[0].query).toBe('xAxis');
 
   cleanup();
   mockEchart.mockReset();
@@ -445,9 +445,7 @@ test('uses rendered categorical axis for query event handlers', () => {
     />,
   );
 
-  expect(getLatestEchartProps().queryEventHandlers?.[0].query).toBe(
-    'yAxis.category',
-  );
+  expect(getLatestEchartProps().queryEventHandlers?.[0].query).toBe('yAxis');
 });
 
 test('emits cross-filter from horizontal categorical axis label clicks', () => {
@@ -473,8 +471,9 @@ test('emits cross-filter from horizontal categorical axis label clicks', () => {
     getLatestEchartProps().queryEventHandlers?.[0].handler;
   expect(labelClickHandler).toBeDefined();
   labelClickHandler?.({
+    targetType: 'axisLabel',
     value: 'Product A',
-  } as ECElementEvent);
+  } as unknown as ECElementEvent);
 
   expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
     {
@@ -485,7 +484,8 @@ test('emits cross-filter from horizontal categorical axis label clicks', () => {
   ]);
 });
 
-test('does not emit duplicate cross-filter for generic axis label clicks', async () => {
+test('does not emit duplicate cross-filter for generic axis label clicks', () => {
+  jest.useFakeTimers();
   const setDataMaskMock = jest.fn();
 
   render(
@@ -507,11 +507,28 @@ test('does not emit duplicate cross-filter for generic axis label clicks', async
     name: 'Product A',
   });
 
-  await new Promise(resolve => setTimeout(resolve, 400));
+  jest.advanceTimersByTime(400);
   expect(setDataMaskMock).not.toHaveBeenCalled();
 });
 
-test('does not emit cross-filter when no dimensions and time-based X-axis', async () => {
+test('keeps temporal range exclusive ends on whole-second boundaries', () => {
+  const clickedTimestamp = new Date(Date.UTC(2021, 0, 15, 12, 34, 56, 789));
+
+  [TimeGranularity.DAY, TimeGranularity.MONTH, TimeGranularity.YEAR].forEach(
+    grain => {
+      const [, inclusiveEnd] = createTimeRangeFromGranularity(
+        clickedTimestamp,
+        grain,
+        false,
+      );
+      const exclusiveEnd = new Date(inclusiveEnd.getTime() + 1);
+
+      expect(exclusiveEnd.getUTCMilliseconds()).toBe(0);
+    },
+  );
+});
+
+test('emits TEMPORAL_RANGE cross-filter from time axis label click on day bucket', () => {
   const setDataMaskMock = jest.fn();
 
   const propsWithTimeXAxis: TimeseriesChartTransformedProps = {
@@ -519,39 +536,610 @@ test('does not emit cross-filter when no dimensions and time-based X-axis', asyn
     emitCrossFilters: true,
     setDataMask: setDataMaskMock,
     groupby: [], // No dimensions
+    resolvedTimeGrain: TimeGranularity.DAY,
+    formData: {
+      ...defaultFormData,
+      granularitySqla: 'ds',
+      timeGrainSqla: TimeGranularity.DAY,
+    },
     xAxis: {
-      label: '__timestamp',
-      type: AxisType.Time, // Time-based X-axis (not categorical)
+      label: DTTM_ALIAS,
+      type: AxisType.Time,
     },
   };
 
   render(<EchartsTimeseries {...propsWithTimeXAxis} />);
 
-  const lastCall = mockEchart.mock.calls.at(-1);
-  expect(lastCall).toBeDefined();
-  const [props] = lastCall as [EchartsProps];
+  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
+    ({ query }) => query === 'xAxis',
+  )?.handler;
+  expect(labelClickHandler).toBeDefined();
+  labelClickHandler?.({
+    targetType: 'axisLabel',
+    value: '2021-01-01',
+  } as unknown as ECElementEvent);
 
-  // Simulate a click event
-  const clickHandler = props.eventHandlers?.click;
-  if (clickHandler) {
-    clickHandler({
-      componentType: 'series',
-      seriesName: 'Sales',
-      data: [1609459200000, 100], // Timestamp
-      name: '2021-01-01',
-      dataIndex: 0,
-    });
+  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2021-01-02T00:00:00',
+    },
+  ]);
+});
 
-    // Wait a bit and verify setDataMask was NOT called
-    await new Promise(resolve => setTimeout(resolve, 400));
-    expect(setDataMaskMock).not.toHaveBeenCalled();
-  }
+test('emits TEMPORAL_RANGE cross-filter from time axis label click on month bucket', () => {
+  const setDataMaskMock = jest.fn();
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      setDataMask={setDataMaskMock}
+      groupby={[]}
+      resolvedTimeGrain={TimeGranularity.MONTH}
+      formData={{
+        ...defaultFormData,
+        granularitySqla: 'ds',
+        timeGrainSqla: TimeGranularity.MONTH,
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
+    ({ query }) => query === 'xAxis',
+  )?.handler;
+  expect(labelClickHandler).toBeDefined();
+  labelClickHandler?.({
+    targetType: 'axisLabel',
+    value: '2021-01-01',
+  } as unknown as ECElementEvent);
+
+  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
+    },
+  ]);
+});
+
+test('emits TEMPORAL_RANGE cross-filter from time axis label click on year bucket', () => {
+  const setDataMaskMock = jest.fn();
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      setDataMask={setDataMaskMock}
+      groupby={[]}
+      resolvedTimeGrain={TimeGranularity.YEAR}
+      formData={{
+        ...defaultFormData,
+        granularitySqla: 'ds',
+        timeGrainSqla: TimeGranularity.YEAR,
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
+    ({ query }) => query === 'xAxis',
+  )?.handler;
+  expect(labelClickHandler).toBeDefined();
+  labelClickHandler?.({
+    targetType: 'axisLabel',
+    value: '2021-01-01',
+  } as unknown as ECElementEvent);
+
+  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2022-01-01T00:00:00',
+    },
+  ]);
+});
+
+test('emits upper-exclusive TEMPORAL_RANGE from time point click on month bucket', () => {
+  jest.useFakeTimers();
+  const setDataMaskMock = jest.fn();
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      setDataMask={setDataMaskMock}
+      groupby={[]}
+      resolvedTimeGrain={TimeGranularity.MONTH}
+      formData={{
+        ...defaultFormData,
+        granularitySqla: 'ds',
+        timeGrainSqla: TimeGranularity.MONTH,
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const clickHandler = getLatestEchartProps().eventHandlers?.click;
+  expect(clickHandler).toBeDefined();
+  clickHandler?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: [Date.UTC(2021, 0, 1), 100],
+    name: '2021-01-01',
+    dataIndex: 0,
+  });
+
+  advanceClickTimer();
+
+  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
+    },
+  ]);
+});
+
+test('emits TEMPORAL_RANGE from string-typed time point click value', () => {
+  jest.useFakeTimers();
+  const setDataMaskMock = jest.fn();
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      setDataMask={setDataMaskMock}
+      groupby={[]}
+      resolvedTimeGrain={TimeGranularity.MONTH}
+      formData={{
+        ...defaultFormData,
+        granularitySqla: 'ds',
+        timeGrainSqla: TimeGranularity.MONTH,
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const clickHandler = getLatestEchartProps().eventHandlers?.click;
+  expect(clickHandler).toBeDefined();
+  clickHandler?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: ['2021-01-01T00:00:00Z', 100],
+    name: '2021-01-01',
+    dataIndex: 0,
+  });
+
+  advanceClickTimer();
+
+  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
+    },
+  ]);
+});
+
+test('uses resolved time grain for temporal point-click cross-filter', () => {
+  jest.useFakeTimers();
+  const setDataMaskMock = jest.fn();
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      setDataMask={setDataMaskMock}
+      groupby={[]}
+      resolvedTimeGrain={TimeGranularity.MONTH}
+      formData={{
+        ...defaultFormData,
+        granularitySqla: 'ds',
+        timeGrainSqla: TimeGranularity.DAY,
+        extraFormData: {
+          time_grain_sqla: TimeGranularity.MONTH,
+        },
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const clickHandler = getLatestEchartProps().eventHandlers?.click;
+  expect(clickHandler).toBeDefined();
+  clickHandler?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: [Date.UTC(2021, 0, 1), 100],
+    name: '2021-01-01',
+    dataIndex: 0,
+  });
+
+  advanceClickTimer();
+
+  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
+    },
+  ]);
+});
+
+test('emits TEMPORAL_RANGE from horizontal time point click using timestamp, not metric', () => {
+  jest.useFakeTimers();
+  const setDataMaskMock = jest.fn();
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      setDataMask={setDataMaskMock}
+      groupby={[]}
+      resolvedTimeGrain={TimeGranularity.MONTH}
+      formData={{
+        ...defaultFormData,
+        orientation: OrientationType.Horizontal,
+        granularitySqla: 'ds',
+        timeGrainSqla: TimeGranularity.MONTH,
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const clickHandler = getLatestEchartProps().eventHandlers?.click;
+  expect(clickHandler).toBeDefined();
+  clickHandler?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: [129, Date.UTC(2021, 0, 1)],
+    name: '2021-01-01',
+    dataIndex: 0,
+  });
+
+  advanceClickTimer();
+
+  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
+    },
+  ]);
+});
+
+test('emits TEMPORAL_RANGE cross-filter from horizontal time axis label click', () => {
+  const setDataMaskMock = jest.fn();
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      setDataMask={setDataMaskMock}
+      groupby={[]}
+      resolvedTimeGrain={TimeGranularity.MONTH}
+      formData={{
+        ...defaultFormData,
+        orientation: OrientationType.Horizontal,
+        granularitySqla: 'ds',
+        timeGrainSqla: TimeGranularity.MONTH,
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
+    ({ query }) => query === 'yAxis',
+  )?.handler;
+  expect(labelClickHandler).toBeDefined();
+  labelClickHandler?.({
+    targetType: 'axisLabel',
+    value: '2021-01-01',
+  } as unknown as ECElementEvent);
+
+  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
+    },
+  ]);
+});
+
+test('warns and skips temporal axis label cross-filter when label value cannot be parsed', () => {
+  const setDataMaskMock = jest.fn();
+  const warn = jest.spyOn(logging, 'warn').mockImplementation();
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      setDataMask={setDataMaskMock}
+      groupby={[]}
+      formData={{
+        ...defaultFormData,
+        granularitySqla: 'ds',
+        timeGrainSqla: TimeGranularity.MONTH,
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
+    ({ query }) => query === 'xAxis',
+  )?.handler;
+  expect(labelClickHandler).toBeDefined();
+  labelClickHandler?.({
+    targetType: 'axisLabel',
+    value: 'not-a-date',
+  } as unknown as ECElementEvent);
+
+  expect(setDataMaskMock).not.toHaveBeenCalled();
+  expect(warn).toHaveBeenCalledWith(
+    'Unable to parse time axis value for cross-filtering',
+    'not-a-date',
+  );
+
+  warn.mockRestore();
+});
+
+test('logs and skips temporal point-click cross-filter when string value cannot be parsed', () => {
+  jest.useFakeTimers();
+  const setDataMaskMock = jest.fn();
+  const warn = jest.spyOn(logging, 'warn').mockImplementation();
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      setDataMask={setDataMaskMock}
+      groupby={[]}
+      resolvedTimeGrain={TimeGranularity.MONTH}
+      formData={{
+        ...defaultFormData,
+        granularitySqla: 'ds',
+        timeGrainSqla: TimeGranularity.MONTH,
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const clickHandler = getLatestEchartProps().eventHandlers?.click;
+  expect(clickHandler).toBeDefined();
+  clickHandler?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: ['not-a-date', 100],
+    name: 'not-a-date',
+    dataIndex: 0,
+  });
+
+  advanceClickTimer();
+
+  expect(setDataMaskMock).not.toHaveBeenCalled();
+  expect(warn).toHaveBeenCalledWith(
+    'Unable to parse time axis value for cross-filtering',
+    'not-a-date',
+  );
+
+  warn.mockRestore();
+});
+
+test('emits empty temporal X-axis data mask when filter grain is missing', () => {
+  jest.useFakeTimers();
+  const setDataMaskMock = jest.fn();
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      setDataMask={setDataMaskMock}
+      groupby={[]}
+      formData={{
+        ...defaultFormData,
+        granularitySqla: 'ds',
+        timeGrainSqla: undefined,
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const clickHandler = getLatestEchartProps().eventHandlers?.click;
+  expect(clickHandler).toBeDefined();
+  clickHandler?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: [Date.UTC(2021, 0, 1), 100],
+    name: '2021-01-01',
+    dataIndex: 0,
+  });
+
+  advanceClickTimer();
+
+  expect(setDataMaskMock.mock.calls[0][0]).toEqual({
+    extraFormData: {
+      filters: [],
+    },
+    filterState: {
+      label: undefined,
+      value: null,
+      selectedValues: null,
+    },
+  });
+});
+
+test('clears temporal X-axis cross-filter when clicking selected bucket again', () => {
+  jest.useFakeTimers();
+  const setDataMaskMock = jest.fn();
+  const selectedRange = '2021-01-01T00:00:00 : 2021-02-01T00:00:00';
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      setDataMask={setDataMaskMock}
+      groupby={[]}
+      selectedValues={{ 0: selectedRange }}
+      resolvedTimeGrain={TimeGranularity.MONTH}
+      formData={{
+        ...defaultFormData,
+        granularitySqla: 'ds',
+        timeGrainSqla: TimeGranularity.MONTH,
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const clickHandler = getLatestEchartProps().eventHandlers?.click;
+  expect(clickHandler).toBeDefined();
+  clickHandler?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: [Date.UTC(2021, 0, 1), 100],
+    name: '2021-01-01',
+    dataIndex: 0,
+  });
+
+  advanceClickTimer();
+
+  expect(setDataMaskMock.mock.calls[0][0]).toEqual({
+    extraFormData: {
+      filters: [],
+    },
+    filterState: {
+      label: undefined,
+      value: null,
+      selectedValues: null,
+    },
+  });
+});
+
+test('does not emit temporal X-axis label cross-filter when dimensions are set', () => {
+  const setDataMaskMock = jest.fn();
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      setDataMask={setDataMaskMock}
+      groupby={['country']}
+      formData={{
+        ...defaultFormData,
+        groupby: ['country'],
+        granularitySqla: 'ds',
+        timeGrainSqla: TimeGranularity.MONTH,
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
+    ({ query }) => query === 'xAxis',
+  )?.handler;
+  expect(labelClickHandler).toBeDefined();
+  labelClickHandler?.({
+    targetType: 'axisLabel',
+    value: '2021-01-01',
+  } as unknown as ECElementEvent);
+
+  expect(setDataMaskMock).not.toHaveBeenCalled();
+});
+
+test('does not emit temporal X-axis cross-filter when dimensions are set', () => {
+  jest.useFakeTimers();
+  const setDataMaskMock = jest.fn();
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      setDataMask={setDataMaskMock}
+      groupby={['country']}
+      labelMap={{
+        Sales: ['US'],
+      }}
+      formData={{
+        ...defaultFormData,
+        groupby: ['country'],
+        granularitySqla: 'ds',
+        timeGrainSqla: TimeGranularity.MONTH,
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const clickHandler = getLatestEchartProps().eventHandlers?.click;
+  expect(clickHandler).toBeDefined();
+  clickHandler?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: [Date.UTC(2021, 0, 1), 100],
+    name: '2021-01-01',
+    dataIndex: 0,
+  });
+
+  advanceClickTimer();
+
+  expect(setDataMaskMock.mock.calls[0][0].extraFormData.filters).toEqual([
+    {
+      col: 'country',
+      op: 'IN',
+      val: ['US'],
+    },
+  ]);
+  expect(
+    setDataMaskMock.mock.calls[0][0].extraFormData.filters.some(
+      (filter: { op: string }) => filter.op === 'TEMPORAL_RANGE',
+    ),
+  ).toBe(false);
 });
 
 // Test for issue #41102: horizontal bar cross-filter must use the category
 // value, not the metric. For horizontal bars the data tuple is value-first
 // (e.g. [100, 'Product A']), so relying on data[0] emitted the metric value.
-test('emits cross-filter on the category value for a horizontal categorical bar', async () => {
+test('emits cross-filter on the category value for a horizontal categorical bar', () => {
+  jest.useFakeTimers();
   const setDataMaskMock = jest.fn();
 
   const propsWithHorizontalXAxis: TimeseriesChartTransformedProps = {
@@ -585,12 +1173,7 @@ test('emits cross-filter on the category value for a horizontal categorical bar'
       dataIndex: 0,
     });
 
-    await waitFor(
-      () => {
-        expect(setDataMaskMock).toHaveBeenCalled();
-      },
-      { timeout: 500 },
-    );
+    advanceClickTimer();
 
     // Must filter on the category ('Product A'), not the metric value (100)
     const dataMaskCall = setDataMaskMock.mock.calls[0][0];
@@ -604,6 +1187,55 @@ test('emits cross-filter on the category value for a horizontal categorical bar'
   }
 });
 
+test('context menu cross-filter is available for a temporal bar point', async () => {
+  const onContextMenuMock = jest.fn();
+
+  render(
+    <EchartsTimeseries
+      {...defaultProps}
+      emitCrossFilters
+      onContextMenu={onContextMenuMock}
+      groupby={[]}
+      resolvedTimeGrain={TimeGranularity.MONTH}
+      formData={{
+        ...defaultFormData,
+        granularitySqla: 'ds',
+        timeGrainSqla: TimeGranularity.DAY,
+        extraFormData: {
+          time_grain_sqla: TimeGranularity.MONTH,
+        },
+      }}
+      xAxis={{
+        label: DTTM_ALIAS,
+        type: AxisType.Time,
+      }}
+    />,
+  );
+
+  const contextMenuHandler = getLatestEchartProps().eventHandlers?.contextmenu;
+  expect(contextMenuHandler).toBeDefined();
+  await contextMenuHandler?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: [Date.UTC(2021, 0, 1), 100],
+    name: '2021-01-01',
+    event: { stop: jest.fn(), event: { clientX: 10, clientY: 20 } },
+  });
+
+  await waitFor(() => {
+    expect(onContextMenuMock).toHaveBeenCalled();
+  });
+
+  const { crossFilter } = onContextMenuMock.mock.calls[0][2];
+  expect(crossFilter.dataMask.extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
+    },
+  ]);
+});
+
 // Test for issue #41102: the context-menu ("Add cross-filter") path must also
 // use the category value, not the metric, for a horizontal categorical bar.
 test('context menu cross-filter uses the category value for a horizontal categorical bar', async () => {

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/EchartsTimeseries.tsx

@@ -21,14 +21,17 @@ import {
   DTTM_ALIAS,
   BinaryQueryObjectFilterClause,
   AxisType,
+  type TimeGranularity,
   getTimeFormatter,
   getColumnLabel,
   getNumberFormatter,
   LegendState,
   ensureIsArray,
+  createTimeRangeFromGranularity,
 } from '@superset-ui/core';
 import { useTheme } from '@apache-superset/core/theme';
 import { GenericDataType } from '@apache-superset/core/common';
+import { logging } from '@apache-superset/core/utils';
 import type {
   ECElementEvent,
   ViewRootGroup,
@@ -48,6 +51,29 @@ import { getTemporalXAxisDrillByFilter } from '../utils/xAxisDrillByFilter';
 import { ExtraControls } from '../components/ExtraControls';
 
 const TIMER_DURATION = 300;
+const getTimestampFromTimeAxisValue = (value: string | number) => {
+  if (typeof value === 'number') {
+    return Number.isFinite(value) ? value : undefined;
+  }
+  const timestamp = Date.parse(value);
+  if (Number.isNaN(timestamp)) {
+    logging.warn('Unable to parse time axis value for cross-filtering', value);
+  }
+  return Number.isNaN(timestamp) ? undefined : timestamp;
+};
+
+// Day, month, and year ranges end at 23:59:59.999, so adding 1ms lands on a
+// whole-second next bucket boundary. The formatter intentionally emits seconds.
+const formatDateTime = (date: Date) =>
+  `${[
+    date.getUTCFullYear(),
+    String(date.getUTCMonth() + 1).padStart(2, '0'),
+    String(date.getUTCDate()).padStart(2, '0'),
+  ].join('-')}T${[
+    String(date.getUTCHours()).padStart(2, '0'),
+    String(date.getUTCMinutes()).padStart(2, '0'),
+    String(date.getUTCSeconds()).padStart(2, '0'),
+  ].join(':')}`;
 
 // Percent-change draggable baseline handle geometry, in pixels.
 const BASELINE_HANDLE_WIDTH = 8;
@@ -71,6 +97,7 @@ export default function EchartsTimeseries({
   onFocusedSeries,
   xValueFormatter,
   xAxis,
+  resolvedTimeGrain,
   refs,
   emitCrossFilters,
   coltypeMapping,
@@ -363,6 +390,65 @@ export default function EchartsTimeseries({
     [selectedValues, xAxis.label],
   );
 
+  const getTimeAxisCrossFilterDataMask = useCallback(
+    (clickedTimestamp: number) => {
+      const filterColumn =
+        xAxis.label === DTTM_ALIAS ? formData.granularitySqla : xAxis.label;
+      const grain = resolvedTimeGrain as TimeGranularity | undefined;
+
+      if (!filterColumn || !grain) {
+        return {
+          dataMask: {
+            extraFormData: {
+              filters: [],
+            },
+            filterState: {
+              label: undefined,
+              value: null,
+              selectedValues: null,
+            },
+          },
+          isCurrentValueSelected: false,
+        };
+      }
+
+      const [start, inclusiveEnd] = createTimeRangeFromGranularity(
+        new Date(clickedTimestamp),
+        grain,
+        false,
+      );
+      const exclusiveEnd = new Date(inclusiveEnd.getTime() + 1);
+      const timeRange = `${formatDateTime(start)} : ${formatDateTime(exclusiveEnd)}`;
+      const selected: string[] = Object.values(selectedValues);
+      const isCurrentValueSelected = selected.includes(timeRange);
+      const values = isCurrentValueSelected ? [] : [timeRange];
+
+      return {
+        dataMask: {
+          extraFormData: {
+            filters:
+              values.length === 0
+                ? []
+                : [
+                    {
+                      col: filterColumn,
+                      op: 'TEMPORAL_RANGE' as const,
+                      val: timeRange,
+                    },
+                  ],
+          },
+          filterState: {
+            label: values.length ? values : undefined,
+            value: values.length ? values : null,
+            selectedValues: values.length ? values : null,
+          },
+        },
+        isCurrentValueSelected,
+      };
+    },
+    [formData.granularitySqla, resolvedTimeGrain, selectedValues, xAxis.label],
+  );
+
   const handleChange = useCallback(
     (value: string) => {
       if (!emitCrossFilters) {
@@ -384,15 +470,26 @@ export default function EchartsTimeseries({
     [emitCrossFilters, setDataMask, getXAxisCrossFilterDataMask],
   );
 
