fix(databricks): support cancelling SQL Lab queries on SEA connections

Databricks queries run through the Python Connector previously had no "stop query" support. The connector's only cancellation mechanism is Cursor.cancel(), which needs a full command identifier from the same backend session; the default Thrift backend's identifier includes a secret that's never exposed via any public/documented accessor, so it can't be reconstructed on the fresh cursor Superset uses to issue cancellation. The newer, opt-in SEA (Statement Execution API) backend uses a plain statement id instead, which can be captured and reused safely, so cancellation is implemented for that case only. Co-Authored-By: Claude <noreply@anthropic.com>
2026-09-11 17:54:25 +00:00 · 2026-08-07 21:58:10 +00:00
2643 changed files with 96407 additions and 250153 deletions
@@ -79,7 +79,6 @@ github:
          - lint-check
          - cypress-matrix-required
          - dependency-review
-          - enforce-single-migration-head
          - frontend-build
          - playwright-tests-required
          - pre-commit (current)
@@ -3,7 +3,9 @@ codecov:
        after_n_builds: 4
 ignore:
  - "superset/migrations/versions/*.py"
+  - "superset-frontend/packages/superset-ui-demo/**/*"
  - "**/*.stories.tsx"
+  - "**/*.stories.jsx"
 coverage:
  status:
    project:
@@ -1,3 +1,22 @@
+# Notify all committers of DB migration changes, per SIP-59
+
+/superset/migrations/ @mistercrunch @michael-s-molina @betodealmeida @eschutho @sadpandajoe @rusackas
+
+# Notify some committers of changes in the components
+
+/superset-frontend/src/components/Select/ @michael-s-molina @geido @kgabryje
+/superset-frontend/src/components/MetadataBar/ @michael-s-molina @geido @kgabryje
+/superset-frontend/src/components/DropdownContainer/ @michael-s-molina @geido @kgabryje
+
+# Notify Helm Chart maintainers about changes in it
+
+/helm/superset/ @dpgaspar @villebro @nytai @michael-s-molina @mistercrunch @rusackas @Antonio-RiveroMartnez @hainenber
+
+# Notify E2E test maintainers of changes
+
+/superset-frontend/playwright/ @sadpandajoe @geido @eschutho @rusackas @mistercrunch
+/superset-frontend/cypress-base/ @sadpandajoe @geido @eschutho @rusackas @mistercrunch
+
 # Notify PMC members of changes to GitHub Actions

 /.github/ @villebro @geido @eschutho @rusackas @betodealmeida @nytai @mistercrunch @kgabryje @sha174n @dpgaspar @sadpandajoe @hainenber
@@ -11,19 +30,23 @@

 /.asf.yaml @villebro @geido @eschutho @rusackas @betodealmeida @nytai @mistercrunch @kgabryje @dpgaspar @sha174n @Antonio-RiveroMartnez

-# Maps are fragile and political. GeoJson edits MUST be made in the Jupyter notebook or they'll be overwritten.
+# Maps are a finicky contribution process we care about

 **/*.geojson @villebro @rusackas
 **/*.ipynb @villebro @rusackas
-/superset-frontend/plugins/plugin-chart-country-map/ @villebro @rusackas
+/superset-frontend/plugins/legacy-plugin-chart-country-map/ @villebro @rusackas
+
+# Notify translation maintainers of changes to translations
+
+/superset/translations/ @sfirke @rusackas @villebro @sadpandajoe @hainenber

 # Notify PMC members of changes to extension-related files

-/docs/developer_docs/extensions/ @michael-s-molina @villebro @rusackas
-/superset-extensions-cli/ @michael-s-molina @villebro @rusackas @sadpandajoe
-/superset/extensions/ @michael-s-molina @villebro @rusackas @sadpandajoe
-/superset-frontend/src/extensions/ @michael-s-molina @villebro @rusackas @sadpandajoe
-
-# Notify PMC members of config changes e.g. feature flags
-
-/superset/config.py @michael-s-molina @villebro @rusackas @sadpandajoe
+/docs/developer_portal/extensions/ @michael-s-molina @villebro @rusackas
+/superset-core/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje
+/superset-extensions-cli/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje
+/superset/core/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje
+/superset/extensions/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje
+/superset-frontend/src/packages/superset-core/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje
+/superset-frontend/src/core/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje
+/superset-frontend/src/extensions/ @michael-s-molina @villebro @geido @eschutho @rusackas @kgabryje
@@ -1,6 +1,6 @@
 name: Bug report
 description: Report a bug to improve Superset's stability
-labels: ["#bug"]
+labels: ["bug"]
 body:
  - type: markdown
    attributes:
@@ -1,7 +1,7 @@
 ---
 name: Cosmetic Issue
 about: Describe a cosmetic issue with CSS, positioning, layout, labeling, or similar
-labels: "#bug:cosmetic"
+labels: "cosmetic-issue"
 ---

 ## Screenshot
@@ -0,0 +1,23 @@
+name: Label Draft PRs
+on:
+  pull_request:
+    types:
+      - opened
+      - converted_to_draft
+jobs:
+  label-draft:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check if the PR is a draft
+        id: check-draft
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const isDraft = context.payload.pull_request.draft;
+            core.setOutput('isDraft', isDraft);
+      - name: Add `review:draft` Label
+        if: steps.check-draft.outputs.isDraft == 'true'
+        uses: actions-ecosystem/action-add-labels@v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          labels: "review:draft"
@@ -5,6 +5,10 @@ inputs:
    description: 'Python version to set up. Accepts a version number, "current", or "next".'
    required: true
    default: 'current'
+  cache:
+    description: 'Cache dependencies. Options: pip'
+    required: false
+    default: 'pip'
  requirements-type:
    description: 'Type of requirements to install. Options: base, development, default'
    required: false
@@ -39,31 +43,17 @@ runs:
      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
      with:
        python-version: ${{ steps.set-python-version.outputs.python-version }}
-    - name: Install uv
-      if: inputs.install-superset == 'true'
-      uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
-      with:
-        python-version: ${{ steps.set-python-version.outputs.python-version }}
-        enable-cache: true
-    - name: Update apt package lists
-      # cache-apt-pkgs-action assumes a fresh `apt-cache` index (true on GitHub-hosted
-      # runners, not on all self-hosted/custom runner images), so refresh it explicitly
-      # or package lookups silently resolve to an empty list.
-      if: inputs.install-superset == 'true'
-      shell: bash
-      run: sudo apt-get update
-    - name: Install apt packages
-      if: inputs.install-superset == 'true'
-      uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
-      with:
-        packages: libldap2-dev libsasl2-dev
-        version: 1.0
+        cache: ${{ inputs.cache }}
    - name: Install dependencies
      env:
        INPUT_INSTALL_SUPERSET: ${{ inputs.install-superset }}
        INPUT_REQUIREMENTS_TYPE: ${{ inputs.requirements-type }}
      run: |
        if [ "$INPUT_INSTALL_SUPERSET" = "true" ]; then
+          sudo apt-get update && sudo apt-get -y install libldap2-dev libsasl2-dev
+
+          pip install --upgrade pip setuptools wheel uv
+
          if [ "$INPUT_REQUIREMENTS_TYPE" = "dev" ]; then
            uv pip install --system -r requirements/development.txt
          elif [ "$INPUT_REQUIREMENTS_TYPE" = "base" ]; then
@@ -26,7 +26,7 @@ runs:

    - name: Set up QEMU
      if: ${{ inputs.build == 'true' }}
-      uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+      uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
      with:
        # Pin the binfmt image to a specific QEMU release. The default
        # (`tonistiigi/binfmt:latest`) is a moving target, and drift across
@@ -39,12 +39,12 @@ runs:

    - name: Set up Docker Buildx
      if: ${{ inputs.build == 'true' }}
-      uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

    - name: Try to login to DockerHub
      if: ${{ inputs.login-to-dockerhub == 'true' }}
      continue-on-error: true
-      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
      with:
        username: ${{ inputs.dockerhub-user }}
        password: ${{ inputs.dockerhub-token }}
@@ -5,10 +5,6 @@ updates:
    directory: "/"
    schedule:
      interval: "daily"
-    groups:
-      security:
-        applies-to: "security-updates"
-        patterns: ["*"]
    cooldown:
      default-days: 7

@@ -24,6 +20,14 @@ updates:
      - dependency-name: "@types/react-dom"
        update-types: ["version-update:semver-major"]
      - dependency-name: "react-icons"
+      # JSDOM v30 doesn't play well with Jest v30
+      # Source: https://jestjs.io/blog#known-issues
+      # GH thread: https://github.com/jsdom/jsdom/issues/3492
+      - dependency-name: "jest-environment-jsdom"
+      # `@swc/plugin-transform-imports` doesn't work with current Webpack-SWC hybrid setup
+      # See https://github.com/apache/superset/pull/37384#issuecomment-3793991389
+      # TODO: remove the plugin once Lodash usage has been migrated to a more readily tree-shakeable alternative
+      - dependency-name: "@swc/plugin-transform-imports"
      # deck.gl and luma.gl share strict peer constraints across the root and
      # plugin workspaces, and root overrides pin their transitive versions.
      # Upgrade both families together in a manually validated change.
@@ -43,13 +47,6 @@ updates:
      # as a single manual upgrade anyway. TODO: remove when Babel 8 support is viable.
      - dependency-name: "@babel/*"
        update-types: ["version-update:semver-major"]
-      # v2.0.0 renamed ZSTDDecompress to decompress and made it async, breaking
-      # the webpack dev proxy (see #38662, #39138, #39139). Dependabot reopened
-      # the same bump in #39369 after the first revert, so pin it here instead
-      # of relying on a package.json comment (package.json is JSON and can't
-      # hold comments). Remove this once the proxy code is updated to await
-      # the async decompress() API.
-      - dependency-name: "simple-zstd"
    directory: "/superset-frontend/"
    schedule:
      interval: "daily"
@@ -57,9 +54,6 @@ updates:
      - npm
      - dependabot
    groups:
-      security:
-        applies-to: "security-updates"
-        patterns: ["*"]
      rjsf:
        patterns:
          - "@rjsf/*"
@@ -79,23 +73,6 @@ updates:
        patterns:
          - "ag-grid-react"
          - "ag-grid-community"
-      swc:
-        patterns:
-          - "@swc/core"
-          - "@swc/plugin-emotion"
-          - "@swc/plugin-transform-imports"
-      jsonforms:
-        patterns:
-          - "@jsonforms/*"
-      visx:
-        patterns:
-          - "@visx/*"
-      emotion:
-        patterns:
-          - "@emotion/*"
-      fontsource:
-        patterns:
-          - "@fontsource/*"
    open-pull-requests-limit: 30
    versioning-strategy: increase
    cooldown:
@@ -114,10 +91,6 @@ updates:
    labels:
      - pip
      - dependabot
-    groups:
-      security:
-        applies-to: "security-updates"
-        patterns: ["*"]
    cooldown:
      default-days: 7

@@ -125,10 +98,6 @@ updates:
    directory: ".github/actions"
    schedule:
      interval: "daily"
-    groups:
-      security:
-        applies-to: "security-updates"
-        patterns: ["*"]
    open-pull-requests-limit: 10
    versioning-strategy: increase
    cooldown:
@@ -139,9 +108,6 @@ updates:
    schedule:
      interval: "daily"
    groups:
-      security:
-        applies-to: "security-updates"
-        patterns: ["*"]
      storybook:
        patterns:
          - "@storybook/*"
@@ -169,10 +135,6 @@ updates:
    labels:
      - npm
      - dependabot
-    groups:
-      security:
-        applies-to: "security-updates"
-        patterns: ["*"]
    versioning-strategy: increase
    cooldown:
      default-days: 7
@@ -184,29 +146,7 @@ updates:
    labels:
      - npm
      - dependabot
-    groups:
-      security:
-        applies-to: "security-updates"
-        patterns: ["*"]
    open-pull-requests-limit: 10
    versioning-strategy: increase
    cooldown:
      default-days: 7
-
-  - package-ecosystem: "npm"
-    directory: "/superset-embedded-sdk/"
-    schedule:
-      interval: "daily"
-    labels:
-      - npm
-      - dependabot
-    groups:
-      security:
-        applies-to: "security-updates"
-        patterns: ["*"]
-      babel:
-        patterns:
-          - "@babel/*"
-    versioning-strategy: increase
-    cooldown:
-      default-days: 7
@@ -29,7 +29,7 @@
 "dependencies:python":
 - changed-files:
  - any-glob-to-any-file:
-    - 'requirements/**'
+    - 'superset/requirements/**'
    - 'superset/translations/requirements.txt'
    - 'RELEASING/requirements.txt'

