Merge branch 'master' into fix/issue-31991-iran-alborz-duplicate-iso

fix(sqllab): wrap process_template() in format_sql to prevent raw UndefinedError leak (#42917 )
fix: hydrate JWT user before list API filters (#39946 )
2026-08-12 11:11:01 +00:00 · 2026-08-10 15:25:46 -07:00 · 2026-08-10 15:02:10 -07:00 · 2026-08-10 14:18:28 -07:00 · 2026-08-10 13:56:47 -07:00 · 2026-08-10 16:52:43 -03:00
990 changed files with 59065 additions and 28712 deletions
@@ -34,7 +34,7 @@

 **/*.geojson @villebro @rusackas
 **/*.ipynb @villebro @rusackas
-/superset-frontend/plugins/legacy-plugin-chart-country-map/ @villebro @rusackas
+/superset-frontend/plugins/plugin-chart-country-map/ @villebro @rusackas

 # Notify translation maintainers of changes to translations

@@ -47,6 +47,13 @@ updates:
      # as a single manual upgrade anyway. TODO: remove when Babel 8 support is viable.
      - dependency-name: "@babel/*"
        update-types: ["version-update:semver-major"]
+      # v2.0.0 renamed ZSTDDecompress to decompress and made it async, breaking
+      # the webpack dev proxy (see #38662, #39138, #39139). Dependabot reopened
+      # the same bump in #39369 after the first revert, so pin it here instead
+      # of relying on a package.json comment (package.json is JSON and can't
+      # hold comments). Remove this once the proxy code is updated to await
+      # the async decompress() API.
+      - dependency-name: "simple-zstd"
    directory: "/superset-frontend/"
    schedule:
      interval: "daily"
@@ -22,7 +22,7 @@ jobs:
  check-python-deps:
    runs-on: ubuntu-26.04
    steps:
-      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
        with:
          expand-composite-actions: true

@@ -51,7 +51,7 @@ jobs:
      - name: Login to Docker Hub
        if: steps.check.outputs.python
        continue-on-error: true
-        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USER }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -64,7 +64,7 @@ jobs:

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
        with:
          languages: ${{ matrix.language }}
          # If you wish to specify custom queries, you can do so here or in a config file.
@@ -75,6 +75,6 @@ jobs:
          # queries: security-extended,security-and-quality

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
        with:
          category: "/language:${{matrix.language}}"
@@ -50,7 +50,7 @@ jobs:
    # You cannot use a liccheck.ini file in this workflow.
    runs-on: ubuntu-slim
    steps:
-      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
        with:
          expand-composite-actions: true

@@ -221,6 +221,6 @@ jobs:
    permissions:
      actions: read
    steps:
-      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
        with:
          expand-composite-actions: true
@@ -37,7 +37,7 @@ jobs:
          persist-credentials: false
          submodules: recursive
      - name: Setup Java
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          distribution: "temurin"
          java-version: "11"
@@ -46,4 +46,4 @@ jobs:
        run: bash .github/workflows/github-action-validator.sh

      - name: Check for security issues on GHA workflows
-        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
@@ -23,7 +23,7 @@ jobs:
          persist-credentials: false
          submodules: recursive
      - name: Setup Java
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          distribution: "temurin"
          java-version: "11"
@@ -80,13 +80,13 @@ jobs:
          - starburstdata/presto:350-e.6
    steps:
      - name: Log in to Docker Hub (authenticated source pulls)
-        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USER }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Log in to GHCR (push target)
-        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -195,6 +195,6 @@ jobs:
    if: always()
    runs-on: ubuntu-26.04
    steps:
-      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
        with:
          expand-composite-actions: true
@@ -41,7 +41,7 @@ jobs:
        ports:
          - 16379:6379
    steps:
-      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
        with:
          expand-composite-actions: true

@@ -60,7 +60,7 @@ jobs:
    name: Build & Deploy
    runs-on: ubuntu-26.04
    steps:
-      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
        with:
          expand-composite-actions: true

@@ -76,7 +76,7 @@ jobs:
          node-version-file: "./docs/.nvmrc"
      - name: Setup Python
        uses: ./.github/actions/setup-backend/
-      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          distribution: "zulu"
          java-version: "21"
@@ -355,6 +355,6 @@ jobs:
    permissions:
      actions: read
    steps:
-      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
        with:
          expand-composite-actions: true
@@ -76,6 +76,6 @@ jobs:
    if: always()
    runs-on: ubuntu-26.04
    steps:
-      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
        with:
          expand-composite-actions: true
@@ -182,11 +182,6 @@ jobs:
          docker run --rm $TAG bash -c \
          "npm ls --all --package-lock-only --depth=0 --json > /dev/null"

-      - name: Build Plugins Packages
-        run: |
-          docker run --rm $TAG bash -c \
-          "npm run plugins:build"
-
  test-storybook:
    needs: frontend-build
    if: needs.frontend-build.outputs.should-run == 'true'
@@ -214,6 +209,6 @@ jobs:
    permissions:
      actions: read
    steps:
-      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
        with:
          expand-composite-actions: true
@@ -22,7 +22,7 @@ jobs:
  lint-test:
    runs-on: ubuntu-slim
    steps:
-      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
        with:
          expand-composite-actions: true

@@ -178,6 +178,6 @@ jobs:
    permissions:
      actions: read
    steps:
-      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
        with:
          expand-composite-actions: true
@@ -263,6 +263,6 @@ jobs:
    permissions:
      actions: read
    steps:
-      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
        with:
          expand-composite-actions: true
@@ -166,6 +166,6 @@ jobs:
    permissions:
      actions: read
    steps:
-      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
        with:
          expand-composite-actions: true
@@ -105,7 +105,7 @@ jobs:
      contents: read
      actions: read
    steps:
-      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
        with:
          expand-composite-actions: true

@@ -161,6 +161,6 @@ jobs:
    permissions:
      actions: read
    steps:
-      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
        with:
          expand-composite-actions: true
@@ -38,7 +38,7 @@ jobs:
      - name: Login to Docker Hub
        if: ${{ steps.dependabot-metadata.outputs.package-ecosystem == 'pip' }}
        continue-on-error: true
-        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USER }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -138,6 +138,7 @@ PROJECT.md
 .aider*
 .claude_rc*
 .claude/settings.local.json
+.claude/worktrees/
 .env.local
 oxc-custom-build/
 *.code-workspace
@@ -2,22 +2,29 @@

 Apache Superset is a data visualization platform with Flask/Python backend and React/TypeScript frontend.

-## ⚠️ CRITICAL: Always Run Pre-commit Before Pushing
+## Run Pre-commit Before Pushing

-**ALWAYS run `pre-commit run --all-files` before pushing commits.** CI will fail if pre-commit checks don't pass. This is non-negotiable.
+Always run pre-commit against the files changed by the current branch before
+pushing. This matches CI and keeps unrelated failures already present on
+`master` from blocking otherwise independent work.

 ```bash
 # Stage your changes first
 git add .

-# Run pre-commit on all files
-pre-commit run --all-files
+# Run pre-commit on staged files
+pre-commit run

 # If there are auto-fixes, stage them and commit
 git add .
 git commit --amend  # or new commit
 ```

+Use `pre-commit run --all-files` when auditing or repairing the repository-wide
+baseline. If that check finds failures in files untouched by the current branch,
+fix them in a separate branch rather than adding unrelated changes to the
+current pull request.
+
 Common pre-commit failures:
 - **Formatting** - black, oxfmt, eslint will auto-fix
 - **Type errors** - mypy failures need manual fixes
@@ -24,6 +24,104 @@ assists people when migrating to a new version.

 ## Next

+- [42393](https://github.com/apache/superset/pull/42393): Exported dataset YAML now carries a `uuid` for each metric and column so that custom folder assignments (which reference metrics/columns by UUID) survive an import into another workspace. This affects any export bundle that contains datasets, not just a dataset export: chart, dashboard, database and full-asset exports all embed the same dataset YAML, so a dashboard exported from this release also fails to import into an older one even though no dataset was exported directly. As with `folders` and `currency_code_column`, the affected `datasets/` files fail schema validation (`Unknown field: uuid`) when imported into Superset releases that predate this change; regenerate or hand-edit exports for older targets in mixed-version fleets.
+
+### Soft delete is on by default, and purging is live
+
+`SOFT_DELETE` now ships **on** (`DEFAULT_FEATURE_FLAGS`), so deleting a
+dashboard, chart, or dataset archives it rather than removing it. Archived
+objects are hidden from normal listings, recoverable from **Recently Archived**,
+and permanently removed once the retention window elapses.
+`SOFT_DELETE_PURGE_DRY_RUN` also flips to `False`, so the nightly
+`deletion_retention.purge_soft_deleted` task deletes for real instead of only
+logging `would_purge` counts.
+
+**What operators should do before upgrading:**
+
+- **Size the first live purge.** The first real run removes every entity that
+  aged past `SOFT_DELETE_RETENTION_DAYS` (default 30) since soft delete began
+  capturing, which on a busy deployment can be a large batch in one window. To
+  see the size first, set `SOFT_DELETE_PURGE_DRY_RUN = True`, read the
+  `would_purge` counts from one nightly run, then set it back.
+- **Check a replaced `CELERY_CONFIG`.** A deployment that redefines it rather
+  than inheriting must carry both `superset.tasks.deletion_retention` in
+  `imports` and the `deletion_retention.purge_soft_deleted` beat entry;
+  a startup warning now names whichever is absent.
+
+**Both switches are retained.** `SOFT_DELETE = False` restores hard-delete
+behaviour and `SOFT_DELETE_PURGE_DRY_RUN = True` suspends purging, at any time.
+One caveat on turning soft delete back off: objects archived while it was on are
+**resurrected** into normal listings, since the rows were never removed — an
+emergency stop rather than a clean rollback.
+
+### Version history is on by default
+
+`VERSION_HISTORY` and `ENABLE_VERSIONING_CAPTURE` now both ship **on**. Every
+save of a chart, dashboard, or dataset writes version rows, and the version
+history panel appears on Explore and Dashboard pages. The two flip together
+deliberately: a panel with capture off renders an empty "No history yet" that
+misrepresents the entity as unchanged.
+
+**What operators should expect:**
+
+- **Storage growth.** Capture writes shadow rows per save, so the metadata
+  database grows with edit volume. The `version_history.prune_old_versions`
+  beat task removes rows whose transaction is older than
+  `SUPERSET_VERSION_HISTORY_RETENTION_DAYS` (default 30). A deployment that
+  replaces `CELERY_CONFIG` rather than inheriting it must carry both the
+  `superset.tasks.version_history_retention` import and the beat entry; a
+  startup warning names whichever is absent.
+- **`PUT` responses change shape.** Entity updates now return populated
+  `old_version_uuid` / `new_version_uuid` fields and an `ETag` header, which
+  were null or absent while capture was off.
+
+`ENABLE_VERSIONING_CAPTURE` is **retained permanently** as an operational
+kill-switch — not removed with the rollout toggles. Setting it to a falsy value
+stops capture within a restart, without a revert-and-redeploy. Unlike the
+soft-delete toggle, turning it off is a clean stop: existing version rows remain
+readable and no entity state is altered.
+
+### Scheduled report execution now enforces one application deadline
+
+Scheduled report (not alert) executions are now governed by a single
+end-to-end deadline shared by browser readiness, capture/PDF generation,
+notification delivery, and terminal-state persistence, configured via
+`ALERT_REPORTS_EXECUTION_BUDGET_SECONDS` (with per-phase reserve settings).
+Behavior changes to be aware of:
+
+- The effective budget for a schedule is
+  `min(ALERT_REPORTS_EXECUTION_BUDGET_SECONDS, working_timeout)`. The default
+  budget (one hour) matches the historical `working_timeout` model default,
+  so default installations see no change in how long a report may run —
+  but reports now fail cleanly (with an error notification) at the deadline
+  instead of being killed silently by Celery.
+- For REPORT schedules, the Celery `soft_time_limit`/`time_limit` are now
+  derived from that same effective budget plus
+  `ALERT_REPORTS_EXECUTION_HARD_TIMEOUT_GRACE_SECONDS`, replacing the
+  previous `working_timeout + ALERT_REPORTS_WORKING_TIME_OUT_LAG` /
+  `+ ALERT_REPORTS_WORKING_SOFT_TIME_OUT_LAG` derivation. Alert schedules
+  keep the previous behavior.
+- A `working_timeout` smaller than the summed phase reserves is floored at
+  the minimum viable budget (reserves + 30s) with a warning; such reports
+  fail fast at the first phase check rather than erroring at setup.
+- Dashboard reports whose charts have not mounted are no longer captured
+  blank: readiness is polled until the deadline, and the report fails loudly
+  if charts never mount. Thumbnails and non-report screenshots keep their
+  previous behavior.
+
+### Embedded (guest token) API responses no longer echo database errors
+
+API responses served to a guest-token principal now carry a generic
+`An error occurred while fetching the data.` in place of the underlying error
+(`You don't have permission to access this resource.` on a 401/403), and drop
+the `stacktrace` and error `extra` payloads. Engine errors routinely quote
+catalog, schema, table and column names of the warehouse, which embedded
+viewers should not see. Errors Superset authors itself — access denials, OAuth2
+redirects, timeouts, payload validation — keep their message and type, though
+their `extra` is still reduced to the fields the client needs. Responses to
+every non-guest principal are unchanged, and the full error is still logged
+server-side.
+
 ### Principal listing APIs now honour related-field filters

 Two authorization-related listing behaviors changed for API clients. Neither
@@ -233,6 +331,10 @@ are the intended model going forward; deprecating and removing implicit viewersh
 in a later major version.

 - [41044](https://github.com/apache/superset/issues/41044): Removes the deprecated `AVOID_COLORS_COLLISION` feature flag (it defaulted to `True`). Color-collision avoidance is now permanently enabled; any config override setting it to `False` is ignored.
+- [41714](https://github.com/apache/superset/pull/41714): **Breaking — the legacy `explore_json` chart-data pipeline is removed** at its long-declared `5.0.0` EOL. The `/superset/explore_json/` and `/superset/explore_json/data/<cache_key>` endpoints, `superset/viz.py`, the `Slice.viz` property, the `get_viz` factory, the `load_explore_json_into_cache` celery task and the `viz=` overload of `security_manager.raise_for_access` are gone. Anything importing `superset.viz` must migrate to the QueryContext / `pandas_postprocessing` pipeline behind `/api/v1/chart/data`. All 15 remaining legacy charts were migrated first: most keep their `viz_type` and renderer (no action needed for saved charts), while saved nvd3 Bubble charts are auto-migrated to the ECharts Bubble Chart (`bubble_v2`) and saved "Time-series Percent Change" (`compare`) charts to the ECharts Line Chart, which restores the nvd3 renderer's interactive percent re-basing via a draggable baseline. The deck.gl Multiple Layers chart now fetches its layers entirely client-side, refitting the viewport as each layer's data arrives, and caps the number of sub-slices fanned out per chart at `DECK_MULTI_MAX_SLICES` (default 50, configurable); dashboard filter badges no longer aggregate child-layer filter metadata.
+
+- [41714](https://github.com/apache/superset/pull/41714): Charts migrated in place keep a `NULL` saved query context until they are next opened in Explore (which regenerates it automatically) or re-saved. Until then, cache warm-up and annotation layers referencing such a chart report an actionable error rather than warming/rendering; opening the chart once resolves it.
+- [41714](https://github.com/apache/superset/pull/41714): **Breaking for third-party viz plugins** — the `useLegacyApi` field of `ChartMetadata` in `@superset-ui/core` is removed. Plugins that set it must provide a `buildQuery` and consume `/api/v1/chart/data`. The migrated first-party packages also drop their `legacy-` prefix: `@superset-ui/legacy-plugin-chart-{calendar,chord,country-map,horizon,paired-t-test,parallel-coordinates,partition,rose,world-map}` → `@superset-ui/plugin-chart-*`, and `@superset-ui/legacy-preset-chart-nvd3` → `@superset-ui/preset-chart-nvd3`. The `can_explore_json` permission is no longer created or granted; custom roles referencing it should switch to the `can_read` permissions on `Chart`.

 - [41813](https://github.com/apache/superset/pull/41813): `redis` (the Python client, `redis-py`) is bumped from 5.3.1 to 8.0.1. redis-py 8 changes several connection defaults; Superset's own Redis-backed features (`GLOBAL_ASYNC_QUERIES_CACHE_BACKEND`, `DISTRIBUTED_COORDINATION_CONFIG`, and the MCP Redis store) explicitly pin the pre-upgrade behavior so this bump is a no-op for them: the wire protocol stays RESP2 (not the new RESP3 default, which requires Redis/Sentinel 6+ to speak `HELLO`) and there is still no socket timeout by default (redis-py 8 defaults to 5s, which could otherwise newly time out large cached payloads or slow networks). The no-timeout default can now be overridden via two new config keys, `CACHE_REDIS_SOCKET_TIMEOUT` / `CACHE_REDIS_SOCKET_CONNECT_TIMEOUT`, on any `CacheConfig` dict using `CACHE_TYPE: RedisCache` or `RedisSentinelCache`. Separately, redis-py 6+ changed the default for `ssl_check_hostname` from `False` to `True` for SSL connections using `ssl_cert_reqs="required"` (the default) — this is a security improvement, so it has **not** been reverted; deployments with `CACHE_REDIS_SSL=True` whose certificates lack a hostname matching the connection address should set `CACHE_REDIS_SSL_CERT_REQS="none"` (disables cert verification entirely, matching hostname-check bypass) or replace the certificate. General-purpose cache/results backends configured via `CACHE_CONFIG` / `DATA_CACHE_CONFIG` / `RESULTS_BACKEND` with `CACHE_TYPE: RedisCache` go through `flask-caching`'s own Redis backend (outside Superset's code) and are subject to the same new defaults; pass `socket_timeout` / `protocol` via `CACHE_OPTIONS` there if needed. Celery broker and result-backend connections (built by `kombu`, also outside Superset's code) keep their no-socket-timeout behavior (`kombu` passes `socket_timeout=None` explicitly) but do **not** pin the wire protocol, so they follow redis-py's RESP3 default — which requires a Redis server new enough to speak `HELLO` (Redis 6+). Deployments using a pre-6.0 Redis server (EOL) as a Celery broker should upgrade the server before taking this bump.

@@ -252,7 +354,7 @@ in a later major version.

 - **`SqlaTable.sql_url` query-string format.** `SqlaTable.sql_url` now URL-encodes `table_name` and joins it as a query parameter rather than concatenating a second `?`. Previously, with `Database.sql_url` returning `/sqllab/?dbid=<id>`, the concatenation produced `/sqllab/?dbid=<id>?table_name=<raw>` — a malformed second `?` that broke the query parser. External code that parsed the legacy `<base>?table_name=<raw>` shape now sees properly percent-encoded values (e.g. `/` → `%2F`, ` ` → `+` or `%20`); decode with `urllib.parse.parse_qsl`.

- **New config flag `EMBEDDED_DISABLE_PERMALINK_ORIGIN_REWRITE` (default `False`).** Share/permalink URLs now substitute `window.location.origin` for the backend-supplied origin so a proxied or subdirectory-deployed Superset never hands the user an unreachable internal hostname. Operators whose reverse proxy correctly forwards `X-Forwarded-Host` *and* who want permalinks to carry the backend's literal origin can opt out by setting `EMBEDDED_DISABLE_PERMALINK_ORIGIN_REWRITE = True` in `superset_config.py`. Default `False` (rewrite is on); flipping the default would regress the dominant proxied/subdir deployment to an unreachable host.
+- **New config flag `EMBEDDED_DISABLE_PERMALINK_ORIGIN_REWRITE` (default `False`).** Share/permalink URLs now substitute `window.location.origin` for the backend-supplied origin so a proxied or subdirectory-deployed Superset never hands the user an unreachable internal hostname. Operators whose reverse proxy correctly forwards `X-Forwarded-Host` _and_ who want permalinks to carry the backend's literal origin can opt out by setting `EMBEDDED_DISABLE_PERMALINK_ORIGIN_REWRITE = True` in `superset_config.py`. Default `False` (rewrite is on); flipping the default would regress the dominant proxied/subdir deployment to an unreachable host.

 - [41651](https://github.com/apache/superset/pull/41651): **New do-not-translate standard for translation catalogs.** Strings that must stay identical to the source — icon names (e.g. `bolt`), enum/option values (`step-after`), SQL keywords, API field names (`error_message`), code constants, and example placeholders — are now marked with a `#. do-not-translate` extracted comment. The list lives in the `superset/translations/do-not-translate.txt` registry; `scripts/translations/apply_do_not_translate.py` stamps the marker onto `messages.pot` during `babel_update.sh`, and `pybabel update` propagates it to every `.po`, so the status is consistent across all languages. The AI backfill (`backfill_po.py`) and translators leave these entries untranslated (source fallback). The legacy per-catalog convention (a `# Не переводить` translator comment in the `ru` catalog) is still honored for back-compat but is superseded by this standard; contributors adding new machine-read strings should add the msgid to the registry rather than annotating individual catalogs.

@@ -289,7 +391,7 @@ Theme tokens are unaffected — antd 6 removed none of the tokens Superset expos

 ### Guest-token RLS rules reject unknown fields

-The `rls` rules passed to `POST /api/v1/security/guest_token/` are now validated strictly: a rule may only contain `dataset` and `clause`. Previously unknown fields were silently dropped, so a mistyped or legacy scope key (most commonly `datasource` instead of `dataset`) produced a rule with no `dataset`, which is treated as a *global* rule applied to every dataset the embedded resource can reach. Such a request now returns HTTP 400 identifying the offending field instead of issuing a token with an unintended global rule. Integrators that were sending extra fields in RLS rules must remove them; valid dataset-scoped (`{"dataset": 41, "clause": "..."}`) and global (`{"clause": "..."}`) rules are unaffected.
+The `rls` rules passed to `POST /api/v1/security/guest_token/` are now validated strictly: a rule may only contain `dataset` and `clause`. Previously unknown fields were silently dropped, so a mistyped or legacy scope key (most commonly `datasource` instead of `dataset`) produced a rule with no `dataset`, which is treated as a _global_ rule applied to every dataset the embedded resource can reach. Such a request now returns HTTP 400 identifying the offending field instead of issuing a token with an unintended global rule. Integrators that were sending extra fields in RLS rules must remove them; valid dataset-scoped (`{"dataset": 41, "clause": "..."}`) and global (`{"clause": "..."}`) rules are unaffected.

 ### MCP service requires `MCP_JWT_AUDIENCE` when JWT auth is enabled

@@ -340,9 +442,23 @@ As a result the per-table **"Aggregation function"** control (which let you pick
 how totals were aggregated client-side, e.g. Sum/Average/Count) has been
 removed: totals now always reflect the metric's own definition evaluated at the
 total's granularity. For additive metrics (`SUM`/`COUNT`/`MIN`/`MAX`) the result
-is unchanged. Saved charts that set `aggregateFunction` will ignore it; no
-migration is required. If you previously relied on a plain sum-of-cells total
-for a non-additive metric, that specific behavior is no longer available.
+is unchanged. If you previously relied on a plain sum-of-cells total for a
+non-additive metric, that specific behavior is no longer available.
+
+The "Sum as Fraction of Total/Rows/Columns" display options are back as a
+new, standalone **"Show values as"** control (below "Combine metrics" in the
+Options panel), since those were mathematically correct even before this
+change and are unrelated to the totals-correctness fix. A DB migration
+derives the new field from any still-present `aggregateFunction` Sum-fraction
+value, so a chart that had one of those options configured picks the
+equivalent "Show values as" setting back up automatically. The "Count as
+Fraction of ..." variants are **not** migrated: they divided a record count,
+while the new control divides the metric's own value, so translating them
+automatically would silently change what the chart displays rather than
+restore it; those charts need to be manually reconfigured if the value-based
+percentage is what's wanted. Charts that used any other non-fraction
+`aggregateFunction` value (Sum, Average, Count, ...) are unaffected, since
+that specific behavior remains unavailable per the above.