+  const handleTimeAxisChange = useCallback(
+    (clickedTimestamp: number) => {
+      if (!emitCrossFilters) {
+        return;
+      }
+      setDataMask(getTimeAxisCrossFilterDataMask(clickedTimestamp).dataMask);
+    },
+    [emitCrossFilters, setDataMask, getTimeAxisCrossFilterDataMask],
+  );
+
   // Determine if X-axis can be used for cross-filtering (categorical axis without dimensions)
   const canCrossFilterByXAxis =
-    !hasDimensions && xAxis.type === AxisType.Category;
-  const categoryAxisValueIndex =
+    !hasDimensions &&
+    (xAxis.type === AxisType.Category || xAxis.type === AxisType.Time);
+  const xAxisValueIndex =
     formData.orientation === OrientationType.Horizontal ? 1 : 0;
-  const getCategoryAxisValue = useCallback(
+  const getXAxisValue = useCallback(
     (data: unknown, name: unknown) => {
       if (Array.isArray(data)) {
-        const categoryAxisValue = data[categoryAxisValueIndex];
+        const categoryAxisValue = data[xAxisValueIndex];
         if (
           typeof categoryAxisValue === 'string' ||
           typeof categoryAxisValue === 'number'
@@ -405,7 +502,7 @@ export default function EchartsTimeseries({
       }
       return undefined;
     },
-    [categoryAxisValueIndex],
+    [xAxisValueIndex],
   );
 
   const eventHandlers: EventHandlers = {
@@ -423,15 +520,28 @@ export default function EchartsTimeseries({
           // Cross-filter by dimension (original behavior)
           const { seriesName: name } = props;
           handleChange(name);
-        } else if (canCrossFilterByXAxis && props.componentType === 'series') {
+        } else if (
+          canCrossFilterByXAxis &&
+          xAxis.type === AxisType.Category &&
+          props.componentType === 'series'
+        ) {
           // Cross-filter by X-axis value when no dimensions (issue #25334)
-          const categoryAxisValue = getCategoryAxisValue(
-            props.data,
-            props.name,
-          );
+          const categoryAxisValue = getXAxisValue(props.data, props.name);
           if (categoryAxisValue !== undefined) {
             handleXAxisChange(categoryAxisValue);
           }
+        } else if (
+          canCrossFilterByXAxis &&
+          xAxis.type === AxisType.Time &&
+          props.componentType === 'series'
+        ) {
+          const timeAxisValue = getXAxisValue(props.data, props.name);
+          if (timeAxisValue !== undefined) {
+            const timestamp = getTimestampFromTimeAxisValue(timeAxisValue);
+            if (timestamp !== undefined) {
+              handleTimeAxisChange(timestamp);
+            }
+          }
         }
       }, TIMER_DURATION);
     },
@@ -466,17 +576,20 @@ export default function EchartsTimeseries({
         ];
         const groupBy = ensureIsArray(formData.groupby);
         if (data && xAxis.type === AxisType.Time) {
-          drillToDetailFilters.push({
-            col:
-              // if the xAxis is '__timestamp', granularity_sqla will be the column of filter
-              xAxis.label === DTTM_ALIAS
-                ? formData.granularitySqla
-                : xAxis.label,
-            grain: formData.timeGrainSqla,
-            op: '==',
-            val: data[0],
-            formattedVal: xValueFormatter(data[0]),
-          });
+          const timeAxisValue = getXAxisValue(data, eventParams.name);
+          if (timeAxisValue !== undefined) {
+            drillToDetailFilters.push({
+              col:
+                // if the xAxis is '__timestamp', granularity_sqla will be the column of filter
+                xAxis.label === DTTM_ALIAS
+                  ? formData.granularitySqla
+                  : xAxis.label,
+              grain: resolvedTimeGrain,
+              op: '==',
+              val: timeAxisValue,
+              formattedVal: xValueFormatter(timeAxisValue),
+            });
+          }
         }
         [
           ...(xAxis.type === AxisType.Category && data ? [xAxis.label] : []),
@@ -517,9 +630,7 @@ export default function EchartsTimeseries({
           xAxis.label === DTTM_ALIAS ? formData.granularitySqla : xAxis.label;
         if (data && xAxis.type === AxisType.Time && xAxisCol) {
           // For horizontal orientation the [x, value] pair is swapped
-          const xValue = Array.isArray(data)
-            ? data[categoryAxisValueIndex]
-            : data;
+          const xValue = Array.isArray(data) ? data[xAxisValueIndex] : data;
           const xAxisFilter = getTemporalXAxisDrillByFilter(
             xAxisCol,
             xValue,
@@ -530,10 +641,7 @@ export default function EchartsTimeseries({
             xAxisFilters.push(xAxisFilter);
           }
         } else if (xAxis.type === AxisType.Category && xAxisCol) {
-          const categoryAxisValue = getCategoryAxisValue(
-            data,
-            eventParams.name,
-          );
+          const categoryAxisValue = getXAxisValue(data, eventParams.name);
           if (categoryAxisValue !== undefined) {
             // A category axis can still sit on a temporal column when the
             // axis is forced categorical; filter by time bucket in that case
@@ -564,15 +672,25 @@ export default function EchartsTimeseries({
           crossFilter = getCrossFilterDataMask(seriesName);
         } else if (
           canCrossFilterByXAxis &&
+          xAxis.type === AxisType.Category &&
           eventParams.componentType === 'series'
         ) {
-          const categoryAxisValue = getCategoryAxisValue(
-            data,
-            eventParams.name,
-          );
+          const categoryAxisValue = getXAxisValue(data, eventParams.name);
           if (categoryAxisValue !== undefined) {
             crossFilter = getXAxisCrossFilterDataMask(categoryAxisValue);
           }
+        } else if (
+          canCrossFilterByXAxis &&
+          xAxis.type === AxisType.Time &&
+          eventParams.componentType === 'series'
+        ) {
+          const timeAxisValue = getXAxisValue(data, eventParams.name);
+          if (timeAxisValue !== undefined) {
+            const timestamp = getTimestampFromTimeAxisValue(timeAxisValue);
+            if (timestamp !== undefined) {
+              crossFilter = getTimeAxisCrossFilterDataMask(timestamp);
+            }
+          }
         }
 
         onContextMenu(pointerEvent.clientX, pointerEvent.clientY, {
@@ -593,26 +711,39 @@ export default function EchartsTimeseries({
       const { value } = event;
       if (
         canCrossFilterByXAxis &&
+        event.targetType === 'axisLabel' &&
         (typeof value === 'string' || typeof value === 'number')
       ) {
-        handleXAxisChange(value);
+        if (xAxis.type === AxisType.Time) {
+          const timestamp = getTimestampFromTimeAxisValue(value);
+          if (timestamp !== undefined) {
+            handleTimeAxisChange(timestamp);
+          }
+        } else {
+          handleXAxisChange(value);
+        }
       }
     },
-    [canCrossFilterByXAxis, handleXAxisChange],
+    [
+      canCrossFilterByXAxis,
+      handleTimeAxisChange,
+      handleXAxisChange,
+      xAxis.type,
+    ],
   );
 
-  const categoryAxis =
+  const renderedXAxis =
     formData.orientation === OrientationType.Horizontal ? 'yAxis' : 'xAxis';
 
   const queryEventHandlers = useMemo(
     () => [
       {
         name: 'click',
-        query: `${categoryAxis}.category`,
+        query: renderedXAxis,
         handler: handleXAxisLabelClick,
       },
     ],
-    [categoryAxis, handleXAxisLabelClick],
+    [renderedXAxis, handleXAxisLabelClick],
   );
 
   const zrEventHandlers: EventHandlers = {

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/transformProps.ts

@@ -1248,7 +1248,7 @@ export default function transformProps(
     name: xAxisTitle,
     nameGap: convertInteger(xAxisTitleMargin),
     nameLocation: 'middle',
-    ...(xAxisType === AxisType.Category &&
+    ...((xAxisType === AxisType.Category || xAxisType === AxisType.Time) &&
       groupBy.length === 0 && {
         triggerEvent: true,
       }),
@@ -1256,10 +1256,12 @@ export default function transformProps(
       // When rotation is applied on time axes, hideOverlap can
       // aggressively hide the last label. Rotated labels already
       // have less overlap, so disabling hideOverlap is safe.
-      // At 0° rotation, keep hideOverlap to prevent long labels
-      // from overlapping each other, with showMaxLabel to ensure
-      // the last data point label stays visible (#37181).
-      hideOverlap: !(xAxisType === AxisType.Time && xAxisLabelRotation !== 0),
+      // At 0° rotation, also disable hideOverlap when showMaxLabel
+      // is active so the forced boundary label is never suppressed
+      // by ECharts' overlap detection (#39899).
+      hideOverlap: showMaxLabel
+        ? false
+        : !(xAxisType === AxisType.Time && xAxisLabelRotation !== 0),
       formatter: deduplicatedFormatter,
       rotate: xAxisLabelRotation,
       interval: xAxisLabelInterval,
@@ -1598,6 +1600,7 @@ export default function transformProps(
       label: xAxisLabel,
       type: xAxisType,
     },
+    resolvedTimeGrain,
     refs,
     coltypeMapping: dataTypes,
     onLegendScroll,

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/types.ts

@@ -122,5 +122,6 @@ export type TimeseriesChartTransformedProps =
         label: string;
         type: AxisType;
       };
+      resolvedTimeGrain?: TimeGranularity;
       onFocusedSeries: (series: string | null) => void;
     };

superset-frontend/plugins/plugin-chart-echarts/src/utils/eChartOptionsSchema.ts

@@ -28,6 +28,7 @@
  */
 
 import { z } from 'zod';
+import { sanitizeHtml } from '@superset-ui/core';
 
 // =============================================================================
 // Common Schemas
@@ -57,6 +58,33 @@ const fontStyleSchema = z.enum(['normal', 'italic', 'oblique']);
 /** Symbol type */
 const symbolTypeSchema = z.string();
 
+/**
+ * With the ECharts default renderMode 'html', a string tooltip formatter is
+ * assigned to the tooltip DOM element via innerHTML. ECharts formatter
+ * strings commonly rely on inline markup (e.g. '{b}<br/>{c}') for layout, so
+ * rejecting every '<' would break that supported usage; instead the value is
+ * run through the same allowlist sanitizer used for other tooltip HTML,
+ * which keeps presentational tags and strips anything else.
+ */
+const sanitizedFormatterSchema = z
+  .string()
+  .transform(value => sanitizeHtml(value));
+
+/**
+ * ECharts navigates to title.link/sublink on click, so restrict them to
+ * http(s) and same-origin relative paths.
+ */
+const safeLinkSchema = z
+  .string()
+  .refine(
+    value =>
+      /^https?:\/\//i.test(value) ||
+      (value.startsWith('/') && !value.startsWith('//')),
+    {
+      message: 'Only http(s) or same-origin relative URLs are allowed',
+    },
+  );
+
 // =============================================================================
 // Text Style Schema
 // =============================================================================
@@ -168,11 +196,11 @@ export const titleSchema = z.object({
   id: z.string().optional(),
   show: z.boolean().optional(),
   text: z.string().optional(),
-  link: z.string().optional(),
+  link: safeLinkSchema.optional(),
   target: z.enum(['self', 'blank']).optional(),
   textStyle: textStyleSchema.optional(),
   subtext: z.string().optional(),
-  sublink: z.string().optional(),
+  sublink: safeLinkSchema.optional(),
   subtarget: z.enum(['self', 'blank']).optional(),
   subtextStyle: textStyleSchema.optional(),
   textAlign: z.enum(['left', 'center', 'right']).optional(),
@@ -386,7 +414,9 @@ export const tooltipSchema = z.object({
       z.array(z.union([z.number(), z.string()])),
     ])
     .optional(),
-  formatter: z.string().optional(), // Only string formatters
+  // Only string formatters: a string tooltip formatter is rendered via
+  // innerHTML (default renderMode 'html'), so it is sanitized above.
+  formatter: sanitizedFormatterSchema.optional(),
   padding: z.union([z.number(), z.array(z.number())]).optional(),
   backgroundColor: colorSchema.optional(),
   borderColor: colorSchema.optional(),
@@ -397,7 +427,9 @@ export const tooltipSchema = z.object({
   shadowOffsetX: z.number().optional(),
   shadowOffsetY: z.number().optional(),
   textStyle: textStyleSchema.optional(),
-  extraCssText: z.string().optional(),
+  // `extraCssText` is intentionally not accepted; unknown keys are
+  // stripped by the schema, so configs that still carry it keep working
+  // minus the raw CSS.
   order: z
     .enum(['seriesAsc', 'seriesDesc', 'valueAsc', 'valueDesc'])
     .optional(),
@@ -575,6 +607,9 @@ export const seriesSchema = z.object({
   polarIndex: z.number().optional(),
   geoIndex: z.number().optional(),
   calendarIndex: z.number().optional(),
+  // Per-series `tooltip` is intentionally not admitted; the schema
+  // strips unknown keys. If per-series tooltips are ever admitted, reuse
+  // tooltipSchema so the formatter sanitization applies.
   label: labelSchema.optional(),
   labelLine: z
     .object({

superset-frontend/plugins/plugin-chart-echarts/src/utils/safeEChartOptionsParser.test.ts

@@ -523,3 +523,73 @@ test('EChartOptionsParseError contains validation error details', () => {
     );
   }
 });
+
+// =============================================================================
+// Creator-authored options must not reach the tooltip's innerHTML/
+// navigation sinks unsanitized.
+// =============================================================================
+
+test('sanitizes tooltip string formatters instead of rejecting all markup', () => {
+  const input = `{ tooltip: { formatter: '<img src=x onerror=alert(1)>' } }`;
+  const result = parseEChartOptions(input);
+
+  expect(result.success).toBe(true);
+  expect(result.data?.tooltip).toEqual({ formatter: '<img src>' });
+});
+
+test('keeps presentational tags in tooltip string formatters', () => {
+  const input = `{ tooltip: { formatter: '{b}<br/>{c}' } }`;
+  const result = parseEChartOptions(input);
+
+  expect(result.success).toBe(true);
+  expect(result.data?.tooltip).toEqual({ formatter: '{b}<br />{c}' });
+});
+
+test('strips per-series tooltip config so its formatter never reaches the merge', () => {
+  const result = parseEChartOptions(
+    `{ series: [{ type: 'line', tooltip: { formatter: '<b onpointerover=alert(1)>x</b>' } }] }`,
+  );
+
+  expect(result.success).toBe(true);
+  expect(result.data).toEqual({ series: [{ type: 'line' }] });
+});
+
+test('accepts markup-free tooltip placeholder formatters', () => {
+  const input = `{ tooltip: { formatter: '{b}: {c}' } }`;
+  const result = parseEChartOptions(input);
+
+  expect(result.success).toBe(true);
+  expect(result.data).toEqual({ tooltip: { formatter: '{b}: {c}' } });
+});
+
+test('rejects javascript: URLs in title link and sublink', () => {
+  expect(() =>
+    parseEChartOptions(`{ title: { link: 'javascript:alert(1)' } }`),
+  ).toThrow(EChartOptionsParseError);
+  expect(() =>
+    parseEChartOptions(`{ title: { sublink: 'javascript:alert(1)' } }`),
+  ).toThrow(EChartOptionsParseError);
+  expect(() =>
+    parseEChartOptions(`{ title: { link: '//evil.example/x' } }`),
+  ).toThrow(EChartOptionsParseError);
+});
+
+test('accepts http(s) and same-origin relative title links', () => {
+  const result = parseEChartOptions(
+    `{ title: { link: 'https://superset.apache.org', sublink: '/dashboard/1/' } }`,
+  );
+
+  expect(result.success).toBe(true);
+  expect(result.data).toEqual({
+    title: { link: 'https://superset.apache.org', sublink: '/dashboard/1/' },
+  });
+});
+
+test('strips tooltip extraCssText instead of passing raw CSS through', () => {
+  const result = parseEChartOptions(
+    `{ tooltip: { show: true, extraCssText: 'background:url(//evil.example/x)' } }`,
+  );
+
+  expect(result.success).toBe(true);
+  expect(result.data).toEqual({ tooltip: { show: true } });
+});

superset-frontend/plugins/plugin-chart-echarts/test/MixedTimeseries/transformProps.test.ts

@@ -1165,6 +1165,110 @@ test('x-axis dedup keeps the forced min label when the endpoints format identica
   expect(formatter(min)).toBe('May');
 });
 
+test('#39899 - x-axis dates do not overlap and last label stays visible at 0° rotation (mixed)', () => {
+  // When showMaxLabel is active on a time axis with 0° rotation,
+  // hideOverlap must be off so ECharts cannot suppress the forced
+  // max label (the end-of-axis date).
+  const chartProps = createEchartsTimeseriesTestChartProps<
+    EchartsMixedTimeseriesFormData,
+    EchartsMixedTimeseriesProps
+  >({
+    ...MIXED_TIMESERIES_CHART_PROPS_DEFAULTS,
+    defaultQueriesData: [
+      createTestQueryData(
+        [
+          {
+            __timestamp: Date.UTC(2026, 0, 1),
+            sum__num: 100,
+          },
+          {
+            __timestamp: Date.UTC(2026, 6, 1),
+            sum__num: 200,
+          },
+        ],
+        {
+          colnames: ['__timestamp', 'sum__num'],
+          coltypes: [GenericDataType.Temporal, GenericDataType.Numeric],
+          label_map: { __timestamp: ['__timestamp'], sum__num: ['sum__num'] },
+        },
+      ),
+      createTestQueryData(
+        [
+          {
+            __timestamp: Date.UTC(2026, 0, 1),
+            sum__num: 100,
+          },
+          {
+            __timestamp: Date.UTC(2026, 6, 1),
+            sum__num: 200,
+          },
+        ],
+        {
+          colnames: ['__timestamp', 'sum__num'],
+          coltypes: [GenericDataType.Temporal, GenericDataType.Numeric],
+          label_map: { __timestamp: ['__timestamp'], sum__num: ['sum__num'] },
+        },
+      ),
+    ],
+    formData: {
+      ...formData,
+      x_axis: '__timestamp',
+      metrics: ['sum__num'],
+      metricsB: ['sum__num'],
+      groupby: [],
+      groupbyB: [],
+      xAxisLabelRotation: 0,
+      // showMaxLabel (and therefore hideOverlap: false) only activates when
+      // a time grain resolves, so this needs one set to actually exercise
+      // the #39899 fix rather than silently no-op.
+      timeGrainSqla: TimeGranularity.MONTH,
+    },
+    queriesData: [
+      createTestQueryData(
+        [
+          {
+            __timestamp: Date.UTC(2026, 0, 1),
+            sum__num: 100,
+          },
+          {
+            __timestamp: Date.UTC(2026, 6, 1),
+            sum__num: 200,
+          },
+        ],
+        {
+          colnames: ['__timestamp', 'sum__num'],
+          coltypes: [GenericDataType.Temporal, GenericDataType.Numeric],
+          label_map: { __timestamp: ['__timestamp'], sum__num: ['sum__num'] },
+        },
+      ),
+      createTestQueryData(
+        [
+          {
+            __timestamp: Date.UTC(2026, 0, 1),
+            sum__num: 100,
+          },
+          {
+            __timestamp: Date.UTC(2026, 6, 1),
+            sum__num: 200,
+          },
+        ],
+        {
+          colnames: ['__timestamp', 'sum__num'],
+          coltypes: [GenericDataType.Temporal, GenericDataType.Numeric],
+          label_map: { __timestamp: ['__timestamp'], sum__num: ['sum__num'] },
+        },
+      ),
+    ],
+  });
+
+  const { echartOptions } = transformProps(chartProps);
+  const { axisLabel } = echartOptions.xAxis as Record<string, any>;
+
+  expect(axisLabel.showMaxLabel).toBe(true);
+  expect(axisLabel.alignMaxLabel).toBe('right');
+  expect(axisLabel.hideOverlap).toBe(false);
+});
+
 test('regression #37921: multi-metric Query A with groupby does not duplicate first metric in series names', () => {
   // Regression test for https://github.com/apache/superset/issues/37921
   // ("Residual" follow-up to #37055).

superset-frontend/plugins/plugin-chart-echarts/test/Radar/utils.test.ts

@@ -70,4 +70,42 @@ describe('renderNormalizedTooltip', () => {
     expect(tooltip).toContain('N/A');
     expect(tooltip).not.toContain('NaN');
   });
+
+  test('should HTML-escape series names from query data', () => {
+    // Regression test: the tooltip is rendered via innerHTML, so markup
+    // in query-result values must not become live DOM.
+    const tooltip = renderNormalizedTooltip(
+      { ...params, name: '<img src=x onerror=alert(1)>' },
+      metrics,
+      mockGetDenormalizedValue,
+      metricsWithCustomBounds,
+    );
+    expect(tooltip).not.toContain('<img');
+    expect(tooltip).toContain('&lt;img');
+  });
+
+  test('should HTML-escape metric labels', () => {
+    const tooltip = renderNormalizedTooltip(
+      params,
+      ['<svg onload=alert(1)>', 'metric2'],
+      mockGetDenormalizedValue,
+      metricsWithCustomBounds,
+    );
+    expect(tooltip).not.toContain('<svg');
+    expect(tooltip).toContain('&lt;svg');
+  });
+
+  test('should HTML-escape the series color used for the tooltip color dot', () => {
+    // Regression test: `color` is interpolated into a style attribute
+    // unquoted, so an unescaped quote could break out of the attribute
+    // and inject markup.
+    const tooltip = renderNormalizedTooltip(
+      { ...params, color: 'red" onmouseover="alert(1)' },
+      metrics,
+      mockGetDenormalizedValue,
+      metricsWithCustomBounds,
+    );
+    expect(tooltip).not.toContain('" onmouseover="alert(1)"');
+    expect(tooltip).toContain('&quot; onmouseover=&quot;alert(1)');
+  });
 });

superset-frontend/plugins/plugin-chart-echarts/test/Timeseries/EchartsTimeseries.test.tsx

@@ -16,11 +16,17 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { render } from '@testing-library/react';
-import { AxisType } from '@superset-ui/core';
+import { render, waitFor } from '@testing-library/react';
+import { AxisType, DTTM_ALIAS, TimeGranularity } from '@superset-ui/core';
 import { supersetTheme, ThemeProvider } from '@apache-superset/core/theme';
+import { logging } from '@apache-superset/core/utils';
+import type { ECElementEvent } from 'echarts/types/src/util/types';
 import EchartsTimeseries from '../../src/Timeseries/EchartsTimeseries';
-import { TimeseriesChartTransformedProps } from '../../src/Timeseries/types';
+import {
+  OrientationType,
+  TimeseriesChartTransformedProps,
+} from '../../src/Timeseries/types';
+import type { EchartsProps } from '../../src/types';
 