@@ -1,46 +0,0 @@
-# Verifies that every `uses:` ref under .github/ is on the ASF Infrastructure
-# GitHub Actions allowlist (apache/infrastructure-actions). An action that is
-# not allowlisted fails at "Set up job" with no logs and no notification, so
-# this check surfaces the problem at PR time instead. It also warns (without
-# failing) when a pinned SHA's allowlist entry is about to expire.
-name: ASF Allowlist Check
-
-on:
-  workflow_dispatch:
-  pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
-    paths:
-      - ".github/**"
-  push:
-    branches:
-      - "master"
-      - "[0-9].[0-9]*"
-    paths:
-      - ".github/**"
-  schedule:
-    # Weekly, so allowlist expirations are surfaced even when nothing under
-    # .github/ has changed.
-    - cron: "0 6 * * 1"
-
-permissions:
-  contents: read
-
-# cancel previous workflow jobs for PRs
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  asf-allowlist-check:
-    runs-on: ubuntu-26.04
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Check action refs against the ASF allowlist
-        uses: apache/infrastructure-actions/allowlist-check@df54e48ff76152790f317934c691cfa7fd7a1a46 # allowlist-check/v1.0.1
-        with:
-          # Default scan-glob is .github/**/*.yml, which misses .yaml files.
-          scan-glob: ".github/**/*.y*ml"
@@ -201,23 +201,18 @@ cypress-run-all() {
  # navigation flow under E2E. We diverge from the entrypoint on:
  #   --timeout 120: heavy dashboard import/export specs exceed the 60s
  #     default
+  #   --max-requests / --max-requests-jitter: recycle the worker under
+  #     test load to avoid leaks accumulating across the run
  #   superset.app:create_app(): explicit factory so we don't depend on
  #     FLASK_APP being exported
-  #
-  # No --max-requests, matching the entrypoint's default of 0 (recycling
-  # off). With a single worker a recycle takes the whole backend offline for
-  # the graceful-timeout drain — browser keep-alive connections hold it open
-  # for the full 30s — plus ~5s of app boot. A run issues ~3800 requests in
-  # ~8 minutes, so recycling every 500 produced seven ~35s outages per run
-  # and flaked whichever specs happened to navigate into one. Lowering
-  # --graceful-timeout is not enough: a dashboard load plus chart render
-  # needs 6-10s, which still lands inside the window.
  nohup gunicorn \
    --bind "127.0.0.1:$port" \
    --workers 1 \
    --worker-class gthread \
    --threads 20 \
    --timeout 120 \
+    --max-requests 500 \
+    --max-requests-jitter 50 \
    --access-logfile - \
    --error-logfile - \
    "superset.app:create_app()" \
@@ -299,14 +294,16 @@ playwright-run() {
  export PLAYWRIGHT_BASE_URL

  # See cypress-run-all() above for the args rationale (1 worker × 20
-  # gthread threads matching docker/entrypoints/run-server.sh, a 120s
-  # timeout for heavy E2E load, and why worker recycling is off).
+  # gthread threads matching docker/entrypoints/run-server.sh, plus a
+  # 120s timeout and request-recycling for heavy E2E load).
  nohup gunicorn \
    --bind "127.0.0.1:$port" \
    --workers 1 \
    --worker-class gthread \
    --threads 20 \
    --timeout 120 \
+    --max-requests 500 \
+    --max-requests-jitter 50 \
    --access-logfile - \
    --error-logfile - \
    "superset.app:create_app()" \
@@ -21,9 +21,6 @@ on:
  #schedule:
  #  - cron: '0 0 * * *'  # Runs daily at midnight UTC

-permissions:
-  contents: read
-
 jobs:
  bump-python-package:
    runs-on: ubuntu-slim
@@ -48,10 +45,7 @@ jobs:
          python-version: "3.11"

      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
-        with:
-          python-version: "3.11"
-          enable-cache: true
+        run: pip install uv

      - name: supersetbot bump-python -p "${{ github.event.inputs.package }}"
        env:
@@ -16,9 +16,6 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

-permissions:
-  contents: read
-
 jobs:
  check_db_migration_conflict:
    name: Check DB migration conflict
@@ -1,99 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-name: Check OpenAPI spec drift
-on:
-  push:
-    branches:
-      - "master"
-      - "[0-9].[0-9]*"
-  pull_request:
-    types: [synchronize, opened, reopened, ready_for_review]
-
-# Deliberately unfiltered by `paths`: a required check that does not run on a
-# PR blocks it from merging forever.
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  check-openapi-spec-drift:
-    runs-on: ubuntu-26.04
-    steps:
-      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Setup Python
-        uses: ./.github/actions/setup-backend/
-        with:
-          # The generated output depends on the pinned apispec version.
-          requirements-type: base
-      - name: Regenerate the spec
-        env:
-          # No config file: the spec documents what a default deployment
-          # registers, so feature flags must stay off.
-          SUPERSET__SQLALCHEMY_DATABASE_URI: "sqlite:///:memory:"
-          FLASK_APP: "superset.app:create_app()"
-        run: superset update-api-docs
-      - name: Assert the published spec is up to date
-        env:
-          SPEC: docs/static/resources/openapi.json
-        run: |
-          if git diff --quiet -- "$SPEC"; then
-            exit 0
-          fi
-
-          # Staged to a file, not piped: `head` closing the pipe would
-          # SIGPIPE-kill `git diff` under pipefail and abort this step.
-          diff_file="$RUNNER_TEMP/openapi.diff"
-          git diff -- "$SPEC" > "$diff_file"
-
-          regen="SUPERSET__SQLALCHEMY_DATABASE_URI='sqlite:///:memory:' FLASK_APP='superset.app:create_app()' superset update-api-docs"
-
-          echo "::error::$SPEC is stale. Regenerate it on the pinned requirements:"
-          echo "$regen"
-          git diff --stat -- "$SPEC"
-
-          # Summaries cap at 1 MiB, well under a full regeneration.
-          {
-            echo '### OpenAPI spec is stale'
-            echo
-            git diff --stat -- "$SPEC"
-            echo
-            echo 'Regenerate with:'
-            echo
-            echo '```bash'
-            echo "$regen"
-            echo '```'
-            echo
-            echo '```diff'
-            head -300 "$diff_file"
-            echo '```'
-            if [ "$(wc -l < "$diff_file")" -gt 300 ]; then
-              echo
-              echo '_Truncated at 300 lines; see the job log for the full diff._'
-            fi
-          } >> "$GITHUB_STEP_SUMMARY"
-
-          echo "::group::Full diff"
-          cat "$diff_file"
-          echo "::endgroup::"
-          exit 1
@@ -22,7 +22,7 @@ jobs:
  check-python-deps:
    runs-on: ubuntu-26.04
    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
        with:
          expand-composite-actions: true

@@ -14,9 +14,6 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

-permissions:
-  contents: read
-
 jobs:
  changes:
    runs-on: ubuntu-26.04
@@ -67,7 +64,7 @@ jobs:

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
        with:
          languages: ${{ matrix.language }}
          # If you wish to specify custom queries, you can do so here or in a config file.
@@ -78,6 +75,6 @@ jobs:
          # queries: security-extended,security-and-quality

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
        with:
          category: "/language:${{matrix.language}}"
@@ -50,7 +50,7 @@ jobs:
    # You cannot use a liccheck.ini file in this workflow.
    runs-on: ubuntu-slim
    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
        with:
          expand-composite-actions: true

@@ -66,27 +66,6 @@ jobs:

      - name: "Set up liccheck"
        run: |
-          # liccheck (as of 0.9.2) still does a bare `import pkg_resources`
-          # without declaring setuptools as a dependency, relying on it
-          # having historically been bundled. setuptools 81+ (installed
-          # above via requirements/base.txt) dropped the pkg_resources
-          # subpackage entirely, so liccheck's own import breaks outright.
-          #
-          # Reinstalling an older setuptools would restore pkg_resources but
-          # would also downgrade the *real* setuptools install, which then
-          # trips liccheck's own working_set.resolve() -- it cross-checks
-          # requirements/base.txt's declared `setuptools==84.0.0` against
-          # what's actually installed, and a downgrade makes those disagree.
-          #
-          # Instead, vendor just the pkg_resources/ package files from an
-          # old setuptools wheel into site-packages, leaving the real
-          # setuptools install (and its dist-info metadata) untouched. This
-          # gives liccheck an importable pkg_resources whose own working-set
-          # scan still correctly reports the real installed setuptools
-          # version, so no conflict is raised.
-          pip download "setuptools<81" --no-deps -d /tmp/old-setuptools
-          python -m zipfile -e /tmp/old-setuptools/setuptools-*.whl /tmp/old-setuptools-extracted/
-          cp -r /tmp/old-setuptools-extracted/pkg_resources "$(python -c 'import site; print(site.getsitepackages()[0])')/"
          uv pip install --system liccheck
      - name: "Run liccheck"
        run: |
@@ -51,53 +51,6 @@ jobs:
          echo "matrix_config=${MATRIX_CONFIG}" >> $GITHUB_OUTPUT
          echo $GITHUB_OUTPUT

-  # Runs unconditionally (no dependency on `changes`, and no build-preset
-  # matrix restriction) so a regression in the PY_VER override logic is
-  # always caught on PRs. Without this, the real docker-build job only runs
-  # when the change detector flags docker/python/frontend changes (a
-  # workflow-only edit like this one does not), and even then the PR build
-  # matrix never includes the "py311"/"py312" presets that logic protects -
-  # so a break here would otherwise first surface on a push to master.
-  pyver-override-check:
-    name: verify docker build PY_VER override
-    runs-on: ubuntu-26.04
-    timeout-minutes: 5
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Setup supersetbot
-        uses: ./.github/actions/setup-supersetbot/
-      - name: Assert PY_VER override applies to every preset except py311/py312
-        shell: bash
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          # Asserts against the actual buildx command line `supersetbot docker
-          # --dry-run` would run, not just this repo's own extra-flags helper,
-          # so a regression in supersetbot itself (dropping the py311/py312
-          # PY_VER pin, or reordering args so our override no longer lands
-          # last) is caught here too, instead of only surfacing on master.
-          assert_effective_py_ver() {
-            local preset="$1" expected="$2" extra_flags command actual
-            extra_flags="$(scripts/docker-build-extra-flags.sh "$preset" dummy-tag)"
-            command="$(supersetbot docker --preset "$preset" --platform linux/amd64 --extra-flags "$extra_flags" --dry-run)"
-            # docker buildx keeps the LAST value of a repeated --build-arg key.
-            actual="$(grep -oE -- '--build-arg PY_VER=[^[:space:]]+' <<<"$command" | tail -1)"
-            if [ "$actual" != "--build-arg PY_VER=$expected" ]; then
-              echo "::error::preset '$preset' expected effective --build-arg PY_VER=$expected, got: ${actual:-<none>} (full command: $command)"
-              exit 1
-            fi
-          }
-          for preset in dev lean websocket dockerize; do
-            assert_effective_py_ver "$preset" "3.11.14-slim-trixie"
-          done
-          assert_effective_py_ver py311 "3.11-slim-bookworm"
-          assert_effective_py_ver py312 "3.12-slim-bookworm"
-          echo "PY_VER override logic verified against the assembled buildx command for all build presets"
-
  docker-build:
    name: docker-build
    needs: [setup_matrix, changes]
@@ -171,21 +124,19 @@ jobs:
          # the whole job. buildx reuses the buildkit layer cache from the
          # failed attempt, so a retry mostly re-does just the failed push.
          #
-          # See scripts/docker-build-extra-flags.sh for why "py311"/"py312"
-          # are excluded from the PY_VER override applied to every other
-          # preset; that logic is also exercised on every PR by the
-          # always-on pyver-override-check job below, since this job itself
-          # only runs when the change detector flags docker/python/frontend
-          # changes and the PR build matrix never includes py311/py312.
-          EXTRA_FLAGS="$(scripts/docker-build-extra-flags.sh "$BUILD_PRESET" "$IMAGE_TAG")"
-
+          # supersetbot's "dev"/"lean" presets pin their own --build-arg
+          # PY_VER, which lands ahead of --extra-flags on the assembled
+          # buildx command line; docker/buildx keeps the last value for a
+          # repeated --build-arg key, so appending PY_VER here overrides
+          # supersetbot's pin and keeps the build on the Dockerfile's own
+          # supported Python version.
          for attempt in 1 2 3; do
            if supersetbot docker \
              $PUSH_OR_LOAD \
              --preset "$BUILD_PRESET" \
              --context "$EVENT" \
              --context-ref "$RELEASE" $FORCE_LATEST \
-              --extra-flags "$EXTRA_FLAGS" \
+              --extra-flags "--build-arg PY_VER=3.11.14-slim-trixie --build-arg INCLUDE_CHROMIUM=false --tag $IMAGE_TAG" \
              $PLATFORM_ARG; then
              break
            fi
@@ -213,29 +164,6 @@ jobs:
          docker images $IMAGE_TAG
          docker history $IMAGE_TAG