 ### `thumbnail_url` removed from dashboard list API response

@@ -373,6 +489,7 @@ ALTER TABLE tagged_object DROP CONSTRAINT <constraint_name>;
 -- MySQL: find names via `SHOW CREATE TABLE tagged_object;`
 ALTER TABLE tagged_object DROP FOREIGN KEY <constraint_name>;
 ```
+
 ### Entity version-history infrastructure (gated off by default)

 Introduces the schema and SQLAlchemy-Continuum wiring that captures version history for charts, dashboards, and datasets, plus read-only `GET /api/v1/{chart,dashboard,dataset}/<uuid>/versions/` endpoints. This ships **inert**: a new config flag `ENABLE_VERSIONING_CAPTURE` defaults to `False`, so no save writes any version rows and the endpoints return empty. It is an operational kill-switch (a release toggle that becomes a permanent ops switch), not a feature flag — set it to `True` to enable capture once validated. The migration is additive; existing entity `PUT` responses gain `old_version_uuid` / `new_version_uuid` body fields and an `ETag` header (both null/absent when capture is off).
@@ -389,12 +506,12 @@ These are behavior changes that take effect on upgrade regardless of `ENABLE_VER

 A read-only companion to the version-history endpoints: each entity type gains a `GET /api/v1/{chart,dashboard,dataset}/<uuid>/activity/` endpoint returning a chronological, access-filtered stream of edits — the entity's own edits plus, for charts and dashboards, transitive edits to related entities during their association windows. Datasets have no related layer in V2, so `include=related` returns an empty stream for a dataset and `include=all` reduces to the dataset's own edits.

-| Param | Type | Default | Purpose |
-|---|---|---|---|
-| `since` / `until` | ISO 8601 | — | Bound `issued_at` |
-| `include` | `self` \| `related` \| `all` | `all` | Own edits, related edits, or both |
-| `q` | string | — | Case-insensitive search over the full history, applied before pagination (so `count` reflects matches) |
-| `page` / `page_size` | integer | `0` / `25` | Pagination (`page_size` clamped to 200) |
+| Param                | Type                         | Default    | Purpose                                                                                                |
+| -------------------- | ---------------------------- | ---------- | ------------------------------------------------------------------------------------------------------ |
+| `since` / `until`    | ISO 8601                     | —          | Bound `issued_at`                                                                                      |
+| `include`            | `self` \| `related` \| `all` | `all`      | Own edits, related edits, or both                                                                      |
+| `q`                  | string                       | —          | Case-insensitive search over the full history, applied before pagination (so `count` reflects matches) |
+| `page` / `page_size` | integer                      | `0` / `25` | Pagination (`page_size` clamped to 200)                                                                |

 Authorization reuses the resource's `can_read` permission and per-object `raise_for_access`; related-entity rows are visibility-filtered to what the caller may see. The stream is empty unless version capture is on (`ENABLE_VERSIONING_CAPTURE`).

@@ -406,17 +523,17 @@ Entity version history (the `version_transaction` / `*_version` shadow tables th
 |---|---|---|
 | `SUPERSET_VERSION_HISTORY_RETENTION_DAYS` | `30` | Version rows whose owning `version_transaction.issued_at` is older than this many days are pruned. Each entity's live row (`end_transaction_id IS NULL`) is always preserved, as are the live rows of its children and associations; closed historical rows (including the baseline) age out. Set to `0` or a negative value to disable pruning. |

-The task ships in the default `CeleryConfig.beat_schedule`; a deployment that overrides `CELERY_CONFIG` without inheriting the default will log a startup warning that the prune task is absent (so it never silently stops running). Retention only prunes whatever history exists — capture itself is gated separately by `ENABLE_VERSIONING_CAPTURE` (ships off).
+The task ships in the default `CeleryConfig` (both the `superset.tasks.version_history_retention` import and the beat entry). A deployment that overrides `CELERY_CONFIG` without the beat entry logs a startup warning. When the override explicitly defines `imports`, a missing retention module is also reported; an absent `imports` setting is not diagnosed because Celery may register tasks through `include`, autodiscovery, or worker startup imports. Retention only prunes whatever history exists — capture itself is gated separately by `ENABLE_VERSIONING_CAPTURE`, which now ships on.

 ### Deletion retention (soft-deleted entities are eventually purged)

 Soft-deleted dashboards, charts, and datasets are now permanently removed after a retention window (default 30 days; `SOFT_DELETE_RETENTION_DAYS`, `0` disables; settable per workspace at runtime via the `deletion-retention set-window` CLI, which takes precedence). The `deletion_retention.purge_soft_deleted` Celery beat task runs daily and removes each aged-out entity together with its M:N join rows, owned children, datasource permission, and version-history shadow rows. After purge an entity is **unrecoverable** — its detail and `/restore` endpoints return 404 and its version history is gone.

-The introducing release **defaults to dry-run** (`SOFT_DELETE_PURGE_DRY_RUN=True`): the task logs `would_purge` counts but deletes nothing, so operators can validate against production before activating real purging by setting it to `False`. Note `would_purge` is an **upper bound** — it counts every entity past the retention window without evaluating deletion blockers, so a real run may purge fewer (entities referenced by report schedules or set as a user's welcome dashboard are blocked and reported separately). The task only acts while the temporary `SOFT_DELETE` rollout flag is on.
+Purging is **live by default** (`SOFT_DELETE_PURGE_DRY_RUN=False`), so the retention promise above is real on a stock deployment. Set it to `True` to have the task log `would_purge` counts and delete nothing — the lever is retained, so an operator can return to dry-run at any time. Note `would_purge` is an **upper bound** — it counts every entity past the retention window without evaluating deletion blockers, so a real run may purge fewer (entities referenced by report schedules or set as a user's welcome dashboard are blocked and reported separately). The task only acts while the `SOFT_DELETE` rollout flag is on; it now ships on by default.

-Deployments that replace the default `CELERY_CONFIG` must add `superset.tasks.deletion_retention` to the Celery `imports` and schedule the `deletion_retention.purge_soft_deleted` task themselves. The shipped Docker development config includes both entries.
+Deployments that replace the default `CELERY_CONFIG` must ensure workers register `superset.tasks.deletion_retention` and schedule the `deletion_retention.purge_soft_deleted` task themselves. The shipped Docker development config uses `imports` and includes both entries. While `SOFT_DELETE` is statically enabled, a missing beat entry logs a startup warning; when the override explicitly defines `imports`, a missing purge module is also reported.

-Operators can immediately erase a specific entity for compliance (GDPR) via `superset deletion-retention force-purge --uuid <uuid>`; this applies legacy hard-delete semantics — a live chart referencing a force-purged dataset is left without a datasource until re-pointed (the chart is not modified), and it purges the named entity even when it was never soft-deleted. Every purge writes an immutable, content-free audit record to the new `purge_audit_log` table that survives the entity it names: the **scheduled** purge fails closed (an entity whose audit row cannot be written is skipped and retried next run), while **force-purge** proceeds even if the audit write fails — the operator is present and deletion outranks audit for a compliance erasure.
+Operators can immediately erase a specific entity for compliance (GDPR) via `superset deletion-retention force-purge --uuid <uuid>`; this applies legacy hard-delete semantics — a live chart referencing a force-purged dataset is left without a datasource until re-pointed (the chart is not modified), and it purges the named entity even when it was never soft-deleted. Every scheduled evaluation writes a provisional, content-free record to the new `purge_audit_log` table before the cascade starts. Meaningful retained outcomes survive the entity they name. Consecutive scheduled evaluations with the same blocked outcome suppress only the redundant current provisional record; completed outcomes, outcome transitions, and every force-purge attempt remain independent and immutable. The **scheduled** purge fails closed when its provisional record cannot be written, while **force-purge** proceeds even if the audit write fails — the operator is present and deletion outranks audit for a compliance erasure. Operators can monitor `deletion_retention.blocked_audit_suppressed` and `deletion_retention.blocked_audit_dedupe_fallback` to verify suppression and fail-safe fallback behavior without changing the existing blocked-workload gauge.

 ### Recently Archived view and permanent delete (purge) endpoints

@@ -478,6 +595,7 @@ Operators can tune or disable the policy via config:
 ### Data uploads bounded by UPLOAD_MAX_FILE_SIZE_BYTES

 Single data-file uploads (CSV, Excel, columnar) are now bounded by the `UPLOAD_MAX_FILE_SIZE_BYTES` config option, which defaults to `100 * 1024 * 1024` (100 MB). Files larger than this are rejected with a `413` before their contents are buffered into memory. Set `UPLOAD_MAX_FILE_SIZE_BYTES = None` to disable the check and restore unbounded uploads.
+
 ### Currency symbol position follows the locale when unset

 When a chart's currency control leaves the **Prefix or suffix** field empty, the currency symbol position is now derived from the deployment locale's own convention via `Intl.NumberFormat` instead of always defaulting to a suffix. For example, under the default `en-US` locale `USD`, `GBP`, and `EUR` render as a prefix (`$ 1,000`), while eurozone locales such as `fr-FR` render `EUR` as a suffix (`1 000 €`). An explicit Prefix/Suffix selection is always honored and is unaffected.
@@ -603,7 +721,7 @@ SQLALCHEMY_ENCRYPTED_FIELD_ENGINE = "aes"
   ```bash
   superset re-encrypt-secrets --engine aes-gcm
   ```
-   A live instance keeps writing *new* secrets as AES-CBC during the window between step 2 and the restart in step 4; this second pass sweeps those up (it is idempotent, so already-migrated values are skipped).
+   A live instance keeps writing _new_ secrets as AES-CBC during the window between step 2 and the restart in step 4; this second pass sweeps those up (it is idempotent, so already-migrated values are skipped).

 Schedule the cutover in a quiet window. Runtime reads use only the single configured engine, so in a multi-worker deployment there is an unavoidable brief decrypt-outage between the migration commit and the last worker restarting with the new config — each migrator run is transactional, but the fleet-wide cutover is not zero-downtime.

@@ -631,11 +749,11 @@ With the flag enabled: `DELETE /api/v1/dataset/<id>` no longer hard-deletes the

 **Schema migration:** the migration adds a nullable `deleted_at` column and an index on it (`ix_tables_deleted_at`) to the `tables` table. The column add is instant; the index build runs inline (no `CONCURRENTLY`) and may briefly block writes on the `tables` table (INSERT/UPDATE/DELETE are queued while the index builds; reads are unaffected) on large Postgres deployments. MySQL InnoDB builds the index online (no blocking). Production deployments with many thousands of datasets should run this migration during a maintenance window.

-**Rollback note:** if the application code is rolled back after datasets have been soft-deleted, the older code path's visibility filter no longer applies and previously hidden rows become visible to the older code. Pair the rollback with a data decision (restore the rows, hard-delete them, or also downgrade the migration) rather than assuming the old hard-delete semantics still hold. **Downgrading the migration destroys the deletion markers**: `downgrade()` drops the `deleted_at` column, so any not-yet-restored soft-deleted datasets silently become live, active datasets with no record they were ever deleted. Reconcile the trash (restore or hard-delete each row) *before* downgrading, and disable the `SOFT_DELETE` flag first so no new soft deletes land mid-rollback.
+**Rollback note:** if the application code is rolled back after datasets have been soft-deleted, the older code path's visibility filter no longer applies and previously hidden rows become visible to the older code. Pair the rollback with a data decision (restore the rows, hard-delete them, or also downgrade the migration) rather than assuming the old hard-delete semantics still hold. **Downgrading the migration destroys the deletion markers**: `downgrade()` drops the `deleted_at` column, so any not-yet-restored soft-deleted datasets silently become live, active datasets with no record they were ever deleted. Reconcile the trash (restore or hard-delete each row) _before_ downgrading, and disable the `SOFT_DELETE` flag first so no new soft deletes land mid-rollback.

 **SQL Lab / dataset-creation flows:** creating a dataset over a table whose dataset sits in the trash is refused. The SQL Lab "save as dataset" flow (`get_or_create_dataset`) and file uploads return a **422 naming the hidden twin and the restore endpoint**; the plain create, update, and duplicate paths currently fail with the generic "already exists" 422. In all cases the remediation is the same: restore the hidden dataset (or use a different table name). Perm-string maintenance also covers hidden rows: renaming a database rewrites `perm`/`schema_perm`/`catalog_perm` on soft-deleted datasets and their charts, so a later restore does not resurrect stale permission strings.

-**Importer behavior:** importing a dataset YAML whose UUID matches an existing **soft-deleted** dataset is treated as an implicit restore-with-update — **and this happens even when `overwrite` is not set**. This is a deliberate asymmetry with active rows: an active dataset imported without `overwrite=true` is returned unchanged, but a soft-deleted UUID match is restored *and* has the upload's contents applied regardless of the `overwrite` argument, on the reasoning that re-importing a deleted dataset's exact UUID is an explicit request to bring it back. The restore preserves the original PK, the chart back-reference, `table_columns`, and `sql_metrics`. Non-editors get `ImportFailedError`. Callers without `can_write` get `ImportFailedError` instead of silently receiving the soft-deleted row.
+**Importer behavior:** importing a dataset YAML whose UUID matches an existing **soft-deleted** dataset is treated as an implicit restore-with-update — **and this happens even when `overwrite` is not set**. This is a deliberate asymmetry with active rows: an active dataset imported without `overwrite=true` is returned unchanged, but a soft-deleted UUID match is restored _and_ has the upload's contents applied regardless of the `overwrite` argument, on the reasoning that re-importing a deleted dataset's exact UUID is an explicit request to bring it back. The restore preserves the original PK, the chart back-reference, `table_columns`, and `sql_metrics`. Non-editors get `ImportFailedError`. Callers without `can_write` get `ImportFailedError` instead of silently receiving the soft-deleted row.

 **Uniqueness-validation changes that apply regardless of the feature flag:** two dataset uniqueness checks were tightened alongside this work and are active even with `SOFT_DELETE` off. (1) Create/update uniqueness treats a dataset whose `catalog` is `NULL` as belonging to the database's default catalog, so a legacy twin pair (`catalog=NULL` vs. `catalog=<default>`, same database/schema/name) that older versions allowed now fails validation with "already exists" when either row is edited — resolve by renaming or removing one of the twins. (2) Duplicating a dataset now checks name collisions scoped to the target (database, catalog, schema) instead of globally by name alone: duplicates into other databases that were previously blocked are now allowed.

@@ -655,9 +773,9 @@ With the flag enabled: `DELETE /api/v1/chart/<id>` no longer hard-deletes the ch

 **Schema migration:** the migration adds a nullable `deleted_at` column and an index on it (`ix_slices_deleted_at`) to the `slices` table. The column add is instant; the index build runs inline (no `CONCURRENTLY`) and may briefly block writes on the `slices` table (INSERT/UPDATE/DELETE are queued while the index builds; reads are unaffected) on large Postgres deployments. MySQL InnoDB builds the index online (no blocking).

-**Rollback note:** if the application code is rolled back after charts have been soft-deleted, the older code path's visibility filter no longer applies and previously hidden rows become visible to the older code. Pair the rollback with a data decision (restore the rows, hard-delete them, or also downgrade the migration) rather than assuming the old hard-delete semantics still hold. **Downgrading the migration destroys the deletion markers**: `downgrade()` drops the `deleted_at` column, so any not-yet-restored soft-deleted charts silently become live, active charts with no record they were ever deleted. Reconcile the trash (restore or hard-delete each row) *before* downgrading, and disable the `SOFT_DELETE` flag first so no new soft deletes land mid-rollback.
+**Rollback note:** if the application code is rolled back after charts have been soft-deleted, the older code path's visibility filter no longer applies and previously hidden rows become visible to the older code. Pair the rollback with a data decision (restore the rows, hard-delete them, or also downgrade the migration) rather than assuming the old hard-delete semantics still hold. **Downgrading the migration destroys the deletion markers**: `downgrade()` drops the `deleted_at` column, so any not-yet-restored soft-deleted charts silently become live, active charts with no record they were ever deleted. Reconcile the trash (restore or hard-delete each row) _before_ downgrading, and disable the `SOFT_DELETE` flag first so no new soft deletes land mid-rollback.

-**Importer behavior:** importing a chart YAML whose UUID matches an existing **soft-deleted** chart is treated as an implicit restore-with-update — **and this happens even when `overwrite` is not set**. This is a deliberate asymmetry with active rows: an active chart imported without `overwrite=true` is returned unchanged, but a soft-deleted UUID match is restored *and* has the upload's contents applied regardless of the `overwrite` argument, on the reasoning that re-importing a deleted chart's exact UUID is an explicit request to bring it back. The restore preserves the original PK and all out-of-archive references (`dashboard_slices` junctions, `report.chart_id`, tag rows). The operation is permission-gated: non-editors get `ImportFailedError`, and callers without `can_write` get `ImportFailedError` instead of silently receiving the soft-deleted row.
+**Importer behavior:** importing a chart YAML whose UUID matches an existing **soft-deleted** chart is treated as an implicit restore-with-update — **and this happens even when `overwrite` is not set**. This is a deliberate asymmetry with active rows: an active chart imported without `overwrite=true` is returned unchanged, but a soft-deleted UUID match is restored _and_ has the upload's contents applied regardless of the `overwrite` argument, on the reasoning that re-importing a deleted chart's exact UUID is an explicit request to bring it back. The restore preserves the original PK and all out-of-archive references (`dashboard_slices` junctions, `report.chart_id`, tag rows). The operation is permission-gated: non-editors get `ImportFailedError`, and callers without `can_write` get `ImportFailedError` instead of silently receiving the soft-deleted row.

 - [39914](https://github.com/apache/superset/pull/39914) `ALERT_REPORT_SLACK_V2` now defaults to `True` and the legacy Slack v1 integration (`Slack` recipient type, `files.upload` API) is deprecated for removal in the next major. Slack blocked new apps from `files.upload` in May 2024 and fully retired the method for all apps on November 12, 2025; because the v1 path sends files through `files.upload`, v1 file-bearing sends now fail at the API level — only text-only `chat_postMessage` still works via the legacy path. Grant your Slack bot the `channels:read` and `groups:read` scopes so existing `Slack` recipients can be auto-upgraded to `SlackV2` on next send. Operators who explicitly override the flag to `False`, or whose Slack bot is missing those scopes, will see deprecation warnings while text-only sends continue through the legacy path.

@@ -681,7 +799,7 @@ The partial-index replacement is dialect-dependent: PostgreSQL uses a native `WH

 **Slug semantics:** on PostgreSQL and MySQL 8.0.13+, the slug of a soft-deleted dashboard is **free for reuse**. A new active dashboard can claim it immediately. Restoring a soft-deleted dashboard whose slug has since been claimed returns **422 with a clean error** (`DashboardSlugConflictError`) — rename one of the dashboards and retry; the restore is not silently rejected by a database-level constraint violation.

-**Importer behavior:** importing a dashboard YAML whose UUID matches an existing **soft-deleted** dashboard is treated as an implicit restore-with-update — **and this happens even when `overwrite` is not set**. This is a deliberate asymmetry with active rows: an active dashboard imported without `overwrite=true` is returned unchanged (the import never mutates it), but a soft-deleted UUID match is restored *and* has the upload's contents applied regardless of the `overwrite` argument, on the reasoning that re-importing a deleted dashboard's exact UUID is an explicit request to bring it back. The restore preserves the original PK and all pre-deletion relationship rows (`dashboard_slices` junctions, editor/viewer subjects, tags). Callers whose imports must never mutate existing state should treat bundles that may contain previously deleted UUIDs accordingly. The operation is permission-gated: it requires `can_write` and editorship of the deleted row (or admin) — non-editors get `ImportFailedError`, and callers without `can_write` get `ImportFailedError` instead of silently receiving the soft-deleted row.
+**Importer behavior:** importing a dashboard YAML whose UUID matches an existing **soft-deleted** dashboard is treated as an implicit restore-with-update — **and this happens even when `overwrite` is not set**. This is a deliberate asymmetry with active rows: an active dashboard imported without `overwrite=true` is returned unchanged (the import never mutates it), but a soft-deleted UUID match is restored _and_ has the upload's contents applied regardless of the `overwrite` argument, on the reasoning that re-importing a deleted dashboard's exact UUID is an explicit request to bring it back. The restore preserves the original PK and all pre-deletion relationship rows (`dashboard_slices` junctions, editor/viewer subjects, tags). Callers whose imports must never mutate existing state should treat bundles that may contain previously deleted UUIDs accordingly. The operation is permission-gated: it requires `can_write` and editorship of the deleted row (or admin) — non-editors get `ImportFailedError`, and callers without `can_write` get `ImportFailedError` instead of silently receiving the soft-deleted row.

 ### Engine spec capability flag: `supports_offset`

@@ -693,10 +811,10 @@ A new `BaseEngineSpec.supports_offset` attribute (default `True`) indicates whet

 A new feature flag `GRANULAR_EXPORT_CONTROLS` introduces three fine-grained permissions that replace the legacy `can_csv` permission:

-| Permission | Controls |
-|---|---|
-| `can_export_data` | CSV, Excel, JSON exports |
-| `can_export_image` | Screenshot/PDF exports |
+| Permission           | Controls                     |
+| -------------------- | ---------------------------- |
+| `can_export_data`    | CSV, Excel, JSON exports     |
+| `can_export_image`   | Screenshot/PDF exports       |
 | `can_copy_clipboard` | Copy-to-clipboard operations |

 When the feature flag is enabled, these permissions are enforced on both the frontend (disabled buttons with tooltips) and backend (403 responses from API endpoints). When disabled, legacy `can_csv` behavior is preserved.
@@ -740,14 +858,17 @@ The Kenya country map has been updated to reflect the 47 counties established un
 MCP (Model Context Protocol) tools now include enhanced observability instrumentation for monitoring and debugging:

 **Two-layer instrumentation:**
+
 1. **Middleware layer** (`LoggingMiddleware`): Automatically logs all MCP tool calls with `duration_ms` and `success` status in the audit log (Action Log UI, logs table)
 2. **Sub-operation tracking**: All 19 MCP tools include granular `event_logger.log_context()` blocks for tracking individual operations like validation, database writes, and query execution

 **Action naming convention:**
+
 - Tool-level logs: `mcp_tool_call` (via middleware)
 - Sub-operation logs: `mcp.{tool_name}.{operation}` (e.g., `mcp.generate_chart.validation`, `mcp.execute_sql.query_execution`)

 **Querying MCP logs:**
+
 ```sql
 -- Top slowest MCP operations
 SELECT action, COUNT(*) as calls, AVG(duration_ms) as avg_ms
@@ -782,6 +903,7 @@ A new `DISTRIBUTED_COORDINATION_CONFIG` configuration provides a unified Redis-b
 The distributed coordination is used by the Global Task Framework (GTF) for abort notifications and task completion signaling, and will eventually replace `GLOBAL_ASYNC_QUERIES_CACHE_BACKEND` as the standard signaling backend. Configuring this is recommended for Redis enabled production deployments.

 Example configuration in `superset_config.py`:
+
 ```python
 DISTRIBUTED_COORDINATION_CONFIG = {
    "CACHE_TYPE": "RedisCache",
@@ -796,9 +918,11 @@ See `superset/config.py` for complete configuration options.
 ### WebSocket config for GAQ with Docker

 [35896](https://github.com/apache/superset/pull/35896) and [37624](https://github.com/apache/superset/pull/37624) updated documentation on how to run and configure Superset with Docker. Specifically for the WebSocket configuration, a new `docker/superset-websocket/config.example.json` was added to the repo, so that users could copy it to create a `docker/superset-websocket/config.json` file. The existing `docker/superset-websocket/config.json` was removed and git-ignored, so if you're using GAQ / WebSocket make sure to:
+
 - Stash/backup your existing `config.json` file, to re-apply it after (will get git-ignored going forward)
 - Update the `volumes` configuration for the `superset-websocket` service in your `docker-compose.override.yml` file, to include the `docker/superset-websocket/config.json` file. For example:
-``` yaml
+
+```yaml
 services:
  superset-websocket:
    volumes:
@@ -811,7 +935,9 @@ services:
 ### Example Data Loading Improvements

 #### New Directory Structure
+
 Examples are now organized by name with data and configs co-located:
+
 ```
 superset/examples/
 ├── _shared/              # Shared database & metadata configs
@@ -824,12 +950,14 @@ superset/examples/
 ```

 #### Simplified Parquet-based Loading
+
 - Auto-discovery: create `superset/examples/my_dataset/data.parquet` to add a new example
 - Parquet is an Apache project format: compressed (~27% smaller), self-describing schema
 - YAML configs define datasets, charts, and dashboards declaratively
 - Removed Python-based data generation from individual example files

 #### Test Data Reorganization
+
 - Moved `big_data.py` to `superset/cli/test_loaders.py` - better reflects its purpose as a test utility
 - Fixed inverted logic for `--load-test-data` flag (now correctly includes .test.yaml files when flag is set)
 - Clarified CLI flags:
@@ -839,6 +967,7 @@ superset/examples/
  - `--load-big-data` / `-b`: Generate synthetic stress-test data

 #### Bug Fixes
+
 - Fixed numpy array serialization for PostgreSQL (converts complex types to JSON strings)
 - Fixed KeyError for `allow_csv_upload` field in database configs (now optional with default)
 - Fixed test data loading logic that was incorrectly filtering files
@@ -848,6 +977,7 @@ superset/examples/
 The MCP (Model Context Protocol) service enables AI assistants and automation tools to interact programmatically with Superset.

 #### New Features
+
 - MCP service infrastructure with FastMCP framework
 - Tools for dashboards, charts, datasets, SQL Lab, and instance metadata
 - Optional dependency: install with `pip install apache-superset[fastmcp]`
@@ -857,6 +987,7 @@ The MCP (Model Context Protocol) service enables AI assistants and automation to
 #### New Configuration Options

 **Development** (single-user, local testing):
+
 ```python
 # superset_config.py
 MCP_DEV_USERNAME = "admin"  # User for MCP authentication
@@ -865,6 +996,7 @@ MCP_SERVICE_PORT = 5008
 ```

 **Production** (JWT-based, multi-user):
+
 ```python
 # superset_config.py
 MCP_AUTH_ENABLED = True
@@ -910,12 +1042,14 @@ superset mcp run --port 5008 --use-factory-config
 The MCP service runs as a **separate process** from the Superset web server.

 **Important**:
+
 - Requires same Python environment and configuration as Superset
 - Shares database connections with main Superset app
 - Can be scaled independently from web server
 - Requires `fastmcp` package (optional dependency)

 **Installation**:
+
 ```bash
 # Install with MCP support
 pip install apache-superset[fastmcp]
@@ -929,6 +1063,7 @@ Use systemd, supervisord, or Kubernetes to manage the MCP service process.
 See `superset/mcp_service/PRODUCTION.md` for deployment guides.

 **Security**:
+
 - Development: Uses `MCP_DEV_USERNAME` for single-user access
 - Production: **MUST** configure JWT authentication
 - See `superset/mcp_service/SECURITY.md` for details
@@ -948,8 +1083,10 @@ See `superset/mcp_service/PRODUCTION.md` for deployment guides.
 - [35062](https://github.com/apache/superset/pull/35062): Changed the function signature of `setupExtensions` to `setupCodeOverrides` with options as arguments.

 ### Breaking Changes
+
 - [37370](https://github.com/apache/superset/pull/37370): The `APP_NAME` configuration variable no longer controls the browser window/tab title or other frontend branding. Application names should now be configured using the theme system with the `brandAppName` token. The `APP_NAME` config is still used for backend contexts (MCP service, logs, etc.) and serves as a fallback if `brandAppName` is not set.
  - **Migration:**
+
  ```python
  # Before (Superset 5.x)
  APP_NAME = "My Custom App"
@@ -993,16 +1130,16 @@ See `superset/mcp_service/PRODUCTION.md` for deployment guides.

 Eight M:N association tables move from a synthetic `id INTEGER PRIMARY KEY` to a composite `PRIMARY KEY (fk1, fk2)` on their two foreign-key columns. The surrogate `id` is dropped, and the redundant `UNIQUE (fk1, fk2)` on the two tables that carried one is removed (now subsumed by the PK).

-| Table | Composite PK |
-|---|---|
-| `dashboard_roles` | `(dashboard_id, role_id)` |
-| `dashboard_slices` | `(dashboard_id, slice_id)` |
-| `dashboard_user` | `(user_id, dashboard_id)` |
+| Table                  | Composite PK                    |
+| ---------------------- | ------------------------------- |
+| `dashboard_roles`      | `(dashboard_id, role_id)`       |
+| `dashboard_slices`     | `(dashboard_id, slice_id)`      |
+| `dashboard_user`       | `(user_id, dashboard_id)`       |
 | `report_schedule_user` | `(user_id, report_schedule_id)` |
-| `rls_filter_roles` | `(role_id, rls_filter_id)` |
-| `rls_filter_tables` | `(table_id, rls_filter_id)` |
-| `slice_user` | `(user_id, slice_id)` |
-| `sqlatable_user` | `(user_id, table_id)` |
+| `rls_filter_roles`     | `(role_id, rls_filter_id)`      |
+| `rls_filter_tables`    | `(table_id, rls_filter_id)`     |
+| `slice_user`           | `(user_id, slice_id)`           |
+| `sqlatable_user`       | `(user_id, table_id)`           |

 **Before upgrading:**

@@ -1013,6 +1150,7 @@ Eight M:N association tables move from a synthetic `id INTEGER PRIMARY KEY` to a
 For large `dashboard_slices` / `report_schedule_user` tables, see the operator runbook in [#39859](https://github.com/apache/superset/pull/39859) — pre-flight inventory queries, per-dialect lock-window sizing, and the duplicate / NULL-FK roll-up — to plan the maintenance window.

 ## 6.0.0
+
 - [33055](https://github.com/apache/superset/pull/33055): Upgrades Flask-AppBuilder to 5.0.0. The AUTH_OID authentication type has been deprecated and is no longer available as an option in Flask-AppBuilder. OpenID (OID) is considered a deprecated authentication protocol - if you are using AUTH_OID, you will need to migrate to an alternative authentication method such as OAuth, LDAP, or database authentication before upgrading.
 - [34871](https://github.com/apache/superset/pull/34871): Fixed Jest test hanging issue from Ant Design v5 upgrade. MessageChannel is now mocked in test environment to prevent rc-overflow from causing Jest to hang. Test environment only - no production impact.
 - [34782](https://github.com/apache/superset/pull/34782): Dataset exports now include the dataset ID in their file name (similar to charts and dashboards). If managing assets as code, make sure to rename existing dataset YAMLs to include the ID (and avoid duplicated files).
@@ -1021,8 +1159,8 @@ For large `dashboard_slices` / `report_schedule_user` tables, see the operator r
  - Change any hex color values to one of: `"success"`, `"processing"`, `"error"`, `"warning"`, `"default"`
  - Custom colors are no longer supported to maintain consistency with Ant Design components
 - [34561](https://github.com/apache/superset/pull/34561) Added tiled screenshot functionality for Playwright-based reports to handle large dashboards more efficiently. When enabled (default: `SCREENSHOT_TILED_ENABLED = True`), dashboards with 20+ charts or height exceeding 5000px will be captured using multiple viewport-sized tiles and combined into a single image. This improves report generation performance and reliability for large dashboards.
-Note: Pillow is now a required dependency (previously optional) to support image processing for tiled screenshots.
-`thumbnails` optional dependency is now deprecated and will be removed in the next major release (7.0).
+  Note: Pillow is now a required dependency (previously optional) to support image processing for tiled screenshots.
+  `thumbnails` optional dependency is now deprecated and will be removed in the next major release (7.0).
 - [33084](https://github.com/apache/superset/pull/33084) The DISALLOWED_SQL_FUNCTIONS configuration now includes additional potentially sensitive database functions across PostgreSQL, MySQL, SQLite, MS SQL Server, and ClickHouse. Existing queries using these functions may now be blocked. Review your SQL Lab queries and dashboards if you encounter "disallowed function" errors after upgrading
 - [34235](https://github.com/apache/superset/pull/34235) CSV exports now use `utf-8-sig` encoding by default to include a UTF-8 BOM, improving compatibility with Excel.
 - [34258](https://github.com/apache/superset/pull/34258) changing the default in Dockerfile to INCLUDE_CHROMIUM="false" (from "true") in the past. This ensures the `lean` layer is lean by default, and people can opt-in to the `chromium` layer by setting the build arg `INCLUDE_CHROMIUM=true`. This is a breaking change for anyone using the `lean` layer, as it will no longer include Chromium by default.
@@ -122,7 +122,13 @@ FEATURE_FLAGS = {
 }
 EXTENSIONS_PATH = "/app/docker/extensions"
 ALERT_REPORTS_NOTIFICATION_DRY_RUN = True
-WEBDRIVER_BASEURL = f"http://superset_app{os.environ.get('SUPERSET_APP_ROOT', '/')}/"  # When using docker compose baseurl should be http://superset_nginx{ENV{BASEPATH}}/  # noqa: E501
+# The Docker Compose app service is named "superset" and listens on 8088. Report
+# paths are root-relative, so urljoin drops the base path; only the scheme, host,
+# and port must be correct here. SUPERSET_APP_ROOT is kept for consumers that
+# concatenate paths directly (e.g. cache warm-up). For screenshots in the dev
+# stack (unbuilt static assets) point this at the nginx service instead:
+# http://nginx{SUPERSET_APP_ROOT}/
+WEBDRIVER_BASEURL = f"http://superset:8088{os.environ.get('SUPERSET_APP_ROOT', '/')}/"
 # The base URL for the email report hyperlinks.
 WEBDRIVER_BASEURL_USER_FRIENDLY = (
    f"http://localhost:8888/{os.environ.get('SUPERSET_APP_ROOT', '/')}/"
@@ -28,6 +28,7 @@ Alerts and reports are disabled by default. To turn them on, you'll need to chan
 - Users can customize the email subject by including date code placeholders, which will automatically be replaced with the corresponding UTC date when the email is sent. To enable this functionality, activate the `"DATE_FORMAT_IN_EMAIL_SUBJECT"` [feature flag](/admin-docs/configuration/configuring-superset#feature-flags). This enables date formatting in email subjects, preventing all reporting emails from being grouped into the same thread (optional for the reporting feature).
  - Use date codes from [strftime.org](https://strftime.org/) to create the email subject.
  - If no date code is provided, the original string will be used as the email subject.
+- Each alert/report has an "Include a link back to Superset" option (enabled by default) controlling whether the call-to-action link is included in email and Slack notifications. The link text in emails is configurable via `EMAIL_REPORTS_CTA`; the Slack message always uses "Explore in Superset". Uncheck the option when recipients should not receive a link to your Superset host, e.g. for external audiences.

 ##### Disable dry-run mode

@@ -132,7 +133,7 @@ Superset sends an HTTP POST with `Content-Type: application/json`:
  },
  "text": "Alert condition met: value exceeded threshold",
  "description": "Monthly revenue dropped below target",
-  "url": "https://your-superset-host/superset/dashboard/1/"
+  "url": "https://your-superset-host/dashboard/1/"
 }
 ```

@@ -245,6 +246,53 @@ class CeleryConfig:
    }
 CELERY_CONFIG = CeleryConfig

+# Scheduled reports share one deadline across browser readiness, capture/PDF
+# generation, delivery, and terminal-state persistence. The effective budget
+# for a schedule is min(this value, the schedule's working_timeout), so the
+# per-schedule field keeps its meaning as a user-facing cap. The default (one
+# hour) matches the historical working_timeout default, so upgrading changes
+# no default behavior; lower it to enforce a tighter report SLA.
+ALERT_REPORTS_EXECUTION_BUDGET_SECONDS = 3600
+
+# These reserves are part of (not additions to) the total budget and their sum
+# must be less than it. Readiness polling stops in time to leave capacity for
+# the later phases.
+ALERT_REPORTS_EXECUTION_CAPTURE_RESERVE_SECONDS = 60
+ALERT_REPORTS_EXECUTION_DELIVERY_RESERVE_SECONDS = 120
+ALERT_REPORTS_EXECUTION_CLEANUP_RESERVE_SECONDS = 30
+
+# Celery's hard limit leaves this additional window for terminal cleanup after
+# the soft limit, which equals the resolved execution budget (the configured
+# budget capped by each schedule's working_timeout).
+# ALERT_REPORTS_WORKING_TIME_OUT_KILL controls these Celery limits; disabling
+# it does not disable the application deadline above.
+ALERT_REPORTS_EXECUTION_HARD_TIMEOUT_GRACE_SECONDS = 30
+
+# Invalid budget/reserve combinations fail application startup instead of
+# allowing every scheduled report to fail later. A report Celery soft timeout
+# records ERROR and increments `reports.execute.celery_soft_timeout`; it does
+# not attempt an in-band customer error notification during the hard-limit
+# grace window. Alert schedules retain their existing timeout notifications.
+#
+# The application deadline is cooperative between synchronous phases. The
+# Celery limits provide the final preemption boundary when the worker pool
+# supports them; PDF construction is checked immediately before and after the
+# synchronous builder but cannot be interrupted inside that call.
+#
+# Sizing the budget against infrastructure limits:
+# - Kubernetes (or similar) pod termination grace must exceed
+#   budget + hard-timeout grace, or in-flight reports are killed mid-run on
+#   every deploy/node drain despite the application deadline.
+# - The web server's per-request timeout (e.g. gunicorn ``timeout``) bounds
+#   each individual chart data request made by the headless browser -- not
+#   the report as a whole. Readiness allowance beyond that per-request
+#   ceiling buys nothing for a single slow chart (its request dies at the
+#   web layer and the chart reaches an error state), but multi-chart and
+#   tiled captures legitimately accumulate total time well past it.
+
+# Screenshot-specific waits continue to apply to thumbnails and other
+# standalone screenshot calls. Scheduled reports derive their waits from the
+# shared execution deadline above.
 SCREENSHOT_LOCATE_WAIT = 100
 SCREENSHOT_LOAD_WAIT = 600

@@ -278,7 +326,7 @@ WEBDRIVER_OPTION_ARGS = [
 ]

 # This is for internal use, you can keep http
-WEBDRIVER_BASEURL = "http://superset:8088" # When running using docker compose use "http://superset_app:8088'
+WEBDRIVER_BASEURL = "http://superset:8088" # This is also the default for Docker Compose, where the app service is named "superset"
 # This is the link sent to the recipient. Change to your domain, e.g. https://superset.mydomain.com
 WEBDRIVER_BASEURL_USER_FRIENDLY = "http://localhost:8088"
 ```
@@ -403,9 +451,9 @@ Possible fixes:

 The worker may be unable to reach the report. It will use the value of `WEBDRIVER_BASEURL` to browse to the report. If that route is invalid, or presents an authentication challenge that the worker can't pass, the report screenshot will fail.

-Check this by attempting to `curl` the URL of a report that you see in the error logs of your worker. For instance, from the worker environment, run `curl http://superset_app:8088/superset/dashboard/1/`. You may get different responses depending on whether the dashboard exists - for example, you may need to change the `1` in that URL. If there's a URL in your logs from a failed report screenshot, that's a good place to start. The goal is to determine a valid value for `WEBDRIVER_BASEURL` and determine if an issue like HTTPS or authentication is redirecting your worker.
+Check this by attempting to `curl` the URL of a report that you see in the error logs of your worker. For instance, from the worker environment, run `curl http://superset:8088/dashboard/1/`. You may get different responses depending on whether the dashboard exists - for example, you may need to change the `1` in that URL. If there's a URL in your logs from a failed report screenshot, that's a good place to start. The goal is to determine a valid value for `WEBDRIVER_BASEURL` and determine if an issue like HTTPS or authentication is redirecting your worker.

-In a deployment with authentication measures enabled like HTTPS and Single Sign-On, it may make sense to have the worker navigate directly to the Superset application running in the same location, avoiding the need to sign in. For instance, you could use `WEBDRIVER_BASEURL="http://superset_app:8088"` for a docker compose deployment, and set `"force_https": False,` in your `TALISMAN_CONFIG`.
+In a deployment with authentication measures enabled like HTTPS and Single Sign-On, it may make sense to have the worker navigate directly to the Superset application running in the same location, avoiding the need to sign in. For instance, you could use `WEBDRIVER_BASEURL="http://superset:8088"` for a docker compose deployment, and set `"force_https": False,` in your `TALISMAN_CONFIG` — appropriate only for an isolated development stack or when HTTPS is enforced by a trusted proxy in front of Superset.