 // Percent-change draggable baseline: this is the one piece of the ECharts
 // rebuilds with zero prior test coverage despite six separate production
@@ -40,12 +46,14 @@ let mockChart: {
   convertFromPixel: jest.Mock;
   getModel: jest.Mock;
 };
+const mockEchart = jest.fn();
 
 jest.mock('../../src/components/Echart', () => {
   const { forwardRef, useImperativeHandle } = jest.requireActual('react');
   return {
     __esModule: true,
-    default: forwardRef((_props: unknown, ref: unknown) => {
+    default: forwardRef((props: unknown, ref: unknown) => {
+      mockEchart(props);
       useImperativeHandle(ref, () => ({
         getEchartInstance: () => mockChart,
       }));
@@ -115,6 +123,17 @@ function renderTimeseries(
   );
 }
 
+function getLatestEchartProps() {
+  const lastCall = mockEchart.mock.calls.at(-1);
+  expect(lastCall).toBeDefined();
+  const [props] = lastCall as [EchartsProps];
+  return props;
+}
+
+function advanceClickTimer() {
+  jest.advanceTimersByTime(300);
+}
+
 // Pulls the graphic descriptor for the draggable baseline handle out of the
 // most recent setOption call, mirroring how ECharts itself would read it.
 function getBaselineGraphic() {
@@ -126,6 +145,7 @@ function getBaselineGraphic() {
 
 beforeEach(() => {
   jest.clearAllMocks();
+  mockEchart.mockReset();
   setupChartMock();
   jest.spyOn(window, 'requestAnimationFrame').mockImplementation(cb => {
     cb(0);
@@ -134,6 +154,7 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  jest.useRealTimers();
   jest.restoreAllMocks();
 });
 
@@ -245,3 +266,400 @@ test('does not touch the chart instance when rebase is disabled', () => {
 
   expect(mockChart.setOption).not.toHaveBeenCalled();
 });
+
+test('emits TEMPORAL_RANGE cross-filter from time axis label click on day bucket', () => {
+  const setDataMask = jest.fn();
+
+  renderTimeseries({
+    emitCrossFilters: true,
+    setDataMask,
+    groupby: [],
+    resolvedTimeGrain: TimeGranularity.DAY,
+    formData: {
+      granularitySqla: 'ds',
+      timeGrainSqla: TimeGranularity.DAY,
+      vizType: 'echarts_timeseries_line',
+    } as any,
+    xAxis: {
+      label: DTTM_ALIAS,
+      type: AxisType.Time,
+    },
+  });
+
+  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
+    ({ query }) => query === 'xAxis',
+  )?.handler;
+  expect(labelClickHandler).toBeDefined();
+  labelClickHandler?.({
+    targetType: 'axisLabel',
+    value: '2021-01-01',
+  } as unknown as ECElementEvent);
+
+  expect(setDataMask.mock.calls[0][0]).toEqual({
+    extraFormData: {
+      filters: [
+        {
+          col: 'ds',
+          op: 'TEMPORAL_RANGE',
+          val: '2021-01-01T00:00:00 : 2021-01-02T00:00:00',
+        },
+      ],
+    },
+    filterState: {
+      label: ['2021-01-01T00:00:00 : 2021-01-02T00:00:00'],
+      value: ['2021-01-01T00:00:00 : 2021-01-02T00:00:00'],
+      selectedValues: ['2021-01-01T00:00:00 : 2021-01-02T00:00:00'],
+    },
+  });
+});
+
+test('emits upper-exclusive TEMPORAL_RANGE from time point click on month bucket', () => {
+  jest.useFakeTimers();
+  const setDataMask = jest.fn();
+
+  renderTimeseries({
+    emitCrossFilters: true,
+    setDataMask,
+    groupby: [],
+    resolvedTimeGrain: TimeGranularity.MONTH,
+    formData: {
+      granularitySqla: 'ds',
+      timeGrainSqla: TimeGranularity.MONTH,
+      vizType: 'echarts_timeseries_line',
+    } as any,
+    xAxis: {
+      label: DTTM_ALIAS,
+      type: AxisType.Time,
+    },
+  });
+
+  getLatestEchartProps().eventHandlers?.click?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: [Date.UTC(2021, 0, 1), 100],
+    name: '2021-01-01',
+    dataIndex: 0,
+  });
+  advanceClickTimer();
+
+  expect(setDataMask.mock.calls[0][0].extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
+    },
+  ]);
+});
+
+test('uses resolved time grain for temporal point-click cross-filter', () => {
+  jest.useFakeTimers();
+  const setDataMask = jest.fn();
+
+  renderTimeseries({
+    emitCrossFilters: true,
+    setDataMask,
+    groupby: [],
+    resolvedTimeGrain: TimeGranularity.MONTH,
+    formData: {
+      granularitySqla: 'ds',
+      timeGrainSqla: TimeGranularity.DAY,
+      extraFormData: {
+        time_grain_sqla: TimeGranularity.MONTH,
+      },
+      vizType: 'echarts_timeseries_line',
+    } as any,
+    xAxis: {
+      label: DTTM_ALIAS,
+      type: AxisType.Time,
+    },
+  });
+
+  getLatestEchartProps().eventHandlers?.click?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: [Date.UTC(2021, 0, 1), 100],
+    name: '2021-01-01',
+    dataIndex: 0,
+  });
+  advanceClickTimer();
+
+  expect(setDataMask.mock.calls[0][0].extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
+    },
+  ]);
+});
+
+test('emits TEMPORAL_RANGE from string-typed time point click value', () => {
+  jest.useFakeTimers();
+  const setDataMask = jest.fn();
+
+  renderTimeseries({
+    emitCrossFilters: true,
+    setDataMask,
+    groupby: [],
+    resolvedTimeGrain: TimeGranularity.MONTH,
+    formData: {
+      granularitySqla: 'ds',
+      timeGrainSqla: TimeGranularity.MONTH,
+      vizType: 'echarts_timeseries_line',
+    } as any,
+    xAxis: {
+      label: DTTM_ALIAS,
+      type: AxisType.Time,
+    },
+  });
+
+  getLatestEchartProps().eventHandlers?.click?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: ['2021-01-01T00:00:00Z', 100],
+    name: '2021-01-01',
+    dataIndex: 0,
+  });
+  advanceClickTimer();
+
+  expect(setDataMask.mock.calls[0][0].extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
+    },
+  ]);
+});
+
+test('emits TEMPORAL_RANGE from horizontal time point click using timestamp, not metric', () => {
+  jest.useFakeTimers();
+  const setDataMask = jest.fn();
+
+  renderTimeseries({
+    emitCrossFilters: true,
+    setDataMask,
+    groupby: [],
+    resolvedTimeGrain: TimeGranularity.MONTH,
+    formData: {
+      orientation: OrientationType.Horizontal,
+      granularitySqla: 'ds',
+      timeGrainSqla: TimeGranularity.MONTH,
+      vizType: 'echarts_timeseries_line',
+    } as any,
+    xAxis: {
+      label: DTTM_ALIAS,
+      type: AxisType.Time,
+    },
+  });
+
+  getLatestEchartProps().eventHandlers?.click?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: [129, Date.UTC(2021, 0, 1)],
+    name: '2021-01-01',
+    dataIndex: 0,
+  });
+  advanceClickTimer();
+
+  expect(setDataMask.mock.calls[0][0].extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
+    },
+  ]);
+});
+
+test('clears temporal X-axis cross-filter when clicking selected bucket again', () => {
+  jest.useFakeTimers();
+  const setDataMask = jest.fn();
+  const selectedRange = '2021-01-01T00:00:00 : 2021-02-01T00:00:00';
+
+  renderTimeseries({
+    emitCrossFilters: true,
+    setDataMask,
+    groupby: [],
+    selectedValues: { 0: selectedRange },
+    resolvedTimeGrain: TimeGranularity.MONTH,
+    formData: {
+      granularitySqla: 'ds',
+      timeGrainSqla: TimeGranularity.MONTH,
+      vizType: 'echarts_timeseries_line',
+    } as any,
+    xAxis: {
+      label: DTTM_ALIAS,
+      type: AxisType.Time,
+    },
+  });
+
+  getLatestEchartProps().eventHandlers?.click?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: [Date.UTC(2021, 0, 1), 100],
+    name: '2021-01-01',
+    dataIndex: 0,
+  });
+  advanceClickTimer();
+
+  expect(setDataMask.mock.calls[0][0]).toEqual({
+    extraFormData: {
+      filters: [],
+    },
+    filterState: {
+      label: undefined,
+      value: null,
+      selectedValues: null,
+    },
+  });
+});
+
+test('emits empty temporal X-axis data mask when filter grain is missing', () => {
+  jest.useFakeTimers();
+  const setDataMask = jest.fn();
+
+  renderTimeseries({
+    emitCrossFilters: true,
+    setDataMask,
+    groupby: [],
+    formData: {
+      granularitySqla: 'ds',
+      timeGrainSqla: undefined,
+      vizType: 'echarts_timeseries_line',
+    } as any,
+    xAxis: {
+      label: DTTM_ALIAS,
+      type: AxisType.Time,
+    },
+  });
+
+  getLatestEchartProps().eventHandlers?.click?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: [Date.UTC(2021, 0, 1), 100],
+    name: '2021-01-01',
+    dataIndex: 0,
+  });
+  advanceClickTimer();
+
+  expect(setDataMask.mock.calls[0][0]).toEqual({
+    extraFormData: {
+      filters: [],
+    },
+    filterState: {
+      label: undefined,
+      value: null,
+      selectedValues: null,
+    },
+  });
+});
+
+test('warns and skips temporal cross-filter when string value cannot be parsed', () => {
+  jest.useFakeTimers();
+  const setDataMask = jest.fn();
+  const warn = jest.spyOn(logging, 'warn').mockImplementation();
+
+  renderTimeseries({
+    emitCrossFilters: true,
+    setDataMask,
+    groupby: [],
+    resolvedTimeGrain: TimeGranularity.MONTH,
+    formData: {
+      granularitySqla: 'ds',
+      timeGrainSqla: TimeGranularity.MONTH,
+      vizType: 'echarts_timeseries_line',
+    } as any,
+    xAxis: {
+      label: DTTM_ALIAS,
+      type: AxisType.Time,
+    },
+  });
+
+  getLatestEchartProps().eventHandlers?.click?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: ['not-a-date', 100],
+    name: 'not-a-date',
+    dataIndex: 0,
+  });
+  advanceClickTimer();
+
+  expect(setDataMask).not.toHaveBeenCalled();
+  expect(warn).toHaveBeenCalledWith(
+    'Unable to parse time axis value for cross-filtering',
+    'not-a-date',
+  );
+});
+
+test('does not emit temporal X-axis label cross-filter when dimensions are set', () => {
+  const setDataMask = jest.fn();
+
+  renderTimeseries({
+    emitCrossFilters: true,
+    setDataMask,
+    groupby: ['country'],
+    formData: {
+      groupby: ['country'],
+      granularitySqla: 'ds',
+      timeGrainSqla: TimeGranularity.MONTH,
+      vizType: 'echarts_timeseries_line',
+    } as any,
+    xAxis: {
+      label: DTTM_ALIAS,
+      type: AxisType.Time,
+    },
+  });
+
+  const labelClickHandler = getLatestEchartProps().queryEventHandlers?.find(
+    ({ query }) => query === 'xAxis',
+  )?.handler;
+  expect(labelClickHandler).toBeDefined();
+  labelClickHandler?.({
+    targetType: 'axisLabel',
+    value: '2021-01-01',
+  } as unknown as ECElementEvent);
+
+  expect(setDataMask).not.toHaveBeenCalled();
+});
+
+test('context menu cross-filter is available for a temporal bar point', async () => {
+  const onContextMenu = jest.fn();
+
+  renderTimeseries({
+    emitCrossFilters: true,
+    onContextMenu,
+    groupby: [],
+    resolvedTimeGrain: TimeGranularity.MONTH,
+    formData: {
+      granularitySqla: 'ds',
+      timeGrainSqla: TimeGranularity.DAY,
+      extraFormData: {
+        time_grain_sqla: TimeGranularity.MONTH,
+      },
+      vizType: 'echarts_timeseries_line',
+    } as any,
+    xAxis: {
+      label: DTTM_ALIAS,
+      type: AxisType.Time,
+    },
+  });
+
+  await getLatestEchartProps().eventHandlers?.contextmenu?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: [Date.UTC(2021, 0, 1), 100],
+    name: '2021-01-01',
+    event: { stop: jest.fn(), event: { clientX: 10, clientY: 20 } },
+  });
+
+  await waitFor(() => {
+    expect(onContextMenu).toHaveBeenCalled();
+  });
+
+  const { crossFilter } = onContextMenu.mock.calls[0][2];
+  expect(crossFilter.dataMask.extraFormData.filters).toEqual([
+    {
+      col: 'ds',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
+    },
+  ]);
+});

superset-frontend/plugins/plugin-chart-echarts/test/Timeseries/transformProps.test.ts

@@ -2083,6 +2083,39 @@ test('xAxisForceCategorical forces Category axis regardless of Numeric coltype',
   expect(xAxis.triggerEvent).toBe(true);
 });
 
+test('temporal x-axis enables trigger events when no dimensions are set', () => {
+  const ts1 = 1745784000000;
+  const ts2 = 1745870400000;
+  const chartProps = createTestChartProps({
+    formData: {
+      metrics: ['metric'],
+      granularity_sqla: 'ds',
+      x_axis: '__timestamp',
+    },
+    queriesData: [
+      createTestQueryData(
+        [
+          { __timestamp: ts1, metric: 10 },
+          { __timestamp: ts2, metric: 20 },
+        ],
+        {
+          colnames: ['__timestamp', 'metric'],
+          coltypes: [GenericDataType.Temporal, GenericDataType.Numeric],
+        },
+      ),
+    ],
+  });
+
+  const { echartOptions } = transformProps(chartProps);
+  const xAxis = echartOptions.xAxis as {
+    triggerEvent?: boolean;
+    type: string;
+  };
+
+  expect(xAxis.type).toBe(AxisType.Time);
+  expect(xAxis.triggerEvent).toBe(true);
+});
+
 test('temporal x coltype forced categorical yields a Category axis with date labels', () => {
   // Issue #28204: with a temporal x-axis (e.g. weekly grain) the default Time
   // scale places ticks at "nice" intervals that don't line up with the buckets.
@@ -2330,6 +2363,7 @@ test('tooltip time grain wiring: dashboard-level extraFormData time grain overri
   });
 
   const transformedProps = transformProps(chartProps);
+  expect(transformedProps.resolvedTimeGrain).toBe(TimeGranularity.MONTH);
   const tooltipFormatter = (
     transformedProps.echartOptions as unknown as TooltipFormatterOptions
   ).tooltip.formatter;
@@ -2363,6 +2397,7 @@ test('tooltip time grain wiring: chart-level time grain drives the tooltip when
   });
 
   const transformedProps = transformProps(chartProps);
+  expect(transformedProps.resolvedTimeGrain).toBe(TimeGranularity.YEAR);
   const tooltipFormatter = (
     transformedProps.echartOptions as unknown as TooltipFormatterOptions
   ).tooltip.formatter;

superset-frontend/plugins/plugin-chart-echarts/test/Timeseries/transformers.test.ts

@@ -341,15 +341,15 @@ test('should configure time axis labels to show max label for last month visibil
   );
 });
 
-test('x-axis dates do not overlap and last label stays visible at 0° rotation', () => {
+test('#39899 - x-axis dates do not overlap and last label stays visible at 0° rotation', () => {
   const result = transformProps(buildTimeseriesChartProps());
   const { axisLabel } = result.echartOptions.xAxis as Record<string, any>;
 
-  expect(axisLabel.hideOverlap).toBe(true);
-  // showMaxLabel forces the last data point label to render even
-  // when hideOverlap is active, preventing the #37181 regression.
+  // showMaxLabel forces the last data point label to render
   expect(axisLabel.showMaxLabel).toBe(true);
   expect(axisLabel.alignMaxLabel).toBe('right');
+  // hideOverlap must be OFF so ECharts cannot suppress the forced max label
+  expect(axisLabel.hideOverlap).toBe(false);
 });
 
 test('last x-axis date is visible and not cut off when rotated -45°', () => {

superset-frontend/plugins/plugin-chart-pivot-table/test/plugin/utilities.test.ts

@@ -290,6 +290,25 @@ test('isAdditiveMetric: non-additive aggregates, SQL, and saved metrics are not
   expect(isAdditiveMetric('count')).toBe(false);
 });
 
+test('isAdditiveMetric: MEDIAN/STDDEV_SAMP/VAR_SAMP are non-additive, with no dedicated code needed', () => {
+  // Regression guard: MEDIAN/STDDEV_SAMP/VAR_SAMP are new system-wide metric
+  // aggregates (not pivot-table-specific). They must fall outside
+  // ADDITIVE_AGGREGATES so totals/subtotals route through the correct
+  // DB-rollup path automatically, same as AVG/COUNT_DISTINCT already do --
+  // averaging per-group medians (or variances) is exactly the class of bug
+  // SIP-216 fixed for AVG, and would be equally wrong here.
+  (['MEDIAN', 'STDDEV_SAMP', 'VAR_SAMP'] as const).forEach(aggregate => {
+    expect(
+      isAdditiveMetric({
+        expressionType: 'SIMPLE',
+        aggregate,
+        column: { column_name: 'num' },
+        label: `${aggregate.toLowerCase()}_num`,
+      } as QueryFormMetric),
+    ).toBe(false);
+  });
+});
+
 test('allMetricsAdditive: all additive vs any non-additive vs empty', () => {
   const sum = {
     expressionType: 'SIMPLE',

superset-frontend/plugins/plugin-chart-world-map/src/WorldMap.ts

@@ -80,6 +80,19 @@ interface DatamapSource {
   country?: string;
 }
 
+/**
+ * Escape HTML special characters to prevent XSS attacks. Popup templates are
+ * assigned to the hover element via innerHTML by the datamaps library, and
+ * formatter output can echo a creator-controlled format string verbatim
+ * (see createD3NumberFormatter's invalid-format fallback), so both the name
+ * and the formatted value must be treated as untrusted text.
+ */
+function escapeHtml(text: string): string {
+  const div = document.createElement('div');
+  div.textContent = text;
+  return div.innerHTML;
+}
+
 const propTypes = {
   data: PropTypes.arrayOf(
     PropTypes.shape({
@@ -279,9 +292,9 @@ function WorldMap(element: HTMLElement, props: WorldMapProps): void {
       highlightBorderWidth: 1,
       popupTemplate: (geo, d) =>
         d &&
-        `<div class="hoverinfo"><strong>${d.name}</strong><br>${formatter(
-          d.m1,
-        )}</div>`,
+        `<div class="hoverinfo"><strong>${escapeHtml(
+          d.name,
+        )}</strong><br>${escapeHtml(String(formatter(d.m1)))}</div>`,
     },
     bubblesConfig: {
       borderWidth: 1,
@@ -290,9 +303,9 @@ function WorldMap(element: HTMLElement, props: WorldMapProps): void {
       popupOnHover: !inContextMenu,
       radius: null,
       popupTemplate: (geo, d) =>
-        `<div class="hoverinfo"><strong>${d.name}</strong><br>${formatter(
-          d.m2,
-        )}</div>`,
+        `<div class="hoverinfo"><strong>${escapeHtml(
+          d.name,
+        )}</strong><br>${escapeHtml(String(formatter(d.m2)))}</div>`,
       fillOpacity: 0.5,
       animate: true,
       highlightOnHover: !inContextMenu,

superset-frontend/plugins/plugin-chart-world-map/test/WorldMap.test.ts

@@ -180,6 +180,33 @@ test('disables Datamaps highlightOnHover while the context menu is open', () =>
   expect(geographyConfig?.highlightOnHover).toBe(false);
 });
 
+test('escapes markup in hover popup templates', () => {
+  // Regression test for stored XSS via the number-formatter fallback: an
+  // invalid Y Axis Format string is echoed verbatim by the formatter
+  // (createD3NumberFormatter's catch branch), so the popup templates must
+  // HTML-escape formatter output before datamaps assigns it via innerHTML.
+  const maliciousFormatter = getNumberFormatter('<img src=x onerror=alert(1)>');
+  WorldMap(container, { ...baseProps, formatter: maliciousFormatter });
+
+  const geographyConfig = lastDatamapConfig?.geographyConfig as {
+    popupTemplate: (geo: unknown, d: unknown) => string;
+  };
+  const bubblesConfig = lastDatamapConfig?.bubblesConfig as {
+    popupTemplate: (geo: unknown, d: unknown) => string;
+  };
+  const entry = { name: '<b>United States</b>', m1: 100, m2: 200 };
+
+  const geoPopup = geographyConfig.popupTemplate({}, entry);
+  const bubblePopup = bubblesConfig.popupTemplate({}, entry);
+
+  [geoPopup, bubblePopup].forEach(popup => {
+    expect(popup).not.toContain('<img');
+    expect(popup).not.toContain('<b>');
+    expect(popup).toContain('&lt;img src=x onerror=alert(1)&gt;');
+    expect(popup).toContain('&lt;b&gt;United States&lt;/b&gt;');
+  });
+});
+
 test('does not throw error when onContextMenu is undefined', () => {
   const propsWithoutContextMenu = {
     ...baseProps,

superset-frontend/src/SqlLab/actions/sqlLab.ts

@@ -1524,7 +1524,9 @@ export function popPermalink(key: string): SqlLabThunkAction<Promise<unknown>> {
             dbId: json.dbId ? parseInt(json.dbId, 10) : undefined,
             catalog: json.catalog ?? null,
             schema: json.schema ?? undefined,
-            autorun: json.autorun ? json.autorun : false,
+            // The recipient must review the prefilled query and press
+            // Run; a permalink payload never auto-runs.
+            autorun: false,
             sql: json.sql ? json.sql : 'SELECT ...',
             templateParams: json.templateParams,
           }),
@@ -1548,7 +1550,9 @@ export function popStoredQuery(
             dbId: json.dbId ? parseInt(json.dbId, 10) : undefined,
             catalog: json.catalog ?? null,
             schema: json.schema ?? undefined,
-            autorun: json.autorun ? json.autorun : false,
+            // Same rule as popPermalink above — stored payloads never
+            // auto-run.
+            autorun: false,
             sql: json.sql ? json.sql : 'SELECT ...',
             templateParams: json.templateParams,
           }),
@@ -1627,7 +1631,9 @@ export function popDatasourceQuery(
             name: `${QUERY_TEXT} ${json.result.name}`,
             dbId: json.result.database.id,
             schema: json.result.schema,
-            autorun: sql !== undefined,
+            // `sql` here can come straight from the URL, so its mere
+            // presence must never imply auto-execution.
+            autorun: false,
             sql: sql || json.result.select_star,
           }),
         ),

superset-frontend/src/SqlLab/components/ResultSet/index.tsx

@@ -719,7 +719,7 @@ const ResultSet = ({
     if (data && data.length > 0) {
       const allowHTML = getItem(
         LocalStorageKeys.SqllabIsRenderHtmlEnabled,
-        true,
+        false,
       );
 
       const tableProps = {

superset-frontend/src/SqlLab/components/SqlEditor/index.tsx

@@ -284,7 +284,7 @@ const SqlEditor: FC<Props> = ({
     getItem(LocalStorageKeys.SqllabIsAutocompleteEnabled, true),
   );
   const [renderHTMLEnabled, setRenderHTMLEnabled] = useState(
-    getItem(LocalStorageKeys.SqllabIsRenderHtmlEnabled, true),
+    getItem(LocalStorageKeys.SqllabIsRenderHtmlEnabled, false),
   );
   const [showCreateAsModal, setShowCreateAsModal] = useState(false);
   const [createAs, setCreateAs] = useState('');

superset-frontend/src/components/Datasource/components/DatasourceEditor/DatasourceEditor.tsx