-      - name: WebSocket server smoke test
-        if: contains(fromJson('["lean", "dev"]'), matrix.build_preset)
-        shell: bash
-        run: |
-          # The realtime WebSocket server is bundled in the official image and
-          # launched via an alternate entrypoint; verify the bundled Node runtime
-          # starts it and it serves /health. (A JWT secret >= 32 bytes is required
-          # or the server refuses to start; no Redis is needed for /health.)
-          # Both presets are checked because docker-compose-non-dev.yml runs the
-          # websocket service from the dev target.
-          docker run -d --name superset-ws \
-            -e JWT_SECRET="ci-smoke-test-secret-ci-smoke-test-secret" \
-            -e PORT=8080 -p 8080:8080 \
-            "$IMAGE_TAG" /app/docker/entrypoints/run-websocket.sh
-          ok=""
-          for _ in $(seq 1 20); do
-            if curl -sf http://localhost:8080/health; then echo "ws /health OK"; ok=1; break; fi
-            sleep 2
-          done
-          docker logs superset-ws || true
-          docker rm -f superset-ws || true
-          [ "$ok" = "1" ] || { echo "::error::websocket /health did not come up"; exit 1; }
-
      - name: docker-compose sanity check
        if: matrix.build_preset == 'dev'
        shell: bash
@@ -289,10 +217,10 @@ jobs:
  actions-timeline:
    needs: [docker-build, docker-compose-image-tag]
    if: always()
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-26.04
    permissions:
      actions: read
    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
        with:
          expand-composite-actions: true
@@ -1,85 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-name: Enforce single Alembic migration head
-on:
-  push:
-    branches:
-      - "master"
-      - "[0-9].[0-9]*"
-  pull_request:
-    types: [synchronize, opened, reopened, ready_for_review]
-
-# No `paths:` filter on purpose: this job is a required status check, and a
-# required check that never runs for a given PR blocks that PR from merging
-# forever. It has to fire on every PR so it always reports a status; whether
-# migrations changed is decided inside the job, not the trigger.
-
-# cancel previous workflow jobs for PRs
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  enforce-single-migration-head:
-    runs-on: ubuntu-26.04
-    permissions:
-      contents: read
-      pull-requests: read
-    steps:
-      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Check for migration file changes
-        id: check
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ github.token }}
-          script: |
-            if (context.eventName === 'push') {
-              core.setOutput('changed', 'true');
-              return;
-            }
-            const files = await github.paginate(github.rest.pulls.listFiles, {
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: context.issue.number,
-            });
-            const changed = files.some((f) => f.filename.startsWith('superset/migrations/'));
-            core.setOutput('changed', String(changed));
-      - name: Setup Python
-        if: steps.check.outputs.changed == 'true'
-        uses: ./.github/actions/setup-backend/
-        with:
-          requirements-type: base
-      - name: Assert a single Alembic head
-        if: steps.check.outputs.changed == 'true'
-        env:
-          SUPERSET__SQLALCHEMY_DATABASE_URI: "sqlite:///:memory:"
-        run: |
-          heads="$(superset db heads)"
-          echo "$heads"
-          head_count=$(printf '%s\n' "$heads" | grep -c .)
-          if [ "$head_count" -ne 1 ]; then
-            echo "::error::superset/migrations resolves to $head_count Alembic heads (expected exactly 1)."
-            echo "Another migration already landed with the same down_revision this branch was cut from."
-            echo "Add a no-op merge revision joining the heads: https://superset.apache.org/docs/contributing/development#merging-db-migrations"
-            exit 1
-          fi
@@ -1,136 +0,0 @@
-name: Frontend bundle size (nightly baseline + analyzer)
-
-# Refreshes the bundle-size baseline that superset-frontend.yml's `bundle-size`
-# job compares PRs against, and publishes a browsable bundle-analyzer treemap
-# report of the same build. Deliberately NOT triggered on every push to
-# master: a day-old baseline/report is fine for catching relative
-# regressions on PRs and for browsing what's actually in the bundle, and
-# building the production bundle on every one of the many pushes master
-# gets per day would burn CI time for no benefit a nightly refresh doesn't
-# already cover.
-on:
-  schedule:
-    - cron: "0 6 * * *"
-  workflow_dispatch: {}
-
-concurrency:
-  group: ${{ github.workflow }}
-  cancel-in-progress: true
-
-env:
-  TAG: apache/superset:bundle-size-nightly-${{ github.run_id }}
-
-permissions:
-  contents: read
-
-jobs:
-  refresh-baseline:
-    runs-on: ubuntu-26.04
-    timeout-minutes: 30
-    env:
-      NETLIFY_SITE_ID: ${{ secrets.NETLIFY_BUNDLE_ANALYZER_SITE_ID }}
-    steps:
-      - name: "Checkout master"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-          ref: master
-
-      - name: Build Docker Image
-        run: |
-          docker buildx build \
-            -t $TAG \
-            --cache-from=type=registry,ref=apache/superset-cache:3.11-slim-trixie \
-            --target superset-node-ci \
-            .
-
-      # Same cache the PR-time bundle-size job restores/writes -- webpack's
-      # persistent filesystem cache turns a warm production build into ~20s
-      # instead of several minutes. See superset-frontend.yml for the
-      # matching restore step and why it's keyed this way.
-      - name: Restore webpack build cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: superset-frontend/.temp_cache
-          key: >-
-            webpack-prod-cache-${{ hashFiles('superset-frontend/package-lock.json',
-            'superset-frontend/babel.config.js', 'superset-frontend/tsconfig.json',
-            'superset-frontend/webpack.config.js') }}
-
-      # Only ever pull the last recorded data point off the cache, keyed by
-      # run ID -- `restore-keys` prefix-matches the most recently created
-      # entry. Absent on the very first run ever; benchmark-action starts a
-      # fresh history in that case.
-      - name: Restore bundle size history
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: bundle-size-history.json
-          key: bundle-size-history-${{ github.run_id }}
-          restore-keys: |
-            bundle-size-history-
-
-      # BUNDLE_ANALYZER rides along in the same build as BUNDLE_SIZE_STATS --
-      # they're independent env-gated additions in webpack.config.js (one
-      # sets `config.stats`, the other pushes plugins), so one production
-      # build produces both the numeric stats.json and the analyzer's
-      # report.html. Only report.html is mounted out, not
-      # BUNDLE_ANALYZER's sibling `statistics.html` sunburst -- that file is
-      # documented in webpack.config.js as routinely exceeding 100MB for
-      # this app (it's .gitignore'd for exactly that reason), too large to
-      # publish as a static site page.
-      - name: Build production bundle with stats and analyzer report
-        run: |
-          mkdir -p ${{ github.workspace }}/superset-frontend/bundle-stats
-          mkdir -p ${{ github.workspace }}/superset-frontend/.temp_cache
-          mkdir -p ${{ github.workspace }}/superset/static/assets
-          docker run \
-          -v ${{ github.workspace }}/superset-frontend/bundle-stats:/app/superset-frontend/bundle-stats \
-          -v ${{ github.workspace }}/superset-frontend/.temp_cache:/app/superset-frontend/.temp_cache \
-          -v ${{ github.workspace }}/superset/static/assets:/app/superset/static/assets \
-          --rm $TAG \
-          bash -c \
-          "npm i && BUNDLE_SIZE_STATS=true BUNDLE_ANALYZER=true npm run build -- --json=bundle-stats/stats.json"
-
-      - name: Summarize bundle size
-        run: |
-          node superset-frontend/scripts/bundle-size-summary.js \
-            superset-frontend/bundle-stats/stats.json > bundle-size-summary.json
-          rm -rf superset-frontend/bundle-stats
-
-      # No PR to comment on here, so comment-on-alert is off -- the job
-      # summary (summary-always) is the only surface for this run.
-      - name: Update bundle size baseline
-        uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1
-        with:
-          tool: customSmallerIsBetter
-          output-file-path: bundle-size-summary.json
-          external-data-json-path: bundle-size-history.json
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          fail-on-alert: false
-          summary-always: true
-
-      - name: Save bundle size history
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: bundle-size-history.json
-          key: bundle-size-history-${{ github.run_id }}
-
-      # Publishes the treemap to Netlify (the same host already used for
-      # superset-storybook.netlify.app and docs previews, reusing the
-      # existing NETLIFY_AUTH_TOKEN). Skipped until
-      # NETLIFY_BUNDLE_ANALYZER_SITE_ID exists -- create a new (free)
-      # Netlify site named superset-bundle-analyzer and add its site ID as
-      # that secret to turn this on; nothing else in this workflow depends
-      # on it.
-      - name: Publish bundle analyzer report to Netlify
-        if: ${{ env.NETLIFY_SITE_ID != '' }}
-        env:
-          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
-        run: |
-          mkdir -p netlify-publish
-          cp superset/static/assets/report.html netlify-publish/index.html
-          # zizmor: ignore[adhoc-packages] - netlify-cli is a one-shot CI deploy
-          # tool, not an application dependency; a global/npx install has no
-          # lockfile context. Version pinned above the floor set by other
-          # ad-hoc installs in this repo (bump deliberately when upgrading).
-          npx --yes netlify-cli@27.0.1 deploy --prod --dir=netlify-publish
@@ -37,7 +37,7 @@ jobs:
          persist-credentials: false
          submodules: recursive
      - name: Setup Java
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
        with:
          distribution: "temurin"
          java-version: "11"
@@ -19,7 +19,7 @@ concurrency:

 jobs:
  validate-all-ghas:
-    runs-on: ubuntu-26.04 # Don't switch to ubuntu-slim as zizmore-action requires Docker
+    runs-on: ubuntu-26.04
    permissions:
      contents: read
      # Required for the zizmor action to upload its SARIF results to
@@ -34,7 +34,7 @@ jobs:
      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
-          node-version-file: "./superset-frontend/.nvmrc"
+          node-version: "20"

      - name: Install Dependencies
        # Versions are pinned to avoid ad-hoc, unpinned package installs.
@@ -45,8 +45,5 @@ jobs:
      - name: Run Script
        run: bash .github/workflows/github-action-validator.sh