 ### Duplicate report deliveries

@@ -54,8 +54,8 @@ celery --app=superset.tasks.celery_app:app beat

 To setup a result backend, you need to pass an instance of a derivative of `BaseCache` (`from
 flask_caching.backends.base import BaseCache`) to the RESULTS_BACKEND configuration key in your
-superset_config.py. You can use Memcached, Redis, S3 (https://pypi.python.org/pypi/s3werkzeugcache),
-memory or the file system (in a single server-type setup or for testing), or to write your own
+superset_config.py. You can use Memcached, Redis, S3, MinIO, memory
+or the file system (in a single server-type setup or for testing), or to write your own
 caching interface. Your `superset_config.py` may look something like:

 ```python
@@ -89,6 +89,12 @@ issues arise. Please clear your existing results cache store when upgrading an e
 - SQL Lab will _only run your queries asynchronously if_ you enable **Asynchronous Query Execution**
  in your database settings (Sources > Databases > Edit record).

+- In order to use dedicated results backend, additional python libraries must be installed. These libraries can be installed using pip.
+  - [redis-py](https://pypi.org/project/redis/) for Redis.
+  - [pylibmc](https://pypi.org/project/pylibmc/) for memcached
+  - [s3werkzeugcache](https://pypi.python.org/pypi/s3werkzeugcache) for S3
+  - [minio-flask-cache](https://github.com/greggailly/minio-flask-cache) for MinIO or other S3 compatible service
+
 ## Celery Flower

 Flower is a web based tool for monitoring the Celery cluster which you can install from pip:
@@ -15,9 +15,8 @@ fail-fast behavior ensures operators are immediately aware of infrastructure iss

 Superset uses [Flask-Caching](https://flask-caching.readthedocs.io/) for caching purposes.
 Flask-Caching supports various caching backends, including Redis (recommended), Memcached,
-SimpleCache (in-memory), or the local filesystem.
-[Custom cache backends](https://flask-caching.readthedocs.io/en/latest/#custom-cache-backends)
-are also supported.
+SimpleCache (in-memory), MinIO/S3, or the local filesystem.
+[Custom cache backends](https://flask-caching.readthedocs.io/en/latest/#custom-cache-backends) are also supported.

 Caching can be configured by providing dictionaries in
 `superset_config.py` that comply with [the Flask-Caching config specifications](https://flask-caching.readthedocs.io/en/latest/#configuring-flask-caching).
@@ -47,6 +46,7 @@ In order to use dedicated cache stores, additional python libraries must be inst
 - For Redis: we recommend the [redis](https://pypi.python.org/pypi/redis) Python package
 - Memcached: we recommend using [pylibmc](https://pypi.org/project/pylibmc/) client library as
  `python-memcached` does not handle storing binary data correctly.
+- MinIO (S3): we recommend using the [minio-flask-cache](https://github.com/greggailly/minio-flask-cache) package

 These libraries can be installed using pip.

@@ -134,6 +134,50 @@ CELERY_CONFIG = CustomCeleryConfig
 This will cache the top 5 most popular dashboards every hour. For other
 strategies, check the `superset/tasks/cache.py` file.

+### Warming Up Native Filter Options
+
+Native filter Value-type dropdown option queries (e.g. `SELECT DISTINCT column FROM table`) are
+cached the same way as chart data, via `DATA_CACHE_CONFIG`. However, the strategies above only warm
+up chart render queries, so the first user to open a dashboard's filter dropdown after a cache entry
+expires still triggers a fresh database query.
+
+The `native_filter_options` strategy pre-populates the cache for these dropdown queries. It reads
+each dashboard's `native_filter_configuration`, builds the same `filter_select` chart-data query the
+frontend would send, and executes it as the configured `SUPERSET_CACHE_WARMUP_USER`:
+
+```python
+class CustomCeleryConfig(CeleryConfig):
+    beat_schedule = {
+        **CeleryConfig.beat_schedule,
+        'cache-warmup-native-filters': {
+            'task': 'cache-warmup',
+            'schedule': crontab(minute=0, hour=3),  # daily at 03:00
+            'kwargs': {
+                'strategy_name': 'native_filter_options',
+                'dashboard_ids': [1, 2, 3],
+            },
+        },
+    }
+```
+
+Requirements and limitations:
+
+- `SUPERSET_CACHE_WARMUP_USER` must be set to a user with access to the dashboards and datasets
+  referenced by the native filters.
+- `DATA_CACHE_CONFIG` must use a backend that actually persists entries (Redis recommended); the
+  default `NullCache` discards writes, so warming has nothing to warm. The effective timeout also
+  needs to be positive — `NATIVE_FILTER_OPTIONS_CACHE_TIMEOUT = -1` disables cache writes for these
+  queries entirely, even with a working backend.
+- Schedule the warm-up at least as often as the effective native filter cache timeout (whichever of
+  `NATIVE_FILTER_OPTIONS_CACHE_TIMEOUT`, the chart/dataset/database timeout, or `DATA_CACHE_CONFIG`'s
+  default applies). A looser schedule still leaves a window of cold, unwarmed queries between expiry
+  and the next run — the daily example above assumes a TTL of a day or more.
+- Cache entries are warmed under the warm-up user's own cache partition, the same entry that user
+  would create by opening the filter dropdown manually. Users with a different role set or row-level
+  security context may still see a cache miss on first load.
+- Cascading/dependent native filters and search-term variants of filter option queries are not
+  warmed by this strategy.
+
 ## Caching Thumbnails

 This is an optional feature that can be turned on by activating its [feature flag](/admin-docs/configuration/configuring-superset#feature-flags) on config:
@@ -301,6 +345,24 @@ DISTRIBUTED_COORDINATION_CONFIG = {
 }
 ```

+By default, connections opened for `DISTRIBUTED_COORDINATION_CONFIG` (as well as
+`GLOBAL_ASYNC_QUERIES_CACHE_BACKEND`, which uses the same `RedisCache`/`RedisSentinelCache`
+backend) have no socket timeout. This can be overridden with `CACHE_REDIS_SOCKET_TIMEOUT` and
+`CACHE_REDIS_SOCKET_CONNECT_TIMEOUT`, both in seconds:
+
+```python
+DISTRIBUTED_COORDINATION_CONFIG = {
+    "CACHE_TYPE": "RedisCache",
+    "CACHE_REDIS_HOST": "localhost",
+    "CACHE_REDIS_PORT": 6379,
+    "CACHE_REDIS_SOCKET_TIMEOUT": 5,  # seconds
+    "CACHE_REDIS_SOCKET_CONNECT_TIMEOUT": 5,  # seconds
+}
+```
+
+These apply to `RedisSentinelCache` connections as well, covering both the sentinel-node
+connections and the resolved master connection.
+
 ### Distributed Lock TTL

 You can configure the default lock TTL (time-to-live) in seconds. Locks automatically expire after
@@ -18,7 +18,7 @@ code is less ambiguous and is unique to all regions in the world.
 ## Included Maps

 The current list of countries can be found in the src
-[legacy-plugin-chart-country-map/src/countries.ts](https://github.com/apache/superset/blob/master/superset-frontend/plugins/legacy-plugin-chart-country-map/src/countries.ts)
+[plugin-chart-country-map/src/countries.ts](https://github.com/apache/superset/blob/master/superset-frontend/plugins/plugin-chart-country-map/src/countries.ts)

 The Country Maps visualization already ships with the maps for the following countries:

@@ -31,10 +31,10 @@ The Country Maps visualization already ships with the maps for the following cou
 ## Adding a New Country

 To add a new country to the list, you'd have to edit files in
-[@superset-ui/legacy-plugin-chart-country-map](https://github.com/apache/superset/tree/master/superset-frontend/plugins/legacy-plugin-chart-country-map).
+[@superset-ui/plugin-chart-country-map](https://github.com/apache/superset/tree/master/superset-frontend/plugins/plugin-chart-country-map).

-1. Generate a new GeoJSON file for your country following the guide in [this Jupyter notebook](https://github.com/apache/superset/blob/master/superset-frontend/plugins/legacy-plugin-chart-country-map/scripts/Country%20Map%20GeoJSON%20Generator.ipynb).
-2. Edit the countries list in [legacy-plugin-chart-country-map/src/countries.ts](https://github.com/apache/superset/blob/master/superset-frontend/plugins/legacy-plugin-chart-country-map/src/countries.ts).
+1. Generate a new GeoJSON file for your country following the guide in [this Jupyter notebook](https://github.com/apache/superset/blob/master/superset-frontend/plugins/plugin-chart-country-map/scripts/Country%20Map%20GeoJSON%20Generator.ipynb).
+2. Edit the countries list in [plugin-chart-country-map/src/countries.ts](https://github.com/apache/superset/blob/master/superset-frontend/plugins/plugin-chart-country-map/src/countries.ts).
 3. Install superset-frontend dependencies: `cd superset-frontend && npm install`
 4. Verify your countries in Superset plugins storybook: `npm run plugins:storybook`.
 5. Build and install Superset from source code.
@@ -315,6 +315,76 @@ Here's a concrete example:
  WHERE country_code = 'US'
  ```

+**Guest User Attributes**
+
+The `{{ get_guest_user_attribute('attribute_name') }}` macro returns a specific attribute value from the guest user context.
+This is useful when working with embedded Superset where guest tokens can contain custom attributes that need to be
+accessed in SQL queries.
+
+This macro only works when the current user is a guest user (authenticated via guest token). If the current user is
+not a guest user, or if the specified attribute doesn't exist, the macro will return `None` or the provided default value.
+
+If you have caching enabled in your Superset configuration, then by default the resolved value (whether it
+came from the guest token, a null attribute, or the provided default) will be used by Superset when
+calculating the cache key. A cache key is a unique identifier that determines if there's a cache hit in the
+future and Superset can retrieve cached data. Including the resolved value on every branch ensures two guests
+whose tokens render different SQL never share a cache entry.
+
+You can disable the inclusion of the attribute value in the calculation of the
+cache key by adding the following parameter to your Jinja code, but only do so
+when the value cannot affect the query results:
+
+```
+{{ get_guest_user_attribute('department', add_to_cache_keys=False) }}
+```
+
+You can also provide a default value if the attribute is not found:
+
+```
+{{ get_guest_user_attribute('region', default='US') }}
+```
+
+Here's a concrete example of using guest user attributes in a query:
+
+```sql
+SELECT *
+FROM sales_data
+WHERE region = '{{ get_guest_user_attribute("user_region", default="global") }}'
+  AND department = '{{ get_guest_user_attribute("department") }}'
+```
+
+:::warning[Security Warning]
+
+Guest token attributes come from the embedding application. By default,
+`get_guest_user_attribute()` escapes string values — including strings nested inside
+arrays and object values, and caller-supplied defaults — through the database dialect's
+literal rendering (the same mechanism as `url_param()`). This covers dialect-specific
+escape characters such as the backslash on MySQL/MariaDB, so the example above is safe
+to interpolate directly. If you pass `escape_result=False`, or interpolate non-string
+values (numbers, booleans), you are responsible for validating or allowlisting the
+values, since they originate outside Superset.
+
+If a guest attribute is an array and you plan to pipe it through the `|where_in` filter
+(for example `full_name IN {{ get_guest_user_attribute('names')|where_in }}`), call
+`get_guest_user_attribute('names', escape_result=False)`. `where_in` already applies its
+own dialect-safe quoting, so escaping the values twice can corrupt them (a value such as
+`O'Brien` would come back doubly escaped and match nothing).
+
+Only individual string values are escaped as SQL literals. Interpolating an entire array
+or object directly (rather than through `|where_in`, or by accessing a specific element)
+renders Python's string form of that structure, which is not valid SQL, and object keys
+are not escaped at all. Use `|where_in` for arrays, `|tojson` where you need a
+JSON-stringified value, or read individual keys/elements out of the structure yourself.
+
+The same double-escaping problem described above for `|where_in` applies to `|tojson`:
+pass `escape_result=False` before piping to `|tojson` (for example
+`{{ get_guest_user_attribute('profile', escape_result=False)|tojson }}`), since JSON
+already handles its own quoting and re-escaping a value first would corrupt it (a nested
+string such as `O'Brien` would come back as the altered `O''Brien` in the serialized
+JSON).
+
+:::
+
 ### Explicitly Including Values in Cache Key

 The `{{ cache_key_wrapper() }}` function explicitly instructs Superset to add a value to the
@@ -198,6 +198,51 @@ Available per-entity overrides are:
 When an override is set, it replaces `SUBJECTS_RELATED_TYPES` for that picker. When it is `None`,
 the picker inherits the global default.

+#### Looking Up Subjects via API
+
+Superset exposes a read-only REST API for resolving subjects:
+
+```
+GET /api/v1/security/subject/
+```
+
+The main use case is **id mapping** — given a user, role, or group id, callers (including
+extensions) can look up the corresponding subject entity, and vice versa. Access is gated by
+the `can_read` permission on the `Subject` resource, which is granted to **Admins only** by
+default, since subjects enumerate every user, role, and group on the instance. Callers without
+that permission receive a `403`. Only `GET` (list, get, info) is exposed — there is no create,
+update, or delete, because subjects are derived automatically from users, roles, and groups and
+kept in sync internally.
+
+**Resolve the subject for a given principal id** using [Rison](https://github.com/Nanonid/rison)
+query syntax:
+
+```
+GET /api/v1/security/subject/?q=(filters:!((col:user_id,opr:eq,value:5)))
+GET /api/v1/security/subject/?q=(filters:!((col:role_id,opr:eq,value:3)))
+GET /api/v1/security/subject/?q=(filters:!((col:group_id,opr:eq,value:2)))
+```
+
+**Filter by subject type or active status:**
+
+```
+GET /api/v1/security/subject/?q=(filters:!((col:type,opr:eq,value:1)))
+GET /api/v1/security/subject/?q=(filters:!((col:active,opr:eq,value:!t)))
+```
+
+The `type` column is an integer enum: `1` for User, `2` for Role, `3` for Group
+(`superset.subjects.types.SubjectType`).
+
+**Search by label:**
+
+```
+GET /api/v1/security/subject/?q=(filters:!((col:label,opr:subject_all_text,value:finance)))
+```
+
+Each subject in the response includes flat scalar ids (`user_id`, `role_id`, `group_id`) rather
+than a nested object, so callers can match directly on whichever id they already have — only the
+id field matching the subject's `type` is populated; the others are `null`.
+
 ### Dashboard Access Control

 Access to dashboards is managed via editors (subjects that have edit permissions to the dashboard).
@@ -303,6 +303,10 @@ Conditional formatting rules highlight cells based on their values. Rules can be

 Each rule has a **"Use gradient"** toggle: enabled applies a varying opacity (lighter = further from threshold), disabled applies a solid fill at full opacity regardless of value.

+Each rule's color is set with a full color picker rather than a fixed dropdown of presets. Pick any custom color, or use the **Colors** preset swatches, which reference theme tokens (success, warning, error, and their background variants) so a rule's color updates automatically if the active theme changes, including switching between light and dark mode.
+
+When a rule targets a column with an active time comparison, a **Trend colors** preset also appears, letting you color cells green for an increase and red for a decrease (or the reverse).
+
 #### HTML Rendering in Table Cells

 Table chart cells can render raw HTML, enabling rich formatting such as hyperlinks, colored badges, and icons directly in the data. Enable this per-column in the chart's **Column Configuration** panel by toggling **Render HTML**.
@@ -129,3 +129,4 @@ The following URL parameters can be passed through the `urlParams` option in `da
 - **Guest tokens expire** — their lifetime is controlled by the `GUEST_TOKEN_JWT_EXP_SECONDS` config (default: 5 minutes). Refresh tokens before they expire using a token refresh mechanism in your host app.
 - **Row-level security** — pass `rls` rules in the guest token request to restrict which rows are visible to the embedded user.
 - **Allowed domains** — restrict which host origins can embed a dashboard by setting **Allowed Domains** per-dashboard in the _Embed_ settings modal. Superset checks the request's `Referer` header against this list before serving the embedded view; an empty list allows any origin, so configure this explicitly for production.
+- **Redacted errors** — API responses to a guest token report a generic `An error occurred while fetching the data.` instead of the underlying error, since engine errors quote catalog, schema, table and column names. Errors Superset raises itself — access denials, timeouts, payload validation — keep their message, and the full error is always available in the server logs.
@@ -352,6 +352,13 @@ The **Custom** time range picker accepts natural language expressions alongside

 These expressions are evaluated at query time, so saved charts always display data relative to the current date.

+### Downloading Drill to Detail and Drill By Results
+
+The **Drill to detail** and **Drill by** modals, available from a chart's context menu, show the row-level
+data behind a chart (or behind a specific data point, when one is selected). Use the **Download** button in
+the modal's toolbar to export the underlying result set as CSV or Excel (XLSX) without leaving the modal —
+the export isn't limited to the page currently visible in the table.
+
 :::resources

 - [Chart Walkthroughs](https://docs.preset.io/docs/chart-walkthroughs) - Detailed guides for most chart types
@@ -0,0 +1,92 @@
+---
+title: Number Formatting
+sidebar_position: 11
+description: Reference for the built-in D3-based number format presets available on chart metrics and axes
+keywords: [number format, d3 format, formatting, duration, memory, length, distance]
+---
+
+{/*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied. See the License for the
+specific language governing permissions and limitations
+under the License.
+*/}
+
+# Number Formatting
+
+Most chart types expose a **Number format** control (labeled **D3 Format**, **Y Axis Format**, or similar depending on the chart) wherever a metric or numeric axis can be formatted. This is available from the **Customize** tab, or from the metric's popover editor, depending on the chart type. Selecting one of the built-in presets below applies that formatting to the values Superset renders in the chart.
+
+When an axis format control's chart has **Comparison display** set to **Percentage** (e.g. period-over-period comparisons), that control's choices are narrowed to percentage-only presets, hiding `SMART_NUMBER`, `~g`, and the duration/memory/length presets.
+
+You can also type a custom [D3 format string](https://github.com/d3/d3-format) directly into the control if none of the presets fit your needs.
+
+## Built-in presets
+
+### General
+
+| Key | Description |
+| --- | --- |
+| `SMART_NUMBER` | Adaptive formatting — automatically picks a reasonable precision based on the value |
+| `~g` | Original value, using D3's general-format specifier (trims trailing zeros; may switch to exponential notation for very large or small values) |
+
+### D3 format strings
+
+These are raw [D3 format specifiers](https://github.com/d3/d3-format#locale_format). The dropdown shows a live preview of each one against a sample value.
+
+| Format spec | What it does |
+| --- | --- |
+| `,d` | Integer, comma-grouped thousands |
+| `.1s` | SI-prefix notation, 1 significant digit |
+| `.3s` | SI-prefix notation, 3 significant digits |
+| `,.1%` | Percentage, 1 decimal place, comma-grouped |
+| `.2%` | Percentage, 2 decimal places |
+| `.3%` | Percentage, 3 decimal places |
+| `.4r` | Rounded to 4 significant digits |
+| `,.1f` | Fixed-point, 1 decimal place, comma-grouped |
+| `,.2f` | Fixed-point, 2 decimal places, comma-grouped |
+| `,.3f` | Fixed-point, 3 decimal places, comma-grouped |
+| `+,` | Comma-grouped, always shows the sign |
+| `$,.2f` | Currency, 2 decimal places, comma-grouped |
+
+### Duration
+
+| Key | Description |
+| --- | --- |
+| `DURATION` | Duration in ms (`66000` => `1m 6s`) |
+| `DURATION_SUB` | Duration in ms, with sub-second precision (`1.40008` => `1ms 400µs 80ns`) |
+| `DURATION_COL` | Duration in ms, colon-separated (`10500` => `0:00:10.5`) |
+
+### Memory
+
+| Key | Description |
+| --- | --- |
+| `MEMORY_DECIMAL` | Memory in bytes, decimal (`1024B` => `1.024kB`) |
+| `MEMORY_BINARY` | Memory in bytes, binary (`1024B` => `1KiB`) |
+| `MEMORY_TRANSFER_RATE_DECIMAL` | Memory transfer rate in bytes, decimal (`1024B` => `1.024kB/s`) |
+| `MEMORY_TRANSFER_RATE_BINARY` | Memory transfer rate in bytes, binary (`1024B` => `1KiB/s`) |
+
+### Distance / length
+
+| Key | Description |
+| --- | --- |
+| `LENGTH` | Length in meters, converted to kilometers (`12345m` => `12.35km`) |
+| `LENGTH_CM_KM` | Length in centimeters, converted to kilometers (`12345678cm` => `123.46km`) |
+| `LENGTH_CM_M` | Length in centimeters, converted to meters (`12345cm` => `123.45m`) |
+
+Use these when a metric's underlying values are stored in meters or centimeters but are easier to read at a coarser unit — for example, distances traveled, cable/pipe lengths, or elevation changes.
+
+## Currency
+
+Some chart types also expose currency-specific formatting, including a dynamic mode that reads the currency from a column value. See [Dynamic Currency Formatting](./creating-your-first-dashboard#dynamic-currency-formatting) for details.
@@ -60,13 +60,13 @@
    "@saucelabs/theme-github-codeblock": "^0.3.0",
    "@storybook/addon-docs": "^10.5.5",
    "@superset-ui/core": "^0.20.4",
-    "@swc/core": "^1.15.46",
-    "antd": "^6.5.2",
-    "baseline-browser-mapping": "^2.11.5",
+    "@swc/core": "^1.15.47",
+    "antd": "^6.5.3",
+    "baseline-browser-mapping": "^2.11.11",
    "caniuse-lite": "^1.0.30001806",
-    "docusaurus-plugin-openapi-docs": "^5.1.2",
-    "docusaurus-theme-openapi-docs": "^5.1.2",
-    "js-yaml": "^5.2.2",
+    "docusaurus-plugin-openapi-docs": "^5.1.3",
+    "docusaurus-theme-openapi-docs": "^5.1.3",
+    "js-yaml": "^5.2.3",
    "json-bigint": "^1.0.0",
    "prism-react-renderer": "^2.4.1",
    "react": "^18.3.1",
@@ -93,11 +93,11 @@
    "@typescript-eslint/parser": "^8.65.0",
    "eslint": "^9.39.2",
    "eslint-plugin-react": "^7.37.5",
-    "globals": "^17.8.0",
+    "globals": "^17.9.0",
    "oxfmt": "^0.61.0",
    "typescript": "~6.0.3",
    "typescript-eslint": "^8.65.0",
-    "webpack": "^5.109.1"
+    "webpack": "^5.109.2"
  },
  "browserslist": {
    "production": [
@@ -89,9 +89,9 @@
      },
      {
        "name": "SOFT_DELETE",
-        "default": false,
+        "default": true,
        "lifecycle": "development",
-        "description": "Temporary rollout / kill-switch gate for soft delete (default off = legacy hard delete). An emergency stop, not a clean rollback: flipping ON->OFF resurrects already-soft-deleted rows. Removed (along with its two gate points \u2014 BaseDAO.delete routing and the do_orm_execute visibility listener) once soft delete is stable."
+        "description": "Temporary rollout / kill-switch gate for soft delete (off = legacy hard delete). An emergency stop, not a clean rollback: flipping ON->OFF resurrects already-soft-deleted rows. Retained through this release as the move-back lever; removed (along with its two gate points \u2014 BaseDAO.delete routing and the do_orm_execute visibility listener) once post-flip confidence is established."
      },
      {
        "name": "TABLE_V2_TIME_COMPARISON_ENABLED",
@@ -107,9 +107,9 @@
      },
      {
        "name": "VERSION_HISTORY",
-        "default": false,
+        "default": true,
        "lifecycle": "development",
-        "description": "Enables the version history panel on Explore and Dashboard pages. History only accrues while ``ENABLE_VERSIONING_CAPTURE`` is also on; with capture off the panel renders but stays empty."
+        "description": "Enables the version history panel on Explore and Dashboard pages. History only accrues while ``ENABLE_VERSIONING_CAPTURE`` is also on; with capture off the panel renders but stays empty, so the two ship with matching defaults and should be changed together."
      }
    ],
    "testing": [
@@ -11383,6 +11383,13 @@
      },
      "User3": {
        "properties": {
+          "attributes": {
+            "additionalProperties": {
+              "nullable": true
+            },
+            "nullable": true,
+            "type": "object"
+          },
          "first_name": {
            "type": "string"
          },
@@ -423,7 +423,7 @@ echo "sqlalchemy-cratedb" >> ./docker/requirements-local.txt
 #### Databend

 The recommended connector library for Databend is [databend-sqlalchemy](https://pypi.org/project/databend-sqlalchemy/).
-Superset has been tested on `databend-sqlalchemy>=0.2.3`.
+Superset has been tested on `databend-sqlalchemy>=0.5.5`.

 The recommended connection string is:

@@ -434,7 +434,7 @@ databend://{username}:{password}@{host}:{port}/{database_name}
 Here's a connection string example of Superset connecting to a Databend database:

 ```
-databend://user:password@localhost:8000/default?secure=false
+databend://user:password@localhost:8000/default?sslmode=disable
 ```

 #### Databricks
@@ -3605,10 +3605,10 @@
    "@rc-component/util" "^1.11.1"
    clsx "^2.1.1"

-"@rc-component/form@~1.8.5":
-  version "1.8.5"
-  resolved "https://registry.yarnpkg.com/@rc-component/form/-/form-1.8.5.tgz#20571cfd401dc38c74c38cdf4722ddc6c23a9806"
-  integrity sha512-d24EYtvUOBhxEtSd/EqIu9DaMuqrWF2IRIvAFCTM6NQ/GJIYNr8DvEpUSUlv2uPxEJ0ZPwYQ+wwlGIAaiHvdrw==
+"@rc-component/form@~1.8.6":
+  version "1.8.6"
+  resolved "https://registry.yarnpkg.com/@rc-component/form/-/form-1.8.6.tgz#4db8ffb27280e92540546e8bb19e3dacfa260f4b"
+  integrity sha512-1EXVsSKPZC6kGrIqxVck7kAWM6T65b6et/n5wIcyiaIa41VrDshD0nVLHoBDEIZr2ATQsOP6icb4XQkNFMLBAw==
  dependencies:
    "@rc-component/async-validator" "^6.0.0"
    "@rc-component/util" "^1.11.1"
@@ -3713,10 +3713,10 @@
    "@rc-component/util" "^1.11.1"
    clsx "^2.1.1"

-"@rc-component/picker@~1.11.0":
-  version "1.11.0"
-  resolved "https://registry.yarnpkg.com/@rc-component/picker/-/picker-1.11.0.tgz#ab85a2f1a3f13a55829837d29c862967e701cddd"
-  integrity sha512-6qXGKtoJvO8sUd17m5cyNEbEJub0zflCHnaZTBBmj63DPRZYc0WEHN8rp6hFSl+yMCJS/dJY5G+1fQ8bLCuD7A==
+"@rc-component/picker@~1.12.0":
+  version "1.12.0"
+  resolved "https://registry.yarnpkg.com/@rc-component/picker/-/picker-1.12.0.tgz#4754d27ad31f2022d81455514871805d556ff790"
+  integrity sha512-0FZGgDiDZFMm2hcfGv4jyjm7yWIj2MiwfeTzLL0vWkO+8cCSKdiM9XhWpkn1aAsoI2EwUy48Oz2cGfvL8ZKrfw==
  dependencies:
    "@rc-component/overflow" "^1.0.0"
    "@rc-component/resize-observer" "^1.0.0"
@@ -4787,86 +4787,86 @@
  dependencies:
    apg-lite "^1.0.4"

-"@swc/core-darwin-arm64@1.15.46":
-  version "1.15.46"
-  resolved "https://registry.yarnpkg.com/@swc/core-darwin-arm64/-/core-darwin-arm64-1.15.46.tgz#393903c7eda790dbd89abd8fa0afdd9041543e5f"
-  integrity sha512-IsISIT22EfktVJrlvIpnAxG2u/A9aob9l99HMlx80x72WlFmFPk1V3UhkEzx86eJP8hw049KTFv/RISho2cq2Q==
+"@swc/core-darwin-arm64@1.15.47":
+  version "1.15.47"
+  resolved "https://registry.yarnpkg.com/@swc/core-darwin-arm64/-/core-darwin-arm64-1.15.47.tgz#345ce6a1bf4033da189c2e3eff1244190195d15b"
+  integrity sha512-GsoMtan3ojGGMGFbl31mmRu5ctZ56re8grGE8mO/OHJ8O+JRkzod02fe7X6ZQ8JvamA3imkEkx/h3u+vsOgPgA==

-"@swc/core-darwin-x64@1.15.46":
-  version "1.15.46"
-  resolved "https://registry.yarnpkg.com/@swc/core-darwin-x64/-/core-darwin-x64-1.15.46.tgz#ddf16787e320636621180df480a3490fd9a868ca"
-  integrity sha512-4Tj4ppVIPCmUMpmGFiGtyEriwLyJ+yi/US4WfBrP/ok8COGddDZXLEzQETnKyK46mjvr1v0jevrS23zjoff7vA==
+"@swc/core-darwin-x64@1.15.47":
+  version "1.15.47"
+  resolved "https://registry.yarnpkg.com/@swc/core-darwin-x64/-/core-darwin-x64-1.15.47.tgz#f3debf50b5c1602bf392acb412bd33fd6d7e4f98"
+  integrity sha512-leTi7Rx3KF4zcC637iqWgk9SoV8VXAD8ppQYXsep63px5A/UftOcxLN1pmr8Z1si/YvX90ompP/rHgpYkgwXWg==

-"@swc/core-linux-arm-gnueabihf@1.15.46":
-  version "1.15.46"
-  resolved "https://registry.yarnpkg.com/@swc/core-linux-arm-gnueabihf/-/core-linux-arm-gnueabihf-1.15.46.tgz#7bee01b7311c43b913771ef9c7012931871de73b"
-  integrity sha512-i8tUGnNjyOgMmfmgFSg4aeJLQoFyfpIHK5FjpQAwpRyQIqEUB2w1e8zIDQzY1WhOxx8NoS1S5iUL813Un4Sf5A==
+"@swc/core-linux-arm-gnueabihf@1.15.47":
+  version "1.15.47"
+  resolved "https://registry.yarnpkg.com/@swc/core-linux-arm-gnueabihf/-/core-linux-arm-gnueabihf-1.15.47.tgz#14a247a12c6d3de1ee63fa4fdbf5a4302936b5d6"
+  integrity sha512-hBqHuoWKKIsKmDBn9qVeWqj5GWZhtlcczVaqQmNRXsDfq+voR5CxKRfamA367QjJXtceYuliLFfEL8QsskRM2g==

-"@swc/core-linux-arm64-gnu@1.15.46":
-  version "1.15.46"
-  resolved "https://registry.yarnpkg.com/@swc/core-linux-arm64-gnu/-/core-linux-arm64-gnu-1.15.46.tgz#964596d757d18f04a02873d85a3660416c09c187"
-  integrity sha512-c0OnhqzdhfOvv6qhNCcByepB+sNYOGZyhtr2Qa6ZCHvAWTYhSRw4j/u92Stue9PbZ/6q74b9nHzi76+kVzqQHQ==
+"@swc/core-linux-arm64-gnu@1.15.47":
+  version "1.15.47"
+  resolved "https://registry.yarnpkg.com/@swc/core-linux-arm64-gnu/-/core-linux-arm64-gnu-1.15.47.tgz#3b8d09c481ae51c7b72d98fb6ce98f7b90065a1a"
+  integrity sha512-TBxvRz+B4K205TWHHZxWVxkC2RFNP/Mz3PNcECBos5PsKwxjg3QSJzdoebr0VCf0Bfh8HOPldKxAP/8XkFe9gA==

-"@swc/core-linux-arm64-musl@1.15.46":
-  version "1.15.46"
-  resolved "https://registry.yarnpkg.com/@swc/core-linux-arm64-musl/-/core-linux-arm64-musl-1.15.46.tgz#213d3ece772689a8166ed51064836346c6ce1c2a"
-  integrity sha512-imyRpNEcUzFQFV2LE4jL68ErvmKEuZCbvZru77iQREunJ+bR4i658cupTgtG1mLYM3F1Tzy3Sb9xYb02KghWTg==
+"@swc/core-linux-arm64-musl@1.15.47":
+  version "1.15.47"
+  resolved "https://registry.yarnpkg.com/@swc/core-linux-arm64-musl/-/core-linux-arm64-musl-1.15.47.tgz#7ff2baa16e67b29017fdf7c6b69e40de7920ce1a"
+  integrity sha512-3Yu3Uq/VgytqsPjTMbkPU1ExADytbdWbruJYhA584E9jrpE2Ki+R6VVPoZCeAVk1Cb7QxcRTgblw6bSa6a/R+w==

-"@swc/core-linux-ppc64-gnu@1.15.46":
-  version "1.15.46"
-  resolved "https://registry.yarnpkg.com/@swc/core-linux-ppc64-gnu/-/core-linux-ppc64-gnu-1.15.46.tgz#4d2ec554103c6bef60cc1e294f374ea5a5edaf78"
-  integrity sha512-ctEfcl/HcUeomK33cbySiHZm98GEDIxTm1EkpBsYCiHxElYBzvTXVeuQT2YwbUXn9XCrjiw4ipyUNk33k26qRg==
+"@swc/core-linux-ppc64-gnu@1.15.47":
+  version "1.15.47"
+  resolved "https://registry.yarnpkg.com/@swc/core-linux-ppc64-gnu/-/core-linux-ppc64-gnu-1.15.47.tgz#a3841982fe2eb2d889648c8e212b6d821db316d6"
+  integrity sha512-wfdMi5IaOaNtmh2/6geRoxIdNfqylUZFdtzTKS655y1axWfIWyx7As74vv0wVdjeCIZ3WmCI9odDd4rUttXOSQ==

-"@swc/core-linux-s390x-gnu@1.15.46":
-  version "1.15.46"
-  resolved "https://registry.yarnpkg.com/@swc/core-linux-s390x-gnu/-/core-linux-s390x-gnu-1.15.46.tgz#097a19792ec22e2f51f6bfac02da1e0b3f5e5bb1"
-  integrity sha512-DxlMdnt84TtRVTv7WL/thWyz9+QU8QZNNoAP9rrk0P68LziuhfePp8MjQ44zIprpTHTsEwyziIuGUUN5iSC1bQ==
+"@swc/core-linux-s390x-gnu@1.15.47":
+  version "1.15.47"
+  resolved "https://registry.yarnpkg.com/@swc/core-linux-s390x-gnu/-/core-linux-s390x-gnu-1.15.47.tgz#edbfd705d6285f7dce48915871478bc9603904c3"
+  integrity sha512-3hHYBY0yx8Ez7GMRrkhXHQzMdR5IZA6Wq5Ee4svlgwvSECLpnAJ9+0AimEGUFDvuLwE7nV/2+PYe8+Nm4rvNcQ==

-"@swc/core-linux-x64-gnu@1.15.46":
-  version "1.15.46"
-  resolved "https://registry.yarnpkg.com/@swc/core-linux-x64-gnu/-/core-linux-x64-gnu-1.15.46.tgz#39c1ca215f9ca643a4aa3ca6250cc38ba5f5c673"
-  integrity sha512-SKxI7J6t90XPl8hRUqtJi9NfGdunN/E/vZMc7Bc0figeRdOPDBT+Tm8g7cx9xM0T0mewh2l+8dewa3Am27/P+A==
+"@swc/core-linux-x64-gnu@1.15.47":
+  version "1.15.47"
+  resolved "https://registry.yarnpkg.com/@swc/core-linux-x64-gnu/-/core-linux-x64-gnu-1.15.47.tgz#e7f61a7771d6a9b5b274521ba61809b3d7644325"
+  integrity sha512-TjfhjgP/jGCfFHYC3JQPhJA1HwErbIJ9JfREDc1KNkvY6P0LodCgKVIlQ5deeTbkG7ih3bF5PHJLuLpaZjdRyQ==

-"@swc/core-linux-x64-musl@1.15.46":
-  version "1.15.46"
-  resolved "https://registry.yarnpkg.com/@swc/core-linux-x64-musl/-/core-linux-x64-musl-1.15.46.tgz#323a720bc965fffeedacdc3167b46a291553b5e0"
-  integrity sha512-qj9T6B7bosI0VEsrWOVXZN1OXxS8Tp63ywyrLxNdOycnUtLdkgYcoBsN5y8ImnDDsnwrEWZOy1e+J4xSe7mA3Q==
+"@swc/core-linux-x64-musl@1.15.47":
+  version "1.15.47"
+  resolved "https://registry.yarnpkg.com/@swc/core-linux-x64-musl/-/core-linux-x64-musl-1.15.47.tgz#7c1ef8305444bcc7894de177fe225f2d8f3be609"
+  integrity sha512-CQpS8Ge/avfjZd0UEwG/sds83Uu32deQXcV1Jo3jD0mmvQQqtYAjpsDZXugmheeAwmt+YIuoVtVHro8LMYHqsQ==

-"@swc/core-win32-arm64-msvc@1.15.46":
-  version "1.15.46"
-  resolved "https://registry.yarnpkg.com/@swc/core-win32-arm64-msvc/-/core-win32-arm64-msvc-1.15.46.tgz#9c2cfd2a59be74671a018097b8914f8cfbcc698d"
-  integrity sha512-8p7l4c3LU+eA5g9Et1JPhNeMC1oQwXTGU+uah8DPIBX7YXzqswvaBtyKVmXefVGi/DJU1x3YJsc3mbAp9aWzSQ==
+"@swc/core-win32-arm64-msvc@1.15.47":
+  version "1.15.47"
+  resolved "https://registry.yarnpkg.com/@swc/core-win32-arm64-msvc/-/core-win32-arm64-msvc-1.15.47.tgz#953856d26b28956d1a18ef10e5f221202b2cb8f1"
+  integrity sha512-0W8IKHsUTYiT7G2RqtOoVWk+89yzZikIiDUb/sCK6BmQDBhN91hQSfyUtW12jhEWLzYgcfmisfsZrmZE+84U1A==

-"@swc/core-win32-ia32-msvc@1.15.46":
-  version "1.15.46"
-  resolved "https://registry.yarnpkg.com/@swc/core-win32-ia32-msvc/-/core-win32-ia32-msvc-1.15.46.tgz#bd7bd009a47b0f9826212e7ed36385d32fe193d8"
-  integrity sha512-tUEnfr3Bn9u6FOjUb3PN9p+09qZC2j+wNDLKHzXXZn22rqGcUqR/ohCRSS+nG9B9+X+U+3FewNEHJkTmdIvMjQ==
+"@swc/core-win32-ia32-msvc@1.15.47":
+  version "1.15.47"
+  resolved "https://registry.yarnpkg.com/@swc/core-win32-ia32-msvc/-/core-win32-ia32-msvc-1.15.47.tgz#2743a5bccc49f252c23bad3135193640cbdcef3a"
+  integrity sha512-ZIp49d2Z4/ka2jO9otOg4hDvTdPmp86kVOgS2M5FCPI7eKKZ1W0boxWn+8XeZrfERtFGW0AlMRm4JhlJa7l3NA==

-"@swc/core-win32-x64-msvc@1.15.46":
-  version "1.15.46"
-  resolved "https://registry.yarnpkg.com/@swc/core-win32-x64-msvc/-/core-win32-x64-msvc-1.15.46.tgz#8371845a5bdb330cf05b009f602bb8c4636c6beb"
-  integrity sha512-Vux7UDzBJYQggSuPfcl2w9iu+IJpgpRCxHzgCaVkELnAXAE4XZMOTX9HNcaNiwfeIDqdu2rkr69RuDm6wY8neA==
+"@swc/core-win32-x64-msvc@1.15.47":
+  version "1.15.47"
+  resolved "https://registry.yarnpkg.com/@swc/core-win32-x64-msvc/-/core-win32-x64-msvc-1.15.47.tgz#9674ad0c9187b7cbe5cc3080b31b960d3ee688b9"
+  integrity sha512-2h8Iek95vnixkBRCo+H8p09+Q5ll2NgSMFrWTy0iKt7+/t+8/T5mBpiT6c0ZxSS7wcWjwZ9sGZkK70tTSYHdDw==

-"@swc/core@^1.15.40", "@swc/core@^1.15.46":
-  version "1.15.46"
-  resolved "https://registry.yarnpkg.com/@swc/core/-/core-1.15.46.tgz#8acc0f68ee55010fdc876adf2a8faf0b097c681b"
-  integrity sha512-Ri3em2mBpq3h2zSPliCYl63otDGqek8PPEfv2nWgRQEbZ/VBCNyypVTVQ6cEbTCXBhy+WE2T3fQb08moIyuYaw==
+"@swc/core@^1.15.40", "@swc/core@^1.15.47":
+  version "1.15.47"
+  resolved "https://registry.yarnpkg.com/@swc/core/-/core-1.15.47.tgz#6226e842160e247eb79a9aeac1095ebddb56639f"
+  integrity sha512-FbsO5JcfOjfH38W/rohBRBweJeERsAuIP4f377lmkmxTcq9exjtx4SkRuZY5CdfhR2CBVwDIJegBpJDffwNsOg==
  dependencies:
    "@swc/counter" "^0.1.3"
    "@swc/types" "^0.1.27"
  optionalDependencies:
-    "@swc/core-darwin-arm64" "1.15.46"
-    "@swc/core-darwin-x64" "1.15.46"
-    "@swc/core-linux-arm-gnueabihf" "1.15.46"
-    "@swc/core-linux-arm64-gnu" "1.15.46"
-    "@swc/core-linux-arm64-musl" "1.15.46"
-    "@swc/core-linux-ppc64-gnu" "1.15.46"
-    "@swc/core-linux-s390x-gnu" "1.15.46"
-    "@swc/core-linux-x64-gnu" "1.15.46"
-    "@swc/core-linux-x64-musl" "1.15.46"
-    "@swc/core-win32-arm64-msvc" "1.15.46"
-    "@swc/core-win32-ia32-msvc" "1.15.46"
-    "@swc/core-win32-x64-msvc" "1.15.46"
+    "@swc/core-darwin-arm64" "1.15.47"
+    "@swc/core-darwin-x64" "1.15.47"
+    "@swc/core-linux-arm-gnueabihf" "1.15.47"
+    "@swc/core-linux-arm64-gnu" "1.15.47"
+    "@swc/core-linux-arm64-musl" "1.15.47"
+    "@swc/core-linux-ppc64-gnu" "1.15.47"
+    "@swc/core-linux-s390x-gnu" "1.15.47"
+    "@swc/core-linux-x64-gnu" "1.15.47"
+    "@swc/core-linux-x64-musl" "1.15.47"
+    "@swc/core-win32-arm64-msvc" "1.15.47"
+    "@swc/core-win32-ia32-msvc" "1.15.47"
+    "@swc/core-win32-x64-msvc" "1.15.47"

 "@swc/counter@^0.1.3":
  version "0.1.3"
@@ -6113,10 +6113,10 @@ ansis@^3.2.0:
  resolved "https://registry.yarnpkg.com/ansis/-/ansis-3.17.0.tgz#fa8d9c2a93fe7d1177e0c17f9eeb562a58a832d7"
  integrity sha512-0qWUglt9JEqLFr3w1I1pbrChn1grhaiAR2ocX1PP/flRmxgtwTzPFFFnfIlD6aMOLQZgSuCRlidD70lvx8yhzg==

-antd@^6.5.2:
-  version "6.5.2"
-  resolved "https://registry.yarnpkg.com/antd/-/antd-6.5.2.tgz#d771211beddf539f37303f862df24e8aaf32b7c4"
-  integrity sha512-ntYx0lr4Jq192QnBkDWkDqEeoberXZ34vSE9SgiP/0J6DY8O0pzR3bVZLBsdpCSguVkwjtEAP+QNeMN7LNAvgw==
+antd@^6.5.3:
+  version "6.5.3"
+  resolved "https://registry.yarnpkg.com/antd/-/antd-6.5.3.tgz#3c7d2ec4a20be116f72b7fbbdb4497d65ffd6dae"
+  integrity sha512-Q5r8sztf9Yk9B70bSUjnPYMCJ4A/eZM7uMoTj8UAhlSKR9aftjEuBEPcNSmRux7hB+87rxO8vN1X4HNjR97qyQ==
  dependencies:
    "@ant-design/colors" "^8.0.1"
    "@ant-design/cssinjs" "^2.1.2"
@@ -6132,7 +6132,7 @@ antd@^6.5.2:
    "@rc-component/dialog" "~1.10.0"
    "@rc-component/drawer" "~1.4.2"
    "@rc-component/dropdown" "~1.0.3"
-    "@rc-component/form" "~1.8.5"
+    "@rc-component/form" "~1.8.6"
    "@rc-component/image" "~1.9.0"
    "@rc-component/input" "~1.3.1"
    "@rc-component/input-number" "~1.6.2"
@@ -6142,7 +6142,7 @@ antd@^6.5.2:
    "@rc-component/mutate-observer" "^2.0.1"
    "@rc-component/notification" "~2.0.7"
    "@rc-component/pagination" "~1.4.0"
-    "@rc-component/picker" "~1.11.0"
+    "@rc-component/picker" "~1.12.0"
    "@rc-component/progress" "~1.0.2"
    "@rc-component/qrcode" "~2.0.0"
    "@rc-component/rate" "~1.0.1"
@@ -6453,10 +6453,10 @@ base64-js@^1.3.1, base64-js@^1.5.1:
  resolved "https://registry.yarnpkg.com/base64-js/-/base64-js-1.5.1.tgz#1b1b440160a5bf7ad40b650f095963481903930a"
  integrity sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==

-baseline-browser-mapping@^2.10.38, baseline-browser-mapping@^2.11.5, baseline-browser-mapping@^2.9.19:
-  version "2.11.5"
-  resolved "https://registry.yarnpkg.com/baseline-browser-mapping/-/baseline-browser-mapping-2.11.5.tgz#eca24c8ff0c24fcedef86260e2aae8c76b8dbce8"
-  integrity sha512-xJo6a6YZnwZfnyGmQKWMbVOcii7XRibjOskRh+WJ9UHQoX16xrQrcIgAMQOzfvs8XiLMx6ih/fsLPF73iY2D1A==
+baseline-browser-mapping@^2.10.38, baseline-browser-mapping@^2.11.11, baseline-browser-mapping@^2.9.19:
+  version "2.11.11"
+  resolved "https://registry.yarnpkg.com/baseline-browser-mapping/-/baseline-browser-mapping-2.11.11.tgz#7e31d8b4ba8e324af999f8f35aedf0b410bea526"
+  integrity sha512-/yImnXwyTvgMkhgekLHok/Rx5vO6E0BmStWlSqKWMVm2a2ITuZ1Tn+9bgLS+gZRdZmWtd8nxuhHpdmCUOWsTQQ==

 batch@0.6.1:
  version "0.6.1"
@@ -7938,10 +7938,10 @@ doctrine@^2.1.0:
  dependencies:
    esutils "^2.0.2"

-docusaurus-plugin-openapi-docs@^5.1.2:
-  version "5.1.2"
-  resolved "https://registry.yarnpkg.com/docusaurus-plugin-openapi-docs/-/docusaurus-plugin-openapi-docs-5.1.2.tgz#1ef66a26d80e2a3baf4caae4e72a0dcf85c6d608"
-  integrity sha512-xlgl/8+2iqSQWdhTJay0lfXqWduaGVTYrn+9i+uT3Uk5gkeDjfQOIVnHGnIHfKg0pUjIm008fvEQVAxk3TvgaQ==
+docusaurus-plugin-openapi-docs@^5.1.3:
+  version "5.1.3"
+  resolved "https://registry.yarnpkg.com/docusaurus-plugin-openapi-docs/-/docusaurus-plugin-openapi-docs-5.1.3.tgz#b8cd5f8451aaf881deb1a744a8295685f1681865"
+  integrity sha512-HnpblSBdXoR39VNTIW9zWERUsMJxXOpvdQoBKyaTkUBPwCM48Z76+ndo2yO2vADq+EhWjJlfxL1DUzCrgNjThQ==
  dependencies:
    "@apidevtools/json-schema-ref-parser" "^15.3.3"
    "@redocly/openapi-core" "^2.25.2"
@@ -7959,10 +7959,10 @@ docusaurus-plugin-openapi-docs@^5.1.2:
    swagger2openapi "^7.0.8"
    xml-formatter "^3.6.6"

-docusaurus-theme-openapi-docs@^5.1.2:
-  version "5.1.2"
-  resolved "https://registry.yarnpkg.com/docusaurus-theme-openapi-docs/-/docusaurus-theme-openapi-docs-5.1.2.tgz#8591e3be971920c5eb347b9aab4bac77db5c7c31"
-  integrity sha512-uJx+a4qHmpOnl+e7YzsPJSga6d6TLGEVZZPtI7KkzC/PgG7bS8E4P8hknvWqmAEahxhLWEb8izIA3up/0g9RwA==
+docusaurus-theme-openapi-docs@^5.1.3:
+  version "5.1.3"
+  resolved "https://registry.yarnpkg.com/docusaurus-theme-openapi-docs/-/docusaurus-theme-openapi-docs-5.1.3.tgz#e23644a63785352abbc76e42760c0dfdff3669e1"
+  integrity sha512-npbD1QahtjAEmrOet/86i5fTmcJX4/rPhVT+c0qKjm7StUNbyqjwchSVBQuU1rB69T51JOA9TpT/y6QcB9Xjvw==
  dependencies:
    "@hookform/error-message" "^2.0.1"
    "@reduxjs/toolkit" "^2.8.2"
@@ -7973,7 +7973,7 @@ docusaurus-theme-openapi-docs@^5.1.2:
    crypto-js "^4.2.0"
    file-saver "^2.0.5"
    lodash "^4.17.21"
-    pako "^2.1.0"
+    pako "^3.0.1"
    path-browserify "^1.0.1"
    postman-code-generators "^2.0.0"
    postman-collection "^5.0.2"
@@ -7988,7 +7988,7 @@ docusaurus-theme-openapi-docs@^5.1.2:
    rehype-raw "^7.0.0"
    remark-gfm "4.0.1"
    sass "^1.89.2"
-    sass-loader "^16.0.5"
+    sass-loader "^17.0.0"
    unist-util-visit "^5.0.0"
    url "^0.11.4"
    xml-formatter "^3.6.6"
@@ -8048,9 +8048,9 @@ domhandler@^5.0.2, domhandler@^5.0.3:
    domelementtype "^2.3.0"

 dompurify@^3.3.3, dompurify@^3.4.12:
-  version "3.4.12"
-  resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-3.4.12.tgz#6fa2265e9bbdce882c4ace4107626051b448ffa8"
-  integrity sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==
+  version "3.4.13"
+  resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-3.4.13.tgz#fc28949d59f92d62e28a3a764bcbeee35897a1be"
+  integrity sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ==
  optionalDependencies:
    "@types/trusted-types" "^2.0.7"

@@ -8151,7 +8151,7 @@ encodeurl@~2.0.0:
  resolved "https://registry.yarnpkg.com/encodeurl/-/encodeurl-2.0.0.tgz#7b8ea898077d7e409d3ac45474ea38eaf0857a58"
  integrity sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==

-enhanced-resolve@^5.24.2:
+enhanced-resolve@^5.24.4:
  version "5.24.5"
  resolved "https://registry.yarnpkg.com/enhanced-resolve/-/enhanced-resolve-5.24.5.tgz#b4dad3255b7545f07ba5535189868e9f85f47573"
  integrity sha512-L1l8TNvomm6UVW5B253AGxQagSQr+vGwhMlrrfRS2qmhx46AMpMVJKQYLvWYbysTMY8VoicOvzHzoHMbyzB+4A==
@@ -9098,10 +9098,10 @@ globals@^14.0.0:
  resolved "https://registry.yarnpkg.com/globals/-/globals-14.0.0.tgz#898d7413c29babcf6bafe56fcadded858ada724e"
  integrity sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==

-globals@^17.8.0:
-  version "17.8.0"
-  resolved "https://registry.yarnpkg.com/globals/-/globals-17.8.0.tgz#a1f213a06adcd0eec38004c5cd39fef7af7e0830"
-  integrity sha512-Zz/LMDZScFmkakeL2cTHzf+PbWKdpU3uclqkZT7TjDG58j5WPt0PpA+n9uPI24fZtlw07q0OtEi84K+umsRzqQ==
+globals@^17.9.0:
+  version "17.9.0"
+  resolved "https://registry.yarnpkg.com/globals/-/globals-17.9.0.tgz#e43f252d6bbe71508da43902a1709c8895a59f70"
+  integrity sha512-m/MvAW61QVU5VDNF1Vj8axt016h8w7L5TU1e9zlab7XIttAT2YAlCwl75K1fOqvMM9apmD7lbCIRhpfkhmxhCg==

 globalthis@^1.0.4:
  version "1.0.4"
@@ -10215,10 +10215,10 @@ js-yaml@4.1.0, js-yaml@=4.3.0, js-yaml@^4.1.0, js-yaml@^4.1.1, js-yaml@^4.2.0, j
  dependencies:
    argparse "^2.0.1"

-js-yaml@^5.2.2:
-  version "5.2.2"
-  resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-5.2.2.tgz#497bfe63f0b0db11c7bbc5ce8bc568e836c8b08c"
-  integrity sha512-dayzUzKkJ1MkuUtZglSebU43utNXH0OWQByK9rKOOuYIO8M5TV1y+n8ALMdG0rdzBnfNkOmZEqrURepb0ejqBw==
+js-yaml@^5.2.3:
+  version "5.2.3"
+  resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-5.2.3.tgz#0942ae8f507e22eb0e54624871789cd477106e54"
+  integrity sha512-n+mUVyUX5bVv7G/G2zyIHOhdxfuU1dY2NOFzTQUWiMUbFss8b57NFlgCCaggU78wSw5KVS9cllzeLyzyR+n5nw==
  dependencies:
    argparse "^2.0.1"

@@ -10949,9 +10949,9 @@ merge2@^1.3.0, merge2@^1.4.1:
  integrity sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==

 mermaid@>=11.6.0:
-  version "11.16.0"
-  resolved "https://registry.yarnpkg.com/mermaid/-/mermaid-11.16.0.tgz#dc946bc84bde9d093ba14940d49df1d9f7d8c32f"
-  integrity sha512-Zvm3kbstgdpvIJPPItlL7fppIZ3kibvc1oZIGxdvk9t6UFz6flv+Jw7FtRGKwfcI8OckmH04LqG6LlS6X4B1pA==
+  version "11.16.1"
+  resolved "https://registry.yarnpkg.com/mermaid/-/mermaid-11.16.1.tgz#57ae2342f6c45b967113b04c9258430bdd057ee8"
+  integrity sha512-TQsq6u22fAn3rek5VOubrhKPo1g5hwC3FXUN9hiyupTckcYiGuuKGkNQrKYwGJkXUxZdojwRG46gsSCFZMDp4g==
  dependencies:
    "@braintree/sanitize-url" "^7.1.2"
    "@iconify/utils" "^3.0.2"
@@ -11737,9 +11737,9 @@ mz@^2.7.0:
    thenify-all "^1.0.0"

 nanoid@^3.3.16:
-  version "3.3.16"
-  resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.16.tgz#a04d8ec4b1f10009d2d533947aefe4293737816c"
-  integrity sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==
+  version "3.3.18"
+  resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.18.tgz#f66a2de1199ffde0fcf21c8a5f13106b1c081913"
+  integrity sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==

 natural-compare@^1.4.0:
  version "1.4.0"
@@ -12290,10 +12290,10 @@ package-manager-detector@^1.3.0:
  resolved "https://registry.yarnpkg.com/package-manager-detector/-/package-manager-detector-1.7.0.tgz#0a6d6d3856627b8ac9331f95fc891ea81247aafd"
  integrity sha512-xg1eHpwYL/D/HEdWw2goFZP6vV0FH7W+PZ5rFkGjdIDLtxq7EkzBUeT3m+lndYCt8wKbmofUu1MUdMCXkCk9ZQ==

-pako@^2.1.0:
-  version "2.2.0"
-  resolved "https://registry.yarnpkg.com/pako/-/pako-2.2.0.tgz#246b9d4c841a8d308e484c0d03786651b143e63a"
-  integrity sha512-zJq6RP/5q+TO2OpFV3FHzlPnFjmkb7Nc99a5SNjJE+uu/PkpChs+NIZSSzbBoD+6kjiISXjfYdwj1ZRQ81dz/w==
+pako@^3.0.1:
+  version "3.0.1"
+  resolved "https://registry.yarnpkg.com/pako/-/pako-3.0.1.tgz#3156f8fa86e3cc2ae5a36369475b14d4f05696ce"
+  integrity sha512-GupotUUI0mlhugKjUs4bjOwLt3nrehy9Ys2dxC0GtgVef5cnKggkDMmf2bq2poCCuVXopWPmqsc9VDT2iJUy+w==

 param-case@^3.0.4:
  version "3.0.4"
@@ -14182,12 +14182,10 @@ safe-regex-test@^1.1.0:
  resolved "https://registry.yarnpkg.com/safer-buffer/-/safer-buffer-2.1.2.tgz#44fa161b0187b9549dd84bb91802f9bd8385cd6a"
  integrity sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==

-sass-loader@^16.0.5:
-  version "16.0.8"
-  resolved "https://registry.yarnpkg.com/sass-loader/-/sass-loader-16.0.8.tgz#b7eef3b7947b32e2988dd760a2f7f0d547838e6b"
-  integrity sha512-hcov4ZwZJIGbEuyNr9EmiTmZueyrxSToE6GOzoZnq5JM7ecRO7ttyvilPn+VmRsqiP16+VYZzVnGZj/hzZgKBA==
-  dependencies:
-    neo-async "^2.6.2"
+sass-loader@^17.0.0:
+  version "17.0.0"
+  resolved "https://registry.yarnpkg.com/sass-loader/-/sass-loader-17.0.0.tgz#8f4f8864d834c1abb18f0f3d2bc653bbf29dde2a"
+  integrity sha512-0Ybm8ohBQ9LcrycVrFQp/KQBNX5a3Wda9/smS0mE/xLffzEnwvV8nykOzrbiSWNzTE3IB/jiXx8O4QmDPG2+Gw==

 sass@^1.89.2:
  version "1.101.0"
@@ -15945,10 +15943,10 @@ webpack-virtual-modules@^0.6.2:
  resolved "https://registry.yarnpkg.com/webpack-virtual-modules/-/webpack-virtual-modules-0.6.2.tgz#057faa9065c8acf48f24cb57ac0e77739ab9a7e8"
  integrity sha512-66/V2i5hQanC51vBQKPH4aI8NMAcBW59FVBs+rC7eGHupMyfn34q7rZIE+ETlJ+XTevqfUhVVBgSUNSW2flEUQ==

-webpack@^5.109.1, webpack@^5.88.1, webpack@^5.95.0:
-  version "5.109.1"
-  resolved "https://registry.yarnpkg.com/webpack/-/webpack-5.109.1.tgz#e920c94d522f5deffb5b05991f4e547b0529bfc0"
-  integrity sha512-Q4XQscWSLNQSaMFsIWUZ+IVpvwLqD+MvjIuSQC1hG8m1ZMK78VAsNMhTjD3icJelypp6aM5Hq8BZNEX3sc1PJw==
+webpack@^5.109.2, webpack@^5.88.1, webpack@^5.95.0:
+  version "5.109.2"
+  resolved "https://registry.yarnpkg.com/webpack/-/webpack-5.109.2.tgz#b58dc289561c3282db35c210a99379a836a4c28d"
+  integrity sha512-U9/cvLzxObKNEZ9+TtdqrHM5/9z3lgl2c+c4BzbqGxFQvQvBAq87yql5A8pQ+rrMbS496MZJeF5enVBndIy2hw==
  dependencies:
    "@types/estree" "^1.0.8"
    "@types/json-schema" "^7.0.15"
@@ -15958,7 +15956,7 @@ webpack@^5.109.1, webpack@^5.88.1, webpack@^5.95.0:
    acorn "^8.16.0"
    browserslist "^4.28.1"
    chrome-trace-event "^1.0.2"
-    enhanced-resolve "^5.24.2"
+    enhanced-resolve "^5.24.4"
    es-module-lexer "^2.1.0"
    eslint-scope "5.1.1"
    events "^3.2.0"
@@ -29,7 +29,7 @@ maintainers:
  - name: craig-rueda
    email: craig@craigrueda.com
    url: https://github.com/craig-rueda
-version: 0.22.4 # See [README](https://github.com/apache/superset/blob/master/helm/superset/README.md#versioning) for version details.
+version: 0.22.5 # See [README](https://github.com/apache/superset/blob/master/helm/superset/README.md#versioning) for version details.
 dependencies:
  - name: postgresql
    version: 16.7.27
@@ -23,7 +23,7 @@ NOTE: This file is generated by helm-docs: https://github.com/norwoodj/helm-docs

 # superset

-![Version: 0.22.4](https://img.shields.io/badge/Version-0.22.4-informational?style=flat-square)
+![Version: 0.22.5](https://img.shields.io/badge/Version-0.22.5-informational?style=flat-square)

 Apache Superset is a modern, enterprise-ready business intelligence web application

@@ -328,6 +328,7 @@ class CeleryConfig:
        "superset.tasks.scheduler",
        "superset.tasks.thumbnails",
        "superset.tasks.cache",
+        "superset.tasks.slack",
    )
    broker_connection_retry_on_startup = True
    worker_prefetch_multiplier = 10
@@ -50,7 +50,7 @@ dependencies = [
    "flask-cors>=6.0.5, <7.0",
    "croniter>=6.2.4",
    "cron-descriptor",
-    "cryptography>=49.0.0, <50.0.0",
+    "cryptography>=50.0.0, <51.0.0",
    "deprecation>=2.1.0, <2.2.0",
    "flask>=2.2.5, <4.0.0",
    "flask-appbuilder>=5.2.2, <6.0.0",
@@ -60,23 +60,27 @@ dependencies = [
    "flask-login>=0.6.0, < 1.0",
    "flask-migrate>=4.1.0, <5.0",
    "flask-session>=0.4.0, <1.0",
-    # EXPERIMENTAL: testing whether passing model_class= explicitly when
-    # constructing SQLA() (see superset/extensions/__init__.py) resolves the
-    # PR #42542 regression before committing to a real bump. Do not merge
-    # this pin change as-is.
-    "flask-sqlalchemy>=3.0.5, <3.1",
+    # Pinned explicitly below 3.0: 3.0.5 resolves without conflict and
+    # supports both SQLAlchemy 1.4 and 2.0, but real CI runs surfaced a
+    # structural incompatibility with Superset's current session/app-context
+    # handling across Celery task boundaries (see PR #42542) -- widespread
+    # "NoneType has no attribute X" failures and MySQL lock-wait timeouts,
+    # not just a connection-pool quirk. Needs dedicated investigation, not a
+    # driver-compat-prep bump; revisit alongside the actual SQLAlchemy 2.0
+    # core bump (discussion #40273, step 6).
+    "flask-sqlalchemy>=2.5.1, <4.0",
    "flask-wtf>=1.3.0, <2.0",
    "geopy",
    "greenlet<=3.5.4, >=3.5.4",
    "gunicorn>=26.0.0, <27; sys_platform != 'win32'",
    "hashids>=1.3.1, <2",
    # holidays>=0.45 required for security fix
-    "holidays>=0.99, <1",
+    "holidays>=0.101, <1",
    "humanize",
    "isodate",
    "jsonpath-ng>=1.8.0, <2",
    "Mako>=1.2.2",
-    "markdown>=3.10.2",
+    "markdown>=3.10.3",
    # marshmallow 4 compatibility: see superset/marshmallow_compatibility.py for a
    # Flask-AppBuilder workaround. Tracking issue:
    # https://github.com/apache/superset/issues/33162
@@ -84,7 +88,7 @@ dependencies = [
    "marshmallow-union>=0.1.15.post1",
    "msgpack>=1.2.0, <1.3",
    "nh3>=0.3.5, <0.4",
-    "numpy>1.23.5, <2.3",
+    "numpy>=1.23.5, <2.5",
    "packaging",
    # --------------------------
    # pandas and related (wanting pandas[performance] without numba as it's 100+MB and not needed)
@@ -106,15 +110,15 @@ dependencies = [
    "PyJWT>=2.4.0, <3.0",
    "redis>=5.0.0, <9.0",
    "rison>=2.0.1, <3.0",
-    "selenium>=4.45.0, <5.0",
-    "shillelagh[gsheetsapi]>=1.4.4, <2.0",
+    "selenium>=4.46.0, <5.0",
+    "shillelagh[gsheetsapi]>=1.4.5, <2.0",
    "sshtunnel>=0.4.0, <0.5",
    "simplejson>=4.1.1",
    "slack_sdk>=3.43.0, <4",
    "sqlalchemy>=1.4.43, <2", # 1.4.43 adds the python-oracledb (oracle+oracledb) dialect
    "sqlalchemy-continuum>=1.6.0, <2.0.0",
    "sqlalchemy-utils>=0.42.1, <0.43", # expanding lowerbound to work with pydoris
-    "sqlglot>=30.12.0, <31",
+    "sqlglot>=30.14.0, <31",
    # newer pandas needs 0.9+
    "tabulate>=0.10.0, <1.0",
    "typing-extensions>=4.16.0, <5",
@@ -127,7 +131,7 @@ dependencies = [

 [project.optional-dependencies]

-athena = ["pyathena[pandas]>=3.35.2, <4"]
+athena = ["pyathena[pandas]>=3.35.4, <4"]
 # No SQLAlchemy 2.0 support anywhere in this dialect's ecosystem today: our
 # own preset-io/sqlalchemy-aurora-data-api fork is dead since 2021, and the
 # more active community fork (cloud-utils/sqlalchemy-aurora-data-api) has an
@@ -139,7 +143,7 @@ bigquery = [
    # 1.17.1 is likely the final release: googleapis/python-bigquery-sqlalchemy
    # was archived 2026-05-16. Both 1.17.0 and 1.17.1 support SQLAlchemy 1.4/2.0.
    "sqlalchemy-bigquery>=1.17.1",
-    "google-cloud-bigquery>=3.42.2",
+    "google-cloud-bigquery>=3.42.3",
 ]
 clickhouse = ["clickhouse-connect>=1.6.0, <2.0"]
 cockroachdb = ["cockroachdb>=0.3.5, <0.4"]
@@ -169,7 +173,7 @@ dremio = ["sqlalchemy-dremio>=1.2.1, <3.0.5"]
 # 1.1.10 already supports SQLAlchemy 2.0 (added `import_dbapi` in 1.1.7).
 drill = ["sqlalchemy-drill>=1.1.10, <3"]
 druid = ["pydruid>=0.6.5,<0.7"]
-duckdb = ["duckdb>=1.5.4,<2", "duckdb-engine>=0.17.0"]
+duckdb = ["duckdb>=1.5.5,<2", "duckdb-engine>=0.17.0"]
 dynamodb = ["pydynamodb>=0.8.2"]
 # Effectively unmaintained (only dependabot bumps since 2024); hard-pinned to
 # SQLAlchemy ~1.4.7 upstream, no SQLAlchemy 2.0 work. See
@@ -187,7 +191,7 @@ excel = ["xlrd>=2.0.2, <2.1"]
 # installing this extra is only required to actually run exports.
 excel-export = ["boto3"]
 fastmcp = [
-    "fastmcp>=3.4.3,<4.0",
+    "fastmcp>=3.4.5,<4.0",
    # tiktoken backs the response-size-guard token estimator. Without
    # it, the middleware falls back to a coarser character-based
    # heuristic that under-counts JSON-heavy MCP responses.
@@ -199,8 +203,8 @@ fastmcp = [
 # Superset's own SQLAlchemy 2.0 core bump (discussion #40273), not before.
 firebird = ["sqlalchemy-firebird>=0.8.0, <2.0.0"]
 firebolt = ["firebolt-sqlalchemy>=1.1.2, <2"]
-gevent = ["gevent>=26.4.0"]
-gsheets = ["shillelagh[gsheetsapi]>=1.4.4, <2"]
+gevent = ["gevent>=26.7.0"]
+gsheets = ["shillelagh[gsheetsapi]>=1.4.5, <2"]
 hana = ["hdbcli==2.29.25", "sqlalchemy_hana==3.0.3"]
 hive = [
    "pyhive[hive_pure_sasl]>=0.7.0",
@@ -230,7 +234,7 @@ ocient = [
 oracle = ["oracledb>=4.0.2, <5"]
 parseable = ["sqlalchemy-parseable>=0.1.6,<0.2.0"]
 pinot = ["pinotdb>=5.0.0, <10.0.0"]
-playwright = ["playwright>=1.61.0, <2"]
+playwright = ["playwright>=1.62.0, <2"]
 postgres = ["psycopg2-binary==2.9.12"]
 presto = ["pyhive[presto]>=0.6.5"]
 trino = ["trino>=0.338.0"]
@@ -244,8 +248,8 @@ redshift = ["sqlalchemy-redshift>=0.8.1, <0.9"]
 # and 2.0 (version numbers don't track SQLAlchemy compat monotonically); pin
 # to the newest 1.4-only release for now. Bump to >=2.0.0 in lockstep with
 # Superset's own SQLAlchemy 2.0 core bump (discussion #40273), not before.
-risingwave = ["sqlalchemy-risingwave>=1.4.1, <2.0.0"]
-shillelagh = ["shillelagh[all]>=1.4.4, <2"]
+risingwave = ["sqlalchemy-risingwave>=1.4.1, <3.0.0"]
+shillelagh = ["shillelagh[all]>=1.4.5, <2"]
 singlestore = ["sqlalchemy-singlestoredb>=1.2.1, <2"]
 snowflake = ["snowflake-sqlalchemy>=1.11.0, <2"]
 sqlite = ["syntaqlite>=0.7.0,<0.8.0"]
@@ -255,14 +259,14 @@ spark = [
    "thrift>=0.24.0, <1",
 ]
 tdengine = [
-    "taospy>=2.8.9",
+    "taospy>=2.8.10",
    "taos-ws-py>=0.7.0"
 ]
-teradata = ["teradatasql>=20.0.0.62"]
+teradata = ["teradatasql>=20.0.0.64"]
 thumbnails = [] # deprecated, will be removed in 7.0
 vertica = ["sqlalchemy-vertica-python>= 0.6.3, < 0.7"]
 netezza = ["nzalchemy>= 11.1.2, < 11.2"]
-starrocks = ["starrocks>=1.3.3, <2"]
+starrocks = ["starrocks>=1.3.4, <2"]
 doris = ["pydoris>=1.2.0, <2.0.0"]
 oceanbase = ["oceanbase_py>=0.0.1.2"]
 ydb = ["ydb-sqlalchemy>=0.1.22", "ydb-sqlglot-plugin>=0.2.8"]
@@ -282,7 +286,7 @@ development = [
    "progress>=1.6.1,<2",
    "psutil",
    "pyfakefs",
-    "pyinstrument>=5.1.2,<6",
+    "pyinstrument>=5.1.3,<6",
    "pylint",
    "pytest<10.0.0", # cap below the next major until validated; the earlier <8 pin (current_app proxy timing) no longer reproduces
    "pytest-asyncio",
@@ -531,6 +535,11 @@ authorized_licenses = [
 # Seems ok, might need legal review
 # https://github.com/urschrei/pypolyline/blob/master/LICENSE.md
 polyline = "2"
+# NumPy 2.x reports a combined SPDX license expression covering vendored
+# code (BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0), all of which
+# are permissive OSI-approved licenses; the package itself remains
+# BSD-3-Clause. https://github.com/numpy/numpy/blob/main/LICENSE.txt
+numpy = "2"
 # --------------------------------------------------------------

 # TODO REMOVE THESE DEPS FROM CODEBASE
@@ -30,9 +30,12 @@ filterwarnings =
    always::sqlalchemy.exc.RemovedIn20Warning
    error:Passing a string to Connection.execute\(\) is deprecated:sqlalchemy.exc.RemovedIn20Warning