@@ -1993,7 +1993,6 @@ function DatasourceEditor({
                           col => col.column_name,
                         )}
                         height={300}
-                        allowHTML
                       />
                     </>
                   )}

superset-frontend/src/components/FilterableTable/index.tsx

@@ -63,7 +63,7 @@ export const FilterableTable = ({
   height,
   filterText = '',
   expandedColumns = [],
-  allowHTML = true,
+  allowHTML = false,
   striped,
   themeOverrides,
 }: FilterableTableProps) => {

superset-frontend/src/components/FilterableTable/utils.test.tsx

@@ -64,6 +64,35 @@ test('should render cellData value for default cell data', () => {
   expect(container).toHaveTextContent('regular_text');
 });
 
+test('should render HTML cell data as inert text by default', () => {
+  const { container } = render(
+    <>
+      {renderResultCell({
+        cellData: '<img src="https://attacker.example/beacon.gif" />link',
+        columnKey: 'a',
+      })}
+    </>,
+  );
+  expect(container.querySelector('img')).not.toBeInTheDocument();
+  expect(container).toHaveTextContent(
+    '<img src="https://attacker.example/beacon.gif" />link',
+  );
+});
+
+test('should render sanitized HTML only when allowHTML is explicitly enabled', () => {
+  const { container } = render(
+    <>
+      {renderResultCell({
+        cellData: '<b>bold</b>',
+        columnKey: 'a',
+        allowHTML: true,
+      })}
+    </>,
+  );
+  expect(container.querySelector('b')).toBeInTheDocument();
+  expect(container).toHaveTextContent('bold');
+});
+
 test('should transform cell data by getCellContent for the regular text', () => {
   const { container } = render(
     <>

superset-frontend/src/components/FilterableTable/utils.tsx

@@ -32,11 +32,15 @@ type Params = CellParams & {
   getCellContent?: (args: CellParams) => string;
 };
 
+// Result cells carry untrusted warehouse data, so HTML rendering is opt-in:
+// even sanitized markup keeps active capabilities (img/video fetch beacons,
+// phishing anchors), which must not activate by default for data the viewer
+// did not author.
 export const renderResultCell = ({
   cellData,
   getCellContent,
   columnKey,
-  allowHTML = true,
+  allowHTML = false,
 }: Params) => {
   const cellNode =
     getCellContent?.({ cellData, columnKey }) ?? String(cellData);

superset-frontend/src/constants.test.ts

@@ -0,0 +1,31 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import {
+  URL_PARAMS,
+  RESERVED_CHART_URL_PARAMS,
+  RESERVED_DASHBOARD_URL_PARAMS,
+} from 'src/constants';
+
+test('permalinkKey is reserved on both the chart and dashboard URL param lists', () => {
+  // Dashboard and explore permalinks resolve against different backend
+  // KV resources/salts, so a key from one must never leak into the other's
+  // URL via the reserved-params passthrough logic.
+  expect(RESERVED_DASHBOARD_URL_PARAMS).toContain(URL_PARAMS.permalinkKey.name);
+  expect(RESERVED_CHART_URL_PARAMS).toContain(URL_PARAMS.permalinkKey.name);
+});

superset-frontend/src/constants.ts

@@ -123,6 +123,7 @@ export const RESERVED_CHART_URL_PARAMS: string[] = [
   URL_PARAMS.datasourceId.name,
   URL_PARAMS.datasourceType.name,
   URL_PARAMS.datasetId.name,
+  URL_PARAMS.permalinkKey.name,
   URL_PARAMS.versionHistory.name,
 ];
 export const RESERVED_DASHBOARD_URL_PARAMS: string[] = [

superset-frontend/src/explore/components/DataTablesPane/components/useGridResultTable.tsx

@@ -19,7 +19,6 @@
 import { useMemo, useCallback, useRef, useState } from 'react';
 import {
   getTimeFormatter,
-  safeHtmlSpan,
   TimeFormats,
   getMetricLabel,
   QueryFormMetric,
@@ -92,8 +91,11 @@ export function useGridColumns(
                   ) {
                     return timeFormatter(value);
                   }
+                  // Render string cells as plain text: this grid shows raw
+                  // query results (untrusted warehouse data) to any viewer,
+                  // so HTML must stay inert here even after sanitization.
                   if (typeof value === 'string') {
-                    return safeHtmlSpan(value);
+                    return value;
                   }
                   return String(value);
                 },

superset-frontend/src/explore/components/controls/ColorBreakpointsControl/ColorBreakpointOption.test.tsx

@@ -112,6 +112,31 @@ describe('ColorBreakpointOption', () => {
     expect(colorPreview).toBeInTheDocument();
   });
 
+  test('should coerce non-numeric color channels instead of injecting CSS', async () => {
+    // Stored form_data is opaque JSON, so a saved chart can carry a string
+    // channel crafted to break out of the styled-component declaration.
+    const maliciousBreakpoint = {
+      id: 3,
+      color: {
+        r: '0,0,0,1); } body { display: none } .x { background: rgba(0' as unknown as number,
+        g: 0,
+        b: 0,
+        a: 1,
+      },
+      minValue: 0,
+      maxValue: 100,
+    };
+
+    renderComponent({ breakpoint: maliciousBreakpoint });
+
+    const colorPreview = await screen.findByTestId('color-preview');
+    expect(colorPreview).toBeInTheDocument();
+    // The malicious string is coerced to a safe numeric channel (0), so the
+    // rendered rule is a plain rgba() value with no injected CSS.
+    expect(colorPreview).toHaveStyle({ background: 'rgba(0, 0, 0, 1)' });
+    expect(document.body).toBeVisible();
+  });
+
   test('should handle decimal values', async () => {
     const decimalBreakpoint: ColorBreakpointType = {
       id: 2,

superset-frontend/src/explore/components/controls/ColorBreakpointsControl/ColorBreakpointOption.tsx

@@ -31,6 +31,19 @@ const BreakpointColorPreview = styled.div`
   margin-right: ${({ theme }) => theme.sizeUnit}px;
 `;
 
+// Chart params are stored server-side as opaque JSON, so breakpoint color
+// channels can arrive as arbitrary strings despite the compile-time numeric
+// type. The formatted color is interpolated into a styled-component template
+// (a stylesheet, not a per-property style assignment), so each channel must
+// be coerced to a plain number to keep attacker-controlled strings from
+// injecting CSS rules.
+const toRgbChannel = (channel: unknown): number => {
+  const value = Number(channel);
+  return Number.isFinite(value)
+    ? Math.min(255, Math.max(0, Math.round(value)))
+    : 0;
+};
+
 const ColorBreakpointOption = ({
   breakpoint,
   colorBreakpoints,
@@ -41,7 +54,9 @@ const ColorBreakpointOption = ({
   const { color, minValue, maxValue } = breakpoint;
 
   const formattedColor = color
-    ? `rgba(${color.r}, ${color.g}, ${color.b}, 1)`
+    ? `rgba(${toRgbChannel(color.r)}, ${toRgbChannel(color.g)}, ${toRgbChannel(
+        color.b,
+      )}, 1)`
     : '';
 
   return (

superset-frontend/src/explore/components/controls/MetricControl/AdhocMetric.test.ts

@@ -191,6 +191,29 @@ describe('AdhocMetric', () => {
     expect(adhocMetric2.inferSqlExpressionAggregate()).toBeNull();
   });
 
+  test('can infer the new extended aggregates (STDDEV_SAMP/VAR_SAMP/MEDIAN) from sql expressions', () => {
+    const stddevSamp = new AdhocMetric({
+      expressionType: EXPRESSION_TYPES.SQL,
+      sqlExpression: 'STDDEV_SAMP(my_column)',
+    });
+    expect(stddevSamp.inferSqlExpressionColumn()).toBe('my_column');
+    expect(stddevSamp.inferSqlExpressionAggregate()).toBe('STDDEV_SAMP');
+
+    const varSamp = new AdhocMetric({
+      expressionType: EXPRESSION_TYPES.SQL,
+      sqlExpression: 'VAR_SAMP(my_column)',
+    });
+    expect(varSamp.inferSqlExpressionColumn()).toBe('my_column');
+    expect(varSamp.inferSqlExpressionAggregate()).toBe('VAR_SAMP');
+
+    const median = new AdhocMetric({
+      expressionType: EXPRESSION_TYPES.SQL,
+      sqlExpression: 'MEDIAN(my_column)',
+    });
+    expect(median.inferSqlExpressionColumn()).toBe('my_column');
+    expect(median.inferSqlExpressionAggregate()).toBe('MEDIAN');
+  });
+
   test('will infer columns and aggregates when converting to a simple expression', () => {
     const adhocMetric = new AdhocMetric({
       expressionType: EXPRESSION_TYPES.SQL,
@@ -248,4 +271,20 @@ describe('AdhocMetric', () => {
     ).toBe('COUNT_DISTINCT');
     expect(emptyColumnName.getDefaultLabel()).toBe('COUNT_DISTINCT');
   });
+
+  test('should prefill a portable MEDIAN expression for the Custom SQL tab, but keep the raw label', () => {
+    const median = new AdhocMetric({
+      column: valueColumn,
+      aggregate: AGGREGATES.MEDIAN,
+      hasCustomLabel: false,
+    });
+    // MEDIAN(column) isn't valid SQL on every engine this PR verifies it
+    // for (e.g. PostgreSQL has no MEDIAN function), so the editable Custom
+    // SQL tab is prefilled with the portable, standards-based spelling.
+    expect(median.translateToSql({ transformCountDistinct: true })).toBe(
+      'PERCENTILE_CONT(0.5) WITHIN GROUP (ORDER BY value)',
+    );
+    // The display label stays the concise, human-readable form.
+    expect(median.getDefaultLabel()).toBe('MEDIAN(value)');
+  });
 });

superset-frontend/src/explore/components/controls/MetricControl/AdhocMetric.ts

@@ -153,6 +153,19 @@ export default class AdhocMetric {
       ) {
         return `COUNT(DISTINCT ${column.slice(1, -1)})`;
       }
+      // MEDIAN(column) isn't a real function on every engine this PR
+      // verifies it for -- PostgreSQL/Redshift compile it to
+      // PERCENTILE_CONT(0.5) WITHIN GROUP instead. `transformCountDistinct`
+      // signals this call is prefilling the *editable, executable* Custom
+      // SQL tab (not just a display label), so use the portable,
+      // standards-based spelling there instead of the raw aggregate name.
+      if (
+        params.transformCountDistinct &&
+        aggregate === AGGREGATES.MEDIAN &&
+        /^\(.*\)$/.test(column)
+      ) {
+        return `PERCENTILE_CONT(0.5) WITHIN GROUP (ORDER BY ${column.slice(1, -1)})`;
+      }
       return aggregate + column;
     }
     if (this.expressionType === EXPRESSION_TYPES.SQL) {

superset-frontend/src/explore/components/controls/MetricControl/AdhocMetricEditPopover/index.tsx

@@ -36,6 +36,7 @@ import {
 import sqlKeywords from 'src/SqlLab/utils/sqlKeywords';
 import { noOp } from 'src/utils/common';
 import {
+  AGGREGATES_LABELS,
   AGGREGATES_OPTIONS,
   POPOVER_INITIAL_HEIGHT,
   POPOVER_INITIAL_WIDTH,
@@ -548,7 +549,7 @@ function AdhocMetricEditPopover({
                   <Select
                     options={AGGREGATES_OPTIONS.map(option => ({
                       value: option,
-                      label: option,
+                      label: AGGREGATES_LABELS[option] ?? option,
                       key: option,
                     }))}
                     {...aggregateSelectProps}

superset-frontend/src/explore/components/controls/VizTypeControl/VizTypeControl.test.tsx

@@ -278,6 +278,24 @@ describe('VizTypeControl', () => {
     ).not.toBeInTheDocument();
   });
 
+  test('Thumbnail labels expose the full chart name via a title tooltip', async () => {
+    // Labels are clamped to a fixed two-line block so every tile is the same
+    // height; the full (possibly truncated) name must stay discoverable through
+    // the title attribute.
+    await waitForRenderWrapper();
+    userEvent.click(screen.getByRole('tab', { name: 'All charts' }));
+
+    const visualizations = screen.getByTestId(getTestId('viz-row'));
+    const labels = await within(visualizations).findAllByTestId(
+      getTestId('viztype-label'),
+    );
+
+    expect(labels.length).toBeGreaterThan(0);
+    labels.forEach(label => {
+      expect(label).toHaveAttribute('title', label.textContent ?? '');
+    });
+  });
+
   test('Submit on viz type double-click', async () => {
     await waitForRenderWrapper();
     userEvent.click(screen.getByRole('tab', { name: 'All charts' }));

superset-frontend/src/explore/components/controls/VizTypeControl/VizTypeGallery.tsx

@@ -214,6 +214,9 @@ const IconsPane = styled.div`
   justify-content: space-evenly;
   grid-gap: ${({ theme }) => theme.sizeUnit * 2}px;
   justify-items: center;
+  /* top-align every tile so a longer chart name never pushes the thumbnails
+     of the other tiles in the same row upward */
+  align-items: start;
   /* for some reason this padding doesn't seem to apply at the bottom of the container. Why is a mystery. */
   padding: ${({ theme }) => theme.sizeUnit * 2}px;
 `;
@@ -274,7 +277,6 @@ const thumbnailContainerCss = (theme: SupersetTheme) => css`
   font: inherit;
   cursor: pointer;
   width: ${theme.sizeUnit * THUMBNAIL_GRID_UNITS}px;
-  position: relative;
   outline: none; /* Remove focus outline to show only selected state */
 
   img {
@@ -297,6 +299,16 @@ const thumbnailContainerCss = (theme: SupersetTheme) => css`
   .viztype-label {
     margin-top: ${theme.sizeUnit * 2}px;
     text-align: center;
+    /* reserve a fixed two-line block so every tile is the same height,
+       regardless of how long the chart name is. Longer names are clamped
+       with an ellipsis; the full name stays available via the title tooltip. */
+    line-height: ${theme.sizeUnit * 4}px;
+    height: ${theme.sizeUnit * 8}px;
+    display: -webkit-box;
+    -webkit-line-clamp: 2;
+    -webkit-box-orient: vertical;
+    overflow: hidden;
+    word-break: break-word;
   }
 `;
 
@@ -320,10 +332,19 @@ const HighlightLabel = styled.div`
   `}
 `;
 
+// Wraps the thumbnail image so the "Featured" badge can be anchored to the
+// image itself rather than to the whole tile (whose height varies with the
+// chart-name length). line-height: 0 removes the inline-image descender gap.
+const ThumbnailImageWrapper = styled.div`
+  position: relative;
+  width: ${({ theme }) => theme.sizeUnit * THUMBNAIL_GRID_UNITS}px;
+  line-height: 0;
+`;
+
 const ThumbnailLabelWrapper = styled.div`
   position: absolute;
   right: ${({ theme }) => theme.sizeUnit}px;
-  top: ${({ theme }) => theme.sizeUnit * 19}px;
+  top: ${({ theme }) => theme.sizeUnit}px;
 `;
 
 const TitleLabelWrapper = styled.div`
@@ -367,27 +388,32 @@ const Thumbnail: FC<ThumbnailProps> = ({
       onFocus={handleFocus}
       data-test="viztype-selector-container"
     >
-      <img
-        alt={type.name}
-        width="100%"
-        className={`viztype-selector ${isSelected ? 'selected' : ''}`}
-        src={
-          isDarkMode && type.thumbnailDark ? type.thumbnailDark : type.thumbnail
-        }
-      />
+      <ThumbnailImageWrapper>
+        <img
+          alt={type.name}
+          width="100%"
+          className={`viztype-selector ${isSelected ? 'selected' : ''}`}
+          src={
+            isDarkMode && type.thumbnailDark
+              ? type.thumbnailDark
+              : type.thumbnail
+          }
+        />
+        {type.label && (
+          <ThumbnailLabelWrapper>
+            <HighlightLabel>
+              <div>{t(type.label)}</div>
+            </HighlightLabel>
+          </ThumbnailLabelWrapper>
+        )}
+      </ThumbnailImageWrapper>
       <div
         className="viztype-label"
         data-test={`${VIZ_TYPE_CONTROL_TEST_ID}__viztype-label`}
+        title={type.name}
       >
         {type.name}
       </div>
-      {type.label && (
-        <ThumbnailLabelWrapper>
-          <HighlightLabel>
-            <div>{t(type.label)}</div>
-          </HighlightLabel>
-        </ThumbnailLabelWrapper>
-      )}
     </button>
   );
 };

superset-frontend/src/explore/components/useExploreAdditionalActionsMenu/index.tsx

@@ -78,6 +78,37 @@ import { useExploreDataExport } from './useExploreDataExport';
 
 export const SEARCH_THRESHOLD = 10;
 
+/**
+ * Escape a single CSV cell value.
+ *
+ * Mirrors the server-side chokepoint (superset/utils/csv.py escape_value):
+ * values starting with a spreadsheet formula prefix (=, +, -, @, |, %, or a
+ * leading tab/carriage return, optionally behind leading whitespace) are
+ * neutralized with a leading single quote so exported cells cannot execute
+ * as formulas when opened in Excel/LibreOffice/Google Sheets. Plain negative
+ * numbers are left untouched. RFC-4180 quoting is applied afterwards.
+ */
+export const escapeCsvValue = (v: unknown): string => {
+  if (v === null || v === undefined) return '';
+  let s = String(v);
+  if (s.length > 0) {
+    const stripped = s.replace(/^\s+/, '');
+    const startsLikeFormula =
+      s[0] === '\t' ||
+      s[0] === '\r' ||
+      (stripped.length > 0 && '-@+|=%'.includes(stripped[0]));
+    const isNegativeNumber = s.length > 1 && /^-[0-9.]+$/.test(s);
+    if (startsLikeFormula && !isNegativeNumber) {
+      // Escape pipe to be extra safe (DDE payloads), then prefix with a
+      // single quote to prevent formula evaluation. Existing backslashes
+      // must be escaped first so the resulting `\|`/`\\` sequences are
+      // unambiguous to a downstream unescaper.
+      s = `'${s.replace(/\\/g, '\\\\').replace(/\|/g, '\\|')}`;
+    }
+  }
+  return /[",\r\n]/.test(s) ? `"${s.replace(/"/g, '""')}"` : s;
+};
+
 const MENU_KEYS = {
   EDIT_PROPERTIES: 'edit_properties',
   DASHBOARDS_ADDED_TO: 'dashboards_added_to',
@@ -488,15 +519,11 @@ export const useExploreAdditionalActionsMenu = (
     filename: string,
   ) => {
     if (!rows?.length || !columns?.length) return;
-    const esc = (v: unknown): string => {
-      if (v === null || v === undefined) return '';
-      const s = String(v);
-      const wrapped = /[",\n]/.test(s) ? `"${s.replace(/"/g, '""')}"` : s;
-      return wrapped;
-    };
-    const header = columns.map(c => esc(c.label ?? c.key ?? '')).join(',');
+    const header = columns
+      .map(c => escapeCsvValue(c.label ?? c.key ?? ''))
+      .join(',');
     const body = rows
-      .map(r => columns.map(c => esc(r[c.key])).join(','))
+      .map(r => columns.map(c => escapeCsvValue(r[c.key])).join(','))
       .join('\n');
     const csv = `${header}\n${body}`;
     const blob = new Blob([csv], { type: 'text/csv;charset=utf-8;' });

superset-frontend/src/explore/components/useExploreAdditionalActionsMenu/useExploreAdditionalActionsMenu.test.tsx

@@ -25,6 +25,7 @@ import downloadAsPdf from 'src/utils/downloadAsPdf';
 import {
   useExploreAdditionalActionsMenu,
   getExportScreenshotMenuItems,
+  escapeCsvValue,
 } from './index';
 import * as exploreUtils from 'src/explore/exploreUtils';
 import { Slice } from 'src/types/Chart';
@@ -180,6 +181,45 @@ test('hides Edit chart properties from a chart editor lacking chart write permis
   expect(screen.queryByText('Edit chart properties')).not.toBeInTheDocument();
 });
 
+test('escapeCsvValue neutralizes spreadsheet formula prefixes', () => {
+  // Mirrors superset/utils/csv.py escape_value so the client-built
+  // "Current View" CSV cannot ship live formulas (CSV injection).
+  expect(escapeCsvValue('=HYPERLINK("https://attacker.example")')).toBe(
+    `"'=HYPERLINK(""https://attacker.example"")"`,
+  );
+  expect(escapeCsvValue('@SUM(1+1)')).toBe(`'@SUM(1+1)`);
+  expect(escapeCsvValue('+cmd')).toBe(`'+cmd`);
+  expect(escapeCsvValue('%x')).toBe(`'%x`);
+  expect(escapeCsvValue('\t=1+1')).toBe(`'\t=1+1`);
+  expect(escapeCsvValue('  =1+1')).toBe(`'  =1+1`);
+  expect(escapeCsvValue('=cmd|calc')).toBe(`'=cmd\\|calc`);
+});
+
+test('escapeCsvValue escapes pre-existing backslashes before escaping pipes', () => {
+  // A literal backslash sitting next to a pipe must not be left as-is: if it
+  // were, the escaped output (`\|`) would be indistinguishable from an
+  // escaped pipe, so a downstream unescaper couldn't recover the original
+  // value. Escaping backslashes first keeps the two cases unambiguous.
+  expect(escapeCsvValue('=cmd\\|calc')).toBe(`'=cmd\\\\\\|calc`);
+});
+
+test('escapeCsvValue RFC-4180-quotes a value containing a bare carriage return', () => {
+  // A raw \r inside a cell can be read as a record separator by some CSV
+  // consumers, so it must trigger outer quoting the same way \n does, even
+  // when it also triggered the formula-prefix guard above.
+  expect(escapeCsvValue('\r=1+1')).toBe(`"'\r=1+1"`);
+});
+
+test('escapeCsvValue keeps ordinary values intact', () => {
+  expect(escapeCsvValue('regular text')).toBe('regular text');
+  expect(escapeCsvValue('-12.5')).toBe('-12.5');
+  expect(escapeCsvValue(42)).toBe('42');
+  expect(escapeCsvValue(null)).toBe('');
+  expect(escapeCsvValue(undefined)).toBe('');
+  expect(escapeCsvValue('a,b')).toBe(`"a,b"`);
+  expect(escapeCsvValue('say "hi"')).toBe(`"say ""hi"""`);
+});
+
 test('shows 413 error toast when exportCSV fails with 413', async () => {
   mockExportChart.mockRejectedValue({ status: 413 });
 

superset-frontend/src/explore/constants.ts

@@ -23,11 +23,22 @@ export const AGGREGATES = {
   COUNT: 'COUNT',
   COUNT_DISTINCT: 'COUNT_DISTINCT',
   MAX: 'MAX',
+  MEDIAN: 'MEDIAN',
   MIN: 'MIN',
+  STDDEV_SAMP: 'STDDEV_SAMP',
   SUM: 'SUM',
+  VAR_SAMP: 'VAR_SAMP',
 };
 export const AGGREGATES_OPTIONS = Object.values(AGGREGATES);
 