-      - name: Test docs-deploy freshness gate
-        run: bash .github/workflows/scripts/check-docs-deploy-freshness.test.sh
-
      - name: Check for security issues on GHA workflows
-        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
+        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
@@ -26,7 +26,7 @@ jobs:
  cancel-on-hold:
    name: Cancel CI runs when hold label applied
    if: github.event.action == 'labeled' && startsWith(github.event.label.name, 'hold')
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-26.04
    permissions:
      actions: write
      pull-requests: read
@@ -69,7 +69,7 @@ jobs:
  rerun-on-unhold:
    name: Re-run CI when hold label removed
    if: github.event.action == 'unlabeled' && startsWith(github.event.label.name, 'hold')
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-24.04
    permissions:
      actions: write
      pull-requests: read
@@ -7,9 +7,6 @@ on:
  pull_request:
    types: [opened, edited]

-permissions:
-  contents: read
-
 jobs:
  superbot-orglabel:
    runs-on: ubuntu-slim
@@ -7,9 +7,6 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

-permissions:
-  contents: read
-
 jobs:
  labeler:
    permissions:
@@ -0,0 +1,39 @@
+name: Tags
+on:
+  release:
+    types: [published] # This makes it run only when a new released is published
+
+jobs:
+  latest-release:
+    name: Add/update tag to new release
+    runs-on: ubuntu-slim
+    permissions:
+      contents: write
+
+    steps:
+      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          submodules: recursive
+
+      - name: Check for latest tag
+        id: latest-tag
+        env:
+          RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
+        run: |
+          source ./scripts/tag_latest_release.sh "$RELEASE_TAG_NAME" --dry-run
+
+      - name: Configure Git
+        run: |
+          git config user.name "$GITHUB_ACTOR"
+          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+
+      - name: Run latest-tag
+        uses: ./.github/actions/latest-tag
+        if: steps.latest-tag.outputs.SKIP_TAG != 'true'
+        with:
+          description: Superset latest release
+          tag-name: latest
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
@@ -23,7 +23,7 @@ jobs:
          persist-credentials: false
          submodules: recursive
      - name: Setup Java
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
        with:
          distribution: "temurin"
          java-version: "11"
@@ -93,7 +93,7 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Copy image to GHCR
        env:
@@ -19,9 +19,6 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: false

-permissions:
-  contents: read
-
 jobs:
  lint-check:
    runs-on: ubuntu-slim
@@ -53,15 +53,6 @@ jobs:
      - name: Install helm-docs
        run: go install github.com/norwoodj/helm-docs/cmd/helm-docs@v1.14.2

-      # Spike: run the existing .pre-commit-config.yaml through prek (a Rust
-      # reimplementation of pre-commit) instead of pre-commit itself, to see
-      # whether it's viable to speed up this job. CI-only — contributors keep
-      # installing/running `pre-commit` locally exactly as documented; nothing
-      # here changes that.
-      - name: Install prek
-        run: |
-          curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.11/prek-installer.sh | sh
-
      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
@@ -79,13 +70,13 @@ jobs:
          cd docs
          yarn install --immutable

-      - name: Cache prek environments
+      - name: Cache pre-commit environments
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
-          path: ~/.cache/prek
-          key: prek-v1-${{ runner.os }}-py${{ matrix.python-version }}-${{ hashFiles('.pre-commit-config.yaml') }}
+          path: ~/.cache/pre-commit
+          key: pre-commit-v2-${{ runner.os }}-py${{ matrix.python-version }}-${{ hashFiles('.pre-commit-config.yaml') }}
          restore-keys: |
-            prek-v1-${{ runner.os }}-py${{ matrix.python-version }}-
+            pre-commit-v2-${{ runner.os }}-py${{ matrix.python-version }}-

      - name: Determine changed files
        id: changed_files
@@ -151,7 +142,7 @@ jobs:
            } >> "$GITHUB_OUTPUT"
          fi

-      - name: pre-commit (via prek)
+      - name: pre-commit
        env:
          MODE: ${{ steps.changed_files.outputs.mode }}
          CHANGED_FILES: ${{ steps.changed_files.outputs.files }}
@@ -161,22 +152,22 @@ jobs:

          case "${MODE}" in
            all)
-              echo "ℹ️ Running prek on all files."
-              prek run --all-files
+              echo "ℹ️ Running pre-commit on all files."
+              pre-commit run --all-files
              ;;
            files)
-              echo "ℹ️ Running prek on changed files:"
+              echo "ℹ️ Running pre-commit on changed files:"
              echo "${CHANGED_FILES}"
              # shellcheck disable=SC2086
-              prek run --files ${CHANGED_FILES}
+              pre-commit run --files ${CHANGED_FILES}
              ;;
            none)
-              echo "ℹ️ No source files changed; nothing for prek to check."
+              echo "ℹ️ No source files changed; nothing for pre-commit to check."
              exit 0
              ;;
            *)
              echo "⚠️ Unrecognized changed-files mode '${MODE}'; checking all files."
-              prek run --all-files
+              pre-commit run --all-files
              ;;
          esac
          PRE_COMMIT_EXIT_CODE=$?
@@ -202,8 +193,8 @@ jobs:
  actions-timeline:
    needs: pre-commit
    if: always()
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-26.04
    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
        with:
          expand-composite-actions: true
@@ -108,18 +108,8 @@ jobs:
          fetch-depth: 0
          persist-credentials: false

-      # Keep workflow tooling on the triggering revision. Release tags can
-      # contain action pins that no longer satisfy the repository allowlist.
-      - name: Checkout workflow actions
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.sha }}
-          path: workflow-source
-          persist-credentials: false
-          sparse-checkout: .github/actions
-
      - name: Setup Docker Environment
-        uses: ./workflow-source/.github/actions/setup-docker
+        uses: ./.github/actions/setup-docker
        with:
          dockerhub-user: ${{ secrets.DOCKERHUB_USER }}
          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -132,7 +122,7 @@ jobs:
          node-version: 20

      - name: Setup supersetbot
-        uses: ./workflow-source/.github/actions/setup-supersetbot/
+        uses: ./.github/actions/setup-supersetbot/

      - name: Rebuild and push
        env:
@@ -181,7 +171,7 @@ jobs:
            --repo "$REPOSITORY" \
            --title "Scheduled Docker image refresh failed for ${LATEST_RELEASE}" \
            --label "infra:container" \
-            --label "#bug" \
+            --label "bug" \
            --body "The weekly Docker base-image refresh failed for release \`${LATEST_RELEASE}\`. Published images may be missing upstream base-layer security patches until this is resolved.

          Failed run: ${RUN_URL}"
@@ -1,49 +0,0 @@
-#!/bin/bash
-#
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# Shared freshness gate used by the Docs Deployment workflow
-# (superset-docs-deploy.yml) both up front (check-freshness) and again right
-# before the deploy step (recheck-freshness). Writes an output declaring
-# whether BUILD_SHA is still master's current tip, so a superseded run can
-# skip cleanly instead of racing (and clobbering, or being force-cancelled
-# by) a fresher run.
-#
-# Required env vars:
-#   BUILD_SHA     - the commit SHA this run is building
-#   REPO          - "owner/repo" to query, e.g. github.repository
-#   OUTPUT_NAME   - the GITHUB_OUTPUT key to write, e.g. "is-current"
-#   GITHUB_OUTPUT - path to append outputs to (set by the Actions runner)
-# Optional env vars:
-#   EVENT_NAME    - if "workflow_dispatch", bypasses the check and always
-#                   reports current, since a manual dispatch is a deliberate,
-#                   one-off action rather than something racing other triggers
-#   GH_TOKEN      - passed through to `gh`, needed to call the GitHub API
-
-set -euo pipefail
-
-if [ "${EVENT_NAME:-}" = "workflow_dispatch" ]; then
-  echo "${OUTPUT_NAME}=true" >>"$GITHUB_OUTPUT"
-  exit 0
-fi
-
-latest_sha="$(gh api "repos/${REPO}/commits/master" --jq .sha)"
-if [ "${latest_sha}" = "${BUILD_SHA}" ]; then
-  echo "${OUTPUT_NAME}=true" >>"$GITHUB_OUTPUT"
-else
-  echo "${OUTPUT_NAME}=false" >>"$GITHUB_OUTPUT"
-  echo "::notice::master has moved on to ${latest_sha} since ${BUILD_SHA} was triggered — skipping this stale run."
-fi
@@ -1,100 +0,0 @@
-#!/bin/bash
-#
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# Exercises check-docs-deploy-freshness.sh against a stubbed `gh`, covering
-# the dispatch-bypass, current-tip and stale-tip branches so the output
-# contract (is-current / still-current) can't silently regress. Run
-# directly, no extra tooling required:
-#   bash .github/workflows/scripts/check-docs-deploy-freshness.test.sh
-
-set -euo pipefail
-
-script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-script_under_test="${script_dir}/check-docs-deploy-freshness.sh"
-
-failures=0
-
-# Runs the script under test with a stubbed `gh` reporting $1 as master's
-# latest sha, asserting that GITHUB_OUTPUT ends up containing exactly $4.
-run_case() {
-  local case_name="$1"
-  local latest_sha="$2"
-  local build_sha="$3"
-  local event_name="$4"
-  local expected_line="$5"
-
-  local workdir
-  workdir="$(mktemp -d)"
-  trap 'rm -rf "${workdir}"' RETURN
-
-  # Fake `gh` that just echoes back the requested "latest" sha regardless of
-  # arguments, so the script under test never touches the network.
-  cat >"${workdir}/gh" <<EOF
-#!/bin/bash
-echo '${latest_sha}'
-EOF
-  chmod +x "${workdir}/gh"
-
-  local output_file="${workdir}/github_output"
-  : >"${output_file}"
-
-  if PATH="${workdir}:${PATH}" \
-    GITHUB_OUTPUT="${output_file}" \
-    OUTPUT_NAME="is-current" \
-    REPO="apache/superset" \
-    BUILD_SHA="${build_sha}" \
-    EVENT_NAME="${event_name}" \
-    GH_TOKEN="fake-token" \
-    bash "${script_under_test}"; then
-    :
-  else
-    echo "FAIL (${case_name}): script exited non-zero"
-    failures=$((failures + 1))
-    return
-  fi
-
-  local actual
-  actual="$(cat "${output_file}")"
-  if [ "${actual}" = "${expected_line}" ]; then
-    echo "PASS (${case_name})"
-  else
-    echo "FAIL (${case_name}): expected '${expected_line}', got '${actual}'"
-    failures=$((failures + 1))
-  fi
-}
-
-# `gh` prints "should-not-be-called" for the dispatch case above the trick:
-# it's never actually invoked since the bypass short-circuits before the
-# `gh api` call, but the fake still needs a body.
-run_case "workflow_dispatch bypasses the check" \
-  "unused" "abc123" "workflow_dispatch" \
-  "is-current=true"
-
-run_case "build sha matches master's tip" \
-  "abc123" "abc123" "push" \
-  "is-current=true"
-
-run_case "build sha is stale" \
-  "def456" "abc123" "push" \
-  "is-current=false"
-
-if [ "${failures}" -gt 0 ]; then
-  echo "${failures} case(s) failed"
-  exit 1
-fi
-
-echo "All cases passed"
@@ -17,9 +17,6 @@ env:
  GITHUB_ORG: ${{ github.repository_owner }}
  GITHUB_REPO: ${{ github.event.repository.name }}

-permissions:
-  contents: read
-
 jobs:
  cleanup-expired:
    name: Clean up expired showtime environments
@@ -26,9 +26,6 @@ env:
  GITHUB_REPO: ${{ github.event.repository.name }}
  GITHUB_ACTOR: ${{ github.actor }}

-permissions:
-  contents: read
-
 jobs:
  sync:
    name: 🎪 Sync PR to desired state
@@ -41,7 +41,7 @@ jobs:
        ports:
          - 16379:6379
    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
        with:
          expand-composite-actions: true