    error:"Query" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning
+    error:"ReportExecutionLog" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning
+    error:"ReportRecipients" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning
    error:"SavedQuery" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning
    error:"SqlaTable" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning
    error:"SqlMetric" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning
+    error:"SSHTunnel" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning
    error:"TableColumn" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning
    error:"TaggedObject" object is being merged into a Session:sqlalchemy.exc.RemovedIn20Warning
    error:The autoload parameter is deprecated:sqlalchemy.exc.RemovedIn20Warning
@@ -26,7 +26,7 @@ filelock>=3.20.3,<4.0.0
 brotli>=1.2.0,<2.0.0
 numexpr>=2.9.0
 # Security: CVE-2026-34073 (MEDIUM) - Improper Certificate Validation
-cryptography>=49.0.0,<50.0.0
+cryptography>=50.0.0,<51.0.0
 # Security: Snyk - XSS vulnerability in Mako templates
 mako>=1.3.11,<2.0.0
 # Security: CVE-2024-52338 (CRITICAL) - Deserialization of untrusted data in IPC/Parquet readers
@@ -88,7 +88,7 @@ cron-descriptor==1.4.5
    # via apache-superset (pyproject.toml)
 croniter==6.2.4
    # via apache-superset (pyproject.toml)
-cryptography==49.0.0
+cryptography==50.0.0
    # via
    #   -r requirements/base.in
    #   apache-superset (pyproject.toml)
@@ -148,7 +148,7 @@ flask-migrate==4.1.0
    # via apache-superset (pyproject.toml)
 flask-session==0.8.0
    # via apache-superset (pyproject.toml)
-flask-sqlalchemy==3.0.5
+flask-sqlalchemy==2.5.1
    # via
    #   apache-superset (pyproject.toml)
    #   flask-appbuilder
@@ -178,7 +178,7 @@ h11==0.16.0
    # via wsproto
 hashids==1.3.1
    # via apache-superset (pyproject.toml)
-holidays==0.100
+holidays==0.102
    # via apache-superset (pyproject.toml)
 humanize==4.12.3
    # via apache-superset (pyproject.toml)
@@ -219,7 +219,7 @@ mako==1.3.12
    #   -r requirements/base.in
    #   apache-superset (pyproject.toml)
    #   alembic
-markdown==3.10.2
+markdown==3.10.3
    # via apache-superset (pyproject.toml)
 markdown-it-py==3.0.0
    # via rich
@@ -251,7 +251,7 @@ nh3==0.3.6
    # via apache-superset (pyproject.toml)
 numexpr==2.10.2
    # via -r requirements/base.in
-numpy==1.26.4
+numpy==2.4.6
    # via
    #   apache-superset (pyproject.toml)
    #   bottleneck
@@ -326,7 +326,7 @@ pyjwt==2.13.0
    #   flask-jwt-extended
 pynacl==1.6.2
    # via paramiko
-pyopenssl==26.3.0
+pyopenssl==26.4.0
    # via
    #   -r requirements/base.in
    #   shillelagh
@@ -357,7 +357,7 @@ pyyaml==6.0.3
    # via
    #   apache-superset (pyproject.toml)
    #   apispec
-redis==8.0.1
+redis==8.1.0
    # via apache-superset (pyproject.toml)
 referencing==0.36.2
    # via
@@ -380,11 +380,11 @@ rpds-py==0.25.0
    # via
    #   jsonschema
    #   referencing
-selenium==4.45.0
+selenium==4.46.0
    # via apache-superset (pyproject.toml)
 setuptools==80.9.0
    # via -r requirements/base.in
-shillelagh==1.4.4
+shillelagh==1.4.5
    # via apache-superset (pyproject.toml)
 simplejson==4.1.1
    # via apache-superset (pyproject.toml)
@@ -418,7 +418,7 @@ sqlalchemy-utils==0.42.1
    #   apache-superset (pyproject.toml)
    #   apache-superset-core
    #   flask-appbuilder
-sqlglot==30.12.0
+sqlglot==30.15.0
    # via
    #   apache-superset (pyproject.toml)
    #   apache-superset-core
@@ -182,7 +182,7 @@ croniter==6.2.4
    # via
    #   -c requirements/base-constraint.txt
    #   apache-superset
-cryptography==49.0.0
+cryptography==50.0.0
    # via
    #   -c requirements/base-constraint.txt
    #   apache-superset
@@ -225,7 +225,7 @@ docstring-parser==0.17.0
    # via cyclopts
 docutils==0.22.2
    # via rich-rst
-duckdb==1.5.4
+duckdb==1.5.5
    # via
    #   apache-superset
    #   duckdb-engine
@@ -242,9 +242,9 @@ et-xmlfile==2.0.0
    #   openpyxl
 exceptiongroup==1.3.0
    # via fastmcp-slim
-fastmcp==3.4.4
+fastmcp==3.4.5
    # via apache-superset
-fastmcp-slim==3.4.4
+fastmcp-slim==3.4.5
    # via fastmcp
 filelock==3.20.3
    # via
@@ -309,7 +309,7 @@ flask-session==0.8.0
    # via
    #   -c requirements/base-constraint.txt
    #   apache-superset
-flask-sqlalchemy==3.0.5
+flask-sqlalchemy==2.5.1
    # via
    #   -c requirements/base-constraint.txt
    #   apache-superset
@@ -340,7 +340,7 @@ geopy==2.4.1
    # via
    #   -c requirements/base-constraint.txt
    #   apache-superset
-gevent==26.4.0
+gevent==26.7.0
    # via apache-superset
 google-api-core==2.33.0
    # via
@@ -363,7 +363,7 @@ google-auth-oauthlib==1.2.1
    # via
    #   pandas-gbq
    #   pydata-google-auth
-google-cloud-bigquery==3.42.2
+google-cloud-bigquery==3.43.0
    # via
    #   apache-superset
    #   pandas-gbq
@@ -408,7 +408,7 @@ hashids==1.3.1
    # via
    #   -c requirements/base-constraint.txt
    #   apache-superset
-holidays==0.100
+holidays==0.102
    # via
    #   -c requirements/base-constraint.txt
    #   apache-superset
@@ -521,7 +521,7 @@ mako==1.3.12
    #   -c requirements/base-constraint.txt
    #   alembic
    #   apache-superset
-markdown==3.10.2
+markdown==3.10.3
    # via
    #   -c requirements/base-constraint.txt
    #   apache-superset
@@ -581,7 +581,7 @@ nh3==0.3.6
    #   apache-superset
 nodeenv==1.8.0
    # via pre-commit
-numpy==1.26.4
+numpy==2.4.6
    # via
    #   -c requirements/base-constraint.txt
    #   apache-superset
@@ -776,7 +776,7 @@ pygments==2.20.0
    #   rich
 pyhive==0.7.0
    # via apache-superset
-pyinstrument==5.1.2
+pyinstrument==5.1.3
    # via apache-superset
 pyjwt==2.13.0
    # via
@@ -791,7 +791,7 @@ pynacl==1.6.2
    # via
    #   -c requirements/base-constraint.txt
    #   paramiko
-pyopenssl==26.3.0
+pyopenssl==26.4.0
    # via
    #   -c requirements/base-constraint.txt
    #   google-auth
@@ -874,7 +874,7 @@ pyyaml==6.0.3
    #   fastmcp-slim
    #   jsonschema-path
    #   pre-commit
-redis==8.0.1
+redis==8.1.0
    # via
    #   -c requirements/base-constraint.txt
    #   apache-superset
@@ -934,7 +934,7 @@ s3transfer==0.16.0
    # via boto3
 secretstorage==3.5.0
    # via keyring
-selenium==4.45.0
+selenium==4.46.0
    # via
    #   -c requirements/base-constraint.txt
    #   apache-superset
@@ -948,7 +948,7 @@ setuptools==80.9.0
    #   pydata-google-auth
    #   zope-event
    #   zope-interface
-shillelagh==1.4.4
+shillelagh==1.4.5
    # via
    #   -c requirements/base-constraint.txt
    #   apache-superset
@@ -1002,7 +1002,7 @@ sqlalchemy-utils==0.42.1
    #   apache-superset
    #   apache-superset-core
    #   flask-appbuilder
-sqlglot==30.12.0
+sqlglot==30.15.0
    # via
    #   -c requirements/base-constraint.txt
    #   apache-superset
@@ -1,82 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import { SAMPLE_DASHBOARD_1 } from 'cypress/utils/urls';
-import { drag } from 'cypress/utils';
-import { interceptGet } from './utils';
-import { interceptFiltering as interceptCharts } from '../explore/utils';
-
-function editDashboard() {
-  cy.getBySel('edit-dashboard-button').click();
-}
-
-function dragComponent(
-  component = 'Unicode Cloud',
-  target = 'card-title',
-  withFiltering = true,
-) {
-  if (withFiltering) {
-    cy.getBySel('dashboard-charts-filter-search-input').type(component, {
-      force: true,
-    });
-    cy.wait('@filtering');
-  }
-  cy.wait(500);
-  drag(`[data-test="${target}"]`, component).to(
-    '[data-test="grid-content"] [data-test="dragdroppable-object"]',
-  );
-}
-
-function visitEdit(sampleDashboard = SAMPLE_DASHBOARD_1) {
-  interceptCharts();
-  interceptGet();
-
-  if (sampleDashboard === SAMPLE_DASHBOARD_1) {
-    cy.createSampleDashboards([0]);
-  }
-
-  cy.visit(sampleDashboard);
-  cy.wait('@get');
-  editDashboard();
-  cy.get('.grid-container').should('exist');
-  cy.wait('@filtering');
-  cy.wait(500);
-}
-
-describe('Dashboard edit', () => {
-  describe('Components', () => {
-    beforeEach(() => {
-      visitEdit();
-    });
-
-    it('should add charts', () => {
-      cy.get('body').then($body => {
-        if ($body.find('.ant-modal-wrap').length > 0) {
-          cy.get('body').type('{esc}', { force: true });
-          cy.wait(1000);
-          cy.get('.ant-modal-close').click({ force: true });
-          cy.wait(500);
-        }
-      });
-      cy.get('input[type="checkbox"]').scrollIntoView();
-      cy.get('input[type="checkbox"]').click({ force: true });
-      dragComponent();
-      cy.getBySel('dashboard-component-chart-holder').should('have.length', 1);
-    });
-  });
-});
@@ -138,6 +138,7 @@ export function prepareDashboardFilters(
            chart_customization_config: [],
            timed_refresh_immune_slices: [],
            expanded_slices: {},
+            expand_all_slices: false,
            refresh_frequency: 0,
            color_scheme: '',
            label_colors: {},
@@ -79,34 +79,6 @@ export function waitForChartLoad(chart: ChartSpec) {
  });
 }

-/**
- * Drag an element and drop it to another element.
- * Usage:
- *    drag(source).to(target);
- */
-export function drag(selector: string, content: string | number | RegExp) {
-  const dataTransfer = { data: {} };
-  return {
-    to(target: string | Cypress.Chainable) {
-      cy.get('.dragdroppable')
-        .contains(selector, content)
-        .trigger('mousedown', { which: 1, force: true });
-      cy.get('.dragdroppable')
-        .contains(selector, content)
-        .trigger('dragstart', { dataTransfer, force: true });
-      cy.get('.dragdroppable')
-        .contains(selector, content)
-        .trigger('drag', { force: true });
-
-      (typeof target === 'string' ? cy.get(target) : target)
-        .trigger('dragover', { dataTransfer, force: true })
-        .trigger('drop', { dataTransfer, force: true })
-        .trigger('dragend', { dataTransfer, force: true })
-        .trigger('mouseup', { which: 1, force: true });
-    },
-  };
-}
-
 export function resize(selector: string) {
  return {
    to(cordX: number, cordY: number) {
@@ -77,7 +77,7 @@ module.exports = {
    // @ant-design/colors and @ant-design/fast-color are allowed through because
    // @ant-design/icons >= 6.3 deep-imports the ESM build of @ant-design/colors
    // from its CJS output, so babel-jest must transform those files.
-    'node_modules/(?!@ant-design/(colors|fast-color)|@formatjs/.*|d3-(array|interpolate|color|time|scale|time-format|format)|internmap|@mapbox/tiny-sdf|remark-gfm|(?!@ngrx|(?!deck.gl)|d3-scale)|markdown-table|micromark-*.|decode-named-character-reference|character-entities|mdast-util-*.|unist-util-*.|ccount|escape-string-regexp|nanoid|uuid|@rjsf/*.|@x0k/.*|echarts|zrender|fetch-mock|pretty-ms|parse-ms|ol|@babel/runtime|@emotion|cheerio|cheerio/lib|parse5|dom-serializer|entities|htmlparser2|rehype-sanitize|hast-util-sanitize|unified|unist-.*|hast-.*|hastscript|refractor|rehype-.*|remark-.*|mdast-.*|micromark-.*|parse-entities|character-reference-invalid|is-alphanumerical|is-alphabetical|is-decimal|is-hexadecimal|property-information|space-separated-tokens|comma-separated-tokens|bail|devlop|zwitch|longest-streak|geostyler|geostyler-.*|(?!geostyler)lodash|react-error-boundary|react-json-tree|react-base16-styling|lodash-es|rbush|quickselect|react-diff-viewer-continued|storybook/*.|json-stringify-pretty-compact|@x0k/json-schema-merge)',
+    'node_modules/(?!@ant-design/(colors|fast-color)|@formatjs/.*|d3-(array|interpolate|color|time|scale|time-format|format|selection)|internmap|@mapbox/tiny-sdf|remark-gfm|(?!@ngrx|(?!deck.gl)|d3-scale)|markdown-table|micromark-*.|decode-named-character-reference|character-entities|mdast-util-*.|unist-util-*.|ccount|escape-string-regexp|nanoid|uuid|@rjsf/*.|@x0k/.*|echarts|zrender|fetch-mock|pretty-ms|parse-ms|ol|@babel/runtime|@emotion|cheerio|cheerio/lib|parse5|dom-serializer|entities|htmlparser2|rehype-sanitize|hast-util-sanitize|unified|unist-.*|hast-.*|hastscript|refractor|rehype-.*|remark-.*|mdast-.*|micromark-.*|parse-entities|character-reference-invalid|is-alphanumerical|is-alphabetical|is-decimal|is-hexadecimal|property-information|space-separated-tokens|comma-separated-tokens|bail|devlop|zwitch|longest-streak|geostyler|geostyler-.*|(?!geostyler)lodash|react-error-boundary|react-json-tree|react-base16-styling|lodash-es|rbush|quickselect|react-diff-viewer-continued|storybook/*.|json-stringify-pretty-compact|@x0k/json-schema-merge)',
  ],
  preset: 'ts-jest',
  transform: {
@@ -276,6 +276,19 @@
          "test*WithInitialValues"
        ]
      }
+    ],
+
+    // === ESLint rules ===
+    "no-restricted-imports": [
+      "error",
+      {
+        "paths": [
+          {
+            "name": "lodash",
+            "message": "Please use tree-shakeable lodash-es instead"
+          }
+        ]
+      }
    ]
  },
  "overrides": [
@@ -87,7 +87,7 @@
    "test": "cross-env NODE_ENV=test NODE_OPTIONS=\"--max-old-space-size=8192\" jest --max-workers=80% --silent",
    "test-loud": "cross-env NODE_ENV=test NODE_OPTIONS=\"--max-old-space-size=8192\" jest --max-workers=80%",
    "type": "cross-env NODE_OPTIONS=\"--max-old-space-size=8192\" tsc --noEmit",
-    "update-maps": "cd plugins/legacy-plugin-chart-country-map/scripts && jupyter nbconvert --to notebook --execute --inplace --allow-errors --ExecutePreprocessor.timeout=1200 'Country Map GeoJSON Generator.ipynb'",
+    "update-maps": "cd plugins/plugin-chart-country-map/scripts && jupyter nbconvert --to notebook --execute --inplace --allow-errors --ExecutePreprocessor.timeout=1200 'Country Map GeoJSON Generator.ipynb'",
    "validate-release": "../RELEASING/validate_this_release.sh"
  },
  "dependencies": {
@@ -128,24 +128,22 @@
    "@scarf/scarf": "^1.4.0",
    "@superset-ui/chart-controls": "file:./packages/superset-ui-chart-controls",
    "@superset-ui/core": "file:./packages/superset-ui-core",
-    "@superset-ui/legacy-plugin-chart-calendar": "file:./plugins/legacy-plugin-chart-calendar",
-    "@superset-ui/legacy-plugin-chart-chord": "file:./plugins/legacy-plugin-chart-chord",
-    "@superset-ui/legacy-plugin-chart-country-map": "file:./plugins/legacy-plugin-chart-country-map",
-    "@superset-ui/legacy-plugin-chart-horizon": "file:./plugins/legacy-plugin-chart-horizon",
-    "@superset-ui/legacy-plugin-chart-paired-t-test": "file:./plugins/legacy-plugin-chart-paired-t-test",
-    "@superset-ui/legacy-plugin-chart-parallel-coordinates": "file:./plugins/legacy-plugin-chart-parallel-coordinates",
-    "@superset-ui/legacy-plugin-chart-partition": "file:./plugins/legacy-plugin-chart-partition",
-    "@superset-ui/legacy-plugin-chart-rose": "file:./plugins/legacy-plugin-chart-rose",
-    "@superset-ui/legacy-plugin-chart-world-map": "file:./plugins/legacy-plugin-chart-world-map",
-    "@superset-ui/legacy-preset-chart-nvd3": "file:./plugins/legacy-preset-chart-nvd3",
    "@superset-ui/plugin-chart-ag-grid-table": "file:./plugins/plugin-chart-ag-grid-table",
+    "@superset-ui/plugin-chart-calendar": "file:./plugins/plugin-chart-calendar",
    "@superset-ui/plugin-chart-cartodiagram": "file:./plugins/plugin-chart-cartodiagram",
+    "@superset-ui/plugin-chart-chord": "file:./plugins/plugin-chart-chord",
+    "@superset-ui/plugin-chart-country-map": "file:./plugins/plugin-chart-country-map",
    "@superset-ui/plugin-chart-echarts": "file:./plugins/plugin-chart-echarts",
    "@superset-ui/plugin-chart-handlebars": "file:./plugins/plugin-chart-handlebars",
+    "@superset-ui/plugin-chart-horizon": "file:./plugins/plugin-chart-horizon",
+    "@superset-ui/plugin-chart-paired-t-test": "file:./plugins/plugin-chart-paired-t-test",
+    "@superset-ui/plugin-chart-parallel-coordinates": "file:./plugins/plugin-chart-parallel-coordinates",
+    "@superset-ui/plugin-chart-partition": "file:./plugins/plugin-chart-partition",
    "@superset-ui/plugin-chart-pivot-table": "file:./plugins/plugin-chart-pivot-table",
    "@superset-ui/plugin-chart-point-cluster-map": "file:./plugins/plugin-chart-point-cluster-map",
    "@superset-ui/plugin-chart-table": "file:./plugins/plugin-chart-table",
    "@superset-ui/plugin-chart-word-cloud": "file:./plugins/plugin-chart-word-cloud",
+    "@superset-ui/plugin-chart-world-map": "file:./plugins/plugin-chart-world-map",
    "@superset-ui/preset-chart-deckgl": "file:./plugins/preset-chart-deckgl",
    "@superset-ui/switchboard": "file:./packages/superset-ui-switchboard",
    "@types/d3-format": "^3.0.1",
@@ -160,7 +158,7 @@
    "@visx/xychart": "^4.0.0",
    "ag-grid-community": "36.0.2",
    "ag-grid-react": "36.0.2",
-    "antd": "^6.5.2",
+    "antd": "^6.5.3",
    "chrono-node": "^2.10.1",
    "classnames": "^2.2.5",
    "content-disposition": "^2.0.1",
@@ -178,7 +176,7 @@
    "geostyler-openlayers-parser": "^5.7.1",
    "geostyler-style": "11.0.2",
    "geostyler-wfs-parser": "^3.0.1",
-    "google-auth-library": "^10.9.1",
+    "google-auth-library": "^11.0.0",
    "immer": "^11.1.15",
    "interweave": "^13.1.1",
    "jquery": "^4.0.0",
@@ -188,7 +186,7 @@
    "lodash": "^4.18.1",
    "lodash-es": "^4.18.1",
    "mapbox-gl": "^3.27.0",
-    "markdown-to-jsx": "^9.9.0",
+    "markdown-to-jsx": "^9.10.1",
    "match-sorter": "^8.3.0",
    "memoize-one": "^6.0.0",
    "mousetrap": "^1.6.5",
@@ -205,7 +203,7 @@
    "react-dnd-html5-backend": "^11.1.3",
    "react-dom": "^18.3.0",
    "react-google-recaptcha": "^3.1.0",
-    "react-intersection-observer": "^10.1.0",
+    "react-intersection-observer": "^11.0.0",
    "react-json-tree": "^0.20.0",
    "react-lines-ellipsis": "^0.16.1",
    "react-loadable": "^5.5.0",
@@ -218,14 +216,14 @@
    "react-table": "^7.8.0",
    "react-transition-group": "^4.4.5",
    "react-virtualized-auto-sizer": "^1.0.26",
-    "react-window": "^1.8.10",
+    "react-window": "^2.3.0",
    "redux": "^4.2.1",
    "redux-localstorage": "^0.4.1",
    "redux-thunk": "^2.1.0",
    "redux-undo": "^1.0.0-beta9-9-7",
    "rison": "^0.1.1",
    "scroll-into-view-if-needed": "^3.1.0",
-    "simple-zstd": "^2.1.0",
+    "simple-zstd": "^1.4.2",
    "stream-browserify": "^3.0.0",
    "tinycolor2": "^1.6.0",
    "urijs": "^1.19.8",
@@ -252,19 +250,19 @@
    "@babel/register": "^7.29.7",
    "@babel/runtime": "^7.29.7",
    "@babel/runtime-corejs3": "^7.29.7",
-    "@babel/types": "^7.29.7",
+    "@babel/types": "^7.29.8",
    "@emotion/babel-plugin": "^11.13.5",
    "@emotion/jest": "^11.14.2",
    "@formatjs/intl-durationformat": "^0.10.18",
    "@istanbuljs/nyc-config-typescript": "^1.0.1",
-    "@playwright/test": "^1.61.1",
+    "@playwright/test": "^1.62.1",
    "@pmmmwh/react-refresh-webpack-plugin": "^0.6.2",
    "@storybook/addon-docs": "10.5.5",
    "@storybook/addon-links": "10.5.5",
    "@storybook/react-webpack5": "10.5.5",
    "@storybook/test-runner": "0.24.4",
    "@svgr/webpack": "^8.1.0",
-    "@swc/core": "^1.15.46",
+    "@swc/core": "^1.15.47",
    "@swc/plugin-emotion": "^14.15.0",
    "@swc/plugin-transform-imports": "^12.5.0",
    "@testing-library/dom": "^10.4.1",
@@ -286,7 +284,6 @@
    "@types/react-redux": "^7.1.10",
    "@types/react-router-dom": "^5.3.3",
    "@types/react-transition-group": "^4.4.12",
-    "@types/react-window": "^1.8.8",
    "@types/redux-localstorage": "^1.0.8",
    "@types/redux-mock-store": "^1.0.6",
    "@types/rison": "0.1.0",
@@ -298,7 +295,7 @@
    "babel-loader": "^10.1.1",
    "babel-plugin-dynamic-import-node": "^2.3.3",
    "babel-plugin-jsx-remove-data-test-id": "^3.0.0",
-    "baseline-browser-mapping": "^2.11.5",
+    "baseline-browser-mapping": "^2.11.11",
    "cheerio": "1.2.0",
    "concurrently": "^10.0.4",
    "copy-webpack-plugin": "^14.0.0",
@@ -310,7 +307,7 @@
    "eslint-plugin-i18n-strings": "file:eslint-rules/eslint-plugin-i18n-strings",
    "eslint-plugin-icons": "file:eslint-rules/eslint-plugin-icons",
    "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-jest-dom": "^5.5.0",
+    "eslint-plugin-jest-dom": "^5.10.1",
    "eslint-plugin-lodash": "^8.0.0",
    "eslint-plugin-no-only-tests": "^3.4.0",
    "eslint-plugin-react-prefer-function-component": "^5.0.0",
@@ -328,8 +325,8 @@
    "jest-html-reporter": "^4.4.0",
    "jest-websocket-mock": "^2.5.0",
    "js-yaml-loader": "^1.2.2",
-    "jsdom": "^30.0.0",
-    "lerna": "^9.0.4",
+    "jsdom": "^30.0.1",
+    "lerna": "^10.0.0",
    "lightningcss": "^1.33.0",
    "mini-css-extract-plugin": "^2.10.2",
    "minimizer-webpack-plugin": "^5.6.1",
@@ -352,11 +349,11 @@
    "swc-loader": "^0.2.7",
    "ts-jest": "^29.4.12",
    "tscw-config": "^1.1.2",
-    "tsx": "^4.23.1",
+    "tsx": "^4.23.5",
    "typescript": "5.4.5",
    "unzipper": "^0.12.5",
    "wait-on": "^9.1.0",
-    "webpack": "^5.109.1",
+    "webpack": "^5.109.2",
    "webpack-bundle-analyzer": "^5.3.1",
    "webpack-cli": "^7.0.3",
    "webpack-dev-server": "^5.2.5",
@@ -106,10 +106,9 @@
    "@testing-library/jest-dom": "*",
    "@testing-library/react": "^15.0.0",
    "@testing-library/user-event": "*",
-    "@types/lodash": "^4.17.24",
+    "@types/lodash": "^4.17.25",
    "@types/react": "*",
    "@types/react-loadable": "*",
-    "@types/react-window": "^1.8.8",
    "@types/tinycolor2": "*",
    "typescript": "^5.0.0"
  },
@@ -160,6 +160,43 @@ test('Theme.setConfig correctly applies algorithm changes', () => {
  expect(serialized.algorithm).toBe(ThemeAlgorithm.DARK);
 });

+test('Theme.setConfig with baseTheme merges the config over the base theme tokens', () => {
+  const baseTheme: AnyThemeConfig = {
+    token: { colorPrimary: '#111111', colorError: '#ff0000' },
+  };
+  const theme = Theme.fromConfig();
+  theme.setConfig({ token: { colorPrimary: '#0000ff' } }, baseTheme);
+
+  // Config wins for colorPrimary; the base theme fills the untouched colorError.
+  expect(theme.theme.colorPrimary).toBe('#0000ff');
+  expect(theme.theme.colorError).toBe('#ff0000');
+});
+
+test('Theme.setConfig with baseTheme keeps the base theme ECharts overrides', () => {
+  const baseTheme = {
+    token: { colorPrimary: '#111111' },
+    echartsOptionsOverrides: { backgroundColor: '#123456' },
+    echartsOptionsOverridesByChartType: {
+      pie: { itemStyle: { borderWidth: 2 } },
+    },
+  } as AnyThemeConfig & {
+    echartsOptionsOverrides: Record<string, unknown>;
+    echartsOptionsOverridesByChartType: Record<string, unknown>;
+  };
+  const theme = Theme.fromConfig();
+
+  // In-place update whose config sets no ECharts overrides: the base theme's
+  // overrides must survive, the same way its tokens do.
+  theme.setConfig({ token: { colorPrimary: '#0000ff' } }, baseTheme);
+
+  expect(theme.theme.echartsOptionsOverrides).toEqual({
+    backgroundColor: '#123456',
+  });
+  expect(theme.theme.echartsOptionsOverridesByChartType).toEqual({
+    pie: { itemStyle: { borderWidth: 2 } },
+  });
+});
+
 test('Theme.toggleDarkMode switches to dark algorithm when toggling dark mode on', () => {
  const theme = Theme.fromConfig();

@@ -64,10 +64,12 @@ export class Theme {
   * @param config - The theme configuration
   * @param baseTheme - Optional base theme to apply under the config
   */
-  static fromConfig(
+  // Merge a config over an optional base theme (arrays replace rather than
+  // deep-merge; a colorPrimary override without colorLink aligns colorLink).
+  private static mergeConfig(
    config?: AnyThemeConfig,
    baseTheme?: AnyThemeConfig,
-  ): Theme {
+  ): AnyThemeConfig | undefined {
    let mergedConfig: AnyThemeConfig | undefined = config;

    if (baseTheme && config) {
@@ -76,9 +78,9 @@ export class Theme {
      );

      // In Ant Design v5, colorLink derives from colorInfo, not colorPrimary.
-      // Currently we expectlinks to follow the brand/primary color. When the user
-      // overrides colorPrimary without explicitly setting colorLink, update the
-      // merged colorLink so links match the new primary palette.
+      // We expect links to follow the brand/primary color, so when a config
+      // overrides colorPrimary without setting colorLink, align the merged
+      // colorLink with the new primary palette.
      if (config.token?.colorPrimary && !config.token?.colorLink) {
        const mToken = mergedConfig?.token;
        if (mToken) {
@@ -89,7 +91,14 @@ export class Theme {
      mergedConfig = baseTheme;
    }

-    return new Theme({ config: mergedConfig });
+    return mergedConfig;
+  }
+
+  static fromConfig(
+    config?: AnyThemeConfig,
+    baseTheme?: AnyThemeConfig,
+  ): Theme {
+    return new Theme({ config: Theme.mergeConfig(config, baseTheme) });
  }

  private static getFilteredAntdTheme(
@@ -110,12 +119,14 @@ export class Theme {
  }

  /**
-   * Update the theme using any theme configuration
-   * Automatically handles both AntdThemeConfig and SerializableThemeConfig
-   * Dark mode should be specified via the algorithm property in the config
+   * Update the theme using any theme configuration, optionally merged over a
+   * base theme. Automatically handles both AntdThemeConfig and
+   * SerializableThemeConfig. Dark mode should be specified via the algorithm
+   * property in the config.
   */
-  setConfig(config: AnyThemeConfig): void {
-    const antdConfig = normalizeThemeConfig(config);
+  setConfig(config: AnyThemeConfig, baseTheme?: AnyThemeConfig): void {
+    const mergedConfig = Theme.mergeConfig(config, baseTheme) ?? config;
+    const antdConfig = normalizeThemeConfig(mergedConfig);

    if (antdConfig.token?.colorPrimary && !antdConfig.token?.colorLink) {
      antdConfig.token.colorLink = antdConfig.token.colorPrimary;
@@ -124,11 +135,11 @@ export class Theme {
    // First phase: Let Ant Design compute the tokens
    const tokens = Theme.getFilteredAntdTheme(antdConfig);

-    // Extract Superset-specific properties from top-level config.
-    // These are custom properties that aren't part of Ant Design's token system
-    // but need to be passed through to the SupersetTheme for ECharts customization.
+    // Extract Superset-specific properties from the merged config (not the raw
+    // config) so a base theme's ECharts overrides survive in-place updates, the
+    // same way the Ant Design tokens above are taken from the merged config.
    const { echartsOptionsOverrides, echartsOptionsOverridesByChartType } =
-      config as AnyThemeConfig & {
+      mergedConfig as AnyThemeConfig & {
        echartsOptionsOverrides?: any;
        echartsOptionsOverridesByChartType?: Record<string, any>;
      };
@@ -36,6 +36,7 @@ import type {
  QueryResponse,
  TimeFormatter,
 } from '@superset-ui/core';
+import { type RGBColor } from '@superset-ui/core/components';
 import { GenericDataType } from '@apache-superset/core/common';
 import { sharedControls, sharedControlComponents } from './shared-controls';

@@ -494,7 +495,7 @@ export type ConditionalFormattingConfig = {
  targetValueLeft?: number;
  targetValueRight?: number;
  column?: string;
-  colorScheme?: string;
+  colorScheme?: RGBColor | string;
  toAllRow?: boolean;
  toTextColor?: boolean;
  useGradient?: boolean;
@@ -68,6 +68,11 @@ export const D3_FORMAT_OPTIONS: [string, string][] = [
    'MEMORY_TRANSFER_RATE_BINARY',
    t('Memory transfer rate in bytes - binary (1024B => 1KiB/s)'),
  ],
+  ['NETWORK_THROUGHPUT', t('Network throughput in bits/s (1000000 => 1Mbps)')],
+  [
+    'NETWORK_THROUGHPUT_FROM_BYTES',
+    t('Network throughput in bytes/s as bits (1000000 => 8Mbps)'),
+  ],
  ['LENGTH', t('Length in m (12345m => 12.35km)')],
  ['LENGTH_CM_KM', t('Length in cm (12345678cm => 123.46km)')],
  ['LENGTH_CM_M', t('Length in cm (12345cm => 123.45m)')],
@@ -0,0 +1,87 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { ensureIsArray, getMetricLabel } from '@superset-ui/core';
+import type { QueryFormMetric, QueryFormOrderBy } from '@superset-ui/core';
+
+export interface BuildSortMetricOrderbyConfig {
+  /** The query's already-resolved metrics list. */
+  metrics: QueryFormMetric[];
+  /** The raw `timeseries_limit_metric` form-data value (single or multi). */
+  timeseriesLimitMetric?: QueryFormMetric | QueryFormMetric[] | null;
+  order_desc?: boolean;
+  /**
+   * Falls back to the first selected metric when no sort metric is set.
+   * Charts ported from a legacy viz whose query_obj always had a sort
+   * metric (defaulting to the first one) should set this; charts whose
+   * legacy query_obj left ordering absent without one should not.
+   */
+  fallbackToFirstMetric?: boolean;
+  /**
+   * When true, only order when `order_desc` is set (matching legacy vizzes
+   * whose query_obj left the result unordered unless the operator asked
+   * for descending). When false, always order (ascending unless
+   * order_desc), matching legacy vizzes that ordered unconditionally.
+   */
+  orderOnlyWhenDesc?: boolean;
+}
+
+export interface SortMetricOrderby {
+  /** `metrics`, with the sort metric appended if it wasn't already selected. */
+  metrics: QueryFormMetric[];
+  orderby: QueryFormOrderBy[];
+}
+
+/**
+ * Resolves a chart's sort metric and builds the corresponding query_obj
+ * `orderby`, appending the sort metric to `metrics` if it isn't already
+ * selected (so its value is present in the result to sort by). Several
+ * charts ported from the legacy chart-data pipeline share this exact
+ * shape with only the fallback/gating policy differing per their own
+ * legacy `query_obj` behavior -- see `fallbackToFirstMetric` and
+ * `orderOnlyWhenDesc`.
+ */
+export function buildSortMetricOrderby({
+  metrics,
+  timeseriesLimitMetric,
+  order_desc: orderDesc,
+  fallbackToFirstMetric = false,
+  orderOnlyWhenDesc = false,
+}: BuildSortMetricOrderbyConfig): SortMetricOrderby {
+  const sortByMetric =
+    ensureIsArray(timeseriesLimitMetric)[0] ??
+    (fallbackToFirstMetric ? metrics[0] : undefined);
+
+  if (!sortByMetric) {
+    return { metrics, orderby: [] };
+  }
+
+  const sortByLabel = getMetricLabel(sortByMetric);
+  const nextMetrics = metrics.some(
+    metric => getMetricLabel(metric) === sortByLabel,
+  )
+    ? metrics
+    : [...metrics, sortByMetric];
+
+  const shouldOrder = orderOnlyWhenDesc ? Boolean(orderDesc) : true;
+
+  return {
+    metrics: nextMetrics,
+    orderby: shouldOrder ? [[sortByMetric, !orderDesc]] : [],
+  };
+}
@@ -19,7 +19,7 @@
 import memoizeOne from 'memoize-one';
 import { isString, isBoolean } from 'lodash-es';
 import { isBlank } from '@apache-superset/core/utils';
-import { addAlpha, DataRecord } from '@superset-ui/core';
+import { addAlpha, DataRecord, rgbaToHex } from '@superset-ui/core';
 import tinycolor from 'tinycolor2';
 import {
  ColorFormatters,
@@ -27,6 +27,7 @@ import {
  ConditionalFormattingConfig,
  MultipleValueComparators,
  ResolvedColorFormatterResult,
+  ColorSchemeEnum,
 } from '../types';

 export const round = (num: number, precision = 0) =>
@@ -71,6 +72,9 @@ export const getOpacity = (
  );
 };

+const isSpecialColor = (value: unknown): value is ColorSchemeEnum =>
+  Object.values(ColorSchemeEnum).includes(value as ColorSchemeEnum);
+
 export const getColorFunction = (
  {
    operator,
@@ -270,19 +274,51 @@ export const getColorFunction = (
    if (compareResult === false) return undefined;
    const { cutoffValue, extremeValue } = compareResult;

-    // If useGradient is explicitly false, return solid color
-    if (useGradient === false) {
+    if (typeof colorScheme === 'string') {
+      if (isSpecialColor(colorScheme)) {
+        return colorScheme;
+      }
+
+      if (