+// Human-readable labels for aggregates whose raw enum value isn't
+// self-explanatory in the UI. Aggregates absent here (AVG, COUNT, MAX,
+// MEDIAN, MIN, SUM, ...) are already clear as their raw value.
+export const AGGREGATES_LABELS: Record<string, string> = {
+  STDDEV_SAMP: t('Sample Standard Deviation'),
+  VAR_SAMP: t('Sample Variance'),
+};
+
 export enum Operators {
   Equals = 'EQUALS',
   NotEquals = 'NOT_EQUALS',
@@ -176,7 +187,7 @@ export const DISABLE_INPUT_OPERATORS = [
 export const sqlaAutoGeneratedMetricNameRegex =
   /^(sum|min|max|avg|count|count_distinct)__.*$/i;
 export const sqlaAutoGeneratedMetricRegex =
-  /^(LONG|DOUBLE|FLOAT)?(SUM|AVG|MAX|MIN|COUNT)\([A-Z0-9_."]*\)$/i;
+  /^(LONG|DOUBLE|FLOAT)?(SUM|AVG|MAX|MIN|COUNT|MEDIAN|STDDEV_SAMP|VAR_SAMP)\([A-Z0-9_."]*\)$/i;
 
 export const TIME_FILTER_LABELS = {
   time_range: t('Time range'),

superset-frontend/src/features/databases/DatabaseModal/index.test.tsx

@@ -136,6 +136,7 @@ describe('DatabaseModal', () => {
                 format: 'int32',
                 maximum: 65536,
                 minimum: 0,
+                nullable: true,
                 type: 'integer',
               },
               query: {
@@ -153,7 +154,7 @@ describe('DatabaseModal', () => {
                 type: 'string',
               },
             },
-            required: ['database', 'host', 'port', 'username'],
+            required: ['database', 'host', 'username'],
             type: 'object',
           },
           preferred: true,

superset-frontend/src/pages/ChartList/ChartList.test.tsx

@@ -383,3 +383,223 @@ describe('ChartList - Global Filter Interactions', () => {
     expect((searchInput as HTMLInputElement).value).toBe('');
   });
 });
+
+// The blocking-alerts/reports pre-flight in the Archive modal (sc-117151).
+// Each test registers its report-API route BEFORE setupMocks so it takes
+// precedence over the catch-all route.
+const adminChartUser = { ...mockUser, username: 'admin', permissions: {} };
+
+const openFirstDeleteModal = async () => {
+  // ALERT_REPORTS must be on for the pre-flight to fire at all — with it off
+  // the modal opens synchronously with no dependency fetch (see the flag-off
+  // test below).
+  (
+    isFeatureEnabled as jest.MockedFunction<typeof isFeatureEnabled>
+  ).mockImplementation(
+    (feature: string) =>
+      feature === 'SOFT_DELETE' || feature === 'ALERT_REPORTS',
+  );
+  renderChartList(adminChartUser);
+  await screen.findByTestId('chart-list-view');
+  const deleteButtons = await screen.findAllByTestId('chart-row-delete');
+  fireEvent.click(deleteButtons[0]);
+  return screen.findByRole('dialog');
+};
+
+test('archive modal lists the blocking alerts and reports with their types', async () => {
+  fetchMock.removeRoutes();
+  fetchMock.get('glob:*/api/v1/report/*', {
+    count: 2,
+    result: [
+      { id: 1, name: 'TC-081 rerun report', type: 'Report' },
+      { id: 2, name: 'Threshold alert', type: 'Alert' },
+    ],
+  });
+  setupMocks();
+  try {
+    const dialog = await openFirstDeleteModal();
+    expect(
+      within(dialog).getByText('Associated alerts and reports'),
+    ).toBeInTheDocument();
+    expect(within(dialog).getByText('TC-081 rerun report')).toBeInTheDocument();
+    expect(within(dialog).getByText('Threshold alert')).toBeInTheDocument();
+    expect(within(dialog).getByText('Report')).toBeInTheDocument();
+    expect(within(dialog).getByText('Alert')).toBeInTheDocument();
+    // Advisory only: the Archive button stays enabled.
+    expect(
+      within(dialog).getByRole('button', { name: 'Archive' }),
+    ).toBeEnabled();
+  } finally {
+    fetchMock.clearHistory();
+    (
+      isFeatureEnabled as jest.MockedFunction<typeof isFeatureEnabled>
+    ).mockReset();
+  }
+});
+
+test('archive modal is unchanged when the chart has no alerts or reports', async () => {
+  fetchMock.removeRoutes();
+  fetchMock.get('glob:*/api/v1/report/*', { count: 0, result: [] });
+  setupMocks();
+  try {
+    const dialog = await openFirstDeleteModal();
+    expect(
+      within(dialog).getByText(/moved to Recently Archived/i),
+    ).toBeInTheDocument();
+    expect(
+      within(dialog).queryByText('Associated alerts and reports'),
+    ).not.toBeInTheDocument();
+  } finally {
+    fetchMock.clearHistory();
+    (
+      isFeatureEnabled as jest.MockedFunction<typeof isFeatureEnabled>
+    ).mockReset();
+  }
+});
+
+test('archive modal opens unchanged and confirm still deletes when the report API 404s', async () => {
+  fetchMock.removeRoutes();
+  fetchMock.get('glob:*/api/v1/report/*', 404);
+  fetchMock.delete(`glob:*/api/v1/chart/${mockCharts[0].id}`, {});
+  setupMocks();
+  try {
+    const dialog = await openFirstDeleteModal();
+    expect(
+      within(dialog).queryByText('Associated alerts and reports'),
+    ).not.toBeInTheDocument();
+    fireEvent.click(within(dialog).getByRole('button', { name: 'Archive' }));
+    await waitFor(() =>
+      expect(
+        fetchMock.callHistory.calls(`glob:*/api/v1/chart/${mockCharts[0].id}`),
+      ).toHaveLength(1),
+    );
+  } finally {
+    fetchMock.clearHistory();
+    (
+      isFeatureEnabled as jest.MockedFunction<typeof isFeatureEnabled>
+    ).mockReset();
+  }
+});
+
+test('archive modal caps the list at ten and reports the overflow count', async () => {
+  fetchMock.removeRoutes();
+  fetchMock.get('glob:*/api/v1/report/*', {
+    count: 12,
+    result: Array.from({ length: 10 }, (_, i) => ({
+      id: i + 1,
+      name: `Blocking report ${i + 1}`,
+      type: 'Report',
+    })),
+  });
+  setupMocks();
+  try {
+    const dialog = await openFirstDeleteModal();
+    expect(within(dialog).getByText('Blocking report 10')).toBeInTheDocument();
+    expect(within(dialog).getByText('... and 2 more')).toBeInTheDocument();
+  } finally {
+    fetchMock.clearHistory();
+    (
+      isFeatureEnabled as jest.MockedFunction<typeof isFeatureEnabled>
+    ).mockReset();
+  }
+});
+
+test('archive modal refetches on every open so the list stays fresh', async () => {
+  fetchMock.removeRoutes();
+  fetchMock.get(
+    'glob:*/api/v1/report/*',
+    {
+      count: 1,
+      result: [{ id: 1, name: 'Detach me first', type: 'Report' }],
+    },
+    { name: 'blocking-reports' },
+  );
+  setupMocks();
+  try {
+    const dialog = await openFirstDeleteModal();
+    expect(within(dialog).getByText('Detach me first')).toBeInTheDocument();
+    fireEvent.click(within(dialog).getByRole('button', { name: 'Cancel' }));
+    await waitFor(() =>
+      expect(screen.queryByRole('dialog')).not.toBeInTheDocument(),
+    );
+
+    // The user detaches the report; the next open must show the new truth.
+    fetchMock.removeRoute('blocking-reports');
+    fetchMock.get(
+      'glob:*/api/v1/report/*',
+      { count: 0, result: [] },
+      { name: 'blocking-reports-empty' },
+    );
+    const deleteButtons = await screen.findAllByTestId('chart-row-delete');
+    fireEvent.click(deleteButtons[0]);
+    const reopened = await screen.findByRole('dialog');
+    expect(
+      within(reopened).queryByText('Detach me first'),
+    ).not.toBeInTheDocument();
+    expect(
+      within(reopened).queryByText('Associated alerts and reports'),
+    ).not.toBeInTheDocument();
+  } finally {
+    fetchMock.clearHistory();
+    (
+      isFeatureEnabled as jest.MockedFunction<typeof isFeatureEnabled>
+    ).mockReset();
+  }
+});
+
+test('archive modal opens without any report fetch when ALERT_REPORTS is off', async () => {
+  fetchMock.removeRoutes();
+  fetchMock.get(
+    'glob:*/api/v1/report/*',
+    {
+      count: 1,
+      result: [{ id: 1, name: 'Should not appear', type: 'Report' }],
+    },
+    { name: 'reports-should-not-be-called' },
+  );
+  setupMocks();
+  (
+    isFeatureEnabled as jest.MockedFunction<typeof isFeatureEnabled>
+  ).mockImplementation((feature: string) => feature === 'SOFT_DELETE');
+  try {
+    renderChartList(adminChartUser);
+    await screen.findByTestId('chart-list-view');
+    const deleteButtons = await screen.findAllByTestId('chart-row-delete');
+    fireEvent.click(deleteButtons[0]);
+    const dialog = await screen.findByRole('dialog');
+    expect(
+      within(dialog).queryByText('Associated alerts and reports'),
+    ).not.toBeInTheDocument();
+    expect(
+      fetchMock.callHistory.calls('reports-should-not-be-called'),
+    ).toHaveLength(0);
+  } finally {
+    fetchMock.clearHistory();
+    (
+      isFeatureEnabled as jest.MockedFunction<typeof isFeatureEnabled>
+    ).mockReset();
+  }
+});
+
+test('delete confirmation keeps the type-DELETE gate when SOFT_DELETE is off', async () => {
+  fetchMock.removeRoutes();
+  fetchMock.get('glob:*/api/v1/report/*', { count: 0, result: [] });
+  setupMocks();
+  (
+    isFeatureEnabled as jest.MockedFunction<typeof isFeatureEnabled>
+  ).mockImplementation((feature: string) => feature === 'ALERT_REPORTS');
+  try {
+    renderChartList(adminChartUser);
+    await screen.findByTestId('chart-list-view');
+    const deleteButtons = await screen.findAllByTestId('chart-row-delete');
+    fireEvent.click(deleteButtons[0]);
+    const dialog = await screen.findByRole('dialog');
+    expect(within(dialog).getByText('Please confirm')).toBeInTheDocument();
+    expect(screen.getByTestId('delete-modal-input')).toBeInTheDocument();
+  } finally {
+    fetchMock.clearHistory();
+    (
+      isFeatureEnabled as jest.MockedFunction<typeof isFeatureEnabled>
+    ).mockReset();
+  }
+});

superset-frontend/src/pages/ChartList/index.tsx

@@ -17,7 +17,7 @@
  * under the License.
  */
 import { SupersetTheme, css, styled } from '@apache-superset/core/theme';
-import { t } from '@apache-superset/core/translation';
+import { t, tn } from '@apache-superset/core/translation';
 import {
   isFeatureEnabled,
   FeatureFlag,
@@ -26,7 +26,7 @@ import {
   SupersetClient,
   isMatrixifyEnabled,
 } from '@superset-ui/core';
-import { useState, useMemo, useCallback } from 'react';
+import { useState, useMemo, useCallback, useRef } from 'react';
 import rison from 'rison';
 import { uniqBy } from 'lodash-es';
 import { useSelector } from 'react-redux';
@@ -53,6 +53,8 @@ import {
   ActionButton,
   ConfirmStatusChange,
   CertifiedBadge,
+  DeleteModal,
+  List,
   Tooltip,
   FaveStar,
   InfoTooltip,
@@ -111,6 +113,77 @@ const FlexRowContainer = styled.div`
 `;
 
 const PAGE_SIZE = 25;
+// How many blocking alerts/reports the archive modal previews before the
+// "... and N more" overflow line (dataset-modal parity).
+const BLOCKING_REPORTS_PREVIEW_SIZE = 10;
+
+interface BlockingReport {
+  id: number;
+  name: string;
+  type: 'Alert' | 'Report';
+}
+
+interface ChartDeleteState {
+  chart: Chart;
+  blockingReports: BlockingReport[];
+  blockingReportsCount: number;
+}
+
+function ChartArchiveDescription({
+  chart,
+  blockingReports,
+  blockingReportsCount,
+  softDelete,
+}: ChartDeleteState & { softDelete: boolean }) {
+  const overflowCount = blockingReportsCount - blockingReports.length;
+  return (
+    <>
+      {softDelete ? (
+        <p>{archiveConfirmDescription(t('chart'))}</p>
+      ) : (
+        <p>
+          {t('Are you sure you want to delete')} <b>{chart.slice_name}</b>?
+        </p>
+      )}
+      {blockingReports.length > 0 && (
+        <>
+          <h4>{t('Associated alerts and reports')}</h4>
+          <p>
+            {t(
+              'Archiving or deleting this chart will be blocked while the following alerts or reports use it. Detach or delete them first.',
+            )}
+          </p>
+          <List
+            split={false}
+            size="small"
+            dataSource={blockingReports}
+            renderItem={(report: BlockingReport) => (
+              <List.Item key={report.id} compact>
+                <List.Item.Meta
+                  avatar={<span aria-hidden="true">•</span>}
+                  title={report.name}
+                  description={
+                    report.type === 'Alert' ? t('Alert') : t('Report')
+                  }
+                />
+              </List.Item>
+            )}
+          />
+          {overflowCount > 0 && (
+            <p>
+              {tn(
+                '... and %s more',
+                '... and %s more',
+                overflowCount,
+                overflowCount,
+              )}
+            </p>
+          )}
+        </>
+      )}
+    </>
+  );
+}
 const PASSWORDS_NEEDED_MESSAGE = t(
   'The passwords for the databases below are needed in order to ' +
     'import them together with the charts. Please note that the ' +
@@ -211,6 +284,11 @@ function ChartList(props: ChartListProps) {
   } = useChartEditModal(setCharts, charts);
 
   const [importingChart, showImportModal] = useState<boolean>(false);
+  const [chartCurrentlyDeleting, setChartCurrentlyDeleting] =
+    useState<ChartDeleteState | null>(null);
+  // Monotonic token: a late pre-flight response for an earlier click must not
+  // swap the modal to a different chart (last-response-wins race).
+  const deleteModalRequestRef = useRef(0);
   const [passwordFields, setPasswordFields] = useState<string[]>([]);
   const [preparingExport, setPreparingExport] = useState<boolean>(false);
   const [sshTunnelPasswordFields, setSSHTunnelPasswordFields] = useState<
@@ -274,6 +352,51 @@ function ChartList(props: ChartListProps) {
     [addDangerToast],
   );
 
+  const openChartDeleteModal = useCallback((chart: Chart) => {
+    deleteModalRequestRef.current += 1;
+    const requestToken = deleteModalRequestRef.current;
+    if (!isFeatureEnabled(FeatureFlag.AlertReports)) {
+      // The whole report API 404s when ALERT_REPORTS is off, while the delete
+      // guard still fires server-side. Skip the doomed request and open the
+      // unchanged modal immediately.
+      setChartCurrentlyDeleting({
+        chart,
+        blockingReports: [],
+        blockingReportsCount: 0,
+      });
+      return;
+    }
+    const queryParams = rison.encode({
+      filters: [{ col: 'chart_id', opr: 'eq', value: chart.id }],
+      columns: ['id', 'name', 'type'],
+      order_column: 'name',
+      order_direction: 'asc',
+      page_size: BLOCKING_REPORTS_PREVIEW_SIZE,
+    });
+    SupersetClient.get({ endpoint: `/api/v1/report/?q=${queryParams}` })
+      .then(({ json = {} }) => {
+        if (requestToken !== deleteModalRequestRef.current) return;
+        const blockingReports: BlockingReport[] = json.result ?? [];
+        setChartCurrentlyDeleting({
+          chart,
+          blockingReports,
+          blockingReportsCount: json.count ?? blockingReports.length,
+        });
+      })
+      .catch(() => {
+        if (requestToken !== deleteModalRequestRef.current) return;
+        // The report API can be visibility-filtered below what the delete
+        // guard sees, or fail outright. The list is advisory only, so every
+        // failure opens the unchanged modal rather than blocking the action;
+        // the confirm-time guard stays authoritative.
+        setChartCurrentlyDeleting({
+          chart,
+          blockingReports: [],
+          blockingReportsCount: 0,
+        });
+      });
+  }, []);
+
   function handleBulkChartDelete(chartsToDelete: Chart[]) {
     SupersetClient.delete({
       endpoint: `/api/v1/chart/?q=${rison.encode(
@@ -528,13 +651,6 @@ function ChartList(props: ChartListProps) {
       {
         Cell: ({ row: { original } }: CellProps<Chart>) => {
           const allowEdit = isUserEditorOrAdmin(user, original.editors);
-          const handleDelete = () =>
-            handleChartDelete(
-              original,
-              addSuccessToast,
-              addDangerToast,
-              refreshData,
-            );
           const openEditModal = () => openChartEditModal(original);
           const handleExport = () => handleBulkChartExport([original]);
           if (!canEdit && !canDelete && !canExport) {
@@ -573,43 +689,21 @@ function ChartList(props: ChartListProps) {
                 />
               )}
               {canDelete && (
-                <ConfirmStatusChange
-                  recoverable={softDelete}
-                  title={
-                    softDelete
-                      ? t('Archive %(name)s?', { name: original.slice_name })
-                      : t('Please confirm')
+                <ActionButton
+                  label={deleteActionLabel()}
+                  tooltip={
+                    allowEdit
+                      ? deleteActionLabel()
+                      : t(
+                          'You must be a chart editor in order to delete. Please reach out to a chart editor to request modifications or edit access.',
+                        )
                   }
-                  description={
-                    softDelete ? (
-                      archiveConfirmDescription(t('chart'))
-                    ) : (
-                      <>
-                        {t('Are you sure you want to delete')}{' '}
-                        <b>{original.slice_name}</b>?
-                      </>
-                    )
-                  }
-                  onConfirm={handleDelete}
-                >
-                  {confirmDelete => (
-                    <ActionButton
-                      label={deleteActionLabel()}
-                      tooltip={
-                        allowEdit
-                          ? deleteActionLabel()
-                          : t(
-                              'You must be a chart editor in order to delete. Please reach out to a chart editor to request modifications or edit access.',
-                            )
-                      }
-                      placement="bottom"
-                      icon={<Icons.DeleteOutlined iconSize="l" />}
-                      dataTest="chart-row-delete"
-                      disabled={!allowEdit}
-                      onClick={confirmDelete}
-                    />
-                  )}
-                </ConfirmStatusChange>
+                  placement="bottom"
+                  icon={<Icons.DeleteOutlined iconSize="l" />}
+                  dataTest="chart-row-delete"
+                  disabled={!allowEdit}
+                  onClick={() => openChartDeleteModal(original)}
+                />
               )}
             </Actions>
           );
@@ -634,11 +728,9 @@ function ChartList(props: ChartListProps) {
       canExport,
       saveFavoriteStatus,
       favoriteStatus,
-      refreshData,
-      addSuccessToast,
-      addDangerToast,
       handleBulkChartExport,
       openChartEditModal,
+      openChartDeleteModal,
     ],
   );
 