@@ -18,6 +18,16 @@ on:

  workflow_dispatch: {}

+# Serialize deploys: the action pushes to apache/superset-site without
+# rebasing, so concurrent runs race on the final push and the loser fails
+# with `! [rejected] asf-site -> asf-site (fetch first)`. Cancel any
+# in-progress run as soon as a newer one starts — the destination repo
+# isn't touched until the final push step, so canceling mid-build is safe,
+# and the freshest content always wins.
+concurrency:
+  group: docs-deploy-asf-site
+  cancel-in-progress: true
+
 permissions:
  contents: read
  actions: read
@@ -38,71 +48,19 @@ jobs:

        env:
          SUPERSET_SITE_BUILD: ${{ (secrets.SUPERSET_SITE_BUILD != '' && secrets.SUPERSET_SITE_BUILD != '') || '' }}
-
-  # Master gets frequent, sometimes bursty pushes, and each one can trigger a
-  # deploy attempt. Rather than let every superseded attempt get force-killed
-  # by the build-deploy concurrency group below (which shows up as a
-  # `cancelled` — i.e. red/failing-looking — check on that commit), have each
-  # run check up front whether it's still building master's current tip and,
-  # if not, skip cleanly. Deliberately outside the docs-deploy-asf-site
-  # concurrency group so it runs immediately for every trigger without
-  # blocking or being blocked by anything.
-  check-freshness:
-    runs-on: ubuntu-26.04
-    outputs:
-      is-current: ${{ steps.check.outputs.is-current }}
-    steps:
-      # Sparse checkout: this job's only job is to be fast, so it fetches
-      # nothing but the freshness-check script itself.
-      - name: Checkout freshness-check script
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-          sparse-checkout: |
-            .github/workflows/scripts
-          sparse-checkout-cone-mode: false
-      - name: "Check whether this is still master's current commit"
-        id: check
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          BUILD_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
-          EVENT_NAME: ${{ github.event_name }}
-          REPO: ${{ github.repository }}
-          OUTPUT_NAME: is-current
-        run: .github/workflows/scripts/check-docs-deploy-freshness.sh
-
  build-deploy:
-    needs: [config, check-freshness]
-    # Only the run for master's current tip proceeds; anything superseded
-    # already skipped at check-freshness above instead of landing here.
+    needs: config
    # For workflow_run triggers, only deploy when the triggering run originated
    # from this repository (not a fork), ensuring the checked-out code and any
    # local actions executed with deploy credentials are trusted.
    if: >-
      needs.config.outputs.has-secrets &&
-      needs.check-freshness.outputs.is-current == 'true' &&
      (github.event_name != 'workflow_run' ||
       github.event.workflow_run.head_repository.full_name == github.repository)
    name: Build & Deploy
    runs-on: ubuntu-26.04
-    # Serialize deploys: the action pushes to apache/superset-site without
-    # rebasing, so concurrent runs race on the final push and the loser fails
-    # with `! [rejected] asf-site -> asf-site (fetch first)`. Queue instead of
-    # canceling: a run that already passed check-freshness can still be
-    # sitting in the queue for a runner when a newer run starts and finishes
-    # first. cancel-in-progress would let that stale, queued run kill the
-    # newer run's in-progress deploy the moment it's finally scheduled, and
-    # then skip itself at the re-check below — losing the deploy entirely.
-    # Queuing means the stale run just waits its turn and then no-ops at the
-    # re-check, so the fresher content that already deployed is never
-    # clobbered or lost. The check-freshness gate above means it should be
-    # rare for more than one run to reach this point, so the queue stays
-    # short in practice.
-    concurrency:
-      group: docs-deploy-asf-site
-      cancel-in-progress: false
    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
        with:
          expand-composite-actions: true

@@ -118,16 +76,12 @@ jobs:
          node-version-file: "./docs/.nvmrc"
      - name: Setup Python
        uses: ./.github/actions/setup-backend/
-      - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
        with:
          distribution: "zulu"
          java-version: "21"
      - name: Install Graphviz
-        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
-        with:
-          packages: graphviz
-          version: 1.0
-          execute_install_scripts: true
+        run: sudo apt-get install -y graphviz
      - name: Compute Entity Relationship diagram (ERD)
        env:
          SUPERSET_SECRET_KEY: not-a-secret
@@ -141,7 +95,7 @@ jobs:
          yarn install --check-cache
      - name: Download database diagnostics (if triggered by integration tests)
        if: github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success'
-        uses: dawidd6/action-download-artifact@d63b86af1b34672e53c440b1b83979861906bad7 # v24
+        uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21
        continue-on-error: true
        with:
          workflow: superset-python-integrationtest.yml
@@ -150,7 +104,7 @@ jobs:
          path: docs/src/data/
      - name: Try to download latest diagnostics (for push/dispatch triggers)
        if: github.event_name != 'workflow_run'
-        uses: dawidd6/action-download-artifact@d63b86af1b34672e53c440b1b83979861906bad7 # v24
+        uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21
        continue-on-error: true
        with:
          workflow: superset-python-integrationtest.yml
@@ -172,24 +126,7 @@ jobs:
        working-directory: docs
        run: |
          yarn build
-      # The check-freshness job above narrows the window but doesn't close it: an
-      # older run can observe is-current=true, then sit through this build while a
-      # newer run's own freshness check also passes and it deploys and finishes
-      # first. If this (stale) run then wins entry into the concurrency group, it
-      # would overwrite the newer content that already deployed. Re-check right
-      # before the one step that actually mutates superset-site, so a stale run
-      # skips deploying instead of clobbering a fresher one that already ran.
-      - name: "Re-check freshness immediately before deploying"
-        id: recheck-freshness
-        if: github.event_name != 'workflow_dispatch'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          BUILD_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
-          REPO: ${{ github.repository }}
-          OUTPUT_NAME: still-current
-        run: .github/workflows/scripts/check-docs-deploy-freshness.sh
      - name: deploy docs
-        if: github.event_name == 'workflow_dispatch' || steps.recheck-freshness.outputs.still-current == 'true'
        uses: ./.github/actions/github-action-push-to-another-repository
        env:
          API_TOKEN_GITHUB: ${{ secrets.SUPERSET_SITE_BUILD }}
@@ -140,7 +140,7 @@ jobs:
        run: |
          yarn install --check-cache
      - name: Download database diagnostics from integration tests
-        uses: dawidd6/action-download-artifact@d63b86af1b34672e53c440b1b83979861906bad7 # v24
+        uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21
        with:
          workflow: superset-python-integrationtest.yml
          run_id: ${{ github.event.workflow_run.id }}
@@ -26,9 +26,6 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

-permissions:
-  contents: read
-
 jobs:
  changes:
    runs-on: ubuntu-26.04
@@ -78,14 +75,14 @@ jobs:
      USE_DASHBOARD: ${{ github.event.inputs.use_dashboard == 'true' || 'false' }}
    services:
      postgres:
-        image: ghcr.io/apache/superset/ci/postgres:17-alpine
+        image: postgres:17-alpine
        env:
          POSTGRES_USER: superset
          POSTGRES_PASSWORD: superset
        ports:
          - 15432:5432
      redis:
-        image: ghcr.io/apache/superset/ci/redis:7-alpine
+        image: redis:7-alpine
        ports:
          - 16379:6379
    steps:
@@ -168,10 +165,7 @@ jobs:
    needs: changes
    if: needs.changes.outputs.python == 'true' || needs.changes.outputs.frontend == 'true'
    runs-on: ubuntu-26.04
-    # Embedded Tests below adds its own gunicorn boot + spec run on top of
-    # Required and Soft-delete; 30m was tight even for the two-step shadow
-    # job this replaced.
-    timeout-minutes: 40
+    timeout-minutes: 30
    permissions:
      contents: read
      pull-requests: read
@@ -179,10 +173,7 @@ jobs:
      fail-fast: false
      matrix:
        browser: ["chromium"]
-        # Subdirectory deployment (APPLICATION_ROOT) is a required-to-pass
-        # dimension, not an optional one, so it runs on every event —
-        # unlike cypress-matrix above, which only widens on push.
-        app_root: ["", "/app/prefix"]
+        app_root: ${{ github.event_name == 'push' && fromJSON('["", "/app/prefix"]') || fromJSON('[""]') }}
    env:
      SUPERSET_ENV: development
      SUPERSET_CONFIG: tests.integration_tests.superset_test_config
@@ -192,14 +183,14 @@ jobs:
      GITHUB_TOKEN: ${{ github.token }}
    services:
      postgres:
-        image: ghcr.io/apache/superset/ci/postgres:17-alpine
+        image: postgres:17-alpine
        env:
          POSTGRES_USER: superset
          POSTGRES_PASSWORD: superset
        ports:
          - 15432:5432
      redis:
-        image: ghcr.io/apache/superset/ci/redis:7-alpine
+        image: redis:7-alpine
        ports:
          - 16379:6379
    steps:
@@ -272,25 +263,14 @@ jobs:
          # Scoped to this step: each playwright-run boots its own gunicorn
          # with the step's env, so the Required Tests server above keeps
          # master's Flask configuration while this one runs with SOFT_DELETE
-          # on — the same isolation pattern as the Embedded Tests step below.
-          # Without a flag-on server the recently-archived specs skip
-          # themselves everywhere and ship zero executed E2E coverage; in the
-          # Required run above they are collected and skipped, which is
-          # expected.
+          # on — the same isolation pattern as the Embedded step in
+          # superset-playwright.yml. Without a flag-on server the
+          # recently-archived specs skip themselves everywhere and ship zero
+          # executed E2E coverage; in the Required run above they are
+          # collected and skipped, which is expected.
          SUPERSET_FEATURE_SOFT_DELETE: "true"
        with:
          run: playwright-run "${{ matrix.app_root }}" recently-archived/
-      - name: Run Playwright (Embedded Tests)
-        uses: ./.github/actions/cached-dependencies
-        env:
-          NODE_OPTIONS: "--max-old-space-size=4096"
-          # Scoped to this step for the same reason as Soft-delete above:
-          # embedding is a real, required feature, so its Playwright coverage
-          # now gates merges instead of running only in shadow mode.
-          SUPERSET_FEATURE_EMBEDDED_SUPERSET: "true"
-          INCLUDE_EMBEDDED: "true"
-        with:
-          run: playwright-run "${{ matrix.app_root }}" embedded
      - name: Set safe app root
        if: failure()
        id: set-safe-app-root
@@ -371,10 +351,10 @@ jobs:
  actions-timeline:
    needs: [cypress-matrix, playwright-tests, cypress-matrix-required, playwright-tests-required]
    if: always()
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-26.04
    permissions:
      actions: read
    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
        with:
          expand-composite-actions: true
@@ -74,8 +74,8 @@ jobs:
  actions-timeline:
    needs: test-superset-extensions-cli-package
    if: always()
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-26.04
    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
        with:
          expand-composite-actions: true
@@ -97,7 +97,6 @@ jobs:
          mkdir -p ${{ github.workspace }}/superset-frontend/coverage
          docker run \
          -v ${{ github.workspace }}/superset-frontend/coverage:/app/superset-frontend/coverage \
-          -e CI=true \
          --rm $TAG \
          bash -c \
          "npm run test -- --coverage --shard=${{ matrix.shard }}/8 --coverageReporters=json"
@@ -111,7 +110,7 @@ jobs:
  report-coverage:
    needs: [sharded-jest-tests]
    if: needs.frontend-build.outputs.should-run == 'true'
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-26.04
    timeout-minutes: 15
    permissions:
      id-token: write
@@ -183,6 +182,11 @@ jobs:
          docker run --rm $TAG bash -c \
          "npm ls --all --package-lock-only --depth=0 --json > /dev/null"