+        useGradient === false ||
+        (useGradient === undefined && colorScheme.length === 9)
+      ) {
+        if (alpha === false) {
+          return colorScheme.length === 9
+            ? colorScheme.slice(0, 7)
+            : colorScheme;
+        }
+        return colorScheme;
+      }
+
+      const cleanHex =
+        colorScheme.length === 9 ? colorScheme.slice(0, 7) : colorScheme;
+
+      if (alpha === undefined || alpha) {
+        return addAlpha(
+          cleanHex,
+          getOpacity(value, cutoffValue, extremeValue, minOpacity, maxOpacity),
+        );
+      }
      return colorScheme;
    }
+    // If useGradient is explicitly false, return solid color
+    if (useGradient === false || useGradient === undefined) {
+      if (alpha === false) {
+        return rgbaToHex({ ...colorScheme, a: 1 });
+      }
+      return rgbaToHex(colorScheme);
+    }

+    const baseHexColor = rgbaToHex({ ...colorScheme, a: 1 });
    // Otherwise apply gradient (default behavior for backward compatibility)
    if (alpha === undefined || alpha) {
      return addAlpha(
-        colorScheme,
+        baseHexColor,
        getOpacity(value, cutoffValue, extremeValue, minOpacity, maxOpacity),
      );
    }
-    return colorScheme;
+    return baseHexColor;
  };
 };

@@ -30,3 +30,4 @@ export * from './getTemporalColumns';
 export * from './displayTimeRelatedControls';
 export * from './colorControls';
 export * from './metricColumnFilter';
+export * from './buildSortMetricOrderby';
@@ -0,0 +1,96 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { buildSortMetricOrderby } from '../../src';
+
+test('is a no-op when there is no sort metric and no fallback', () => {
+  const result = buildSortMetricOrderby({
+    metrics: ['sum__num'],
+    timeseriesLimitMetric: undefined,
+  });
+  expect(result).toEqual({ metrics: ['sum__num'], orderby: [] });
+});
+
+test('falls back to the first metric when configured to', () => {
+  const result = buildSortMetricOrderby({
+    metrics: ['sum__num', 'avg__num'],
+    timeseriesLimitMetric: undefined,
+    fallbackToFirstMetric: true,
+  });
+  expect(result.metrics).toEqual(['sum__num', 'avg__num']);
+  expect(result.orderby).toEqual([['sum__num', true]]);
+});
+
+test('appends the sort metric when it is not already selected', () => {
+  const result = buildSortMetricOrderby({
+    metrics: ['sum__num'],
+    timeseriesLimitMetric: 'count',
+  });
+  expect(result.metrics).toEqual(['sum__num', 'count']);
+});
+
+test('does not duplicate the sort metric when already selected', () => {
+  const result = buildSortMetricOrderby({
+    metrics: ['sum__num', 'count'],
+    timeseriesLimitMetric: 'count',
+  });
+  expect(result.metrics).toEqual(['sum__num', 'count']);
+});
+
+test('unconditional ordering (orderOnlyWhenDesc: false) always orders, flipping direction', () => {
+  const ascending = buildSortMetricOrderby({
+    metrics: ['sum__num'],
+    timeseriesLimitMetric: 'count',
+    order_desc: false,
+  });
+  expect(ascending.orderby).toEqual([['count', true]]);
+
+  const descending = buildSortMetricOrderby({
+    metrics: ['sum__num'],
+    timeseriesLimitMetric: 'count',
+    order_desc: true,
+  });
+  expect(descending.orderby).toEqual([['count', false]]);
+});
+
+test('gated ordering (orderOnlyWhenDesc: true) only orders when order_desc is set', () => {
+  const withoutDesc = buildSortMetricOrderby({
+    metrics: ['sum__num'],
+    timeseriesLimitMetric: 'count',
+    orderOnlyWhenDesc: true,
+  });
+  expect(withoutDesc.metrics).toEqual(['sum__num', 'count']);
+  expect(withoutDesc.orderby).toEqual([]);
+
+  const withDesc = buildSortMetricOrderby({
+    metrics: ['sum__num'],
+    timeseriesLimitMetric: 'count',
+    order_desc: true,
+    orderOnlyWhenDesc: true,
+  });
+  expect(withDesc.orderby).toEqual([['count', false]]);
+});
+
+test('resolves a multi-value timeseriesLimitMetric to its first entry', () => {
+  const result = buildSortMetricOrderby({
+    metrics: ['sum__num'],
+    timeseriesLimitMetric: ['count', 'avg__num'],
+  });
+  expect(result.metrics).toEqual(['sum__num', 'count']);
+  expect(result.orderby).toEqual([['count', true]]);
+});
@@ -952,3 +952,167 @@ test('correct column boolean config', () => {
  expect(colorFormatters[3].getColorFromValue(true)).toEqual('#FF0000FF');
  expect(colorFormatters[3].getColorFromValue(false)).toEqual('#FF0000FF');
 });
+
+test('should return hex color when colorScheme is an RGB object', () => {
+  const colorFunction = getColorFunction(
+    {
+      operator: Comparator.None,
+      colorScheme: { r: 255, g: 128, b: 0, a: 1 },
+      column: 'name',
+    },
+    strValues,
+  );
+  expect(colorFunction('Diana')).toEqual('#ff8000');
+  expect(colorFunction('Carlos')).toEqual('#ff8000');
+  expect(colorFunction('Brian')).toEqual('#ff8000');
+});
+
+test('should return token name as-is when colorScheme is a string token', () => {
+  const colorFunction = getColorFunction(
+    {
+      operator: Comparator.None,
+      colorScheme: 'Green',
+      column: 'name',
+    },
+    strValues,
+  );
+  expect(colorFunction('Diana')).toEqual('Green');
+  expect(colorFunction('Carlos')).toEqual('Green');
+  expect(colorFunction('Brian')).toEqual('Green');
+});
+
+test('should return solid hex color when useGradient is false or true', () => {
+  const columnConfig = [
+    {
+      operator: Comparator.GreaterThan,
+      targetValue: 50,
+      colorScheme: { r: 0, g: 47, b: 255, a: 1 },
+      column: 'count',
+      useGradient: false,
+    },
+    {
+      operator: Comparator.GreaterThan,
+      targetValue: 50,
+      colorScheme: { r: 255, g: 166, b: 0, a: 1 },
+      column: 'count',
+      useGradient: true,
+    },
+  ];
+  const colorFormatters = getColorFormatters(columnConfig, mockData);
+  expect(colorFormatters.length).toEqual(2);
+
+  // First formatter with useGradient: false should return solid color
+  expect(colorFormatters[0].column).toEqual('count');
+  expect(colorFormatters[0].getColorFromValue(100)).toEqual('#002fff');
+
+  // Second formatter with useGradient: true should return gradient color
+  expect(colorFormatters[1].column).toEqual('count');
+  expect(colorFormatters[1].getColorFromValue(100)).toEqual('#ffa600FF');
+});
+
+test('should return hex color without alpha for GreaterThan operator with RGB colorScheme', () => {
+  const config = {
+    operator: Comparator.GreaterThan,
+    targetValue: 50,
+    colorScheme: { r: 255, g: 0, b: 0, a: 1 },
+    useGradient: true,
+  };
+
+  const columnValues = [10, 50, 100];
+
+  const alpha = false;
+  const colorFunction = getColorFunction(config, columnValues, alpha);
+
+  expect(colorFunction(100)).toEqual('#ff0000');
+});
+
+test('should preserve alpha from colorScheme when useGradient is false', () => {
+  const config = {
+    operator: Comparator.None,
+    colorScheme: { r: 255, g: 0, b: 0, a: 0.5 },
+    useGradient: false,
+  };
+
+  const colorFunction = getColorFunction(config, [10, 20, 30]);
+  const result = colorFunction(20);
+
+  expect(result).not.toBe('#ff0000');
+  expect(result).not.toBe('rgb(255, 0, 0)');
+});
+
+test('should force opaque color when useGradient is false but alpha is explicitly false', () => {
+  const config = {
+    operator: Comparator.None,
+    colorScheme: { r: 255, g: 0, b: 0, a: 0.5 },
+    useGradient: false,
+  };
+
+  const colorFunction = getColorFunction(config, [10, 20, 30], false);
+  const result = colorFunction(20);
+
+  expect(result).toBe('#ff0000');
+});
+
+test('should return colorScheme as-is when alpha is false and length is 7', () => {
+  const colorFunction = getColorFunction(
+    {
+      operator: Comparator.GreaterThan,
+      targetValue: 50,
+      colorScheme: '#FF0000',
+      useGradient: false,
+      column: 'count',
+    },
+    countValues,
+    false,
+  );
+
+  expect(colorFunction(100)).toEqual('#FF0000');
+});
+
+test('should preserve alpha when alpha is undefined and colorScheme has 9 chars', () => {
+  const colorFunction = getColorFunction(
+    {
+      operator: Comparator.GreaterThan,
+      targetValue: 50,
+      colorScheme: '#FF000080',
+      useGradient: false,
+      column: 'count',
+    },
+    countValues,
+  );
+
+  expect(colorFunction(100)).toEqual('#FF000080');
+});
+
+test('should preserve alpha when alpha is true and colorScheme has 9 chars', () => {
+  const colorFunction = getColorFunction(
+    {
+      operator: Comparator.GreaterThan,
+      targetValue: 50,
+      colorScheme: '#FF000080',
+      useGradient: false,
+      column: 'count',
+    },
+    countValues,
+    true,
+  );
+
+  expect(colorFunction(100)).toEqual('#FF000080');
+});
+
+test('should strip alpha channel when alpha is false and colorScheme has 9 chars', () => {
+  const colorFunction = getColorFunction(
+    {
+      operator: Comparator.GreaterThan,
+      targetValue: 50,
+      colorScheme: '#FF000080',
+      useGradient: false,
+      column: 'count',
+    },
+    countValues,
+    false,
+  );
+
+  expect(colorFunction(100)).toEqual('#FF0000');
+  expect(colorFunction(100)).toHaveLength(7);
+});
@@ -68,7 +68,7 @@
    "d3-time": "^3.1.0",
    "d3-time-format": "^4.1.0",
    "dayjs": "^1.11.21",
-    "dompurify": "^3.4.12",
+    "dompurify": "^3.4.13",
    "fetch-retry": "^6.0.0",
    "handlebars": "^4.7.9",
    "jed": "^1.1.1",
@@ -78,7 +78,7 @@
    "parse-ms": "^4.0.0",
    "re-resizable": "^6.11.2",
    "react-ace": "^14.0.1",
-    "react-draggable": "^4.7.0",
+    "react-draggable": "^4.7.1",
    "react-error-boundary": "^6.1.2",
    "react-js-cron": "^6.0.2",
    "react-markdown": "^10.1.0",
@@ -102,7 +102,7 @@
    "@types/d3-time": "^3.0.4",
    "@types/d3-time-format": "^4.0.3",
    "@types/jquery": "^4.0.1",
-    "@types/lodash": "^4.17.24",
+    "@types/lodash": "^4.17.25",
    "@types/node": "^26.1.2",
    "@types/prop-types": "^15.7.15",
    "@types/react-syntax-highlighter": "^15.5.13",
@@ -123,7 +123,6 @@
    "@testing-library/user-event": "*",
    "@types/react": "*",
    "@types/react-loadable": "*",
-    "@types/react-window": "^1.8.8",
    "@types/tinycolor2": "*",
    "antd": "^6.0.0",
    "nanoid": "*",
@@ -104,30 +104,19 @@ export default class ChartClient {
    const buildQueryRegistry = getChartBuildQueryRegistry();

    if (metaDataRegistry.has(visType)) {
-      const { useLegacyApi } = metaDataRegistry.get(visType)!;
      const buildQuery =
        (await buildQueryRegistry.get(visType)) ?? (() => formData);
-      const requestConfig: RequestConfig = useLegacyApi
-        ? {
-            endpoint: '/explore_json/',
-            postPayload: {
-              form_data: buildQuery(formData),
-            },
-            ...options,
-          }
-        : {
-            endpoint: '/api/v1/chart/data',
-            jsonPayload: {
-              query_context: buildQuery(formData),
-            },
-            ...options,
-          };
+      const requestConfig: RequestConfig = {
+        endpoint: '/api/v1/chart/data',
+        jsonPayload: buildQuery(formData),
+        ...options,
+      };

-      return this.client
-        .post(requestConfig)
-        .then(response =>
-          Array.isArray(response.json) ? response.json : [response.json],
-        );
+      return this.client.post(requestConfig).then(response => {
+        const { result } = response.json as { result?: QueryData[] };
+
+        return Array.isArray(result) ? result : [response.json as QueryData];
+      });
    }

    return Promise.reject(new Error(`Unknown chart type: ${visType}`));
@@ -21,7 +21,6 @@ import { render, waitFor, configure, act } from '@testing-library/react';
 import '@testing-library/jest-dom';
 import StatefulChart from './StatefulChart';
 import getChartControlPanelRegistry from '../registries/ChartControlPanelRegistrySingleton';
-import getChartMetadataRegistry from '../registries/ChartMetadataRegistrySingleton';
 import getChartBuildQueryRegistry from '../registries/ChartBuildQueryRegistrySingleton';

 // Configure testing library to use data-test attribute
@@ -29,7 +28,6 @@ configure({ testIdAttribute: 'data-test' });

 // Mock the registries
 jest.mock('../registries/ChartControlPanelRegistrySingleton');
-jest.mock('../registries/ChartMetadataRegistrySingleton');
 jest.mock('../registries/ChartBuildQueryRegistrySingleton');
 jest.mock('../clients/ChartClient');

@@ -67,12 +65,6 @@ beforeEach(() => {
  jest.clearAllMocks();

  // Setup default registry mocks
-  jest.mocked(getChartMetadataRegistry).mockReturnValue({
-    get: jest.fn().mockReturnValue({
-      useLegacyApi: false,
-    }),
-  } as unknown as ReturnType<typeof getChartMetadataRegistry>);
-
  jest.mocked(getChartBuildQueryRegistry).mockReturnValue({
    get: jest.fn().mockResolvedValue(null),
  } as unknown as ReturnType<typeof getChartBuildQueryRegistry>);
@@ -746,11 +738,10 @@ test('resolves async (202) responses via the injected handleAsyncChartData hook'
  await waitFor(() => {
    expect(handleAsyncChartData).toHaveBeenCalledTimes(1);
  });
-  // Delegates the raw response + job metadata (and useLegacyApi + abort signal)
+  // Delegates the raw response + job metadata (and abort signal)
  expect(handleAsyncChartData).toHaveBeenCalledWith(
    { status: 202 },
    asyncJob,
-    false,
    expect.any(AbortSignal),
  );
  // Chart renders once the async data resolves
@@ -798,43 +789,6 @@ test('renders synchronous (200) responses that include a response object', async
  expect(mockChartClient.client.post).toHaveBeenCalledTimes(1);
 });

-test('wraps the legacy async body as { result: [body] } for the async handler', async () => {
-  const legacyBody = { job_id: 'j1', channel_id: 'c1', status: 'running' };
-  mockChartClient.client.post.mockResolvedValue({
-    response: { status: 202 } as Response,
-    json: legacyBody,
-  });
-  // Force the legacy API path for this viz type
-  jest.mocked(getChartMetadataRegistry).mockReturnValue({
-    get: jest.fn().mockReturnValue({ useLegacyApi: true }),
-  } as unknown as ReturnType<typeof getChartMetadataRegistry>);
-  const handleAsyncChartData = jest
-    .fn()
-    .mockResolvedValue([{ data: 'legacy result' }]);
-
-  const { getByTestId } = render(
-    <StatefulChart
-      formData={mockFormData}
-      chartType="test_chart"
-      hooks={{ handleAsyncChartData }}
-    />,
-  );
-
-  await waitFor(() => {
-    expect(handleAsyncChartData).toHaveBeenCalledTimes(1);
-  });
-  // Legacy body must be wrapped to match the V1 response signature
-  expect(handleAsyncChartData).toHaveBeenCalledWith(
-    { status: 202 },
-    { result: [legacyBody] },
-    true,
-    expect.any(AbortSignal),
-  );
-  await waitFor(() => {
-    expect(getByTestId('super-chart')).toBeInTheDocument();
-  });
-});
-
 test('does not apply a superseded async response over a newer one', async () => {
  mockChartClient.client.post.mockResolvedValue({
    response: { status: 202 } as Response,
@@ -1024,7 +978,7 @@ test('passes an abort signal to the async handler and aborts it on unmount', asy
    response: { status: 202 } as Response,
    json: { job_id: 'j', channel_id: 'c' },
  });
-  // Typed with a rest param so mock.calls is indexable (the 4th arg is the signal)
+  // Typed with a rest param so mock.calls is indexable (the 3rd arg is the signal)
  const handleAsyncChartData = jest.fn(
    (..._args: unknown[]) => new Promise<never>(() => {}), // never resolves
  );
@@ -1040,7 +994,7 @@ test('passes an abort signal to the async handler and aborts it on unmount', asy
  await waitFor(() => {
    expect(handleAsyncChartData).toHaveBeenCalledTimes(1);
  });
-  const signal = handleAsyncChartData.mock.calls[0][3] as AbortSignal;
+  const signal = handleAsyncChartData.mock.calls[0][2] as AbortSignal;
  expect(signal).toBeInstanceOf(AbortSignal);
  expect(signal.aborted).toBe(false);

@@ -18,7 +18,7 @@
 */

 import { useState, useEffect, useRef, useCallback } from 'react';
-import { isEqual } from 'lodash';
+import { isEqual } from 'lodash-es';
 import { ParentSize } from '@visx/responsive';
 import { t } from '@apache-superset/core/translation';
 import {
@@ -34,7 +34,6 @@ import {
 import { Loading } from '../../components/Loading';
 import ChartClient from '../clients/ChartClient';
 import getChartBuildQueryRegistry from '../registries/ChartBuildQueryRegistrySingleton';
-import getChartMetadataRegistry from '../registries/ChartMetadataRegistrySingleton';
 import getChartControlPanelRegistry from '../registries/ChartControlPanelRegistrySingleton';
 import SuperChart from './SuperChart';

@@ -281,9 +280,6 @@ export default function StatefulChart(props: StatefulChartProps) {
      }
      finalFormData.viz_type = vizType;

-      // Get chart metadata
-      const { useLegacyApi } = getChartMetadataRegistry().get(vizType) || {};
-
      // Build query using the chart's buildQuery function
      const buildQuery = await getChartBuildQueryRegistry().get(vizType);
      let queryContext;
@@ -295,31 +291,20 @@ export default function StatefulChart(props: StatefulChartProps) {
        queryContext = buildQueryContext(finalFormData);
      }

-      // Ensure query_context is properly formatted for new API
-      if (!useLegacyApi && !queryContext.queries) {
+      // Ensure query_context is properly formatted for the API
+      if (!queryContext.queries) {
        queryContext = { queries: [queryContext] };
      }
-      const endpoint = useLegacyApi ? '/explore_json/' : '/api/v1/chart/data';

      const requestConfig: RequestConfig = {
-        endpoint,
+        endpoint: '/api/v1/chart/data',
        signal: controller.signal,
        ...(timeout && { timeout: timeout * 1000 }),
-      };
-
-      if (useLegacyApi) {
-        requestConfig.postPayload = {
-          form_data: {
-            ...finalFormData,
-            ...(force && { force: true }),
-          },
-        };
-      } else {
-        requestConfig.jsonPayload = {
+        jsonPayload: {
          ...queryContext,
          ...(force && { force: true }),
-        };
-      }
+        },
+      };

      const clientResponse =
        await chartClientRef.current!.client.post(requestConfig);
@@ -347,18 +332,10 @@ export default function StatefulChart(props: StatefulChartProps) {
              'the async handler or disable GLOBAL_ASYNC_QUERIES for this chart.',
          );
        }
-        // The async handler (handleChartDataResponse) expects the V1 chart data
-        // response signature. The legacy endpoint returns a flat body, so wrap
-        // it as { result: [body] } exactly like legacyChartDataRequest does for
-        // the standard chart path; the V1 body is already correctly shaped.
-        const asyncPayload = useLegacyApi
-          ? ({ result: [clientResponse.json] } as JsonObject)
-          : (clientResponse.json as JsonObject);
        responseData = ensureIsArray(
          await hooks.handleAsyncChartData(
            rawResponse,
-            asyncPayload,
-            useLegacyApi,
+            clientResponse.json as JsonObject,
            controller.signal,
          ),
        );
@@ -374,10 +351,8 @@ export default function StatefulChart(props: StatefulChartProps) {
            : [clientResponse.json]
        ) as JsonObject[];

-        // Handle the nested result structure from the new API
-        responseData = (
-          !useLegacyApi && rows[0]?.result ? rows[0].result : rows
-        ) as QueryData[];
+        // Handle the nested result structure from the API
+        responseData = (rows[0]?.result ? rows[0].result : rows) as QueryData[];
      }

      // Don't pair this request's data with newer props or fire a stale onLoad
@@ -49,9 +49,14 @@ export type ReactifyProps = {
  className?: string;
 };

+export interface ReactifyUnmountContext<Props extends object = object> {
+  container?: HTMLDivElement;
+  props: Readonly<Props & ReactifyProps>;
+}
+
 // TODO: add more React lifecycle callbacks as needed
-export type LifeCycleCallbacks = {
-  componentWillUnmount?: () => void;
+export type LifeCycleCallbacks<Props extends object = object> = {
+  componentWillUnmount?: (this: ReactifyUnmountContext<Props>) => void;
 };

 export interface RenderFuncType<Props> {
@@ -76,7 +81,7 @@ export type ReactifiedComponent<Props> = ForwardRefExoticComponent<
 // `ReactifiedComponent<Props>` explicitly.
 export default function reactify<Props extends object>(
  renderFn: RenderFuncType<Props>,
-  callbacks?: LifeCycleCallbacks,
+  callbacks?: LifeCycleCallbacks<Props>,
 ): ComponentType<Props & ReactifyProps> {
  const ReactifiedComponent = forwardRef<
    ReactifiedComponentRef,
@@ -89,8 +94,10 @@ export default function reactify<Props extends object>(
    // assignment only happens for committed renders (safe under Concurrent
    // Mode) and is in place before the passive unmount effect reads it.
    const propsRef = useRef(props);
+    const committedContainerRef = useRef<HTMLDivElement>();
    useLayoutEffect(() => {
      propsRef.current = props;
+      committedContainerRef.current = containerRef.current ?? undefined;
    });

    // Expose container via ref for external access
@@ -104,6 +111,22 @@ export default function reactify<Props extends object>(
      [],
    );

+    // Cleanup on unmount
+    useEffect(
+      () => () => {
+        if (callbacks?.componentWillUnmount) {
+          // Preserve the legacy `this.props` access pattern and snapshot the
+          // last committed container because React clears refs before passive
+          // effect cleanup runs on unmount.
+          callbacks.componentWillUnmount.call({
+            container: committedContainerRef.current,
+            props: propsRef.current,
+          });
+        }
+      },
+      [],
+    );
+
    // Execute renderFn on mount and every update (mimics componentDidMount + componentDidUpdate)
    useEffect(() => {
      if (containerRef.current) {
@@ -118,24 +141,6 @@ export default function reactify<Props extends object>(
      }
    });

-    // Cleanup on unmount
-    useEffect(
-      () => () => {
-        if (callbacks?.componentWillUnmount) {
-          // Preserve legacy behavior where `this` was a component instance
-          // exposing `props`. The class version cleared `this.container`
-          // before invoking componentWillUnmount, so mirror that here to
-          // prevent callbacks from touching a DOM node that's being torn
-          // down.
-          callbacks.componentWillUnmount.call({
-            container: undefined,
-            props: propsRef.current,
-          });
-        }
-      },
-      [],
-    );
-
    const { id, className } = props;

    return <div ref={containerRef} id={id} className={className} />;
@@ -40,7 +40,6 @@ export interface ChartMetadataConfig {
  supportedAnnotationTypes?: string[];
  thumbnail: string;
  thumbnailDark?: string;
-  useLegacyApi?: boolean;
  behaviors?: Behavior[];
  exampleGallery?: ExampleImage[];
  tags?: string[];
@@ -75,8 +74,6 @@ export default class ChartMetadata {

  thumbnailDark?: string;

-  useLegacyApi: boolean;
-
  behaviors: Behavior[];

  datasourceCount: number;
@@ -112,7 +109,6 @@ export default class ChartMetadata {
      supportedAnnotationTypes = [],
      thumbnail,
      thumbnailDark,
-      useLegacyApi = false,
      behaviors = [],
      datasourceCount = 1,
      enableNoResults = true,
@@ -144,7 +140,6 @@ export default class ChartMetadata {
    this.supportedAnnotationTypes = supportedAnnotationTypes;
    this.thumbnail = thumbnail;
    this.thumbnailDark = thumbnailDark;
-    this.useLegacyApi = useLegacyApi;
    this.behaviors = behaviors;
    this.datasourceCount = datasourceCount;
    this.enableNoResults = enableNoResults;
@@ -75,7 +75,6 @@ type Hooks = {
  handleAsyncChartData?: (
    response: Response,
    json: JsonObject,
-    useLegacyApi?: boolean,
    signal?: AbortSignal,
  ) => Promise<QueryData[]> | QueryData[];
 } & PlainObject;
@@ -17,6 +17,7 @@
 * under the License.
 */
 import tinycolor from 'tinycolor2';
+import { type RGBColor } from '@superset-ui/core/components';

 const rgbRegex = /^rgb\(\s*(\d+)\s*,\s*(\d+)\s*,\s*(\d+)\s*\)$/;
 export function getContrastingColor(color: string, thresholds = 186) {
@@ -120,3 +121,45 @@ export function rgbToHex(red: number, green: number, blue: number) {

  return `#${r}${g}${b}`;
 }
+
+export function rgbaToHex(rgb: RGBColor): string {
+  const { r, g, b, a = 1 } = rgb;
+  const clampChannel = (value: number) =>
+    Math.min(255, Math.max(0, Math.round(value)));
+  const clampAlpha = (value: number) => Math.min(1, Math.max(0, value));
+  const toHex = (value: number) => {
+    const hex = value.toString(16);
+    return hex.length === 1 ? `0${hex}` : hex;
+  };
+  const hexColor = `#${toHex(clampChannel(r))}${toHex(clampChannel(g))}${toHex(clampChannel(b))}`;
+  const clampedAlpha = clampAlpha(a);
+  if (clampedAlpha !== 1) {
+    return `${hexColor}${toHex(Math.round(clampedAlpha * 255))}`;
+  }
+  return hexColor;
+}
+
+export const forceHexAlpha = (color: string | RGBColor): string => {
+  if (typeof color === 'object' && color !== null) {
+    return rgbaToHex({ ...color, a: 0.6 });
+  }
+
+  let hex = color.startsWith('#') ? color : `#${color}`;
+
+  // Expand shorthand hex (#rgb, #rgba) to full length before appending or
+  // replacing the alpha channel, otherwise the result is not a valid 6- or
+  // 8-digit CSS hex color.
+  if (hex.length === 4 || hex.length === 5) {
+    hex = `#${hex
+      .slice(1)
+      .split('')
+      .map(char => char + char)
+      .join('')}`;
+  }
+
+  if (hex.length === 9) {
+    return `${hex.slice(0, -2)}99`;
+  }
+
+  return `${hex}99`;
+};
@@ -34,8 +34,9 @@ export const DropdownButton = ({
  const { type: buttonType } = rest;
  // divider implementation for default (non-primary) buttons
  const defaultBtnCss = css`
-    ${(!buttonType || buttonType === 'default') &&
-    `.ant-dropdown-trigger {
+    ${
+      (!buttonType || buttonType === 'default') &&
+      `.ant-dropdown-trigger {
      position: relative;
      &:before {
        content: '';
@@ -48,7 +49,8 @@ export const DropdownButton = ({
      .anticon {
        vertical-align: middle;
      }
-    }`}
+    }`
+    }
  `;
  const button = (
    <Dropdown.Button
@@ -58,13 +60,13 @@ export const DropdownButton = ({
        defaultBtnCss,
        css`
          .ant-btn {
-            height: ${styleConfig?.controlHeight ??
-            theme.buttonControlHeightSM ??
-            30}px;
+            height: ${
+              styleConfig?.controlHeight ?? theme.buttonControlHeightSM ?? 30
+            }px;
            box-shadow: ${styleConfig?.boxShadow ?? 'none'};
-            font-size: ${styleConfig?.fontSize ??
-            theme.buttonFontSize ??
-            theme.fontSizeSM}px;
+            font-size: ${
+              styleConfig?.fontSize ?? theme.buttonFontSize ?? theme.fontSizeSM
+            }px;
            font-weight: ${styleConfig?.fontWeight ?? theme.fontWeightStrong};
          }
        `,
@@ -221,18 +221,22 @@ export const DynamicEditableTitle = memo(
            onPressEnter={handleKeyPress}
            placeholder={placeholder}
            css={css`
-              ${!canEdit &&
-              `&[disabled] {
+              ${
+                !canEdit &&
+                `&[disabled] {
                  cursor: default;
                }
-              `}
+              `
+              }
              font-size: ${theme.fontSizeXL}px;
              transition: auto;
-              ${inputWidth &&
-              inputWidth > 0 &&
-              css`
-                width: ${inputWidth}px;
-              `}
+              ${
+                inputWidth &&
+                inputWidth > 0 &&
+                css`
+                  width: ${inputWidth}px;
+                `
+              }
            `}
            disabled={!canEdit}
          />
@@ -171,9 +171,11 @@ export const EmptyState: React.FC<EmptyStateProps> = ({
      {image && <ImageContainer image={image} size={size} />}
      <div
        css={(theme: SupersetTheme) => css`
-          max-width: ${containerSize === 'large'
-            ? theme.sizeUnit * 150
-            : theme.sizeUnit * 100}px;
+          max-width: ${
+            containerSize === 'large'
+              ? theme.sizeUnit * 150
+              : theme.sizeUnit * 100
+          }px;
        `}
      >
        {title && <Title size={effectiveTextSize}>{title}</Title>}
@@ -73,14 +73,16 @@ export const StyledModal = styled(BaseModal)<StyledModalProps>`
    const closeButtonWidth = theme.sizeUnit * 14;

    return css`
-      ${responsive &&
-      css`
-        max-width: ${maxWidth ?? '900px'};
-        padding-left: ${theme.sizeUnit * 3}px;
-        padding-right: ${theme.sizeUnit * 3}px;
-        padding-bottom: 0;
-        top: 0;
-      `}
+      ${
+        responsive &&
+        css`
+          max-width: ${maxWidth ?? '900px'};
+          padding-left: ${theme.sizeUnit * 3}px;
+          padding-right: ${theme.sizeUnit * 3}px;
+          padding-bottom: 0;
+          top: 0;
+        `
+      }

      .ant-modal-container {
        background-color: ${theme.colorBgContainer};
@@ -168,40 +170,46 @@ export const StyledModal = styled(BaseModal)<StyledModalProps>`
        padding: 0;
      }

-      ${draggable &&
-      css`
-        .ant-modal-header {
-          padding: 0;
+      ${
+        draggable &&
+        css`
+          .ant-modal-header {
+            padding: 0;

-          .draggable-trigger {
-            cursor: move;
-            padding: ${theme.sizeUnit * 4}px ${closeButtonWidth}px
-              ${theme.sizeUnit * 4}px ${theme.sizeUnit * 4}px;
-            width: 100%;
-          }
-        }
-      `}
-
-      ${resizable &&
-      css`
-        .resizable {
-          pointer-events: all;
-
-          .resizable-wrapper {
-            height: 100%;
-          }
-
-          .ant-modal-container {
-            height: 100%;
-
-            .ant-modal-body {
-              height: ${hideFooter
-                ? `calc(100% - ${MODAL_HEADER_HEIGHT}px)`
-                : `calc(100% - ${MODAL_HEADER_HEIGHT}px - ${MODAL_FOOTER_HEIGHT}px)`};
+            .draggable-trigger {
+              cursor: move;
+              padding: ${theme.sizeUnit * 4}px ${closeButtonWidth}px
+                ${theme.sizeUnit * 4}px ${theme.sizeUnit * 4}px;
+              width: 100%;
            }
          }
-        }
-      `}
+        `
+      }
+
+      ${
+        resizable &&
+        css`
+          .resizable {
+            pointer-events: all;
+
+            .resizable-wrapper {
+              height: 100%;
+            }
+
+            .ant-modal-container {
+              height: 100%;
+
+              .ant-modal-body {
+                height: ${
+                  hideFooter
+                    ? `calc(100% - ${MODAL_HEADER_HEIGHT}px)`
+                    : `calc(100% - ${MODAL_HEADER_HEIGHT}px - ${MODAL_FOOTER_HEIGHT}px)`
+                };
+              }
+            }
+          }
+        `
+      }
    `;
  }}
 `;
@@ -78,19 +78,78 @@ export function transformLinkUri(uri: string): string {
  return DANGEROUS_LINK_PROTOCOLS.includes(scheme) ? '' : url;
 }

+// A hast-util-sanitize attribute definition is either a bare property name
+// (any value allowed) or a tuple of `[propertyName, ...allowedValues]` (only
+// the listed values allowed). See hast-util-sanitize's `PropertyDefinition`.