@@ -933,6 +1025,36 @@ function ChartList(props: ChartListProps) {
           slice={sliceCurrentlyEditing}
         />
       )}
+      {chartCurrentlyDeleting && (
+        <DeleteModal
+          recoverable={softDelete}
+          title={
+            softDelete
+              ? t('Archive %(name)s?', {
+                  name: chartCurrentlyDeleting.chart.slice_name,
+                })
+              : t('Please confirm')
+          }
+          name={chartCurrentlyDeleting.chart.slice_name}
+          open
+          description={
+            <ChartArchiveDescription
+              {...chartCurrentlyDeleting}
+              softDelete={softDelete}
+            />
+          }
+          onConfirm={() => {
+            handleChartDelete(
+              chartCurrentlyDeleting.chart,
+              addSuccessToast,
+              addDangerToast,
+              refreshData,
+            );
+            setChartCurrentlyDeleting(null);
+          }}
+          onHide={() => setChartCurrentlyDeleting(null)}
+        />
+      )}
       <ConfirmStatusChange
         recoverable={softDelete}
         title={softDelete ? t('Archive selected charts?') : t('Please confirm')}

superset-frontend/src/pages/SqlLab/LocationContext.test.tsx

@@ -0,0 +1,66 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { MemoryRouter } from 'react-router-dom';
+import { render, screen } from 'spec/helpers/testing-library';
+
+import { LocationProvider, useLocationState } from './LocationContext';
+
+const Probe = () => {
+  const { requestedQuery } = useLocationState();
+  return (
+    <>
+      <span data-test="autorun">{String(requestedQuery?.autorun)}</span>
+      <span data-test="sql">{String(requestedQuery?.sql)}</span>
+    </>
+  );
+};
+
+const setup = (initialEntry: string | { pathname: string; state: object }) =>
+  render(
+    <MemoryRouter initialEntries={[initialEntry]}>
+      <LocationProvider>
+        <Probe />
+      </LocationProvider>
+    </MemoryRouter>,
+  );
+
+test('never derives autorun from the URL querystring', () => {
+  // Regression test: a crafted cross-site GET link must not be able to
+  // auto-execute SQL in the victim's session (top-level navigation sends
+  // SameSite=Lax session cookies).
+  setup('/sqllab?dbid=1&sql=SELECT%20%2A%20FROM%20t&autorun=true');
+  expect(screen.getByTestId('autorun')).toHaveTextContent('false');
+  // The deep link still prefills the editor with the requested SQL.
+  expect(screen.getByTestId('sql')).toHaveTextContent('SELECT * FROM t');
+});
+
+test('querystring autorun stays false even when spread from raw params', () => {
+  // `...Object.fromEntries(queryParams)` must not reintroduce the raw
+  // `autorun` string value.
+  setup('/sqllab?sql=SELECT%201&autorun=true');
+  expect(screen.getByTestId('autorun')).toHaveTextContent('false');
+});
+
+test('honors autorun from in-app location.state navigations', () => {
+  setup({
+    pathname: '/sqllab',
+    state: { requestedQuery: { sql: 'SELECT 1', autorun: true } },
+  });
+  expect(screen.getByTestId('autorun')).toHaveTextContent('true');
+});

superset-frontend/src/pages/SqlLab/LocationContext.tsx

@@ -41,12 +41,14 @@ export const LocationProvider: FC<{ children?: ReactNode }> = ({
   const queryParams = new URLSearchParams(location.search);
   const permalink = location.pathname.match(/\/p\/\w+/)?.[0].slice(3);
   if (queryParams.size > 0 || permalink) {
-    const autorun = queryParams.get('autorun') === 'true';
+    // Deep links (querystring or permalink) prefill the editor and wait
+    // for the user to press Run. Only in-app navigations that pass
+    // `location.state` (handled above) may request autorun.
     const isDataset = queryParams.get('isDataset') === 'true';
     const queryParamsState = {
       requestedQuery: {
         ...Object.fromEntries(queryParams),
-        autorun,
+        autorun: false,
         permalink,
       },
       isDataset,

superset-frontend/src/views/CRUD/utils.test.tsx

@@ -17,8 +17,12 @@
  * under the License.
  */
 import rison from 'rison';
+import { waitFor } from '@testing-library/react';
+import { SupersetClient } from '@superset-ui/core';
+import Chart from 'src/types/Chart';
 import {
   checkUploadExtensions,
+  handleChartDelete,
   getAlreadyExists,
   getEncryptedExtraFieldsNeeded,
   getFilterValues,
@@ -743,3 +747,27 @@ test('getFilterValues', () => {
     );
   });
 });
+
+test('handleChartDelete surfaces the blocking alert/report names from a 422', async () => {
+  const guardMessage =
+    'There are associated alerts or reports: TC-081 rerun report';
+  const deleteSpy = jest
+    .spyOn(SupersetClient, 'delete')
+    .mockRejectedValue(
+      new Response(JSON.stringify({ message: guardMessage }), { status: 422 }),
+    );
+  const addDangerToast = jest.fn();
+  try {
+    handleChartDelete(
+      { id: 1, slice_name: 'blocked chart' } as Chart,
+      jest.fn(),
+      addDangerToast,
+      jest.fn(),
+    );
+    await waitFor(() => expect(addDangerToast).toHaveBeenCalledTimes(1));
+    expect(addDangerToast.mock.calls[0][0]).toContain('TC-081 rerun report');
+    expect(addDangerToast.mock.calls[0][0]).toContain('blocked chart');
+  } finally {
+    deleteSpy.mockRestore();
+  }
+});

superset-frontend/src/views/CRUD/utils.tsx

@@ -379,9 +379,9 @@ export function handleChartDelete(
       else refreshData();
       addSuccessToast(deletedToast(sliceName));
     },
-    () => {
-      addDangerToast(deleteFailedToast(sliceName));
-    },
+    createErrorHandler(errMsg =>
+      addDangerToast(deleteFailedToast(sliceName, errMsg)),
+    ),
   );
 }
 

superset-frontend/src/visualizations/TimeTable/components/LeftCell/LeftCell.test.tsx

@@ -140,4 +140,59 @@ describe('LeftCell', () => {
       'http://example.com/sales?type=numeric&label=Sales Data',
     );
   });
+
+  test('should not render javascript: URLs as links for column rows', () => {
+    const columnRow = {
+      label: 'Test Column',
+      column_name: 'test_column',
+    };
+
+    render(
+      <LeftCell
+        row={columnRow}
+        rowType="column"
+        url="javascript:alert(document.domain)" // eslint-disable-line no-script-url
+      />,
+    );
+
+    expect(screen.queryByRole('link')).not.toBeInTheDocument();
+    expect(screen.getByText('Test Column')).toBeInTheDocument();
+  });
+
+  test('should not render script-bearing schemes assembled via templating', () => {
+    const columnRow = {
+      label: 'Test Column',
+      column_name: 'alert(1)',
+    };
+
+    render(
+      <LeftCell
+        row={columnRow}
+        rowType="column"
+        url="javascript:{{metric.column_name}}" // eslint-disable-line no-script-url
+      />,
+    );
+
+    expect(screen.queryByRole('link')).not.toBeInTheDocument();
+  });
+
+  test('should keep relative URLs as links', () => {
+    const columnRow = {
+      label: 'Test Column',
+      column_name: 'test_column',
+    };
+
+    render(
+      <LeftCell
+        row={columnRow}
+        rowType="column"
+        url="/superset/dashboard/{{metric.column_name}}/"
+      />,
+    );
+
+    expect(screen.getByRole('link')).toHaveAttribute(
+      'href',
+      '/superset/dashboard/test_column/',
+    );
+  });
 });

superset-frontend/src/visualizations/TimeTable/components/LeftCell/LeftCell.tsx

@@ -28,6 +28,23 @@ interface LeftCellProps {
   url?: string;
 }
 
+/**
+ * Confines a caller-supplied URL to http(s) and relative schemes before
+ * it's rendered as a link. Returns undefined for anything else, degrading
+ * the cell to plain text.
+ */
+export const toSafeHref = (url: string): string | undefined => {
+  try {
+    const { protocol } = new URL(url, window.location.origin);
+    if (protocol === 'http:' || protocol === 'https:') {
+      return url;
+    }
+  } catch {
+    // fall through: unparseable URLs are not rendered as links
+  }
+  return undefined;
+};
+
 /**
  * Renders the left cell containing either column labels or metric information
  */
@@ -35,7 +52,7 @@ const LeftCell = ({ row, rowType, url }: LeftCellProps): ReactElement => {
   const fullUrl = useMemo(() => {
     if (!url) return undefined;
     const context = { metric: row };
-    return Mustache.render(url, context);
+    return toSafeHref(Mustache.render(url, context));
   }, [url, row]);
 
   if (rowType === 'column') {

superset-websocket/spec/index.test.ts

@@ -625,6 +625,42 @@ describe('server', () => {
       );
       expect(wsEventMock).toHaveBeenCalledWith('pong', expect.any(Function));
     });
+
+    test('unsolicited pong payload cannot pollute Object.prototype', async () => {
+      const validToken = jwt.sign({ channel: channelId }, config.jwtSecret);
+      const request = getRequest(validToken, 'http://localhost');
+
+      server.wsConnection(ws, request);
+
+      // Extract the handler registered for the 'pong' event, the same way
+      // the underlying `ws` library would invoke it on a raw pong frame.
+      const pongCall = wsEventMock.mock.calls.find(call => call[0] === 'pong');
+      expect(pongCall).toBeDefined();
+      const pongHandler = pongCall![1] as (data: Buffer) => void;
+
+      // An unsolicited pong with a payload matching an inherited key must not
+      // resolve through the prototype chain and must not write through to
+      // Object.prototype.
+      pongHandler(Buffer.from('__proto__'));
+      pongHandler(Buffer.from('constructor'));
+      pongHandler(Buffer.from('hasOwnProperty'));
+
+      // eslint-disable-next-line no-prototype-builtins
+      expect(Object.prototype.hasOwnProperty('pongTs')).toBe(false);
+      expect(({} as Record<string, unknown>).pongTs).toBeUndefined();
+
+      // A genuine socket id must still record its pong normally.
+      const socketId = server.channels[channelId].sockets[0];
+      const beforePongTs = server.sockets[socketId].pongTs;
+      dateNowSpy.mockImplementation(() =>
+        new Date('2021-03-10T11:02:58.135Z').valueOf(),
+      );
+      pongHandler(Buffer.from(socketId));
+      expect(server.sockets[socketId].pongTs).not.toBe(beforePongTs);
+      expect(server.sockets[socketId].pongTs).toBe(
+        new Date('2021-03-10T11:02:58.135Z').valueOf(),
+      );
+    });
   });
 
   describe('connection limits', () => {

superset-websocket/src/index.ts

@@ -475,12 +475,18 @@ export const wsConnection = (ws: WebSocket, request: http.IncomingMessage) => {
   // init event handler for `pong` events (connection management)
   ws.on('pong', function pong(data: Buffer) {
     const socketId = data.toString();
-    const socketInstance = sockets[socketId];
-    if (!socketInstance) {
+    // `sockets` is a plain object, so an unsolicited pong carrying an
+    // inherited key ('__proto__', 'constructor', 'hasOwnProperty', ...) as
+    // its payload would otherwise resolve through the prototype chain
+    // instead of missing outright, letting a client write an enumerable
+    // `pongTs` onto Object.prototype (tripped over by the for...in loops in
+    // checkSockets/cleanChannel on every GC pass). Guarding with an
+    // own-property check rejects every such key in one place.
+    if (!Object.prototype.hasOwnProperty.call(sockets, socketId)) {
       logger.warn(`pong received for nonexistent socket ${socketId}`);
-    } else {
-      socketInstance.pongTs = Date.now();
+      return;
     }
+    sockets[socketId].pongTs = Date.now();
   });
 };
 

superset/charts/api.py

@@ -1050,7 +1050,7 @@ class ChartRestApi(SoftDeleteApiMixin, BaseSupersetModelRestApi):
                 task_status=cache_payload.get_status(),
             )
 
-        if cache_payload.should_trigger_task(force):
+        if cache_payload.should_trigger_task(force, expected_scope=f"chart:{chart.id}"):
             logger.info("Triggering screenshot ASYNC")
             screenshot_obj.cache.set(cache_key, ScreenshotCachePayload().to_dict())
             cache_chart_thumbnail.delay(
@@ -1112,6 +1112,12 @@ class ChartRestApi(SoftDeleteApiMixin, BaseSupersetModelRestApi):
             return self.response_404()
 
         if cache_payload := ChartScreenshot.get_from_cache_key(digest):
+            # The digest is caller-supplied and cache entries are shared
+            # across every chart (and, via the same backend, dashboards) --
+            # without this check any cache_key learned for one chart would
+            # serve its image under a different, merely-accessible `pk`.
+            if cache_payload.get_scope() != f"chart:{chart.id}":
+                return self.response_404()
             if cache_payload.status == StatusValues.UPDATED:
                 try:
                     image = cache_payload.get_image()

superset/charts/data/api.py

@@ -413,6 +413,12 @@ class ChartDataRestApi(ChartRestApi):
             # for async queries with jinja context
             set_form_data(cached_data)
             query_context = self._create_query_context_from_form(cached_data)
+            # Mark as a cache replay so _sql_filters_modified skips the
+            # SQL-extras check.  The original request already passed the
+            # full security check, cache keys are opaque SHA-256 hashes
+            # (unguessable), and force_cached only serves pre-computed
+            # data — no new SQL is executed.
+            query_context._from_cache_replay = True
             command = ChartDataCommand(query_context)
             command.validate()
         except ChartDataCacheLoadError:

superset/charts/schemas.py

@@ -42,6 +42,7 @@ from superset.utils import pandas_postprocessing, schema as utils
 from superset.utils.core import (
     AnnotationType,
     DatasourceType,
+    EXTENDED_METRIC_AGGREGATES,
     FilterOperator,
     PostProcessingBoxplotWhiskerType,
     PostProcessingContributionOrientation,
@@ -434,7 +435,15 @@ class ChartDataAdhocMetricSchema(Schema):
             "Only required for simple expression types."
         },
         validate=validate.OneOf(
-            choices=("AVG", "COUNT", "COUNT_DISTINCT", "MAX", "MIN", "SUM")
+            choices=(
+                "AVG",
+                "COUNT",
+                "COUNT_DISTINCT",
+                "MAX",
+                "MIN",
+                "SUM",
+                *sorted(EXTENDED_METRIC_AGGREGATES),
+            )
         ),
     )
     column = fields.Nested(ChartDataColumnSchema)

superset/commands/chart/delete.py

@@ -15,6 +15,7 @@
 # specific language governing permissions and limitations
 # under the License.
 import logging
+from collections import defaultdict
 from functools import partial
 from typing import Optional
 
@@ -32,11 +33,62 @@ from superset.daos.chart import ChartDAO
 from superset.daos.report import ReportScheduleDAO
 from superset.exceptions import SupersetSecurityException
 from superset.models.slice import Slice
+from superset.reports.models import ReportSchedule
 from superset.utils.decorators import on_error, transaction
 
 logger = logging.getLogger(__name__)
 
 
+def build_blocked_by_reports_message(
+    charts: list[Slice],
+    reports: list[ReportSchedule],
+    single_target: bool,
+) -> str:
+    """Build the user-facing message naming the alerts/reports that block deletion.
+
+    Groups the blocking reports per chart, sorted by chart name (chart id as
+    the tie-breaker) and then report name so the message is deterministic
+    across database backends, and appends the remedy sentence. When the
+    command targets a single chart id the group prefix is dropped — in the
+    single-delete endpoint the surrounding toast already names the chart, and
+    in a one-chart bulk selection the user's own selection provides the
+    context. A multi-id command keeps the prefix on every group because the
+    bulk toast is generic, so the prefix is the only chart identification the
+    user gets.
+    """
+    sentences: list[str] = []
+    if single_target:
+        names = sorted(report.name for report in reports)
+        sentences.append(
+            str(
+                _(
+                    "This chart is used by alerts or reports: %(names)s.",
+                    names=", ".join(names),
+                )
+            )
+        )
+    else:
+        report_names_by_chart_id: dict[int, list[str]] = defaultdict(list)
+        for report in reports:
+            report_names_by_chart_id[report.chart_id].append(report.name)
+        charts_by_id = {chart.id: chart for chart in charts}
+        for chart_id, names in sorted(
+            report_names_by_chart_id.items(),
+            key=lambda item: (charts_by_id[item[0]].slice_name or "", item[0]),
+        ):
+            sentences.append(
+                str(
+                    _(
+                        'Chart "%(chart)s" is used by alerts or reports: %(names)s.',
+                        chart=charts_by_id[chart_id].slice_name or str(chart_id),
+                        names=", ".join(sorted(names)),
+                    )
+                )
+            )
+    sentences.append(str(_("Detach or delete them first.")))
+    return " ".join(sentences)
+
+
 class DeleteChartCommand(BaseCommand):
     def __init__(self, model_ids: list[int]):
         self._model_ids = model_ids
@@ -55,11 +107,11 @@ class DeleteChartCommand(BaseCommand):
             raise ChartNotFoundError()
         # Check there are no associated ReportSchedules
         if reports := ReportScheduleDAO.find_by_chart_ids(self._model_ids):
-            report_names = [report.name for report in reports]
             raise ChartDeleteFailedReportsExistError(
-                _(
-                    "There are associated alerts or reports: %(report_names)s",
-                    report_names=",".join(report_names),
+                build_blocked_by_reports_message(
+                    self._models,
+                    reports,
+                    single_target=len(self._model_ids) == 1,
                 )
             )
         # Check editorship

superset/commands/dashboard/importers/dispatcher.py

@@ -21,17 +21,21 @@ from typing import Any
 from marshmallow.exceptions import ValidationError
 
 from superset.commands.base import BaseCommand
-from superset.commands.dashboard.importers import v0, v1
+from superset.commands.dashboard.importers import v1
 from superset.commands.exceptions import CommandInvalidError
 from superset.commands.importers.exceptions import IncorrectVersionError
 
 logger = logging.getLogger(__name__)
 
-# list of different import formats supported; v0 should be last because
-# the files are not versioned
+# list of different import formats supported. The legacy v0 importer is
+# deliberately NOT dispatched here: it overrides datasets matched by
+# (table_name, schema, database) and charts/dashboards matched by remote_id
+# without ownership checks, and this dispatcher is reachable from the HTTP
+# import endpoint (POST /api/v1/dashboard/import/). Operators can still
+# import legacy v0 JSON files with the `legacy_import_dashboards` CLI
+# command, which uses the v0 command directly.
 command_versions = [
     v1.ImportDashboardsCommand,
-    v0.ImportDashboardsCommand,
 ]
 
 

superset/commands/database/importers/v1/utils.py

@@ -21,8 +21,10 @@ from typing import Any
 from flask import current_app as app
 
 from superset import db, security_manager
+from superset.commands.database.exceptions import DatabaseInvalidError
 from superset.commands.database.utils import add_permissions
 from superset.commands.exceptions import ImportFailedError
+from superset.constants import PASSWORD_MASK
 from superset.databases.ssh_tunnel.models import SSHTunnel
 from superset.databases.utils import make_url_safe
 from superset.db_engine_specs.exceptions import SupersetDBAPIConnectionError
@@ -37,6 +39,73 @@ from superset.utils import json
 logger = logging.getLogger(__name__)
 
 
+def _connection_identity_changed(existing: Database, config: dict[str, Any]) -> bool:
+    """Whether the import points the database at a different endpoint."""
+    try:
+        stored = make_url_safe(existing.sqlalchemy_uri)._replace(password=None)
+        incoming = make_url_safe(config["sqlalchemy_uri"])._replace(password=None)
+    except DatabaseInvalidError:
+        # An unparseable URI cannot be compared: treat it as a change so
+        # stored secrets never survive onto it.
+        return True
+    return stored != incoming
+
+
+def _refuse_stored_secret_reuse(existing: Database, config: dict[str, Any]) -> None:
+    """
+    Refuse an overwrite that changes the connection endpoint without fresh
+    credentials.
+
+    Database UUIDs are not secrets -- they appear in every exported bundle --
+    so an import must not be able to repoint an existing connection at a new
+    host while the stored password (or SSH tunnel key) is silently kept: the
+    next connection would hand the real credential to the new endpoint.
+    """
+    if _connection_identity_changed(existing, config):
+        try:
+            uri_password = make_url_safe(config["sqlalchemy_uri"]).password
+        except DatabaseInvalidError:
+            uri_password = None
+        if config.get("password") in (None, PASSWORD_MASK) and uri_password in (
+            None,
+            PASSWORD_MASK,
+        ):
+            raise ImportFailedError(
+                f"Import would change the connection of database "
+                f"'{existing.database_name}' without providing new "
+                "credentials. Re-enter the database password for the new "
+                "connection to confirm the change."
+            )
+
+    if ssh_tunnel := config.get("ssh_tunnel"):
+        existing_tunnel = existing.ssh_tunnel
+        if existing_tunnel and (
+            ssh_tunnel.get("server_address") != existing_tunnel.server_address
+            or ssh_tunnel.get("server_port") != existing_tunnel.server_port
+        ):
+            has_fresh_credential = any(
+                ssh_tunnel.get(field) not in (None, PASSWORD_MASK)
+                for field in ("password", "private_key")
+            )
+            # A passphrase-protected private key's stored passphrase is a
+            # secret in its own right: if the existing tunnel had one, a
+            # repoint that supplies a fresh private_key but leaves
+            # private_key_password masked/absent would keep the old
+            # passphrase attached to the new key rather than requiring the
+            # importer to confirm it too.
+            stale_private_key_password = (
+                existing_tunnel.private_key_password is not None
+                and ssh_tunnel.get("private_key_password") in (None, PASSWORD_MASK)
+            )
+            if not has_fresh_credential or stale_private_key_password:
+                raise ImportFailedError(
+                    f"Import would change the SSH tunnel endpoint of database "
+                    f"'{existing.database_name}' without providing new tunnel "
+                    "credentials. Re-enter the SSH tunnel credentials to "
+                    "confirm the change."
+                )
+
+
 def import_database(  # noqa: C901
     config: dict[str, Any],
     overwrite: bool = False,
@@ -51,6 +120,11 @@ def import_database(  # noqa: C901
         if not overwrite or not can_write:
             return existing
         config["id"] = existing.id
+        # Stored secrets must not be rebound to a different endpoint: without
+        # fresh credentials, an overwrite that changes where the database (or
+        # its SSH tunnel) connects would exfiltrate the stored secret to the
+        # new endpoint on the next connection.
+        _refuse_stored_secret_reuse(existing, config)
     elif not can_write:
         raise ImportFailedError(
             "Database doesn't exist and user doesn't have permission to create databases"  # noqa: E501
@@ -81,7 +155,13 @@ def import_database(  # noqa: C901
     # For existing DBs, reveal masked sensitive values from current encrypted_extra.
     # For new DBs, schema validation already ensured no fields are still masked.
     if masked_encrypted_extra := config.pop("masked_encrypted_extra", None):
-        if existing and existing.encrypted_extra:
+        # Never reveal stored encrypted_extra secrets into a config that
+        # repoints the connection at a different endpoint.
+        if (
+            existing
+            and existing.encrypted_extra
+            and not _connection_identity_changed(existing, config)
+        ):
             old_config = json.loads(existing.encrypted_extra)
             new_config = json.loads(masked_encrypted_extra)
             sensitive_fields = (

superset/commands/dataset/importers/dispatcher.py

@@ -21,17 +21,21 @@ from typing import Any
 from marshmallow.exceptions import ValidationError
 
 from superset.commands.base import BaseCommand
-from superset.commands.dataset.importers import v0, v1
+from superset.commands.dataset.importers import v1
 from superset.commands.exceptions import CommandInvalidError
 from superset.commands.importers.exceptions import IncorrectVersionError
 
 logger = logging.getLogger(__name__)
 
-# list of different import formats supported; v0 should be last because
-# the files are not versioned
+# list of different import formats supported. The legacy v0 importer is
+# deliberately NOT dispatched here: it overrides datasets matched by
+# (table_name, schema, database) without ownership checks, and this
+# dispatcher is reachable from the HTTP import endpoint
+# (POST /api/v1/dataset/import/). Operators can still import legacy v0
+# YAML files with the `legacy_import_datasources` CLI command, which uses
+# the v0 command directly.
 command_versions = [
     v1.ImportDatasetsCommand,
-    v0.ImportDatasetsCommand,
 ]
 
 

superset/commands/dataset/importers/v1/utils.py

@@ -15,6 +15,7 @@
 # specific language governing permissions and limitations
 # under the License.
 import gzip
+import io
 import ipaddress
 import logging
 import os
@@ -611,6 +612,29 @@ def _convert_temporal_columns(df: pd.DataFrame, dtype: dict[str, Any]) -> None:
                 df[column_name] = converted
 