+      - name: Build Plugins Packages
+        run: |
+          docker run --rm $TAG bash -c \
+          "npm run plugins:build"
+
  test-storybook:
    needs: frontend-build
    if: needs.frontend-build.outputs.should-run == 'true'
@@ -206,107 +210,10 @@ jobs:
  actions-timeline:
    needs: [report-coverage, lint-frontend, validate-frontend, test-storybook]
    if: always()
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-26.04
    permissions:
      actions: read
    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
        with:
          expand-composite-actions: true
-
-  # Compares a PR's own bundle size against the last nightly-recorded
-  # baseline (see frontend-bundle-size-nightly.yml, which owns actually
-  # persisting new baselines). PR-only: a push to master doesn't need this
-  # check re-run against itself, and re-persisting the baseline on every
-  # push to master -- which happens many times a day -- would burn a full
-  # production build for no benefit nightly refresh doesn't already cover.
-  bundle-size:
-    needs: frontend-build
-    if: needs.frontend-build.outputs.should-run == 'true' && github.event_name == 'pull_request'
-    runs-on: ubuntu-26.04
-    timeout-minutes: 15
-    permissions:
-      contents: read
-      pull-requests: write
-    steps:
-      - name: Checkout Code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
-
-      - name: Download Docker Image Artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: docker-image
-
-      - name: Load Docker Image
-        run: |
-          zstd -d < docker-image.tar.zst | docker load
-
-      # webpack's persistent filesystem cache (superset-frontend/webpack.config.js)
-      # turns a warm production build into ~20s instead of several minutes,
-      # but GH-hosted runners are fresh VMs with nothing carried over between
-      # jobs -- without restoring it explicitly, every single PR would pay
-      # the full cold-build cost. Keyed on the same files webpack's own
-      # `buildDependencies` invalidates on, so a stale cache is never used.
-      - name: Restore webpack build cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: superset-frontend/.temp_cache
-          key: >-
-            webpack-prod-cache-${{ hashFiles('superset-frontend/package-lock.json',
-            'superset-frontend/babel.config.js', 'superset-frontend/tsconfig.json',
-            'superset-frontend/webpack.config.js') }}
-
-      # Only ever pull the last recorded data point off the cache, keyed by
-      # run ID -- `restore-keys` prefix-matches the most recently created
-      # entry, which is always the latest nightly run. Absent before the
-      # first nightly run ever happens; benchmark-action starts a fresh
-      # history in that case.
-      - name: Restore bundle size history
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: bundle-size-history.json
-          key: bundle-size-history-${{ github.run_id }}
-          restore-keys: |
-            bundle-size-history-
-
-      - name: Build production bundle with stats
-        run: |
-          mkdir -p ${{ github.workspace }}/superset-frontend/bundle-stats
-          mkdir -p ${{ github.workspace }}/superset-frontend/.temp_cache
-          docker run \
-          -v ${{ github.workspace }}/superset-frontend/bundle-stats:/app/superset-frontend/bundle-stats \
-          -v ${{ github.workspace }}/superset-frontend/.temp_cache:/app/superset-frontend/.temp_cache \
-          --rm $TAG \
-          bash -c \
-          "npm i && BUNDLE_SIZE_STATS=true npm run build -- --json=bundle-stats/stats.json"
-
-      - name: Summarize bundle size
-        run: |
-          node superset-frontend/scripts/bundle-size-summary.js \
-            superset-frontend/bundle-stats/stats.json > bundle-size-summary.json
-          rm -rf superset-frontend/bundle-stats
-
-      # Comparison + alert only -- this job never persists. See
-      # frontend-bundle-size-nightly.yml for why.
-      #
-      # comment-on-alert is gated to same-repo PRs: on a fork PR,
-      # GITHUB_TOKEN is forced read-only regardless of the `permissions`
-      # block above, so once the alert threshold is crossed the action's
-      # `pulls.createReview` call 403s. That error isn't gated by
-      # fail-on-alert (which only governs the deliberate alert-threshold
-      # failure) -- it propagates and fails the job outright. Fork PRs
-      # still get the comparison via the job summary (summary-always).
-      - name: Compare bundle size against nightly baseline
-        uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1
-        with:
-          tool: customSmallerIsBetter
-          output-file-path: bundle-size-summary.json
-          external-data-json-path: bundle-size-history.json
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          comment-on-alert: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
-          alert-threshold: "110%"
-          fail-on-alert: false
-          summary-always: true
@@ -22,7 +22,7 @@ jobs:
  lint-test:
    runs-on: ubuntu-slim
    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
        with:
          expand-composite-actions: true

@@ -49,7 +49,7 @@ jobs:
      # allowlist (only v8.1.0+ are, at apache/infrastructure-actions'
      # actions.yml). Needs an INFRA request before this can de-vendor too.
      - name: Set up chart-testing
-        uses: $/.github/actions/chart-testing-action
+        uses: ./.github/actions/chart-testing-action

      - name: Run chart-testing (list-changed)
        id: list-changed
@@ -27,9 +27,6 @@ concurrency:
  group: helm-release
  cancel-in-progress: false

-permissions:
-  contents: read
-
 jobs:
  release:
    runs-on: ubuntu-26.04
@@ -22,9 +22,6 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

-permissions:
-  contents: read
-
 jobs:
  changes:
    runs-on: ubuntu-26.04
@@ -42,14 +39,12 @@ jobs:
          persist-credentials: false
      - name: Check for file changes
        id: check
-        uses: $/.github/actions/change-detector/
+        uses: ./.github/actions/change-detector/
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

-  # NOTE: Required Playwright tests are in superset-e2e.yml (E2E / playwright-tests),
-  # including Embedded — it moved out of this workflow because embedding is a
-  # required feature, not an experimental one. This workflow now contains
-  # only experimental and mobile tests, which run in shadow mode.
+  # NOTE: Required Playwright tests are in superset-e2e.yml (E2E / playwright-tests)
+  # This workflow contains only experimental tests that run in shadow mode
  playwright-tests-experimental:
    needs: changes
    if: needs.changes.outputs.python == 'true' || needs.changes.outputs.frontend == 'true'
@@ -109,25 +104,13 @@ jobs:
          submodules: recursive
      # -------------------------------------------------------
      - name: Setup Python
-        uses: $/.github/actions/setup-backend/
+        uses: ./.github/actions/setup-backend/
      - name: Setup postgres
-        # cached-dependencies is a submodule (not a plain directory), and
-        # the $/ self-repository syntax resolves action files directly from
-        # the repository without performing a real (submodule-aware)
-        # checkout, so it can't see into a submodule's link. Keep this one
-        # on the workspace-relative ./ form, consistent with every other
-        # workflow in the repo that references this action.
-        uses: ./.github/actions/cached-dependencies # zizmor: ignore[self-repository] - $/ cannot resolve an action that lives in a submodule; ./ is required here
+        uses: ./.github/actions/cached-dependencies
        with:
          run: setup-postgres
      - name: Import test data
-        # cached-dependencies is a submodule (not a plain directory), and
-        # the $/ self-repository syntax resolves action files directly from
-        # the repository without performing a real (submodule-aware)
-        # checkout, so it can't see into a submodule's link. Keep this one
-        # on the workspace-relative ./ form, consistent with every other
-        # workflow in the repo that references this action.
-        uses: ./.github/actions/cached-dependencies # zizmor: ignore[self-repository] - $/ cannot resolve an action that lives in a submodule; ./ is required here
+        uses: ./.github/actions/cached-dependencies
        with:
          run: playwright_testdata
      - name: Setup Node.js
@@ -137,57 +120,41 @@ jobs:
          cache: "npm"
          cache-dependency-path: "superset-frontend/package-lock.json"
      - name: Install npm dependencies
-        # cached-dependencies is a submodule (not a plain directory), and
-        # the $/ self-repository syntax resolves action files directly from
-        # the repository without performing a real (submodule-aware)
-        # checkout, so it can't see into a submodule's link. Keep this one
-        # on the workspace-relative ./ form, consistent with every other
-        # workflow in the repo that references this action.
-        uses: ./.github/actions/cached-dependencies # zizmor: ignore[self-repository] - $/ cannot resolve an action that lives in a submodule; ./ is required here
+        uses: ./.github/actions/cached-dependencies
        with:
          run: npm-install
      - name: Build javascript packages
-        # cached-dependencies is a submodule (not a plain directory), and
-        # the $/ self-repository syntax resolves action files directly from
-        # the repository without performing a real (submodule-aware)
-        # checkout, so it can't see into a submodule's link. Keep this one
-        # on the workspace-relative ./ form, consistent with every other
-        # workflow in the repo that references this action.
-        uses: ./.github/actions/cached-dependencies # zizmor: ignore[self-repository] - $/ cannot resolve an action that lives in a submodule; ./ is required here
+        uses: ./.github/actions/cached-dependencies
        with:
          run: build-instrumented-assets
+      - name: Build embedded SDK
+        uses: ./.github/actions/cached-dependencies
+        with:
+          run: build-embedded-sdk
      - name: Install Playwright
-        # the $/ self-repository syntax resolves action files directly from
-        # the repository without performing a real (submodule-aware)
-        # checkout, so it can't see into a submodule's gitlink. Keep this one
-        # on the workspace-relative ./ form, consistent with every other
-        # workflow in the repo that references this action.
-        uses: ./.github/actions/cached-dependencies # zizmor: ignore[self-repository] - $/ cannot resolve an action that lives in a submodule; ./ is required here
+        uses: ./.github/actions/cached-dependencies
        with:
          run: playwright-install
      - name: Run Playwright (Experimental Tests)
-        # cached-dependencies is a submodule (not a plain directory), and
-        # the $/ self-repository syntax resolves action files directly from
-        # the repository without performing a real (submodule-aware)
-        # checkout, so it can't see into a submodule's link. Keep this one
-        # on the workspace-relative ./ form, consistent with every other
-        # workflow in the repo that references this action.
-        uses: ./.github/actions/cached-dependencies # zizmor: ignore[self-repository] - $/ cannot resolve an action that lives in a submodule; ./ is required here
+        uses: ./.github/actions/cached-dependencies
        env:
          NODE_OPTIONS: "--max-old-space-size=4096"
        with:
          run: playwright-run "${{ matrix.app_root }}" experimental/
-      - name: Run Playwright (Mobile Tests)
+      - name: Run Playwright (Embedded Tests)
        uses: ./.github/actions/cached-dependencies
        env:
          NODE_OPTIONS: "--max-old-space-size=4096"
-          # Scoped to this step: setting feature flags at the job level would
-          # alter Flask's configuration for the preceding Experimental step
-          # too — the mobile consumption mode should not do that.
-          SUPERSET_FEATURE_MOBILE_CONSUMPTION_MODE: "true"
-          INCLUDE_MOBILE: "true"
+          # Scope embedded-only env vars to this step. Setting them at the job
+          # level enabled the EMBEDDED_SUPERSET feature flag inside Flask for
+          # the preceding "Required Tests" and "Experimental Tests" steps too,
+          # which loads extra handlers and destabilizes the werkzeug dev
+          # server under the 2-worker Playwright load. Required Tests should
+          # match master's Flask configuration.
+          SUPERSET_FEATURE_EMBEDDED_SUPERSET: "true"
+          INCLUDE_EMBEDDED: "true"
        with:
-          run: playwright-run "${{ matrix.app_root }}" mobile/
+          run: playwright-run "${{ matrix.app_root }}" embedded
      - name: Set safe app root
        if: failure()
        id: set-safe-app-root
@@ -207,10 +174,10 @@ jobs:
  actions-timeline:
    needs: playwright-tests-experimental
    if: always()
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-26.04
    permissions:
      actions: read
    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
        with:
          expand-composite-actions: true
@@ -34,7 +34,7 @@ jobs:
          persist-credentials: false
      - name: Check for file changes
        id: check
-        uses: $/.github/actions/change-detector/
+        uses: ./.github/actions/change-detector/
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