+type AttributeDefinition = string | readonly [string, ...unknown[]];
+
+function getAttributeDefinitionKey(
+  definition: AttributeDefinition,
+): string | undefined {
+  if (typeof definition === 'string') return definition;
+  // htmlSchemaOverrides comes from runtime config and isn't guaranteed to
+  // match the expected shape; a malformed element (e.g. `null`) has no key
+  // rather than crashing the lookup.
+  return Array.isArray(definition) ? definition[0] : undefined;
+}
+
+/**
+ * Merge an operator-supplied list of attribute definitions for a tag (or the
+ * `'*'` wildcard) with the corresponding default definitions.
+ *
+ * hast-util-sanitize's `findDefinition` returns only the FIRST definition it
+ * finds for a given property name, so a naive concat leaves whichever list
+ * happens to declare that property first in charge. The default schema
+ * already declares restrictive tuples for some properties (e.g.
+ * `li: [['className', 'task-list-item']]`), so appending an operator's
+ * override after it never took effect. Because a failed allowlist check
+ * returns `[]` rather than `undefined`, hast-util-sanitize's own `'*'`
+ * fallback never kicked in either.
+ *
+ * To fix that, an override definition replaces the default definition for
+ * the same property (by property name) instead of being appended alongside
+ * it.
+ */
+function mergeAttributeDefinitions(
+  defaults: readonly AttributeDefinition[],
+  overrides: readonly AttributeDefinition[],
+): AttributeDefinition[] {
+  const overriddenKeys = new Set(
+    overrides.map(getAttributeDefinitionKey).filter(Boolean),
+  );
+  const remainingDefaults = defaults.filter(
+    definition => !overriddenKeys.has(getAttributeDefinitionKey(definition)),
+  );
+  return [...remainingDefaults, ...overrides];
+}
+
 export function getOverrideHtmlSchema(
  originalSchema: typeof defaultSchema,
  htmlSchemaOverrides: SafeMarkdownProps['htmlSchemaOverrides'],
 ) {
-  // Merge into a fresh clone: mergeWith mutates its first argument, and the
-  // array customizer concatenates, so merging into the shared defaultSchema
-  // import would progressively widen the sanitization allowlist for every
-  // SafeMarkdown instance app-wide.
+  // Merge into a fresh clone: mergeWith mutates its first argument, so
+  // merging into the shared defaultSchema import would progressively widen
+  // the sanitization allowlist for every SafeMarkdown instance app-wide.
+  const target = cloneDeep(originalSchema);
  return mergeWith(
-    cloneDeep(originalSchema),
+    target,
    htmlSchemaOverrides,
-    (objValue, srcValue) =>
-      Array.isArray(objValue) ? objValue.concat(srcValue) : undefined,
+    (objValue, srcValue, _key, object) => {
+      if (!Array.isArray(objValue)) return undefined;
+      // Only the per-tag (and `'*'`) arrays nested under `attributes` hold
+      // property definitions that need dedup-by-key; every other array in
+      // the schema (e.g. `tagNames`, `protocols.href`) is a plain list where
+      // concatenation is the correct merge.
+      if (object === target.attributes) {
+        // htmlSchemaOverrides comes from runtime config and isn't guaranteed
+        // to match the expected shape; fall back to the default definitions
+        // for a tag rather than throwing if an operator supplies something
+        // other than an array of attribute definitions.
+        if (!Array.isArray(srcValue)) return objValue;
+        return mergeAttributeDefinitions(objValue, srcValue);
+      }
+      return objValue.concat(srcValue);
+    },
  );
 }

@@ -16,10 +16,12 @@
 * specific language governing permissions and limitations
 * under the License.
 */
+import type { LabeledValue as AntdLabeledValue } from 'antd/es/select';
 import {
  splitWithQuoteEscaping,
  stripSurroundingQuotes,
  makeQuoteAwareTokenizer,
+  propertyComparator,
 } from './utils';

 test('stripSurroundingQuotes removes matching surrounding double quotes', () => {
@@ -138,3 +140,47 @@ test('makeQuoteAwareTokenizer detects any separator from the list outside quotes
  expect(tokenize('a\nb')).toEqual(['a', 'b']);
  expect(tokenize('"a\nb"')).toEqual(['"a\nb"']);
 });
+
+test('propertyComparator sorts string properties lexicographically', () => {
+  const compare = propertyComparator('label');
+  const ten = { label: '10' } as AntdLabeledValue;
+  const two = { label: '2' } as AntdLabeledValue;
+  const hundred = { label: '100' } as AntdLabeledValue;
+  expect([ten, two, hundred].sort(compare)).toEqual([ten, hundred, two]);
+});
+
+test('propertyComparator sorts number properties numerically', () => {
+  const compare = propertyComparator('value');
+  const ten = { value: 10 } as unknown as AntdLabeledValue;
+  const two = { value: 2 } as unknown as AntdLabeledValue;
+  const hundred = { value: 100 } as unknown as AntdLabeledValue;
+  expect([ten, two, hundred].sort(compare)).toEqual([two, ten, hundred]);
+});
+
+test('propertyComparator sorts bigint properties numerically, not lexicographically', () => {
+  const compare = propertyComparator('value');
+  const ten = { value: 10n } as unknown as AntdLabeledValue;
+  const two = { value: 2n } as unknown as AntdLabeledValue;
+  const hundred = { value: 100n } as unknown as AntdLabeledValue;
+  expect([ten, two, hundred].sort(compare)).toEqual([two, ten, hundred]);
+});
+
+test('propertyComparator sorts diverging-digit-length bigint values numerically', () => {
+  const compare = propertyComparator('value');
+  const a = { value: 10000000000000002n } as unknown as AntdLabeledValue;
+  const b = { value: 9000000000000001n } as unknown as AntdLabeledValue;
+  const c = { value: 10000000000000001n } as unknown as AntdLabeledValue;
+  expect([a, b, c].sort(compare)).toEqual([b, c, a]);
+});
+
+test('propertyComparator sorts mixed bigint and number properties numerically', () => {
+  const compare = propertyComparator('value');
+  const bigTen = { value: 10n } as unknown as AntdLabeledValue;
+  const two = { value: 2 } as unknown as AntdLabeledValue;
+  const bigHundred = { value: 100n } as unknown as AntdLabeledValue;
+  expect([bigTen, two, bigHundred].sort(compare)).toEqual([
+    two,
+    bigTen,
+    bigHundred,
+  ]);
+});
@@ -79,7 +79,7 @@ export function hasOption(

 /**
 * It creates a comparator to check for a specific property.
- * Can be used with string and number property values.
+ * Can be used with string, number, and bigint property values.
 * */
 export const propertyComparator =
  (property: string) => (a: AntdLabeledValue, b: AntdLabeledValue) => {
@@ -91,6 +91,18 @@ export const propertyComparator =
    if (typeof propertyA === 'number' && typeof propertyB === 'number') {
      return propertyA - propertyB;
    }
+    // BIGINT columns can decode to native `bigint` values (see json-bigint
+    // parsing of large numeric values). Compare numerically rather than
+    // falling through to the string fallback below, which would sort them
+    // lexicographically (e.g. "10", "100", "2").
+    if (
+      (typeof propertyA === 'bigint' || typeof propertyA === 'number') &&
+      (typeof propertyB === 'bigint' || typeof propertyB === 'number')
+    ) {
+      if (propertyA < propertyB) return -1;
+      if (propertyA > propertyB) return 1;
+      return 0;
+    }
    return String(propertyA).localeCompare(String(propertyB)); // fallback to string comparison
  };

@@ -0,0 +1,122 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { render, screen, waitFor } from '@superset-ui/core/spec';
+import type { ColumnsType } from 'antd/es/table';
+import { Table } from './index';
+
+// These tests exercise VirtualTable's react-window v2 `Grid` wiring
+// (`cellComponent`/`cellProps`/`gridRef`), which previously had no direct
+// coverage - `Table.test.tsx` only exercises the non-virtualized code path.
+
+interface BasicData {
+  columnName: string;
+  columnType: string;
+}
+
+const testData: BasicData[] = [
+  { columnName: 'Number', columnType: 'Numerical' },
+  { columnName: 'String', columnType: 'Physical' },
+  { columnName: 'Date', columnType: 'Virtual' },
+];
+
+const testColumns: ColumnsType<BasicData> = [
+  {
+    title: 'Column Name',
+    dataIndex: 'columnName',
+    key: 'columnName',
+    width: 150,
+  },
+  {
+    title: 'Column Type',
+    dataIndex: 'columnType',
+    key: 'columnType',
+    width: 150,
+  },
+];
+
+test('virtualized table renders headers and row content through the react-window Grid', async () => {
+  render(
+    <Table
+      columns={testColumns}
+      data={testData}
+      virtualize
+      height={200}
+      usePagination={false}
+    />,
+  );
+
+  await waitFor(() =>
+    testColumns.forEach(column =>
+      expect(
+        screen
+          .getAllByText(column.title as string)
+          .find(el => el.closest('th')),
+      ).toBeInTheDocument(),
+    ),
+  );
+
+  testData.forEach(row => {
+    expect(screen.getByText(row.columnName)).toBeInTheDocument();
+  });
+});
+
+test('virtualized table cells keep the DOM hooks other code (cypress, downloadAsImage) relies on', async () => {
+  const { container } = render(
+    <Table
+      columns={testColumns}
+      data={testData}
+      virtualize
+      height={200}
+      usePagination={false}
+    />,
+  );
+
+  await waitFor(() => {
+    expect(container.querySelector('.virtual-grid')).toBeInTheDocument();
+    expect(
+      container.querySelectorAll('.virtual-table-cell').length,
+    ).toBeGreaterThan(0);
+  });
+});
+
+test('cell render functions receive their row data via cellProps rather than a stale closure', async () => {
+  const columnsWithRender: ColumnsType<BasicData> = [
+    {
+      title: 'Column Name',
+      dataIndex: 'columnName',
+      key: 'columnName',
+      width: 150,
+      render: (value: string) => `rendered:${value}`,
+    },
+  ];
+
+  render(
+    <Table
+      columns={columnsWithRender}
+      data={testData}
+      virtualize
+      height={200}
+      usePagination={false}
+    />,
+  );
+
+  await waitFor(() => {
+    expect(screen.getByText('rendered:Number')).toBeInTheDocument();
+  });
+});
@@ -24,10 +24,14 @@ import {
 } from 'antd/es/table';
 import classNames from 'classnames';
 import { useResizeDetector } from 'react-resize-detector';
-import { useEffect, useRef, useState, useCallback, CSSProperties } from 'react';
-import { VariableSizeGrid as Grid } from 'react-window';
+import { useRef, useState, useCallback, type UIEvent } from 'react';
+import {
+  Grid,
+  type CellComponentProps,
+  type GridImperativeAPI,
+} from 'react-window';
 import { safeHtmlSpan } from '@superset-ui/core';
-import { useTheme, styled } from '@apache-superset/core/theme';
+import { useTheme, styled, SupersetTheme } from '@apache-superset/core/theme';

 import { TableSize, ETableAction } from './index';

@@ -71,6 +75,59 @@ const StyledTable = styled(AntTable)(
 const SMALL = 39;
 const MIDDLE = 47;

+interface VirtualGridCellProps {
+  mergedColumns: AntTableProps<any>['columns'];
+  rawData: readonly object[];
+  cellSize: number;
+  allowHTML: boolean;
+  theme: SupersetTheme;
+}
+
+// Rendered via `cellComponent`, so it must be a stable reference (module scope)
+// rather than defined inline on every render of the enclosing table -
+// otherwise react-window would treat it as a new component type each render
+// and remount every cell. All the data it needs is threaded through
+// `cellProps` instead of being closed over.
+const VirtualGridCell = ({
+  columnIndex,
+  rowIndex,
+  style,
+  mergedColumns,
+  rawData,
+  cellSize,
+  allowHTML,
+  theme,
+}: CellComponentProps<VirtualGridCellProps>) => {
+  const data: any = rawData?.[rowIndex];
+  // Set default content
+  let content = data?.[(mergedColumns as any)?.[columnIndex]?.dataIndex];
+  // Check if the column has a render function
+  const render = mergedColumns?.[columnIndex]?.render;
+  if (typeof render === 'function') {
+    // Use render function to generate formatted content using column's render function
+    content = render(content, data, rowIndex);
+  }
+
+  if (allowHTML && typeof content === 'string') {
+    content = safeHtmlSpan(content);
+  }
+
+  return (
+    <StyledCell
+      className={classNames('virtual-table-cell', {
+        'virtual-table-cell-last':
+          columnIndex === (mergedColumns?.length ?? 0) - 1,
+      })}
+      style={style}
+      title={typeof content === 'string' ? content : undefined}
+      theme={theme}
+      height={cellSize}
+    >
+      {content}
+    </StyledCell>
+  );
+};
+
 const VirtualTable = <RecordType extends object>(
  props: VirtualTableProps<RecordType>,
 ) => {
@@ -126,19 +183,15 @@ const VirtualTable = <RecordType extends object>(
      (lastColumn.width as number) + Math.floor(tableWidth - totalWidth);
  }

-  const gridRef = useRef<any>();
+  const gridRef = useRef<GridImperativeAPI>(null);
  const [connectObject] = useState<any>(() => {
    const obj = {};
    Object.defineProperty(obj, 'scrollLeft', {
-      get: () => {
-        if (gridRef.current) {
-          return gridRef.current?.state?.scrollLeft;
-        }
-        return 0;
-      },
+      get: () => gridRef.current?.element?.scrollLeft ?? 0,
      set: (scrollLeft: number) => {
-        if (gridRef.current) {
-          gridRef.current.scrollTo({ scrollLeft });
+        const element = gridRef.current?.element;
+        if (element) {
+          element.scrollLeft = scrollLeft;
        }
      },
    });
@@ -146,14 +199,11 @@ const VirtualTable = <RecordType extends object>(
    return obj;
  });

-  const resetVirtualGrid = () => {
-    gridRef.current?.resetAfterIndices({
-      columnIndex: 0,
-      shouldForceUpdate: true,
-    });
-  };
-
-  useEffect(() => resetVirtualGrid, [tableWidth, columns, size]);
+  // No manual cache-reset is needed here (react-window v2 has no
+  // `resetAfterIndices`-style API): `columnWidth` below is a fresh inline
+  // closure over `mergedColumns` on every render, so react-window's internal
+  // size cache - which is invalidated whenever the `columnWidth`/`rowHeight`
+  // function reference changes - recomputes automatically.

  /*
   * antd Table has a runtime error when it tries to fire the onChange event triggered from a pageChange
@@ -166,7 +216,10 @@ const VirtualTable = <RecordType extends object>(
     * We intentionally leave horizontal scroll where it was so user can focus on
     * specific range of columns as they page through data
     */
-    gridRef.current?.scrollTo?.({ scrollTop: 0 });
+    const element = gridRef.current?.element;
+    if (element) {
+      element.scrollTop = 0;
+    }

    onChange?.(
      {
@@ -192,61 +245,31 @@ const VirtualTable = <RecordType extends object>(
    const cellSize = size === TableSize.Middle ? MIDDLE : SMALL;
    return (
      <Grid
-        ref={gridRef}
+        gridRef={gridRef}
        className="virtual-grid"
        columnCount={mergedColumns.length}
        columnWidth={(index: number) => {
          const { width = DEFAULT_COL_WIDTH } = mergedColumns[index];
          return width as number;
        }}
-        height={height || (scroll!.y as number)}
        rowCount={rawData.length}
        rowHeight={() => cellSize}
-        width={tableWidth}
-        onScroll={({ scrollLeft }: { scrollLeft: number }) => {
-          onScroll({ scrollLeft });
+        style={{
+          height: height || (scroll!.y as number),
+          width: tableWidth,
        }}
-      >
-        {({
-          columnIndex,
-          rowIndex,
-          style,
-        }: {
-          columnIndex: number;
-          rowIndex: number;
-          style: CSSProperties;
-        }) => {
-          const data: any = rawData?.[rowIndex];
-          // Set default content
-          let content =
-            data?.[(mergedColumns as any)?.[columnIndex]?.dataIndex];
-          // Check if the column has a render function
-          const render = mergedColumns[columnIndex]?.render;
-          if (typeof render === 'function') {
-            // Use render function to generate formatted content using column's render function
-            content = render(content, data, rowIndex);
-          }
-
-          if (allowHTML && typeof content === 'string') {
-            content = safeHtmlSpan(content);
-          }
-
-          return (
-            <StyledCell
-              className={classNames('virtual-table-cell', {
-                'virtual-table-cell-last':
-                  columnIndex === mergedColumns.length - 1,
-              })}
-              style={style}
-              title={typeof content === 'string' ? content : undefined}
-              theme={theme}
-              height={cellSize}
-            >
-              {content}
-            </StyledCell>
-          );
+        cellComponent={VirtualGridCell}
+        cellProps={{
+          mergedColumns,
+          rawData,
+          cellSize,
+          allowHTML,
+          theme,
        }}
-      </Grid>
+        onScroll={(event: UIEvent<HTMLDivElement>) => {
+          onScroll({ scrollLeft: event.currentTarget.scrollLeft });
+        }}
+      />
    );
  };

@@ -51,8 +51,10 @@ const StyledTabs = ({
      .ant-tabs-body-holder {
        overflow: ${allowOverflow ? 'visible' : 'auto'};
        ${fullHeight && 'height: 100%;'}
-        ${contentHeight &&
-        `height: ${typeof contentHeight === 'number' ? `${contentHeight}px` : contentHeight};`}
+        ${
+          contentHeight &&
+          `height: ${typeof contentHeight === 'number' ? `${contentHeight}px` : contentHeight};`
+        }
        ${contentPadding}
      }
      .ant-tabs-body {
@@ -66,9 +68,11 @@ const StyledTabs = ({
        margin: 0;
      }
      .ant-tabs-nav-wrap {
-        ${!(tabBarStyle && 'paddingLeft' in tabBarStyle)
-          ? `padding: 0 ${theme.sizeUnit * 4}px;`
-          : ''}
+        ${
+          !(tabBarStyle && 'paddingLeft' in tabBarStyle)
+            ? `padding: 0 ${theme.sizeUnit * 4}px;`
+            : ''
+        }
      }
      .ant-tabs-tab {
        flex: 1 1 auto;
@@ -0,0 +1,86 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import NumberFormatter from '../NumberFormatter';
+import { NumberFormatFunction } from '../types';
+
+const BITS_PER_BYTE = 8;
+const BASE = 1000;
+const SUFFIXES = [
+  'bps',
+  'kbps',
+  'Mbps',
+  'Gbps',
+  'Tbps',
+  'Pbps',
+  'Ebps',
+  'Zbps',
+  'Ybps',
+  'Rbps',
+  'Qbps',
+];
+
+function formatThroughput(
+  decimals: number,
+  fromBytes: boolean,
+): NumberFormatFunction {
+  return value => {
+    if (value === 0) {
+      return `0${SUFFIXES[0]}`;
+    }
+
+    const sign = value > 0 ? '' : '-';
+    const magnitude = Math.abs(value);
+    const bits = fromBytes ? magnitude * BITS_PER_BYTE : magnitude;
+    let i = Math.max(
+      0,
+      Math.min(
+        SUFFIXES.length - 1,
+        Math.floor(Math.log(bits) / Math.log(BASE)),
+      ),
+    );
+    let scaled = parseFloat((bits / Math.pow(BASE, i)).toFixed(decimals));
+
+    if (scaled >= BASE && i < SUFFIXES.length - 1) {
+      i += 1;
+      scaled = parseFloat((bits / Math.pow(BASE, i)).toFixed(decimals));
+    }
+
+    return `${sign}${scaled}${SUFFIXES[i]}`;
+  };
+}
+
+export default function createThroughputFormatter(
+  config: {
+    description?: string;
+    id?: string;
+    label?: string;
+    decimals?: number;
+    fromBytes?: boolean;
+  } = {},
+) {
+  const { description, id, label, decimals = 2, fromBytes = false } = config;
+
+  return new NumberFormatter({
+    description,
+    formatFunc: formatThroughput(decimals, fromBytes),
+    id: id ?? 'throughput_format',
+    label: label ?? `Throughput formatter`,
+  });
+}
@@ -36,3 +36,4 @@ export { default as createSiAtMostNDigitFormatter } from './factories/createSiAt
 export { default as createSmartNumberFormatter } from './factories/createSmartNumberFormatter';
 export { default as getSmallNumberFormatter } from './getSmallNumberFormatter';
 export { default as createLengthFormatter } from './factories/createLengthFormatter';
+export { default as createThroughputFormatter } from './factories/createThroughputFormatter';
@@ -54,7 +54,12 @@ class LRUCache<T> {
    if (typeof key !== 'string') {
      throw new TypeError('The LRUCache key must be string.');
    }
-    if (this.cache.size >= this.capacity) {
+    if (this.cache.has(key)) {
+      // Overwriting an existing key must not evict anything: the entry count is
+      // unchanged. Deleting first also refreshes the key's recency, since
+      // Map#set keeps the original insertion position for existing keys.
+      this.cache.delete(key);
+    } else if (this.cache.size >= this.capacity) {
      // Forward-compat: TS 6.0 types IteratorResult.value as `string | undefined`
      // when not explicitly checked; guard before passing to Map#delete.
      const oldestKey = this.cache.keys().next().value;
@@ -18,7 +18,9 @@
 */

 import {
+  DEFAULT_DECK_MULTI_MAX_SLICES,
  getBootstrapDataFromDocument,
+  getDeckMultiMaxSlices,
  getDefaultMapRenderer,
  getMapProviderMapStyle,
  getMapboxApiKeyFromBootstrap,
@@ -58,6 +60,16 @@ test('Mapbox key helpers report absence and presence from bootstrap data', () =>
  ).toBe(true);
 });

+test('deck.gl multi-slice cap falls back to the default when unset', () => {
+  expect(getDeckMultiMaxSlices({ common: { conf: {} } })).toBe(
+    DEFAULT_DECK_MULTI_MAX_SLICES,
+  );
+  expect(getDeckMultiMaxSlices(undefined)).toBe(DEFAULT_DECK_MULTI_MAX_SLICES);
+  expect(
+    getDeckMultiMaxSlices({ common: { conf: { DECK_MULTI_MAX_SLICES: 5 } } }),
+  ).toBe(5);
+});
+
 test('bootstrap data helper parses document data safely', () => {
  document.body.innerHTML = `<div id="app" data-bootstrap='${JSON.stringify({
    common: { conf: { MAPBOX_API_KEY: 'pk.document' } },
@@ -83,10 +83,13 @@ type BootstrapData = {
    conf?: {
      DEFAULT_MAP_RENDERER?: unknown;
      MAPBOX_API_KEY?: unknown;
+      DECK_MULTI_MAX_SLICES?: unknown;
    };
  };
 };

+export const DEFAULT_DECK_MULTI_MAX_SLICES = 50;
+
 export function getBootstrapDataFromDocument(): unknown {
  /* istanbul ignore if -- a missing document only occurs in SSR/worker
     contexts, which Jest cannot simulate: jsdom pins `document` as a
@@ -118,6 +121,16 @@ export function hasMapboxApiKey(
  return getMapboxApiKeyFromBootstrap(bootstrapData).trim().length > 0;
 }

+export function getDeckMultiMaxSlices(
+  bootstrapData: unknown = getBootstrapDataFromDocument(),
+): number {
+  const maxSlices = (bootstrapData as BootstrapData | undefined)?.common?.conf
+    ?.DECK_MULTI_MAX_SLICES;
+  return typeof maxSlices === 'number' && Number.isFinite(maxSlices)
+    ? maxSlices
+    : DEFAULT_DECK_MULTI_MAX_SLICES;
+}
+
 export function getDefaultMapRenderer(
  bootstrapData: unknown = getBootstrapDataFromDocument(),
 ): MapProvider {
@@ -122,7 +122,7 @@ describe('ChartClient', () => {
  });

  describe('.loadQueryData(formData, options)', () => {
-    test('returns a promise of query data for known chart type', () => {
+    test('returns a promise of query data for known chart type', async () => {
      getChartMetadataRegistry().registerValue(
        VizType.WordCloud,
        new ChartMetadata({ name: 'Word Cloud', thumbnail: '' }),
@@ -132,14 +132,18 @@ describe('ChartClient', () => {
        VizType.WordCloud,
        (formData: QueryFormData) => buildQueryContext(formData),
      );
-      fetchMock.post('glob:*/api/v1/chart/data', [
-        {
-          field1: 'abc',
-          field2: 'def',
-        },
-      ]);
+      // The real /api/v1/chart/data endpoint wraps its results in
+      // `{ result: [...] }`, not a bare array.
+      fetchMock.post('glob:*/api/v1/chart/data', {
+        result: [
+          {
+            field1: 'abc',
+            field2: 'def',
+          },
+        ],
+      });

-      return expect(
+      await expect(
        chartClient.loadQueryData({
          granularity: 'minute',
          viz_type: VizType.WordCloud,
@@ -151,6 +155,16 @@ describe('ChartClient', () => {
          field2: 'def',
        },
      ]);
+
+      // The query context fields must be posted at the top level of the
+      // request body -- the endpoint's schema does not expect them nested
+      // under a `query_context` key.
+      const calls = fetchMock.callHistory.calls('glob:*/api/v1/chart/data');
+      const requestBody = JSON.parse(
+        (calls[0].options as RequestInit).body as string,
+      );
+      expect(requestBody.query_context).toBeUndefined();
+      expect(requestBody.datasource).toEqual({ id: 1, type: 'table' });
    });
    test('returns a promise that rejects for unknown chart type', () =>
      expect(
@@ -160,42 +174,6 @@ describe('ChartClient', () => {
          datasource: '1__table',
        }),
      ).rejects.toEqual(new Error('Unknown chart type: rainbow_3d_pie')));
-
-    test('fetches data from the legacy API if ChartMetadata has useLegacyApi=true,', () => {
-      // note legacy charts do not register a buildQuery function in the registry
-      getChartMetadataRegistry().registerValue(
-        'word_cloud_legacy',
-        new ChartMetadata({
-          name: 'Legacy Word Cloud',
-          thumbnail: '.png',
-          useLegacyApi: true,
-        }),
-      );
-
-      fetchMock.post('glob:*/api/v1/chart/data', () =>
-        Promise.reject(new Error('Unexpected all to v1 API')),
-      );
-
-      // post `Superset.route_base = ""`, the legacy endpoint
-      // collapsed from `/superset/explore_json/` to `/explore_json/`.
-      fetchMock.post('glob:*/explore_json/', {
-        field1: 'abc',
-        field2: 'def',
-      });
-
-      return expect(
-        chartClient.loadQueryData({
-          granularity: 'minute',
-          viz_type: 'word_cloud_legacy',
-          datasource: '1__table',
-        }),
-      ).resolves.toEqual([
-        {
-          field1: 'abc',
-          field2: 'def',
-        },
-      ]);
-    });
  });

  describe('.loadDatasource(datasourceKey, options)', () => {
@@ -45,7 +45,16 @@ describe('reactify(renderFn)', () => {
    content: 'ghi',
  };

-  const willUnmountCb = jest.fn();
+  let latestUnmountContext:
+    | {
+        container?: HTMLDivElement;
+        props?: { content?: string; id?: string };
+      }
+    | undefined;
+
+  const willUnmountCb = jest.fn(function captureUnmountContext() {
+    latestUnmountContext = this as typeof latestUnmountContext;
+  });

  const TheChart = reactify(renderFn);
  const TheChartWithWillUnmountHook = reactify(renderFn, {
@@ -66,12 +75,22 @@ describe('reactify(renderFn)', () => {
  }

  function AnotherTestComponent() {
-    return <TheChartWithWillUnmountHook id="another_test" />;
+    const [content, setContent] = useState('abc');
+
+    useEffect(() => {
+      const timer = setTimeout(() => {
+        setContent('def');
+      }, 10);
+      return () => clearTimeout(timer);
+    }, []);
+
+    return <TheChartWithWillUnmountHook id="another_test" content={content} />;
  }

  beforeEach(() => {
    (renderFn as jest.Mock).mockClear();
    willUnmountCb.mockClear();
+    latestUnmountContext = undefined;
  });

  test('returns a React component and re-renders on prop changes', async () => {
@@ -126,9 +145,22 @@ describe('reactify(renderFn)', () => {
    expect(anotherRenderFn).toHaveBeenCalled();
    unmount();
  });
-  test('calls willUnmount hook when it is provided', () => {
+  test('calls willUnmount hook with the committed container and latest props', async () => {
    const { unmount } = render(<AnotherTestComponent />);
+
+    await waitFor(() => {
+      expect(screen.getByText('def')).toBeInTheDocument();
+    });
+
+    const committedContainer = screen.getByText('def').parentElement;
+
    unmount();
+
    expect(willUnmountCb).toHaveBeenCalledTimes(1);
+    expect(latestUnmountContext?.props).toMatchObject({
+      id: 'another_test',
+      content: 'def',
+    });
+    expect(latestUnmountContext?.container).toBe(committedContainer);
  });
 });
@@ -22,6 +22,8 @@ import {
  addAlpha,
  hexToRgb,
  rgbToHex,
+  rgbaToHex,
+  forceHexAlpha,
 } from '@superset-ui/core';

 describe('color utils', () => {
@@ -106,4 +108,51 @@ describe('color utils', () => {
      expect(rgbToHex(0, 0, 0)).toBe('#000000');
    });
  });
+  describe('rgbaToHex', () => {
+    test('omits the alpha channel for opaque colors', () => {
+      expect(rgbaToHex({ r: 255, g: 0, b: 0 })).toBe('#ff0000');
+      expect(rgbaToHex({ r: 255, g: 0, b: 0, a: 1 })).toBe('#ff0000');
+    });
+    test('appends the alpha channel for translucent colors', () => {
+      expect(rgbaToHex({ r: 0, g: 150, b: 0, a: 0.2 })).toBe('#00960033');
+      expect(rgbaToHex({ r: 0, g: 0, b: 0, a: 0.5 })).toBe('#00000080');
+    });
+    test('fully transparent colors keep an explicit 00 alpha', () => {
+      expect(rgbaToHex({ r: 255, g: 255, b: 255, a: 0 })).toBe('#ffffff00');
+    });
+    test('zero-pads single-digit channels', () => {
+      expect(rgbaToHex({ r: 1, g: 2, b: 3 })).toBe('#010203');
+    });
+    test('rounds fractional channel values', () => {
+      expect(rgbaToHex({ r: 254.6, g: 0.4, b: 0 })).toBe('#ff0000');
+    });
+    test('clamps out-of-range channel and alpha values', () => {
+      expect(rgbaToHex({ r: 300, g: -10, b: 0 })).toBe('#ff0000');
+      expect(rgbaToHex({ r: 0, g: 0, b: 0, a: 1.5 })).toBe('#000000');
+      expect(rgbaToHex({ r: 0, g: 0, b: 0, a: -0.5 })).toBe('#00000000');
+    });
+  });
+  describe('forceHexAlpha', () => {
+    test('appends 60% alpha to a 6-digit hex string', () => {
+      expect(forceHexAlpha('#ff0000')).toBe('#ff000099');
+    });
+    test('adds the # prefix when missing', () => {
+      expect(forceHexAlpha('ff0000')).toBe('#ff000099');
+    });
+    test('replaces the existing alpha on an 8-digit hex string', () => {
+      expect(forceHexAlpha('#ff000033')).toBe('#ff000099');
+    });
+    test('converts an RGBColor object using 60% alpha', () => {
+      expect(forceHexAlpha({ r: 255, g: 0, b: 0 })).toBe('#ff000099');
+    });
+    test('overrides the alpha of a translucent RGBColor object', () => {
+      expect(forceHexAlpha({ r: 0, g: 150, b: 0, a: 0.2 })).toBe('#00960099');
+    });
+    test('expands a shorthand 3-digit hex string before adding alpha', () => {
+      expect(forceHexAlpha('#fff')).toBe('#ffffff99');
+    });
+    test('expands a shorthand 4-digit hex string before replacing alpha', () => {
+      expect(forceHexAlpha('#ff03')).toBe('#ffff0099');
+    });
+  });
 });
@@ -83,6 +83,111 @@ describe('getOverrideHtmlSchema', () => {
      (second.tagNames ?? []).filter(name => name === 'iframe'),
    ).toHaveLength(1);
  });
+
+  // Regression tests for #34191: hast-util-sanitize's real default schema
+  // restricts `li`/`ul`/`ol` `className` to specific task-list values, e.g.
+  // `li: [['className', 'task-list-item']]` (see hast-util-sanitize's
+  // `lib/schema.js`). `rehype-sanitize` is mocked globally in this jest
+  // project (see NOTE above), so `defaultSchema` isn't usable here; this
+  // fixture mirrors just the shape that matters for these tests.
+  //
+  // findDefinition only ever returns the FIRST definition it finds for a
+  // given property name, so simply concatenating the operator's override
+  // after the default restrictive tuple left the default in charge: any
+  // other class value was silently dropped, and (since a failed allowlist