 
+def _read_bounded(stream: Any, max_bytes: int) -> io.BytesIO:
+    """
+    Read ``stream`` into memory, failing once more than ``max_bytes`` bytes
+    have been produced.
+
+    Bounds both the raw download and gzip decompression amplification for
+    dataset data URIs: the ``.gz`` path had no analogue of
+    ``check_is_safe_zip`` and allowed unbounded expansion from a small
+    payload.
+    """
+    buffer = io.BytesIO()
+    while chunk := stream.read(1024 * 1024):
+        # Both http.client responses and gzip.open() yield bytes; a handful
+        # of tests substitute a text stream, so normalize either shape.
+        if isinstance(chunk, str):
+            chunk = chunk.encode("utf-8")
+        buffer.write(chunk)
+        if buffer.tell() > max_bytes:
+            raise ImportFailedError("Data URI payload exceeds the maximum allowed size")
+    buffer.seek(0)
+    return buffer
+
+
 def load_data(data_uri: str, dataset: SqlaTable, database: Database) -> None:
     """
     Load data from a data URI into a dataset.
@@ -637,9 +661,15 @@ def load_data(data_uri: str, dataset: SqlaTable, database: Database) -> None:
         handlers.extend([_PeerValidatingHTTPHandler, _PeerValidatingHTTPSHandler])
     opener = request.build_opener(*handlers)
     data = opener.open(data_uri)  # pylint: disable=consider-using-with  # noqa: S310
+    # Cap the bytes materialized from the download, before and after gzip
+    # decompression (same per-file knob as ZIP bundle uploads): a gzip
+    # stream can carry oversized headers, trailing data, or additional
+    # members that would otherwise let the raw (compressed) download exceed
+    # the limit even when the decompressed CSV stays within it.
+    max_bytes = app.config["ZIPPED_FILE_MAX_SIZE"]
     if data_uri.endswith(".gz"):
-        data = gzip.open(data)
-    df = pd.read_csv(data, encoding="utf-8")
+        data = gzip.open(_read_bounded(data, max_bytes))
+    df = pd.read_csv(_read_bounded(data, max_bytes), encoding="utf-8")
     dtype = get_dtype(df, dataset)
 
     _convert_temporal_columns(df, dtype)

superset/commands/importers/v1/utils.py

@@ -27,6 +27,7 @@ from sqlalchemy.orm import Session
 from superset import db
 from superset.commands.importers.exceptions import IncorrectVersionError
 from superset.databases.ssh_tunnel.models import SSHTunnel
+from superset.databases.utils import make_url_safe
 from superset.extensions import feature_flag_manager
 from superset.models.core import Database
 from superset.models.dashboard import dashboard_slices
@@ -103,6 +104,34 @@ def validate_metadata_type(
             exceptions.append(exc)
 
 
+def database_connection_identity_unchanged(
+    stored_uri: Optional[str], incoming_uri: Optional[str]
+) -> bool:
+    """
+    Whether an incoming database config still points at the same connection
+    (driver, host, port -- everything except the credential) as the stored one.
+
+    Stored secrets may only be re-attached to an import when this holds:
+    database UUIDs are not secrets (they appear in every exported bundle and
+    in API responses), so re-attaching secrets on a UUID match alone would
+    let a hostile bundle repoint an existing connection at an
+    attacker-controlled server that then receives the victim's real
+    credentials.
+    """
+    if not stored_uri or not incoming_uri:
+        return False
+    try:
+        stored = make_url_safe(stored_uri)._replace(password=None)
+        incoming = make_url_safe(incoming_uri)._replace(password=None)
+    except Exception:  # pylint: disable=broad-except
+        # An unparseable URI cannot be compared; never attach secrets to it.
+        return False
+    # Compare the full URL minus the credential, not just host/port: query
+    # arguments become driver connect args and can themselves redirect the
+    # connection (e.g. ``?host=`` for postgres drivers).
+    return stored == incoming
+
+
 # pylint: disable=too-many-locals,too-many-arguments
 # ruff: noqa: C901
 def load_configs(
@@ -141,6 +170,21 @@ def load_configs(
             SSHTunnel.uuid, SSHTunnel.private_key_password
         ).all()
     }
+    # load connection endpoints so stored secrets are only re-attached to a
+    # config that still points at the same endpoint (see
+    # database_connection_identity_unchanged)
+    db_sqlalchemy_uris: dict[str, str] = {
+        str(uuid): sqlalchemy_uri
+        for uuid, sqlalchemy_uri in db.session.query(
+            Database.uuid, Database.sqlalchemy_uri
+        ).all()
+    }
+    db_ssh_tunnel_servers: dict[str, tuple[Any, Any]] = {
+        str(uuid): (server_address, server_port)
+        for uuid, server_address, server_port in db.session.query(
+            SSHTunnel.uuid, SSHTunnel.server_address, SSHTunnel.server_port
+        ).all()
+    }
     for file_name, content in contents.items():
         # skip directories
         if not content:
@@ -151,6 +195,38 @@ def load_configs(
         if schema:
             try:
                 config = load_yaml(file_name, content)
+                if not isinstance(config, dict):
+                    # A syntactically valid YAML document whose top-level
+                    # value is a scalar or list (not a mapping) has no
+                    # fields to validate against the schema; report it the
+                    # same way as unparseable YAML instead of letting the
+                    # ``.get()`` calls below raise an unhandled AttributeError.
+                    raise ValidationError({file_name: "Not a valid YAML file"})
+
+                # Stored secrets are only reusable when the incoming config
+                # still points at the same endpoint as the stored one; a UUID
+                # match alone must never rebind stored credentials to a new
+                # host (see database_connection_identity_unchanged).
+                db_secrets_reusable = (
+                    prefix == "databases"
+                    and database_connection_identity_unchanged(
+                        db_sqlalchemy_uris.get(str(config.get("uuid"))),
+                        config.get("sqlalchemy_uri"),
+                    )
+                )
+                incoming_tunnel = config.get("ssh_tunnel") or {}
+                stored_tunnel_server = db_ssh_tunnel_servers.get(
+                    str(config.get("uuid"))
+                )
+                tunnel_secrets_reusable = (
+                    prefix == "databases"
+                    and stored_tunnel_server is not None
+                    and (
+                        incoming_tunnel.get("server_address"),
+                        incoming_tunnel.get("server_port"),
+                    )
+                    == stored_tunnel_server
+                )
 
                 # populate passwords from the request, from YAML config,
                 # or from existing DBs
@@ -159,14 +235,15 @@ def load_configs(
                 elif prefix == "databases" and config.get("password"):
                     # password already in YAML config, keep it
                     pass
-                elif prefix == "databases" and config["uuid"] in db_passwords:
+                elif db_secrets_reusable and config["uuid"] in db_passwords:
                     config["password"] = db_passwords[config["uuid"]]
 
                 # populate ssh_tunnel_passwords from the request or from existing DBs
                 if file_name in ssh_tunnel_passwords:
                     config["ssh_tunnel"]["password"] = ssh_tunnel_passwords[file_name]
                 elif (
-                    prefix == "databases" and config["uuid"] in db_ssh_tunnel_passwords
+                    tunnel_secrets_reusable
+                    and config["uuid"] in db_ssh_tunnel_passwords
                 ):
                     config["ssh_tunnel"]["password"] = db_ssh_tunnel_passwords[
                         config["uuid"]
@@ -178,7 +255,7 @@ def load_configs(
                         file_name
                     ]
                 elif (
-                    prefix == "databases"
+                    tunnel_secrets_reusable
                     and config["uuid"] in db_ssh_tunnel_private_keys
                 ):
                     config["ssh_tunnel"]["private_key"] = db_ssh_tunnel_private_keys[
@@ -191,7 +268,7 @@ def load_configs(
                         ssh_tunnel_priv_key_passwords[file_name]
                     )
                 elif (
-                    prefix == "databases"
+                    tunnel_secrets_reusable
                     and config["uuid"] in db_ssh_tunnel_priv_key_passws
                 ):
                     config["ssh_tunnel"]["private_key_password"] = (

superset/commands/query/importers/v1/utils.py

@@ -17,16 +17,52 @@
 
 from typing import Any
 
-from superset import db
+from superset import db, security_manager
+from superset.commands.exceptions import ImportFailedError
 from superset.models.sql_lab import SavedQuery
+from superset.utils.core import get_user
 
 
-def import_saved_query(config: dict[str, Any], overwrite: bool = False) -> SavedQuery:
+def import_saved_query(
+    config: dict[str, Any],
+    overwrite: bool = False,
+    ignore_permissions: bool = False,
+) -> SavedQuery:
+    """Import a saved query from a config dict, handling existing matches.
+
+    A saved query is a personal, per-user asset: the REST API scopes read,
+    update and delete to ``created_by == g.user`` (``SavedQueryFilter``).
+    The same object-level rule is enforced here on the overwrite path so an
+    importer cannot replace another user's saved query (and the SQL the
+    victim will later run under their own grants) by reusing its UUID in an
+    import bundle -- matching the permission checks every sibling importer
+    (chart, dashboard, dataset, database, theme) already performs.
+    """
+    can_write = ignore_permissions or security_manager.can_access(
+        "can_write",
+        "SavedQuery",
+    )
     existing = db.session.query(SavedQuery).filter_by(uuid=config["uuid"]).first()
     if existing:
-        if not overwrite:
+        if not overwrite or not can_write:
             return existing
+        # ``user`` is None on background paths (no Flask request user);
+        # combined with ``can_write`` (typically from
+        # ``ignore_permissions=True``) the ownership check is skipped there
+        # because the caller has already established trust -- mirroring the
+        # chart importer.
+        user = get_user()
+        if user and not (security_manager.is_admin() or existing.created_by == user):
+            raise ImportFailedError(
+                f"Saved query (uuid {config['uuid']}) already exists and "
+                "user doesn't have permissions to overwrite it"
+            )
         config["id"] = existing.id
+    elif not can_write:
+        raise ImportFailedError(
+            "Saved query doesn't exist and user doesn't have permission to "
+            "create saved queries"
+        )
 
     saved_query = SavedQuery.import_from_dict(config, recursive=False)
     if saved_query.id is None:

superset/commands/report/create.py

@@ -154,7 +154,7 @@ class CreateReportScheduleCommand(CreateMixin, BaseReportScheduleCommand):
         if (
             creation_method != ReportCreationMethod.ALERTS_REPORTS
             and not ReportScheduleDAO.validate_unique_creation_method(
-                dashboard_id, chart_id
+                dashboard_id, chart_id, creation_method
             )
         ):
             raise ReportScheduleCreationMethodUniquenessValidationError()

superset/commands/sql_lab/execute.py

@@ -151,6 +151,15 @@ class ExecuteSqlCommand(BaseCommand):
             self._validate_access(query, self._execution_context.template_params)
             self._execution_context.set_query(query)
             rendered_query = self._sql_query_render.render(self._execution_context)
+            # The check above authorizes a render of query.sql + template_params
+            # performed before rendering, so that macros with side effects are
+            # gated before they run. self._sql_query_render.render() above is an
+            # independent second render of the same source; for a
+            # nondeterministic template (e.g. one using Jinja's `random` filter
+            # to pick a table) the two renders can diverge, letting a query
+            # read a table the first check never saw. Re-validate the literal
+            # rendered text that is about to execute.
+            self._validate_rendered_access(query, rendered_query)
             self._set_query_limit_if_required(rendered_query)
             self._query_dao.update(
                 query, {"limit": self._execution_context.query.limit}
@@ -212,6 +221,23 @@ class ExecuteSqlCommand(BaseCommand):
         except Exception as ex:
             raise QueryIsForbiddenToAccessException(self._execution_context, ex) from ex
 
+    def _validate_rendered_access(self, query: Query, rendered_query: str) -> None:
+        """
+        Re-authorize the exact SQL that is about to execute.
+
+        Pins ``query.executed_sql`` to the literal, already-rendered text so
+        ``security_manager.raise_for_access``'s "prefer executed_sql" path
+        authorizes that exact SQL directly, with no further Jinja
+        re-render (see its docstring). ``executed_sql`` is reset
+        afterwards so the execution path can assign its own final
+        (limited / per-block mutated) SQL.
+        """
+        query.executed_sql = rendered_query
+        try:
+            self._validate_access(query, self._execution_context.template_params)
+        finally:
+            query.executed_sql = None
+
     def _set_query_limit_if_required(
         self,
         rendered_query: str,

superset/commands/sql_lab/permalink/get.py

@@ -17,7 +17,6 @@
 import logging
 from typing import Optional
 
-from superset import db
 from superset.commands.dataset.exceptions import DatasetNotFoundError
 from superset.commands.sql_lab.permalink.base import BaseSqlLabPermalinkCommand
 from superset.daos.key_value import KeyValueDAO
@@ -27,10 +26,8 @@ from superset.key_value.exceptions import (
     KeyValueParseKeyError,
 )
 from superset.key_value.utils import decode_permalink_id
-from superset.models import core as models
 from superset.sqllab.permalink.exceptions import SqlLabPermalinkGetFailedError
 from superset.sqllab.permalink.types import SqlLabPermalinkValue
-from superset.utils import core as utils, json
 
 logger = logging.getLogger(__name__)
 
@@ -41,18 +38,14 @@ class GetSqlLabPermalinkCommand(BaseSqlLabPermalinkCommand):
 
     def run(self) -> Optional[SqlLabPermalinkValue]:
         self.validate()
-        if self.key.startswith("kv:"):
-            id = int(self.key[3:])
-            try:
-                kv = db.session.query(models.KeyValue).filter_by(id=id).scalar()
-                if not kv:
-                    return None
-                return json.loads(kv.value)
-            except Exception as ex:
-                raise SqlLabPermalinkGetFailedError(
-                    message=utils.error_msg_from_exception(ex)
-                ) from ex
-
+        # Legacy `kv:<int>` keys (from the pre-permalink `keyvalue` table) are
+        # no longer resolved here: that table has sequential integer primary
+        # keys and no owner column, so any authenticated caller could
+        # enumerate other users' saved editor state (SQL text and
+        # connection/schema context) by incrementing the id. Such keys now
+        # fall through to `decode_permalink_id` below, which rejects them
+        # (they don't decode against the salted hashid scheme), leaving the
+        # modern salted-hashid store as the only way to resolve a permalink.
         try:
             key = decode_permalink_id(self.key, salt=self.salt)
             value = KeyValueDAO.get_value(self.resource, key, self.codec)

superset/commands/streaming_export/base.py

@@ -33,6 +33,7 @@ from sqlalchemy import text
 
 from superset import db
 from superset.commands.base import BaseCommand
+from superset.utils.csv import escape_value
 
 logger = logging.getLogger(__name__)
 
@@ -110,7 +111,15 @@ class BaseStreamingCSVExportCommand(BaseCommand):
         self, columns: list[str], csv_writer: Any, buffer: io.StringIO
     ) -> tuple[str, int]:
         """Write CSV header and return header data with byte count."""
-        csv_writer.writerow(columns)
+        # Mirror the non-streaming export path (df_to_escaped_csv): header
+        # cells can carry attacker-influenced labels, so neutralize
+        # spreadsheet formula prefixes here too.
+        csv_writer.writerow(
+            [
+                escape_value(column) if isinstance(column, str) else column
+                for column in columns
+            ]
+        )
         header_data = buffer.getvalue()
         total_bytes = len(header_data.encode("utf-8"))
         buffer.seek(0)
@@ -121,7 +130,8 @@ class BaseStreamingCSVExportCommand(BaseCommand):
         self, row: tuple[Any, ...], decimal_separator: str | None
     ) -> list[Any]:
         """
-        Format row values, applying custom decimal separator if specified.
+        Format row values: escape string cells against CSV formula injection
+        and apply the custom decimal separator if specified.
 
         Args:
             row: Database row as a tuple
@@ -130,20 +140,30 @@ class BaseStreamingCSVExportCommand(BaseCommand):
         Returns:
             List of formatted values
         """
-        if not decimal_separator or decimal_separator == ".":
-            return list(row)
+        active_decimal_separator = (
+            decimal_separator
+            if decimal_separator and decimal_separator != "."
+            else None
+        )
 
         formatted: list[Any] = []
         for value in row:
+            # Escape string cells so spreadsheet formula prefixes (= + - @ |,
+            # leading tab/CR) are neutralized, mirroring the non-streaming
+            # CSV path (superset.utils.csv.df_to_escaped_csv).
+            if isinstance(value, str):
+                formatted.append(escape_value(value))
             # Apply the custom decimal separator to any real numeric value
             # (float, decimal.Decimal, numpy numeric types, ...). Booleans are
             # technically a numeric type in Python but should never be rewritten
             # as numbers in CSV output.
-            if isinstance(value, bool):
+            elif isinstance(value, bool):
                 formatted.append(value)
-            elif isinstance(value, (float, Decimal, Real)):
+            elif active_decimal_separator is not None and isinstance(
+                value, (float, Decimal, Real)
+            ):
                 # Format numeric values with custom decimal separator
-                formatted.append(str(value).replace(".", decimal_separator))
+                formatted.append(str(value).replace(".", active_decimal_separator))
             else:
                 formatted.append(value)
         return formatted

superset/connectors/sqla/models.py

@@ -1898,11 +1898,6 @@ class SqlaTable(
 
         if expression_type == utils.AdhocMetricExpressionType.SIMPLE:
             aggregate: Any = metric.get("aggregate")
-            if (
-                not isinstance(aggregate, str)
-                or aggregate not in self.sqla_aggregations
-            ):
-                raise QueryObjectValidationError(_("Adhoc metric aggregate is invalid"))
             metric_column = metric.get("column") or {}
             column_name = cast(str, metric_column.get("column_name"))
             table_column: TableColumn | None = columns_by_name.get(column_name)
@@ -1912,7 +1907,27 @@ class SqlaTable(
                 )
             else:
                 sqla_column = column(column_name)
-            sqla_metric = self.sqla_aggregations[aggregate](sqla_column)
+
+            if isinstance(aggregate, str) and aggregate in self.sqla_aggregations:
+                sqla_metric = self.sqla_aggregations[aggregate](sqla_column)
+            elif isinstance(aggregate, str) and (
+                extended_func := self.db_engine_spec.get_extended_aggregation_func(
+                    aggregate
+                )
+            ):
+                sqla_metric = extended_func(sqla_column)
+            elif (
+                isinstance(aggregate, str)
+                and aggregate in utils.EXTENDED_METRIC_AGGREGATES
+            ):
+                raise QueryObjectValidationError(
+                    _(
+                        "The %(aggregate)s aggregate is not supported on this database",
+                        aggregate=aggregate,
+                    )
+                )
+            else:
+                raise QueryObjectValidationError(_("Adhoc metric aggregate is invalid"))
         elif expression_type == utils.AdhocMetricExpressionType.SQL:
             expression: str | None = metric.get("sqlExpression")
             if not isinstance(expression, str) or not expression.strip():

superset/daos/report.py

@@ -180,17 +180,27 @@ class ReportScheduleDAO(BaseDAO[ReportSchedule]):
 
     @staticmethod
     def validate_unique_creation_method(
-        dashboard_id: int | None = None, chart_id: int | None = None
+        dashboard_id: int | None = None,
+        chart_id: int | None = None,
+        creation_method: str | None = None,
     ) -> bool:
         """
-        Validate if the user already has a chart or dashboard
-        with a report attached form the self subscribe reports
+        Validate if the user already has a chart or dashboard with a report
+        attached that was created via the same creation method as the one
+        being validated. Only reports created through the same method (e.g.
+        two "charts"-sourced reports) compete for the one-per-object slot --
+        an unrelated self-subscribed alert/report (creation method
+        "alerts_reports") on the same chart or dashboard doesn't count
+        against it.
         """
 
         query = db.session.query(ReportSchedule).filter_by(created_by_fk=get_user_id())
         if dashboard_id is not None:
             query = query.filter(ReportSchedule.dashboard_id == dashboard_id)
 
+        if creation_method is not None:
+            query = query.filter(ReportSchedule.creation_method == creation_method)
+
         if chart_id is not None:
             query = query.filter(ReportSchedule.chart_id == chart_id)
 

superset/dashboards/api.py

@@ -74,6 +74,7 @@ from superset.commands.dashboard.export_example import ExportExampleCommand
 from superset.commands.dashboard.fave import AddFavoriteDashboardCommand
 from superset.commands.dashboard.importers.dispatcher import ImportDashboardsCommand
 from superset.commands.dashboard.permalink.create import CreateDashboardPermalinkCommand
+from superset.commands.dashboard.permalink.get import GetDashboardPermalinkCommand
 from superset.commands.dashboard.restore import RestoreDashboardCommand
 from superset.commands.dashboard.unfave import DelFavoriteDashboardCommand
 from superset.commands.dashboard.update import (
@@ -105,6 +106,7 @@ from superset.dashboards.filters import (
     DashboardTagNameFilter,
     DashboardTitleOrSlugFilter,
 )
+from superset.dashboards.permalink.exceptions import DashboardPermalinkGetFailedError
 from superset.dashboards.permalink.types import DashboardPermalinkState
 from superset.dashboards.schemas import (
     CacheScreenshotSchema,
@@ -1842,6 +1844,43 @@ class DashboardRestApi(
             raise
         return self.response(202, job_id=job_id)
 
+    def _validate_permalink_for_dashboard(
+        self, permalink_key: str, dashboard: Dashboard
+    ) -> WerkzeugResponse | None:
+        """
+        Resolve (and access-check, as the calling user) a caller-supplied
+        permalink key, and confirm it belongs to `dashboard`.
+
+        A permalink key is resolved as the calling user, before it's ever
+        handed to the (potentially more-privileged) screenshot executor --
+        otherwise a caller with access only to `dashboard` could pass the
+        permalink key of a dashboard they can't access and have it rendered
+        under the executor's identity.
+
+        :returns: An error response if the key doesn't resolve, isn't
+            accessible to the caller, or belongs to a different dashboard;
+            ``None`` if it's valid for `dashboard`.
+        """
+        try:
+            permalink_value = GetDashboardPermalinkCommand(permalink_key).run()
+        except DashboardPermalinkGetFailedError:
+            return self.response_404()
+        except DashboardAccessDeniedError:
+            return self.response_403()
+        if not permalink_value:
+            return self.response_404()
+        try:
+            permalink_dashboard = DashboardDAO.get_by_id_or_slug(
+                permalink_value["dashboardId"]
+            )
+        except DashboardAccessDeniedError:
+            return self.response_403()
+        except DashboardNotFoundError:
+            return self.response_404()
+        if permalink_dashboard.id != dashboard.id:
+            return self.response_403()
+        return None
+
     @expose("/<pk>/cache_dashboard_screenshot/", methods=("POST",))
     @validate_feature_flags(["THUMBNAILS", "ENABLE_DASHBOARD_SCREENSHOT_ENDPOINTS"])
     @protect()
@@ -1912,13 +1951,17 @@ class DashboardRestApi(
 
         # if the permalink key is provided, dashboard_state will be ignored
         # else, create a permalink key from the dashboard_state
-        permalink_key = (
-            payload.get("permalinkKey", None)
-            or CreateDashboardPermalinkCommand(
+        permalink_key = payload.get("permalinkKey", None)
+        if permalink_key:
+            if error_response := self._validate_permalink_for_dashboard(
+                permalink_key, dashboard
+            ):
+                return error_response
+        else:
+            permalink_key = CreateDashboardPermalinkCommand(
                 dashboard_id=str(dashboard.id),
                 state=dashboard_state,
             ).run()
-        )
 
         dashboard_url = get_url_path("Superset.dashboard_permalink", key=permalink_key)
         screenshot_obj = DashboardScreenshot(dashboard_url, dashboard.digest)
@@ -1940,7 +1983,9 @@ class DashboardRestApi(
                 task_status=cache_payload.get_status(),
             )
 