@@ -53,7 +53,9 @@ jobs:
        mysql+mysqldb://superset:superset@127.0.0.1:13306/superset?charset=utf8mb4&binary_prefix=true
    services:
      mysql:
-        image: ghcr.io/apache/superset/ci/mysql:8.0
+        image: mysql:8.0
+        # Authenticated pulls use our higher Docker Hub rate limit. Empty on
+        # fork PRs (secrets unavailable) -> runner falls back to anonymous.
        env:
          MYSQL_ROOT_PASSWORD: root
        ports:
@@ -64,7 +66,7 @@ jobs:
          --health-timeout=5s
          --health-retries=5
      redis:
-        image: ghcr.io/apache/superset/ci/redis:7-alpine
+        image: redis:7-alpine
        options: --entrypoint redis-server
        ports:
          - 16379:6379
@@ -75,15 +77,9 @@ jobs:
          persist-credentials: false
          submodules: recursive
      - name: Setup Python
-        uses: $/.github/actions/setup-backend/
+        uses: ./.github/actions/setup-backend/
      - name: Setup MySQL
-        # cached-dependencies is a git submodule (not a plain directory), and
-        # the $/ self-repository syntax resolves action files directly from
-        # the repository without performing a real (submodule-aware)
-        # checkout, so it can't see into a submodule's gitlink. Keep this one
-        # on the workspace-relative ./ form, consistent with every other
-        # workflow in the repo that references this action.
-        uses: ./.github/actions/cached-dependencies # zizmor: ignore[self-repository] - $/ cannot resolve an action that lives in a submodule; ./ is required here
+        uses: ./.github/actions/cached-dependencies
        with:
          run: setup-mysql
      - name: Start Celery worker
@@ -147,7 +143,7 @@ jobs:
      SUPERSET__SQLALCHEMY_DATABASE_URI: postgresql+psycopg2://superset:superset@127.0.0.1:15432/superset
    services:
      postgres:
-        image: ghcr.io/apache/superset/ci/postgres:17-alpine
+        image: postgres:17-alpine
        env:
          POSTGRES_USER: superset
          POSTGRES_PASSWORD: superset
@@ -156,7 +152,7 @@ jobs:
          # GitHub action runner's default installations
          - 15432:5432
      redis:
-        image: ghcr.io/apache/superset/ci/redis:7-alpine
+        image: redis:7-alpine
        ports:
          - 16379:6379
    steps:
@@ -206,7 +202,7 @@ jobs:
        sqlite:///${{ github.workspace }}/.temp/examples.db?check_same_thread=true
    services:
      redis:
-        image: ghcr.io/apache/superset/ci/redis:7-alpine
+        image: redis:7-alpine
        ports:
          - 16379:6379
    steps:
@@ -216,15 +212,9 @@ jobs:
          persist-credentials: false
          submodules: recursive
      - name: Setup Python
-        uses: $/.github/actions/setup-backend/
+        uses: ./.github/actions/setup-backend/
      - name: Install dependencies
-        # cached-dependencies is a git submodule (not a plain directory), and
-        # the $/ self-repository syntax resolves action files directly from
-        # the repository without performing a real (submodule-aware)
-        # checkout, so it can't see into a submodule's gitlink. Keep this one
-        # on the workspace-relative ./ form, consistent with every other
-        # workflow in the repo that references this action.
-        uses: ./.github/actions/cached-dependencies # zizmor: ignore[self-repository] - $/ cannot resolve an action that lives in a submodule; ./ is required here
+        uses: ./.github/actions/cached-dependencies
        with:
          run: |
            # sqlite needs this working directory
@@ -269,10 +259,10 @@ jobs:
  actions-timeline:
    needs: [test-mysql, test-postgres, test-sqlite, test-postgres-required]
    if: always()
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-26.04
    permissions:
      actions: read
    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
        with:
          expand-composite-actions: true
@@ -14,9 +14,6 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

-permissions:
-  contents: read
-
 jobs:
  changes:
    runs-on: ubuntu-26.04
@@ -33,7 +30,7 @@ jobs:
          persist-credentials: false
      - name: Check for file changes
        id: check
-        uses: $/.github/actions/change-detector/
+        uses: ./.github/actions/change-detector/
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

@@ -52,7 +49,7 @@ jobs:
      SUPERSET__SQLALCHEMY_EXAMPLES_URI: presto://localhost:15433/memory/default
    services:
      postgres:
-        image: ghcr.io/apache/superset/ci/postgres:17-alpine
+        image: postgres:17-alpine
        env:
          POSTGRES_USER: superset
          POSTGRES_PASSWORD: superset
@@ -61,7 +58,7 @@ jobs:
          # GitHub action runner's default installations
          - 15432:5432
      presto:
-        image: ghcr.io/apache/superset/ci/presto:350-e.6
+        image: starburstdata/presto:350-e.6
        env:
          POSTGRES_USER: superset
          POSTGRES_PASSWORD: superset
@@ -70,7 +67,7 @@ jobs:
          # GitHub action runner's default installations
          - 15433:8080
      redis:
-        image: ghcr.io/apache/superset/ci/redis:7-alpine
+        image: redis:7-alpine
        ports:
          - 16379:6379
    steps:
@@ -80,15 +77,9 @@ jobs:
          persist-credentials: false
          submodules: recursive
      - name: Setup Python
-        uses: $/.github/actions/setup-backend/
+        uses: ./.github/actions/setup-backend/
      - name: Setup Postgres
-        # cached-dependencies is a submodule (not a plain directory), and
-        # the $/ self-repository syntax resolves action files directly from
-        # the repository without performing a real (submodule-aware)
-        # checkout, so it can't see into a submodule's link. Keep this one
-        # on the workspace-relative ./ form, consistent with every other
-        # workflow in the repo that references this action.
-        uses: ./.github/actions/cached-dependencies # zizmor: ignore[self-repository] - $/ cannot resolve an action that lives in a submodule; ./ is required here
+        uses: ./.github/actions/cached-dependencies
        with:
          run: setup-postgres
      - name: Start Celery worker
@@ -122,7 +113,7 @@ jobs:
      UPLOAD_FOLDER: /tmp/.superset/uploads/
    services:
      postgres:
-        image: ghcr.io/apache/superset/ci/postgres:17-alpine
+        image: postgres:17-alpine
        env:
          POSTGRES_USER: superset
          POSTGRES_PASSWORD: superset
@@ -131,7 +122,7 @@ jobs:
          # GitHub action runner's default installations
          - 15432:5432
      redis:
-        image: ghcr.io/apache/superset/ci/redis:7-alpine
+        image: redis:7-alpine
        ports:
          - 16379:6379
    steps:
@@ -147,19 +138,13 @@ jobs:
      - name: Start hadoop and hive
        run: docker compose -f scripts/databases/hive/docker-compose.yml up -d
      - name: Setup Python
-        uses: $/.github/actions/setup-backend/
+        uses: ./.github/actions/setup-backend/
      - name: Setup Postgres
        uses: ./.github/actions/cached-dependencies
        with:
          run: setup-postgres
      - name: Start Celery worker
-        # cached-dependencies is a submodule (not a plain directory), and
-        # the $/ self-repository syntax resolves action files directly from
-        # the repository without performing a real (submodule-aware)
-        # checkout, so it can't see into a submodule's link. Keep this one
-        # on the workspace-relative ./ form, consistent with every other
-        # workflow in the repo that references this action.
-        uses: ./.github/actions/cached-dependencies # zizmor: ignore[self-repository] - $/ cannot resolve an action that lives in a submodule; ./ is required here
+        uses: ./.github/actions/cached-dependencies
        with:
          run: celery-worker
      - name: Python unit tests (PostgreSQL)
@@ -177,10 +162,10 @@ jobs:
  actions-timeline:
    needs: [test-postgres-presto, test-postgres-hive]
    if: always()
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-26.04
    permissions:
      actions: read
    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
        with:
          expand-composite-actions: true
@@ -1,70 +0,0 @@
-name: Python Unit Test Results
-
-on:
-  # zizmor: ignore[dangerous-triggers] - runs in base-branch context and only consumes artifacts uploaded by Python-Unit; never checks out PR code (see note below)
-  workflow_run:
-    workflows: ["Python-Unit"]
-    types: [completed]
-
-# This workflow publishes a check run annotating failing Python unit tests
-# inline on the PR diff, using JUnit XML uploaded by the Python-Unit workflow.
-# It uses the workflow_run trigger so that it always runs in the base-branch
-# context and can safely be granted write permissions, even for PRs from
-# forks or Dependabot.
-#
-# IMPORTANT: This workflow must NEVER check out code from the PR branch. All
-# data comes from artifacts uploaded by the Python-Unit workflow.
-permissions:
-  contents: read
-  checks: write
-  issues: read
-  actions: read
-
-jobs:
-  report:
-    runs-on: ubuntu-26.04
-    timeout-minutes: 10
-    if: >
-      github.event.workflow_run.conclusion == 'success' ||
-      github.event.workflow_run.conclusion == 'failure'
-    steps:
-      # Fails soft (continue-on-error) because the source unit-tests job is
-      # itself gated on change detection: a docs-only PR skips it entirely,
-      # so there is nothing to download or report on.
-      - name: Download JUnit results
-        id: download
-        continue-on-error: true
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          # merge-multiple is intentionally omitted: each matrix leg's
-          # artifact (junit-results-current, junit-results-next) uses the
-          # same XML filenames, so merging them into one directory would let
-          # one Python version's results overwrite the other's. Downloading
-          # into per-artifact subdirectories keeps both, and the glob below
-          # is recursive so it still picks up every XML file.
-          pattern: "junit-results-*"
-          path: artifacts
-          run-id: ${{ github.event.workflow_run.id }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Download event file
-        id: download-event
-        if: steps.download.outcome == 'success'
-        continue-on-error: true
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: "Event File"
-          path: event
-          run-id: ${{ github.event.workflow_run.id }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Publish test results
-        if: steps.download.outcome == 'success' && steps.download-event.outcome == 'success'
-        uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2.24.0
-        with:
-          commit: ${{ github.event.workflow_run.head_sha }}
-          event_file: event/event.json
-          event_name: ${{ github.event.workflow_run.event }}
-          files: "artifacts/**/*.xml"
-          check_name: "Python Unit Test Results"
-          comment_mode: "off"
@@ -35,7 +35,7 @@ jobs:
          persist-credentials: false
      - name: Check for file changes
        id: check
-        uses: $/.github/actions/change-detector/
+        uses: ./.github/actions/change-detector/
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