+  // check returns `[]` rather than `undefined`) hast-util-sanitize's own
+  // `'*'` wildcard fallback never kicked in either.
+  const taskListSchemaFixture: typeof defaultSchema = {
+    attributes: {
+      li: [['className', 'task-list-item']],
+      ul: [['className', 'contains-task-list']],
+      ol: [['className', 'contains-task-list']],
+    },
+  };
+
+  test('an override for a property replaces the same-named default definition', () => {
+    const result = getOverrideHtmlSchema(taskListSchemaFixture, {
+      attributes: { li: ['className'] },
+    });
+
+    // The override should fully replace the default `li` className
+    // restriction, not merely be appended after it.
+    expect(result.attributes?.li).toEqual(['className']);
+  });
+
+  test('a per-tag override leaves a sibling tag definition untouched', () => {
+    const result = getOverrideHtmlSchema(taskListSchemaFixture, {
+      attributes: { li: ['className'] },
+    });
+
+    // Only the overridden tag (`li`) is replaced; `ul`/`ol` keep their
+    // default restrictive definitions since the merge recurses per-tag.
+    expect(result.attributes?.ul).toEqual(taskListSchemaFixture.attributes?.ul);
+    expect(result.attributes?.ol).toEqual(taskListSchemaFixture.attributes?.ol);
+  });
+
+  test('a "*" wildcard override alone does not widen li, which has its own default definition', () => {
+    const result = getOverrideHtmlSchema(taskListSchemaFixture, {
+      attributes: { '*': ['className'] },
+    });
+
+    expect(result.attributes?.['*']).toContainEqual('className');
+    // The restrictive `li`-specific default is still present (untouched by
+    // this override), but since findDefinition matches on the specific
+    // `li` entry first, this alone documents why an `li`-specific override
+    // is required to unblock arbitrary classes on `li` -- a `'*'` override
+    // does not, by itself, widen a tag that already has its own definition.
+    expect(result.attributes?.li).toEqual(taskListSchemaFixture.attributes?.li);
+  });
+
+  test('a malformed (non-array) attribute override for a tag falls back to the default definition instead of throwing', () => {
+    expect(() =>
+      getOverrideHtmlSchema(taskListSchemaFixture, {
+        // Runtime config isn't guaranteed to match the expected shape; a
+        // string here (rather than an array of attribute definitions) must
+        // not crash markdown rendering.
+        attributes: { li: 'className' as unknown as string[] },
+      }),
+    ).not.toThrow();
+
+    const result = getOverrideHtmlSchema(taskListSchemaFixture, {
+      attributes: { li: 'className' as unknown as string[] },
+    });
+    expect(result.attributes?.li).toEqual(taskListSchemaFixture.attributes?.li);
+  });
+
+  test('a malformed (null) element within an attribute override array falls back to the default definition instead of throwing', () => {
+    expect(() =>
+      getOverrideHtmlSchema(taskListSchemaFixture, {
+        // Runtime config isn't guaranteed to match the expected shape; a
+        // `null` element here must not crash the key lookup used to
+        // dedup overrides against the default definitions.
+        attributes: { li: [null] as unknown as string[] },
+      }),
+    ).not.toThrow();
+
+    const result = getOverrideHtmlSchema(taskListSchemaFixture, {
+      attributes: { li: [null] as unknown as string[] },
+    });
+    expect(result.attributes?.li).toEqual([
+      ...taskListSchemaFixture.attributes!.li!,
+      null,
+    ]);
+  });
+
+  test('the default task-list class restriction on li/ul/ol still applies with no override', () => {
+    const result = getOverrideHtmlSchema(taskListSchemaFixture, {});
+
+    expect(result.attributes?.li).toEqual([['className', 'task-list-item']]);
+    expect(result.attributes?.ul).toContainEqual([
+      'className',
+      'contains-task-list',
+    ]);
+    expect(result.attributes?.ol).toContainEqual([
+      'className',
+      'contains-task-list',
+    ]);
+  });
 });

 describe('transformLinkUri', () => {
@@ -0,0 +1,131 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { NumberFormatter, createThroughputFormatter } from '@superset-ui/core';
+
+test('creates an instance of NumberFormatter', () => {
+  const formatter = createThroughputFormatter();
+  expect(formatter).toBeInstanceOf(NumberFormatter);
+});
+
+test('uses default id and label', () => {
+  const formatter = createThroughputFormatter();
+  expect(formatter.id).toBe('throughput_format');
+  expect(formatter.label).toBe('Throughput formatter');
+});
+
+test('accepts a custom id, label and description', () => {
+  const formatter = createThroughputFormatter({
+    id: 'custom_id',
+    label: 'Custom label',
+    description: 'Custom description',
+  });
+  expect(formatter.id).toBe('custom_id');
+  expect(formatter.label).toBe('Custom label');
+  expect(formatter.description).toBe('Custom description');
+});
+
+test('formats bits per second without converting', () => {
+  const formatter = createThroughputFormatter();
+  expect(formatter(0)).toBe('0bps');
+  expect(formatter(500)).toBe('500bps');
+  expect(formatter(1500)).toBe('1.5kbps');
+  expect(formatter(8888)).toBe('8.89kbps');
+  expect(formatter(1000000)).toBe('1Mbps');
+  expect(formatter(1500000)).toBe('1.5Mbps');
+  expect(formatter(1500000000)).toBe('1.5Gbps');
+});
+
+test('scales bits per second across the full range of suffixes', () => {
+  const formatter = createThroughputFormatter();
+  expect(formatter(Math.pow(1000, 1))).toBe('1kbps');
+  expect(formatter(Math.pow(1000, 2))).toBe('1Mbps');
+  expect(formatter(Math.pow(1000, 3))).toBe('1Gbps');
+  expect(formatter(Math.pow(1000, 4))).toBe('1Tbps');
+  expect(formatter(Math.pow(1000, 5))).toBe('1Pbps');
+  expect(formatter(Math.pow(1000, 6))).toBe('1Ebps');
+  expect(formatter(Math.pow(1000, 7))).toBe('1Zbps');
+  expect(formatter(Math.pow(1000, 8))).toBe('1Ybps');
+  expect(formatter(Math.pow(1000, 9))).toBe('1Rbps');
+  expect(formatter(Math.pow(1000, 10))).toBe('1Qbps');
+});
+
+test('converts bytes per second to bits per second with fromBytes', () => {
+  const formatter = createThroughputFormatter({ fromBytes: true });
+  expect(formatter(0)).toBe('0bps');
+  expect(formatter(1)).toBe('8bps');
+  expect(formatter(100)).toBe('800bps');
+  expect(formatter(125)).toBe('1kbps');
+  expect(formatter(1111)).toBe('8.89kbps');
+  expect(formatter(187500)).toBe('1.5Mbps');
+  expect(formatter(1000000)).toBe('8Mbps');
+  expect(formatter(125000000)).toBe('1Gbps');
+});
+
+test('scales bytes per second across the full range of suffixes', () => {
+  const formatter = createThroughputFormatter({ fromBytes: true });
+  expect(formatter(Math.pow(1000, 1) / 8)).toBe('1kbps');
+  expect(formatter(Math.pow(1000, 5) / 8)).toBe('1Pbps');
+  expect(formatter(Math.pow(1000, 10) / 8)).toBe('1Qbps');
+});
+
+test('promotes to the next suffix when rounding reaches the base', () => {
+  const formatter = createThroughputFormatter();
+  expect(formatter(999.999)).toBe('1kbps');
+  expect(formatter(999999)).toBe('1Mbps');
+  expect(formatter(999999999)).toBe('1Gbps');
+  expect(formatter(-999999)).toBe('-1Mbps');
+
+  const fromBytes = createThroughputFormatter({ fromBytes: true });
+  expect(fromBytes(124999.99)).toBe('1Mbps');
+
+  const formatter0decimals = createThroughputFormatter({ decimals: 0 });
+  expect(formatter0decimals(999.6)).toBe('1kbps');
+});
+
+test('clamps to the largest suffix beyond the known range', () => {
+  const formatter = createThroughputFormatter();
+  expect(formatter(Math.pow(1000, 11))).toBe('1000Qbps');
+  expect(formatter(Math.pow(1000, 12))).toBe('1000000Qbps');
+});
+
+test('clamps to the smallest suffix below one bit per second', () => {
+  const formatter = createThroughputFormatter();
+  expect(formatter(0.4)).toBe('0.4bps');
+
+  const fromBytes = createThroughputFormatter({ fromBytes: true });
+  expect(fromBytes(0.05)).toBe('0.4bps');
+});
+
+test('formats negative rates', () => {
+  const formatter = createThroughputFormatter();
+  expect(formatter(-1500)).toBe('-1.5kbps');
+
+  const fromBytes = createThroughputFormatter({ fromBytes: true });
+  expect(fromBytes(-187500)).toBe('-1.5Mbps');
+});
+
+test('rounds according to the decimals option', () => {
+  const formatter0decimals = createThroughputFormatter({ decimals: 0 });
+  expect(formatter0decimals(0)).toBe('0bps');
+  expect(formatter0decimals(8888)).toBe('9kbps');
+
+  const formatter3decimals = createThroughputFormatter({ decimals: 3 });
+  expect(formatter3decimals(8888)).toBe('8.888kbps');
+});
@@ -53,6 +53,27 @@ test('LRU operations', () => {
  expect(cache.capacity).toBe(3);
 });

+test('overwriting an existing key does not evict another entry', () => {
+  const cache = lruCache<string>(2);
+  cache.set('a', 'a');
+  cache.set('b', 'b');
+  cache.set('b', 'b2');
+  expect(cache.size).toBe(2);
+  expect(cache.has('a')).toBe(true);
+  expect(cache.get('b')).toBe('b2');
+});
+
+test('overwriting an existing key refreshes its recency', () => {
+  const cache = lruCache<string>(2);
+  cache.set('a', 'a');
+  cache.set('b', 'b');
+  // `a` becomes the most recently used, so `b` is evicted next
+  cache.set('a', 'a2');
+  cache.set('c', 'c');
+  expect(cache.has('b')).toBe(false);
+  expect(cache.values()).toEqual(['a2', 'c']);
+});
+
 test('LRU handle null and undefined', () => {
  const cache = lruCache();
  cache.set('a', null);
@@ -19,10 +19,16 @@

 import { expect } from '@playwright/test';
 import { Modal, Input } from '../core';
+import { isFeatureEnabled } from '../../helpers/featureFlags';

 /**
- * Delete confirmation modal that requires typing "DELETE" to confirm.
- * Used throughout Superset for destructive delete operations.
+ * Delete confirmation modal, used throughout Superset for delete operations.
+ *
+ * The modal has two modes. Destructive mode demands the user type "DELETE"
+ * before the action is enabled. Recoverable mode — what `SOFT_DELETE` turns
+ * on — archives instead of removing, so the action reads "Archive" and the
+ * type-to-confirm friction is deliberately dropped: reduced friction is what
+ * a reversible action earns.
 *
 * Provides primitives for tests to compose deletion flows.
 */
@@ -96,4 +102,40 @@ export class DeleteConfirmationModal extends Modal {
    await expect(confirmButton).toBeEnabled({ timeout: options?.timeout });
    await confirmButton.click(options);
  }
+
+  /**
+   * Confirms the deletion using whichever interaction the modal is in.
+   *
+   * Which mode is in force is a property of the instance, not of the caller,
+   * so the flag decides rather than the test — the same spec then covers the
+   * hard-delete and archive paths without being rewritten when the default
+   * flips, and keeps covering hard delete for deployments that turn the
+   * toggle back off.
+   *
+   * Neither branch is merely tolerant: the recoverable branch asserts the
+   * confirmation input is genuinely *absent* rather than skipping past it,
+   * so a regression that dropped the typed confirmation from destructive
+   * mode still fails here instead of quietly passing.
+   *
+   * Assumes the modal's mode follows `SOFT_DELETE` alone. That holds
+   * everywhere except a bulk selection containing semantic views, which
+   * stays destructive even with the flag on — such a flow should drive
+   * {@link fillConfirmationInput} and {@link clickDelete} directly.
+   *
+   * @param confirmationText - Text typed in destructive mode
+   *
+   * @example
+   * const deleteModal = new DeleteConfirmationModal(page);
+   * await deleteModal.waitForVisible();
+   * await deleteModal.confirmDeletion();
+   * await deleteModal.waitForHidden();
+   */
+  async confirmDeletion(confirmationText = 'DELETE'): Promise<void> {
+    if (await isFeatureEnabled(this.page, 'SOFT_DELETE')) {
+      await expect(this.confirmationInput.element).toHaveCount(0);
+    } else {
+      await this.fillConfirmationInput(confirmationText);
+    }
+    await this.clickDelete();
+  }
 }
@@ -0,0 +1,74 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Locator, Page } from '@playwright/test';
+
+/**
+ * Unconditional pause between drag events, letting react-dnd's HTML5 backend
+ * commit its monitor state before the next event fires. Deliberately not in
+ * `TIMEOUT`: that object holds wait *ceilings* (a wait may finish sooner),
+ * whereas this is a fixed sleep that always costs what it says.
+ */
+const REACT_DND_SETTLE_MS = 50;
+
+/**
+ * Drives an HTML5 drag-and-drop using synthetic native drag events.
+ *
+ * The dashboard grid uses react-dnd with the HTML5 backend
+ * (`react-dnd-html5-backend`), which listens for native `dragstart` /
+ * `dragenter` / `dragover` / `drop` events rather than the mouse events that
+ * Playwright's built-in `locator.dragTo()` produces. To trigger it we dispatch
+ * the native drag sequence ourselves, threading a single shared `DataTransfer`
+ * object through every event so react-dnd's monitor sees a consistent payload.
+ *
+ * Mirrors the synthetic-event sequence used by the deprecated Cypress `drag`
+ * helper (cypress-base/cypress/utils/index.ts).
+ *
+ * @param page - Playwright page (used to mint the shared DataTransfer)
+ * @param source - The draggable element (or a descendant; drag events bubble)
+ * @param target - The drop target element
+ */
+export async function html5DragAndDrop(
+  page: Page,
+  source: Locator,
+  target: Locator,
+): Promise<void> {
+  // Note: we intentionally do not scrollIntoView the source. The chart card list
+  // is virtualized, so a separate scroll action can detach the element between
+  // resolution and use; dispatchEvent only requires the node to be attached.
+
+  // A single DataTransfer shared across every event in the sequence: react-dnd's
+  // HTML5 backend reads/writes drag state through it, so reusing one handle is
+  // what makes the monitor treat this as one coherent drag.
+  const dataTransfer = await page.evaluateHandle(() => new DataTransfer());
+
+  await source.dispatchEvent('dragstart', { dataTransfer });
+  // react-dnd's HTML5 backend commits monitor state (the active drag source) on a
+  // microtask after dragstart; a short settle avoids a race where dragover/drop
+  // fire before the backend considers a drag to be in progress.
+  await page.waitForTimeout(REACT_DND_SETTLE_MS);
+  // dragenter must precede dragover for react-dnd to register the hover target.
+  await target.dispatchEvent('dragenter', { dataTransfer });
+  await target.dispatchEvent('dragover', { dataTransfer });
+  await page.waitForTimeout(REACT_DND_SETTLE_MS);
+  await target.dispatchEvent('drop', { dataTransfer });
+  await source.dispatchEvent('dragend', { dataTransfer });
+
+  await dataTransfer.dispose();
+}
@@ -17,12 +17,29 @@
 * under the License.
 */

-import { Page, Download, Locator } from '@playwright/test';
-import { Menu } from '../components/core';
+import { Page, Download, Locator, expect } from '@playwright/test';
+import { Button, Input, Menu, Tabs } from '../components/core';
 import { DashboardFilterBar } from '../components/dashboard';
 import { gotoWithRetry } from '../helpers/navigation';
+import { html5DragAndDrop } from '../helpers/dnd';
 import { TIMEOUT } from '../utils/constants';

+/** Tabs of the dashboard builder side pane, by their rendered label. */
+type BuilderTab = 'Charts' | 'Layout elements';
+
+/**
+ * Built-in draggable layout elements, by their rendered label (see
+ * `src/dashboard/components/gridComponents/new/`). Extension-provided elements
+ * carry dynamic names and are not covered here.
+ */
+type LayoutElementLabel =
+  | 'Tabs'
+  | 'Row'
+  | 'Column'
+  | 'Header'
+  | 'Text / Markdown'
+  | 'Divider';
+
 /**
 * Dashboard Page object for interacting with dashboards.
 */
@@ -32,9 +49,28 @@ export class DashboardPage {

  private static readonly SELECTORS = {
    DASHBOARD_HEADER: '[data-test="dashboard-header-container"]',
+    CHART_GRID_COMPONENT: '[data-test="chart-grid-component"]',
+    // `:visible` so the locator empties out as loaders hide; see
+    // waitForLoadersToSettle.
+    LOADING_INDICATOR: '[aria-label="Loading"]:visible',
    DASHBOARD_MENU_TRIGGER: '[data-test="actions-trigger"]',
    // The header-actions-menu is the data-test for the dropdown menu content
    HEADER_ACTIONS_MENU: '[data-test="header-actions-menu"]',
+    EDIT_BUTTON: '[data-test="edit-dashboard-button"]',
+    BUILDER_PANE: '[data-test="dashboard-builder-sidepane"]',
+    CHARTS_SEARCH: '[data-test="dashboard-charts-filter-search-input"]',
+    CHART_CARD: '[data-test="chart-card"]',
+    EMPTY_DROPTARGET: '[data-test="grid-content"] .empty-droptarget',
+    NEW_COMPONENT: '[data-test="new-component"]',
+    CHART_HOLDER: '[data-test="dashboard-component-chart-holder"]',
+    GRID_CONTENT: '[data-test="grid-content"]',
+    DELETE_COMPONENT: '[data-test="dashboard-delete-component-button"]',
+    MARKDOWN_EDITOR: '[data-test="dashboard-markdown-editor"]',
+    EDITABLE_TITLE: '[data-test="editable-title-input"]',
+    // Ace exposes no data-test hooks; these are its own stable DOM classes.
+    ACE_CONTENT: '.ace_content',
+    ACE_TEXT_INPUT: '.ace_text-input',
+    RESIZE_HANDLE_BOTTOM: '.resizable-container-handle--bottom',
  } as const;

  constructor(page: Page) {
@@ -60,12 +96,16 @@ export class DashboardPage {

  /**
   * Wait for the dashboard header to be visible.
+   *
+   * The header container renders well before the grid does, so this only
+   * establishes that the dashboard route mounted — pair it with
+   * {@link waitForChartsToLoad} before asserting on chart content.
   */
  async waitForLoad(options?: { timeout?: number }): Promise<void> {
    const timeout = options?.timeout ?? TIMEOUT.PAGE_LOAD;
-    await this.page.waitForSelector(DashboardPage.SELECTORS.DASHBOARD_HEADER, {
-      timeout,
-    });
+    await this.page
+      .locator(DashboardPage.SELECTORS.DASHBOARD_HEADER)
+      .waitFor({ state: 'visible', timeout });
  }

  /**
@@ -73,37 +113,80 @@ export class DashboardPage {
   */
  getChart(chartId: number): Locator {
    return this.page.locator(
-      `[data-test="chart-grid-component"][data-test-chart-id="${chartId}"]`,
+      `${DashboardPage.SELECTORS.CHART_GRID_COMPONENT}[data-test-chart-id="${chartId}"]`,
    );
  }

  /**
-   * Wait for all charts on the dashboard to finish loading.
-   * Waits until no loading indicators are visible on the page.
+   * Wait for the dashboard's charts to mount and finish loading.
+   *
+   * Waiting only for loading indicators to clear is not enough: the grid mounts
+   * its spinners after the header renders, so a "no visible loader" check
+   * called straight after {@link waitForLoad} passes instantly against a
+   * dashboard that has not started rendering anything. Waiting for at least one
+   * chart grid component first makes the absence of loaders mean "charts
+   * finished" rather than "charts have not begun".
+   *
+   * Only for dashboards that have charts — on an empty one this waits out
+   * `timeout` rather than returning. Use {@link waitForGridToLoad} there.
   */
  async waitForChartsToLoad(options?: { timeout?: number }): Promise<void> {
    const timeout = options?.timeout ?? TIMEOUT.API_RESPONSE;

-    // Use browser-context evaluation to check visibility directly.
-    // Loading indicators ([aria-label="Loading"]) may persist in the DOM as hidden
-    // elements after charts finish loading. This checks that none are currently visible,
-    // returning immediately when charts are already loaded (no timeout penalty).
-    await this.page.waitForFunction(
-      () => {
-        const loaders = document.querySelectorAll('[aria-label="Loading"]');
-        if (loaders.length === 0) return true;
-        return Array.from(loaders).every(el => {
-          const style = getComputedStyle(el);
-          return (
-            style.display === 'none' ||
-            style.visibility === 'hidden' ||
-            style.opacity === '0'
-          );
-        });
-      },
-      undefined,
-      { timeout },
-    );
+    await this.page
+      .locator(DashboardPage.SELECTORS.CHART_GRID_COMPONENT)
+      .first()
+      .waitFor({ state: 'attached', timeout });
+
+    await this.waitForLoadersToSettle(timeout);
+  }
+
+  /**
+   * Wait for the dashboard grid to mount and any loading indicators to clear.
+   *
+   * The counterpart to {@link waitForChartsToLoad} for a dashboard with no
+   * charts on it: the grid container renders whatever the grid holds, so it
+   * gives the "the page got past the header" evidence that a chart component
+   * cannot. Prefer {@link waitForChartsToLoad} whenever charts are expected —
+   * this cannot tell a grid that rendered empty from one whose charts have not
+   * begun rendering.
+   */
+  async waitForGridToLoad(options?: { timeout?: number }): Promise<void> {
+    const timeout = options?.timeout ?? TIMEOUT.API_RESPONSE;
+
+    // Attached rather than visible: an empty grid collapses to zero height,
+    // which Playwright counts as not visible.
+    await this.page
+      .locator(DashboardPage.SELECTORS.GRID_CONTENT)
+      .first()
+      .waitFor({ state: 'attached', timeout });
+
+    await this.waitForLoadersToSettle(timeout);
+  }
+
+  /**
+   * Resolve once no loading indicator is visible.
+   *
+   * Loading indicators persist in the DOM as hidden elements after charts
+   * finish, so this waits for none to be *visible* rather than for none to
+   * exist. The `:visible` engine resolves to zero elements when they are all
+   * hidden, which is what `detached` then matches — and it returns immediately
+   * when they are already settled, with no timeout penalty.
+   *
+   * Deliberately not a `getComputedStyle` check in an evaluated function:
+   * `display` does not inherit, so a loader inside a `display: none` ancestor
+   * computes to its own `display: block` and reads as visible, hanging the wait
+   * until the timeout. Playwright's visibility check accounts for ancestors.
+   *
+   * Loader absence is also the state of a dashboard that has not started
+   * rendering, which is why every caller pairs this with a wait for the content
+   * it expects.
+   */
+  private async waitForLoadersToSettle(timeout: number): Promise<void> {
+    await this.page
+      .locator(DashboardPage.SELECTORS.LOADING_INDICATOR)
+      .first()
+      .waitFor({ state: 'detached', timeout });
  }

  /**
@@ -136,14 +219,13 @@ export class DashboardPage {
   * Open the dashboard header actions menu (three-dot menu)
   */
  async openHeaderActionsMenu(): Promise<void> {
-    await this.page.click(DashboardPage.SELECTORS.DASHBOARD_MENU_TRIGGER);
+    await this.page
+      .locator(DashboardPage.SELECTORS.DASHBOARD_MENU_TRIGGER)
+      .click();
    // Wait for the dropdown menu to appear
-    await this.page.waitForSelector(
-      DashboardPage.SELECTORS.HEADER_ACTIONS_MENU,
-      {
-        state: 'visible',
-      },
-    );
+    await this.page
+      .locator(DashboardPage.SELECTORS.HEADER_ACTIONS_MENU)
+      .waitFor({ state: 'visible' });
  }

  /**
@@ -178,4 +260,198 @@ export class DashboardPage {
    await menu.selectSubmenuItem('Download', optionText);
    return downloadPromise;
  }
+
+  /**
+   * Enter dashboard edit mode and wait for the builder side pane to appear.
+   */
+  async enterEditMode(): Promise<void> {
+    const editButton = new Button(
+      this.page,
+      DashboardPage.SELECTORS.EDIT_BUTTON,
+    );
+    await editButton.click();
+    await this.page
+      .locator(DashboardPage.SELECTORS.BUILDER_PANE)
+      .waitFor({ state: 'visible' });
+  }
+
+  /**
+   * The builder side pane's tab bar (Charts / Layout elements).
+   */
+
+  /**
+   * Switch the builder side pane to one of its tabs.
+   * @param tab - 'Charts' (existing slices) or 'Layout elements' (new components)
+   */
+  private async openBuilderTab(tab: BuilderTab): Promise<void> {
+    // Scoped to `.ant-tabs` because that is the root the shared Tabs component
+    // expects.
+    const builderTabs = new Tabs(
+      this.page,
+      this.page
+        .locator(`${DashboardPage.SELECTORS.BUILDER_PANE} .ant-tabs`)
+        .first(),
+    );
+    await builderTabs.clickTab(tab);
+  }
+
+  /**
+   * Locator for chart-holder components currently placed on the grid.
+   * Markdown components are chart holders too — use
+   * {@link getMarkdownEditors} when the assertion must exclude them.
+   */
+  getChartHolders(): Locator {
+    return this.page.locator(DashboardPage.SELECTORS.CHART_HOLDER);
+  }
+
+  /**
+   * Drag an existing chart from the Charts pane onto the dashboard grid.
+   * Requires edit mode to be active.
+   * @param sliceName - The slice name to search for and drag
+   */
+  async addChartByName(sliceName: string): Promise<void> {
+    await this.openBuilderTab('Charts');
+    const search = new Input(this.page, DashboardPage.SELECTORS.CHARTS_SEARCH);
+    await search.fill(sliceName);
+    const card = this.page
+      .locator(DashboardPage.SELECTORS.CHART_CARD)
+      .filter({ hasText: sliceName })
+      .first();
+    await card.waitFor({ state: 'visible' });
+    await html5DragAndDrop(this.page, card, this.dropTarget());
+  }
+
+  /**
+   * Drag a new Layout element (by its label) onto the dashboard grid.
+   * Requires edit mode to be active.
+   * @param label - The new-component label, e.g. 'Text / Markdown'
+   */
+  async addLayoutElement(label: LayoutElementLabel): Promise<void> {
+    await this.openBuilderTab('Layout elements');
+    const source = this.page
+      .locator(DashboardPage.SELECTORS.NEW_COMPONENT)
+      .filter({ hasText: label })
+      .first();
+    await source.waitFor({ state: 'visible' });
+    await html5DragAndDrop(this.page, source, this.dropTarget());
+  }
+
+  /**
+   * The grid's empty drop target, which the grid renders while in edit mode.
+   *
+   * Only resolves while the grid is still empty. Dropping a second component
+   * needs a target relative to the already-placed one, not this.
+   */
+  private dropTarget(): Locator {
+    return this.page.locator(DashboardPage.SELECTORS.EMPTY_DROPTARGET).first();
+  }
+
+  /**
+   * Hover the first placed chart-holder and click its delete button (edit mode).
+   */
+  async deleteChartHolder(): Promise<void> {
+    const holder = this.getChartHolders().first();
+    await holder.hover();
+    const deleteButton = new Button(
+      this.page,
+      holder.locator(DashboardPage.SELECTORS.DELETE_COMPONENT),
+    );
+    await deleteButton.click();
+  }
+
+  /**
+   * Locator for markdown editor components on the grid.
+   */
+  getMarkdownEditors(): Locator {
+    return this.page.locator(DashboardPage.SELECTORS.MARKDOWN_EDITOR);
+  }
+
+  /**
+   * The rendered ace document inside a markdown component. Present only once
+   * the component has entered its editing state.
+   *
+   * Exposed as a locator rather than routed through the `AceEditor` component:
+   * that component reads and writes through `ace.edit(...)` in page context,
+   * which both bypasses the real keystroke path under test and gives up
+   * web-first retries on assertions.
+   *
+   * @param markdownEditor - A locator from {@link getMarkdownEditors}
+   */
+  getMarkdownAceContent(markdownEditor: Locator): Locator {
+    return markdownEditor.locator(DashboardPage.SELECTORS.ACE_CONTENT);
+  }
+
+  /**
+   * Ace's hidden textarea inside a markdown component — the element that
+   * receives keystrokes.
+   *
+   * @param markdownEditor - A locator from {@link getMarkdownEditors}
+   */
+  getMarkdownAceInput(markdownEditor: Locator): Locator {
+    return markdownEditor.locator(DashboardPage.SELECTORS.ACE_TEXT_INPUT);
+  }
+
+  /**
+   * Click the dashboard title, moving focus off whichever grid component holds
+   * it. Committing a markdown edit needs a click on some other element, and the
+   * title is the one that is always present regardless of what is on the grid.
+   *
+   * In edit mode the click focuses the title's input. That is a state change,
+   * not a no-op — but it edits nothing on its own, so it leaves the component
+   * under test untouched.
+   */
+  async blurToDashboardTitle(): Promise<void> {
+    await this.page
+      .locator(DashboardPage.SELECTORS.EDITABLE_TITLE)
+      .first()
+      .click();
+  }
+
+  /**
+   * Drag a grid component's bottom resize handle down by `deltaY` pixels.
+   * Requires edit mode. Uses the mouse because the resize handle is driven by
+   * `react-resizable`, which tracks real pointer movement.
+   *
+   * @param component - The grid component to resize
+   * @param deltaY - Pixels to drag downwards (positive grows the component)
+   * @returns The component's height before and after the drag
+   */
+  async resizeComponent(
+    component: Locator,
+    deltaY: number,
+  ): Promise<{ heightBefore: number; heightAfter: number }> {
+    const boxBefore = await component.boundingBox();
+    if (!boxBefore) {
+      throw new Error('Cannot resize a component that is not visible');
+    }
+
+    const handle = component
+      .locator(DashboardPage.SELECTORS.RESIZE_HANDLE_BOTTOM)
+      .last();
+    const handleBox = await handle.boundingBox();
+    if (!handleBox) {
+      throw new Error('Resize handle is not visible');
+    }
+
+    const startX = handleBox.x + handleBox.width / 2;
+    const startY = handleBox.y + handleBox.height / 2;
+    await this.page.mouse.move(startX, startY);
+    await this.page.mouse.down();
+    // Multiple steps so react-resizable sees a drag rather than a teleport.
+    await this.page.mouse.move(startX, startY + deltaY, { steps: 10 });
+    await this.page.mouse.up();
+
+    await expect
+      .poll(async () => (await component.boundingBox())?.height, {
+        message: 'Component height did not change after resize',
+      })
+      .not.toBe(boxBefore.height);
+
+    const boxAfter = await component.boundingBox();
+    if (!boxAfter) {
+      throw new Error('Component disappeared during resize');
+    }
+
+    return { heightBefore: boxBefore.height, heightAfter: boxAfter.height };
+  }
 }
@@ -76,11 +76,9 @@ test('should delete a chart with confirmation', async ({
  const deleteModal = new DeleteConfirmationModal(page);
  await deleteModal.waitForVisible();

-  // Type "DELETE" to confirm
-  await deleteModal.fillConfirmationInput('DELETE');
-
-  // Click the Delete button
-  await deleteModal.clickDelete();
+  // Confirm: types "DELETE" while the modal is destructive, and goes straight
+  // through once SOFT_DELETE makes it a recoverable archive instead.
+  await deleteModal.confirmDeletion();

  // Modal should close
  await deleteModal.waitForHidden();
@@ -237,11 +235,9 @@ test('should bulk delete multiple charts', async ({
  const deleteModal = new DeleteConfirmationModal(page);
  await deleteModal.waitForVisible();

-  // Type "DELETE" to confirm
-  await deleteModal.fillConfirmationInput('DELETE');
-
-  // Click the Delete button
-  await deleteModal.clickDelete();
+  // Confirm: types "DELETE" while the modal is destructive, and goes straight
+  // through once SOFT_DELETE makes it a recoverable archive instead.
+  await deleteModal.confirmDeletion();

  // Modal should close
  await deleteModal.waitForHidden();
--- a/Show More
+++ b/Show More