-        if cache_payload.should_trigger_task(force):
+        if cache_payload.should_trigger_task(
+            force, expected_scope=f"dashboard:{dashboard.id}"
+        ):
             logger.info("Triggering screenshot ASYNC")
             cache_dashboard_screenshot.delay(
                 username=get_current_user(),
@@ -2019,6 +2064,12 @@ class DashboardRestApi(
         # fetch the dashboard screenshot using the current user and cache if set
 
         if cache_payload := DashboardScreenshot.get_from_cache_key(digest):
+            # The digest is caller-supplied and cache entries are shared across
+            # every dashboard (and, via the same backend, charts) -- without
+            # this check any cache_key learned for one dashboard would serve
+            # its image under a different, merely-accessible `pk`.
+            if cache_payload.get_scope() != f"dashboard:{dashboard.id}":
+                return self.response_404()
             try:
                 image = cache_payload.get_image()
             except ScreenshotImageNotAvailableException:

superset/db_engine_specs/base.py

@@ -632,6 +632,33 @@ class BaseEngineSpec:  # pylint: disable=too-many-public-methods
     # issuing one query per level. Conservative default of False; engines opt in.
     supports_grouping_sets = False
 
+    # SQL-generating callables for metric aggregates that have no safe, universal
+    # cross-dialect spelling -- unlike SUM/COUNT/AVG/MIN/MAX/COUNT_DISTINCT (see
+    # `SqlaTable.sqla_aggregations`), which SQLAlchemy's generic `sa.func` can emit
+    # unchanged on every engine. Keyed by `Aggregate` name (see
+    # `superset-frontend/packages/superset-ui-core/src/query/types/Metric.ts`);
+    # each value takes a SQLAlchemy column and returns the aggregate expression.
+    # Absent by default: an aggregate not present here is unsupported on this
+    # engine, and callers must surface a clear "not supported" error rather than
+    # emit unverified SQL (a wrong statistic returned silently is worse than an
+    # error). Engines opt in via `get_extended_aggregation_func` below once the
+    # expression has been verified against real engine behavior, not assumed
+    # from syntax alone -- see the MySQL engine spec for a concrete example of
+    # why this distinction matters (its `VARIANCE()` computes the *population*
+    # variance, not the *sample* variance `VAR_SAMP` denotes).
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {}
+
+    @classmethod
+    def get_extended_aggregation_func(
+        cls, aggregate: str
+    ) -> Callable[[ColumnElement], ColumnElement] | None:
+        """
+        SQL-generating callable for an aggregate not handled by the generic
+        `sa.func` mapping (e.g. MEDIAN, STDDEV_SAMP, VAR_SAMP). Returns None if
+        this engine has no verified, correct expression for it.
+        """
+        return cls._extended_aggregations.get(aggregate)
+
     # Is the DB engine spec able to change the default schema? This requires implementing  # noqa: E501
     # a custom `adjust_engine_params` method.
     supports_dynamic_schema = False
@@ -3010,6 +3037,11 @@ class BasicParametersMixin:
     # for Databend this would be `{"sslmode": "disable"}`, eg.
     encryption_disable_parameters: dict[str, str] = {}
 
+    # parameters that `validate_parameters` treats as mandatory; subclasses
+    # override this to relax a parameter (e.g. `port`) without duplicating
+    # the rest of `validate_parameters`
+    required_parameters: set[str] = {"host", "port", "username", "database"}
+
     @classmethod
     def build_sqlalchemy_uri(  # pylint: disable=unused-argument
         cls,
@@ -3081,7 +3113,7 @@ class BasicParametersMixin:
         """
         errors: list[SupersetError] = []
 
-        required = {"host", "port", "username", "database"}
+        required = cls.required_parameters
         parameters = properties.get("parameters", {})
         present = {key for key in parameters if parameters.get(key, ())}
 
@@ -3110,7 +3142,7 @@ class BasicParametersMixin:
             return errors
 
         port = parameters.get("port", None)
-        if not port:
+        if port is None or port == "":
             return errors
         try:
             port = int(port)

superset/db_engine_specs/cockroachdb.py

@@ -15,9 +15,10 @@
 # specific language governing permissions and limitations
 # under the License.
 from datetime import datetime
-from typing import Any, Optional
+from typing import Any, Callable, Optional
 
 from sqlalchemy import types
+from sqlalchemy.sql.elements import ColumnElement
 
 from superset.db_engine_specs.base import DatabaseCategory
 from superset.db_engine_specs.postgres import PostgresEngineSpec
@@ -27,6 +28,12 @@ class CockroachDbEngineSpec(PostgresEngineSpec):
     engine = "cockroachdb"
     engine_name = "CockroachDB"
 
+    # `PostgresEngineSpec._extended_aggregations` (MEDIAN/STDDEV_SAMP/VAR_SAMP)
+    # is verified against real Postgres behavior, not CockroachDB's distributed
+    # query engine; disable it here until someone confirms the same expressions
+    # against a live CockroachDB instance.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {}
+
     metadata = {
         "description": (
             "CockroachDB is a distributed SQL database built for cloud applications."

superset/db_engine_specs/doris.py

@@ -17,13 +17,14 @@
 import logging
 import re
 from re import Pattern
-from typing import Any, Optional
+from typing import Any, Callable, Optional
 from urllib import parse
 
 from flask_babel import gettext as __
 from sqlalchemy import Float, Integer, Numeric, String, TEXT, text, types
 from sqlalchemy.engine.reflection import Inspector
 from sqlalchemy.engine.url import URL
+from sqlalchemy.sql.elements import ColumnElement
 from sqlalchemy.sql.type_api import TypeEngine
 
 from superset.db_engine_specs.base import DatabaseCategory
@@ -121,6 +122,11 @@ class DorisEngineSpec(MySQLEngineSpec):
     # while technically supported by Doris, this generates invalid table identifiers
     supports_cross_catalog_queries = False
 
+    # `MySQLEngineSpec._extended_aggregations` (STDDEV_SAMP/VAR_SAMP) is verified
+    # against real MySQL behavior, not Doris's OLAP query engine; disable it here
+    # until someone confirms the same expressions against a live Doris instance.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {}
+
     metadata = {
         "description": (
             "Apache Doris is a high-performance real-time analytical database."

superset/db_engine_specs/duckdb.py

@@ -20,8 +20,9 @@ from __future__ import annotations
 import re
 from datetime import datetime
 from re import Pattern
-from typing import Any, TYPE_CHECKING, TypedDict
+from typing import Any, Callable, TYPE_CHECKING, TypedDict
 
+import sqlalchemy as sa
 from apispec import APISpec
 from apispec.ext.marshmallow import MarshmallowPlugin
 from flask import current_app as app
@@ -30,6 +31,7 @@ from marshmallow import fields, Schema
 from sqlalchemy import text, types
 from sqlalchemy.engine.reflection import Inspector
 from sqlalchemy.engine.url import URL
+from sqlalchemy.sql.elements import ColumnElement
 
 from superset.constants import TimeGrain
 from superset.databases.utils import make_url_safe
@@ -202,6 +204,18 @@ class DuckDBEngineSpec(DuckDBParametersMixin, BaseEngineSpec):
     sqlalchemy_uri_placeholder = "duckdb:////path/to/duck.db"
     supports_multivalues_insert = True
 
+    # Verified against a live duckdb instance (in-process, no server needed),
+    # including under GROUPING SETS: the grand total correctly reflects every
+    # row, not an aggregate-of-aggregates. STDDEV_SAMP/VAR_SAMP values match
+    # postgres/mysql exactly for the same inputs; MEDIAN matches postgres
+    # (mysql has no native MEDIAN to compare against). Inherited by
+    # MotherDuckEngineSpec.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {
+        "MEDIAN": sa.func.median,
+        "STDDEV_SAMP": sa.func.stddev_samp,
+        "VAR_SAMP": sa.func.var_samp,
+    }
+
     metadata = {
         "description": (
             "DuckDB is an in-process OLAP database designed for fast "

superset/db_engine_specs/greenplum.py

@@ -15,6 +15,10 @@
 # specific language governing permissions and limitations
 # under the License.
 
+from typing import Callable
+
+from sqlalchemy.sql.elements import ColumnElement
+
 from superset.db_engine_specs.base import DatabaseCategory
 from superset.db_engine_specs.postgres import PostgresEngineSpec
 
@@ -30,6 +34,12 @@ class GreenplumEngineSpec(PostgresEngineSpec):
     engine_name = "Greenplum"
     default_driver = "psycopg2"
 
+    # `PostgresEngineSpec._extended_aggregations` (MEDIAN/STDDEV_SAMP/VAR_SAMP) is
+    # verified against real Postgres behavior, not Greenplum's MPP query engine;
+    # disable it here until someone confirms the same expressions against a live
+    # Greenplum instance.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {}
+
     metadata = {
         "description": (
             "VMware Greenplum is a massively parallel processing (MPP) "

superset/db_engine_specs/hana.py

@@ -15,9 +15,10 @@
 # specific language governing permissions and limitations
 # under the License.
 from datetime import datetime
-from typing import Any, Optional
+from typing import Any, Callable, Optional
 
 from sqlalchemy import types
+from sqlalchemy.sql.elements import ColumnElement
 
 from superset.constants import TimeGrain
 from superset.db_engine_specs.base import DatabaseCategory
@@ -29,6 +30,11 @@ class HanaEngineSpec(PostgresBaseEngineSpec):
     engine = "hana"
     engine_name = "SAP HANA"
 
+    # `PostgresBaseEngineSpec._extended_aggregations` (MEDIAN/STDDEV_SAMP/VAR_SAMP)
+    # is verified against real Postgres behavior, not HANA's; disable it here
+    # until someone confirms the same expressions against a live HANA instance.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {}
+
     metadata = {
         "description": (
             "SAP HANA is an in-memory relational database and application platform."

superset/db_engine_specs/hologres.py

@@ -17,6 +17,10 @@
 
 from __future__ import annotations
 
+from typing import Callable
+
+from sqlalchemy.sql.elements import ColumnElement
+
 from superset.db_engine_specs.base import DatabaseCategory
 from superset.db_engine_specs.postgres import PostgresBaseEngineSpec
 
@@ -32,6 +36,12 @@ class HologresEngineSpec(PostgresBaseEngineSpec):
     engine_name = "Hologres"
     default_driver = "psycopg2"
 
+    # `PostgresBaseEngineSpec._extended_aggregations` (MEDIAN/STDDEV_SAMP/VAR_SAMP)
+    # is verified against real Postgres behavior, not Hologres's real-time analytics
+    # engine; disable it here until someone confirms the same expressions against a
+    # live Hologres instance.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {}
+
     metadata = {
         "description": (
             "Alibaba Cloud Hologres is a real-time interactive analytics service, "

superset/db_engine_specs/mysql.py

@@ -25,6 +25,7 @@ from re import Pattern
 from typing import Any, Callable, Optional, TYPE_CHECKING
 from urllib import parse
 
+import sqlalchemy as sa
 from flask_babel import gettext as __
 from sqlalchemy import types
 from sqlalchemy.dialects.mysql import (
@@ -40,6 +41,7 @@ from sqlalchemy.dialects.mysql import (
     TINYTEXT,
 )
 from sqlalchemy.engine.url import URL
+from sqlalchemy.sql.elements import ColumnElement
 
 from superset.constants import TimeGrain
 from superset.db_engine_specs.base import (
@@ -94,6 +96,22 @@ class MySQLEngineSpec(BasicParametersMixin, BaseEngineSpec):
     supports_dynamic_schema = True
     supports_multivalues_insert = True
 
+    # Verified against a live mysql:8.0 instance, including under GROUP BY ...
+    # WITH ROLLUP. `STDDEV_SAMP`/`VAR_SAMP` are native, correct sample
+    # statistics. MEDIAN is deliberately absent: MySQL has neither a `MEDIAN`
+    # function nor `PERCENTILE_CONT` (confirmed: both error). Its `VARIANCE()`
+    # function is population variance, not sample variance, so it is not a
+    # valid stand-in for VAR_SAMP either.
+    # Inherited by MariaDB (a MySQL fork implementing the same aggregate
+    # functions) and by Aurora MySQL / its Data API variant (AWS's wire- and
+    # SQL-compatible managed MySQL) -- unlike CockroachDB/Greenplum/HANA
+    # relative to Postgres, none of these run a materially different query
+    # engine, so no separate reset is needed.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {
+        "STDDEV_SAMP": sa.func.stddev_samp,
+        "VAR_SAMP": sa.func.var_samp,
+    }
+
     metadata = {
         "description": "MySQL is a popular open-source relational database.",
         "logo": "mysql.png",

superset/db_engine_specs/netezza.py

@@ -14,6 +14,10 @@
 # KIND, either express or implied.  See the License for the
 # specific language governing permissions and limitations
 # under the License.
+from typing import Callable
+
+from sqlalchemy.sql.elements import ColumnElement
+
 from superset.constants import TimeGrain
 from superset.db_engine_specs.base import DatabaseCategory
 from superset.db_engine_specs.postgres import PostgresBaseEngineSpec
@@ -24,6 +28,11 @@ class NetezzaEngineSpec(PostgresBaseEngineSpec):
     default_driver = "nzpy"
     engine_name = "IBM Netezza Performance Server"
 
+    # `PostgresBaseEngineSpec._extended_aggregations` (MEDIAN/STDDEV_SAMP/VAR_SAMP)
+    # is verified against real Postgres behavior, not Netezza's; disable it here
+    # until someone confirms the same expressions against a live Netezza instance.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {}
+
     metadata = {
         "description": "IBM Netezza Performance Server is a data warehouse appliance.",
         "logo": "netezza.png",

superset/db_engine_specs/oceanbase.py

@@ -17,10 +17,11 @@
 import logging
 import re
 from re import Pattern
-from typing import Any, Optional
+from typing import Any, Callable, Optional
 
 from flask_babel import gettext as __
 from sqlalchemy import Numeric, TEXT, types
+from sqlalchemy.sql.elements import ColumnElement
 from sqlalchemy.sql.type_api import TypeEngine
 
 from superset.db_engine_specs.base import DatabaseCategory
@@ -84,6 +85,12 @@ class OceanBaseEngineSpec(MySQLEngineSpec):
     encryption_parameters = {"ssl": "0"}
     supports_dynamic_schema = True
 
+    # `MySQLEngineSpec._extended_aggregations` (STDDEV_SAMP/VAR_SAMP) is verified
+    # against real MySQL behavior, not OceanBase's distributed query engine;
+    # disable it here until someone confirms the same expressions against a live
+    # OceanBase instance.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {}
+
     metadata = {
         "description": "OceanBase is a distributed relational database.",
         "logo": "oceanbase.svg",

superset/db_engine_specs/postgres.py

@@ -23,12 +23,16 @@ from datetime import datetime
 from re import Pattern
 from typing import Any, Callable, Optional, TYPE_CHECKING
 
+import sqlalchemy as sa
 from flask_babel import gettext as __
+from marshmallow import fields, pre_load
+from marshmallow.validate import Range
 from sqlalchemy import text, types
 from sqlalchemy.dialects.postgresql import DOUBLE_PRECISION, ENUM, INTERVAL, JSON
 from sqlalchemy.dialects.postgresql.base import PGInspector
 from sqlalchemy.engine.reflection import Inspector
 from sqlalchemy.engine.url import URL
+from sqlalchemy.sql.elements import ColumnElement
 from sqlalchemy.sql.expression import ColumnClause
 from sqlalchemy.types import Date, DateTime, String
 
@@ -37,6 +41,8 @@ from superset.db_engine_specs.base import (
     AURORA_DATA_API_KNOWN_INCOMPATIBILITIES,
     BaseEngineSpec,
     BasicParametersMixin,
+    BasicParametersSchema,
+    BasicParametersType,
     DatabaseCategory,
     TimestampExpression,
 )
@@ -192,6 +198,25 @@ class PostgresBaseEngineSpec(BaseEngineSpec):
         TimeGrain.YEAR: "DATE_TRUNC('year', {col})",
     }
 
+    # Verified against a live postgres:16 instance, including under GROUPING
+    # SETS (the pivot table's non-additive-total rollup pattern): the grand
+    # total correctly reflects every row, not an aggregate-of-aggregates.
+    # STDDEV_SAMP/VAR_SAMP (not MEDIAN -- see its override) are inherited by
+    # Redshift (a Postgres fork); its SQL function reference documents the
+    # same support, but that has not been separately verified against a live
+    # Redshift instance.
+    # Also inherited by TimescaleDB (a Postgres extension, not a forked query
+    # engine -- it runs unmodified Postgres aggregate execution) and by
+    # Aurora PostgreSQL / its Data API variant (AWS's wire- and
+    # SQL-compatible managed Postgres). Engines that share the SQL dialect
+    # but run a materially different query engine (CockroachDB, Greenplum,
+    # SAP HANA) reset this to `{}` instead -- see those engine specs.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {
+        "MEDIAN": lambda col: sa.func.percentile_cont(0.5).within_group(col),
+        "STDDEV_SAMP": sa.func.stddev_samp,
+        "VAR_SAMP": sa.func.var_samp,
+    }
+
     custom_errors: dict[Pattern[str], tuple[str, SupersetErrorType, dict[str, Any]]] = {
         CONNECTION_INVALID_USERNAME_REGEX: (
             __('The username "%(username)s" does not exist.'),
@@ -298,6 +323,34 @@ class PostgresBaseEngineSpec(BaseEngineSpec):
         return None
 
 
+class PostgresParametersSchema(BasicParametersSchema):
+    """
+    Same as ``BasicParametersSchema``, except ``port`` is optional: a blank
+    port falls back to Postgres's own default (5432) in
+    ``PostgresEngineSpec.build_sqlalchemy_uri``.
+    """
+
+    port = fields.Integer(
+        required=False,
+        allow_none=True,
+        metadata={"description": __("Database port")},
+        validate=Range(min=0, max=2**16, max_inclusive=False),
+    )
+
+    @pre_load
+    def blank_port_to_none(self, data: Any, **kwargs: Any) -> Any:
+        """
+        A cleared number input in the Connect Database form submits ``""``
+        for ``port`` (HTML input values are always strings) rather than
+        omitting the key or sending ``null``. Normalize it to ``None`` so it
+        deserializes cleanly instead of failing with "Not a valid integer.",
+        and is treated as blank -- same as an omitted port -- downstream.
+        """
+        if isinstance(data, dict) and data.get("port") == "":
+            data = {**data, "port": None}
+        return data
+
+
 class PostgresEngineSpec(BasicParametersMixin, PostgresBaseEngineSpec):
     engine = "postgresql"
     engine_name = "PostgreSQL"
@@ -309,6 +362,11 @@ class PostgresEngineSpec(BasicParametersMixin, PostgresBaseEngineSpec):
     supports_grouping_sets = True
 
     default_driver = "psycopg2"
+    parameters_schema = PostgresParametersSchema()
+    # ``port`` is intentionally not required: a blank port falls back to
+    # Postgres's own default (``metadata["default_port"]``) in
+    # ``BasicParametersMixin.build_sqlalchemy_uri`` (overridden below).
+    required_parameters = {"host", "username", "database"}
     sqlalchemy_uri_placeholder = (
         "postgresql://user:password@host:port/dbname[?key=value&key=value...]"
     )
@@ -674,6 +732,34 @@ class PostgresEngineSpec(BasicParametersMixin, PostgresBaseEngineSpec):
 
         return uri, connect_args
 
+    @classmethod
+    def build_sqlalchemy_uri(
+        cls,
+        parameters: BasicParametersType,
+        encrypted_extra: dict[str, str] | None = None,
+    ) -> str:
+        """
+        Default a missing/blank port to Postgres's own default (5432) so the
+        dynamic form can connect without requiring the port to be filled in.
+
+        Only an absent key, ``None``, or ``""`` (what a cleared number input
+        submits, since this may be called directly with raw, non-schema-
+        loaded parameters -- see ``ValidateDatabaseParametersCommand``) are
+        treated as blank; an explicitly supplied port -- including ``0`` --
+        is preserved as-is rather than overwritten by a truthiness check.
+        """
+        port = parameters.get("port")
+        resolved_port: int = (
+            cls.metadata["default_port"] if port is None or port == "" else port
+        )
+        parameters_with_default_port: BasicParametersType = {
+            **parameters,
+            "port": resolved_port,
+        }
+        return super().build_sqlalchemy_uri(
+            parameters_with_default_port, encrypted_extra
+        )
+
     @staticmethod
     def mutate_db_for_connection_test(database: Database) -> None:
         """

superset/db_engine_specs/redshift.py

@@ -20,10 +20,12 @@ import logging
 import re
 import warnings
 from re import Pattern
-from typing import Any
+from typing import Any, Callable
 
 import pandas as pd
+import sqlalchemy as sa
 from flask_babel import gettext as __
+from sqlalchemy.sql.elements import ColumnElement
 from sqlalchemy.types import NVARCHAR
 
 from superset.db_engine_specs.base import BasicParametersMixin, DatabaseCategory
@@ -277,6 +279,24 @@ class RedshiftEngineSpec(BasicParametersMixin, PostgresBaseEngineSpec):
         "$.aws_iam.role_arn": "AWS IAM Role ARN",
     }
 
+    # Redshift inherits `PostgresBaseEngineSpec._extended_aggregations` for
+    # STDDEV_SAMP/VAR_SAMP (plain, non-sort-based aggregate calls), but
+    # overrides MEDIAN here instead of inheriting Postgres's spelling.
+    # Postgres has no native MEDIAN function and compiles it to
+    # `percentile_cont(0.5) WITHIN GROUP (ORDER BY col)`; Redshift, unlike
+    # Postgres, documents a native `MEDIAN(x)` aggregate function. Using
+    # that native spelling -- rather than the inherited WITHIN-GROUP form --
+    # also sidesteps a documented Redshift restriction rejecting more than
+    # one sort-based aggregate (MEDIAN, PERCENTILE_CONT, LISTAGG WITHIN
+    # GROUP, ...) with a different ORDER BY in the same query, e.g.
+    # `MEDIAN(sales)` alongside `MEDIAN(margin)`: a plain function call has
+    # no explicit ORDER BY clause to conflict.
+    _extended_aggregations: dict[str, Callable[[ColumnElement], ColumnElement]] = {
+        "MEDIAN": sa.func.median,
+        "STDDEV_SAMP": PostgresBaseEngineSpec._extended_aggregations["STDDEV_SAMP"],
+        "VAR_SAMP": PostgresBaseEngineSpec._extended_aggregations["VAR_SAMP"],
+    }
+
     @staticmethod
     def update_params_from_encrypted_extra(
         database: Database,