@@ -53,6 +53,12 @@ jobs:
        python-version: ${{ github.event_name == 'pull_request' && fromJSON('["current"]') || fromJSON('["current", "next"]') }}
    env:
      PYTHONPATH: ${{ github.workspace }}
+      # Promotes the SQLAlchemy 2.0 deprecation warnings already locked in as
+      # errors via pytest.ini's `filterwarnings` to actually run in CI, so a
+      # regression on those fails the build instead of relying on a
+      # contributor remembering to set this locally. See the migration
+      # battleplan: https://github.com/apache/superset/discussions/40273
+      SQLALCHEMY_WARN_20: "1"
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -60,7 +66,7 @@ jobs:
          persist-credentials: false
          submodules: recursive
      - name: Setup Python
-        uses: $/.github/actions/setup-backend/
+        uses: ./.github/actions/setup-backend/
        with:
          python-version: ${{ matrix.python-version }}
      - name: Python unit tests
@@ -68,19 +74,14 @@ jobs:
          SUPERSET_TESTENV: true
          SUPERSET_SECRET_KEY: not-a-secret
        run: |
-          pytest --durations-min=0.5 --cov-report= --cov=superset ./tests/common ./tests/unit_tests --cache-clear --maxfail=50 --junit-xml=test-results/junit-unit.xml
-      # COVERAGE_FILE keeps these scoped gates off the default .coverage that
-      # the step above wrote. pytest-cov starts a fresh data file per run, so
-      # without it the last gate replaces the full-suite data and the report
-      # uploaded below contains only that gate's subtree -- every other file
-      # then reads as uncovered, and patch coverage on an unrelated PR is 0%.
+          pytest --durations-min=0.5 --cov-report= --cov=superset ./tests/common ./tests/unit_tests --cache-clear --maxfail=50
      - name: Python 100% coverage unit tests
        env:
          SUPERSET_TESTENV: true
          SUPERSET_SECRET_KEY: not-a-secret
        run: |
-          COVERAGE_FILE="${RUNNER_TEMP}/.coverage.sql" pytest --durations-min=0.5 --cov=superset/sql/ ./tests/unit_tests/sql/ --cache-clear --cov-fail-under=100 --junit-xml=test-results/junit-sql-coverage.xml
-          COVERAGE_FILE="${RUNNER_TEMP}/.coverage.semantic_layers" pytest --durations-min=0.5 --cov=superset/semantic_layers/ ./tests/unit_tests/semantic_layers/ --cache-clear --cov-fail-under=100 --junit-xml=test-results/junit-semantic-layers-coverage.xml
+          pytest --durations-min=0.5 --cov=superset/sql/ ./tests/unit_tests/sql/ --cache-clear --cov-fail-under=100
+          pytest --durations-min=0.5 --cov=superset/semantic_layers/ ./tests/unit_tests/semantic_layers/ --cache-clear --cov-fail-under=100
      - name: Upload code coverage
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
@@ -88,33 +89,6 @@ jobs:
          verbose: true
          use_oidc: true
          slug: apache/superset
-      # Uploaded even when a pytest step above fails, since that is exactly
-      # when the JUnit results are needed downstream, to annotate the PR with
-      # the failing tests. Consumed by the "Python Unit Test Results" workflow
-      # via workflow_run (see that workflow for why it can't just be a step
-      # here: it needs to run with write permissions, which this PR-triggered
-      # job can't safely have on a fork PR).
-      - name: Upload JUnit test results
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: junit-results-${{ matrix.python-version }}
-          path: test-results/
-          retention-days: 7
-
-  # Uploads the raw pull_request event payload so the "Python Unit Test
-  # Results" workflow (running via workflow_run, in base-branch context) can
-  # look up which PR/commit to annotate without checking out untrusted code.
-  event-file:
-    runs-on: ubuntu-26.04
-    timeout-minutes: 5
-    steps:
-      - name: Upload event file
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: Event File
-          path: ${{ github.event_path }}
-          retention-days: 7

  # Stable required-status-check anchor. `unit-tests` is a matrix job gated on
  # change detection, so on non-Python PRs it is skipped and never produces its
@@ -125,13 +99,13 @@ jobs:
  unit-tests-required:
    needs: [changes, unit-tests]
    if: always()
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-26.04
    timeout-minutes: 5
    permissions:
      contents: read
      actions: read
    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
        with:
          expand-composite-actions: true

@@ -20,7 +20,7 @@ permissions:

 jobs:
  post-comment:
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-26.04
    # Only act when the Translations workflow failed (which means a regression
    # was detected — the workflow exits 1 on regression).
    if: github.event.workflow_run.conclusion == 'failure'
@@ -32,7 +32,7 @@ jobs:

      - name: Check for file changes
        id: check
-        uses: $/.github/actions/change-detector/
+        uses: ./.github/actions/change-detector/
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

@@ -45,13 +45,7 @@ jobs:
          cache-dependency-path: "superset-frontend/package-lock.json"
      - name: Install dependencies
        if: steps.check.outputs.frontend
-        # cached-dependencies is a git submodule (not a plain directory), and
-        # the $/ self-repository syntax resolves action files directly from
-        # the repository without performing a real (submodule-aware)
-        # checkout, so it can't see into a submodule's gitlink. Keep this one
-        # on the workspace-relative ./ form, consistent with every other
-        # workflow in the repo that references this action.
-        uses: ./.github/actions/cached-dependencies # zizmor: ignore[self-repository] - $/ cannot resolve an action that lives in a submodule; ./ is required here
+        uses: ./.github/actions/cached-dependencies
        with:
          run: npm-install
      - name: lint
@@ -74,20 +68,17 @@ jobs:

      - name: Check for file changes
        id: check
-        uses: $/.github/actions/change-detector/
+        uses: ./.github/actions/change-detector/
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Python
        if: steps.check.outputs.python == 'true' || steps.check.outputs.frontend == 'true'
-        uses: $/.github/actions/setup-backend/
+        uses: ./.github/actions/setup-backend/

      - name: Install gettext tools
        if: steps.check.outputs.python == 'true' || steps.check.outputs.frontend == 'true'
-        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
-        with:
-          packages: gettext
-          version: 1.0
+        run: sudo apt-get update && sudo apt-get install -y gettext

      # Fetch the base ref so we can compare PR-introduced regressions
      # against a fair baseline (also runs babel_update against the base
@@ -166,10 +157,10 @@ jobs:
  actions-timeline:
    needs: [frontend-check-translations, babel-extract]
    if: always()
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-26.04
    permissions:
      actions: read
    steps:
-      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
+      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
        with:
          expand-composite-actions: true
@@ -35,10 +35,10 @@ jobs:
      - name: Install dependencies
        working-directory: ./superset-websocket
        run: npm ci
-      - name: lint
+      - name: eslint
        working-directory: ./superset-websocket
-        run: npm run lint-check
-      - name: typescript check
+        run: npm run eslint -- . --quiet
+      - name: typescript checks
        working-directory: ./superset-websocket
        run: npm run type
      - name: code format check
@@ -13,9 +13,6 @@ on:
        required: true
        type: string

-permissions:
-  contents: read
-
 jobs:
  supersetbot:
    runs-on: ubuntu-26.04
@@ -46,7 +43,7 @@ jobs:
          persist-credentials: false

      - name: Setup supersetbot
-        uses: $/.github/actions/setup-supersetbot/
+        uses: ./.github/actions/setup-supersetbot/

      - name: Execute custom Node.js script
        env:
@@ -66,7 +66,7 @@ jobs:
          fetch-depth: 0

      - name: Setup Docker Environment
-        uses: $/.github/actions/setup-docker
+        uses: ./.github/actions/setup-docker
        with:
          dockerhub-user: ${{ secrets.DOCKERHUB_USER }}
          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -81,7 +81,7 @@ jobs:
          package-manager-cache: false

      - name: Setup supersetbot
-        uses: $/.github/actions/setup-supersetbot
+        uses: ./.github/actions/setup-supersetbot/

      - name: Execute custom Node.js script
        env:
@@ -139,7 +139,7 @@ jobs:
          package-manager-cache: false

      - name: Setup supersetbot
-        uses: $/.github/actions/setup-supersetbot/
+        uses: ./.github/actions/setup-supersetbot/

      - name: Label the PRs with the right release-related labels
        env:
@@ -5,9 +5,6 @@ on:
  pull_request_target:
    types: [opened]

-permissions:
-  contents: read
-
 jobs:
  welcome:
    runs-on: ubuntu-slim
@@ -138,7 +138,6 @@ PROJECT.md
 .aider*
 .claude_rc*
 .claude/settings.local.json
-.claude/worktrees/
 .env.local
 oxc-custom-build/
 *.code-workspace
@@ -15,12 +15,18 @@
 # limitations under the License.
 #

+[submodule ".github/actions/latest-tag"]
+	path = .github/actions/latest-tag
+	url = https://github.com/EndBug/latest-tag
 [submodule ".github/actions/pr-lint-action"]
 	path = .github/actions/pr-lint-action
 	url = https://github.com/morrisoncole/pr-lint-action
 [submodule ".github/actions/cached-dependencies"]
 	path = .github/actions/cached-dependencies
 	url = https://github.com/apache-superset/cached-dependencies
+[submodule ".github/actions/comment-on-pr"]
+	path = .github/actions/comment-on-pr
+	url = https://github.com/unsplash/comment-on-pr
 [submodule ".github/actions/chart-testing-action"]
 	path = .github/actions/chart-testing-action
 	url = https://github.com/helm/chart-testing-action
@@ -64,19 +64,10 @@ repos:
    hooks:
      - id: oxfmt-frontend
        name: oxfmt (frontend)
-        entry: ./scripts/oxfmt.sh superset-frontend
+        entry: bash -c 'cd superset-frontend && files=(); for f in "$@"; do files+=("${f#superset-frontend/}"); done; npx oxfmt --write --no-error-on-unmatched-pattern -- "${files[@]}"' --
        language: system
        pass_filenames: true
        files: ^superset-frontend/.*\.(js|jsx|ts|tsx|css|scss|sass|json)$
-      - id: oxfmt-websocket
-        name: oxfmt (websocket)
-        entry: ./scripts/oxfmt.sh superset-websocket
-        language: system
-        pass_filenames: true
-        # JSON is excluded: superset-websocket/.oxfmtrc.json ignores *.json, so
-        # passing them here would only ever be a no-op (notably for the tracked
-        # package-lock.json).
-        files: ^superset-websocket/.*\.(js|ts)$
  - repo: local
    hooks:
      - id: oxlint-frontend
@@ -97,9 +88,9 @@ repos:
        language: system
        pass_filenames: true
        files: ^superset-frontend/.*\.(js|jsx|ts|tsx)$
-      - id: oxlint-docs
-        name: oxlint (docs)
-        entry: bash -c 'cd docs && FILES=$(printf "%s\n" "$@" | sed "s|^docs/||" | tr "\n" " ") && yarn lint --fix --quiet $FILES'
+      - id: eslint-docs
+        name: eslint (docs)
+        entry: bash -c 'cd docs && FILES=$(printf "%s\n" "$@" | sed "s|^docs/||" | tr "\n" " ") && yarn eslint --fix --quiet $FILES'
        language: system
        pass_filenames: true
        files: ^docs/.*\.(js|jsx|ts|tsx)$
@@ -178,7 +169,7 @@ repos:
        name: zizmor (GHA security audit)
        entry: zizmor
        language: python
-        additional_dependencies: [zizmor==1.30.0]
+        additional_dependencies: [zizmor==1.25.2]
        files: ^\.github/
        types: [yaml]
        pass_filenames: false
@@ -10,7 +10,6 @@
 .stylelintignore
 .flake8
 .nvmrc
-.npmrc
 .rat-excludes
 .swcrc
 .*log
@@ -2,29 +2,22 @@

 Apache Superset is a data visualization platform with Flask/Python backend and React/TypeScript frontend.

-## Run Pre-commit Before Pushing
+## ⚠️ CRITICAL: Always Run Pre-commit Before Pushing

-Always run pre-commit against the files changed by the current branch before
-pushing. This matches CI and keeps unrelated failures already present on
-`master` from blocking otherwise independent work.
+**ALWAYS run `pre-commit run --all-files` before pushing commits.** CI will fail if pre-commit checks don't pass. This is non-negotiable.

 ```bash
 # Stage your changes first
 git add .

-# Run pre-commit on staged files
-pre-commit run
+# Run pre-commit on all files
+pre-commit run --all-files

 # If there are auto-fixes, stage them and commit
 git add .
 git commit --amend  # or new commit
 ```

-Use `pre-commit run --all-files` when auditing or repairing the repository-wide
-baseline. If that check finds failures in files untouched by the current branch,
-fix them in a separate branch rather than adding unrelated changes to the
-current pull request.
-
 Common pre-commit failures:
 - **Formatting** - black, oxfmt, eslint will auto-fix
 - **Type errors** - mypy failures need manual fixes
@@ -167,7 +160,7 @@ The Developer Portal auto-generates MDX documentation from Storybook stories. **
 ### Generator Location
 - Script: `docs/scripts/generate-superset-components.mjs`
 - Wrapper: `docs/src/components/StorybookWrapper.jsx`
- Output: `docs/developer_docs/components/`
+- Output: `docs/developer_portal/components/`

 ## Architecture Patterns

@@ -35,4 +35,4 @@ The Developer Portal includes comprehensive guides for:
 - [Code Review Process](https://superset.apache.org/developer_portal/contributing/code-review)
 - [Development How-tos](https://superset.apache.org/developer_portal/contributing/howtos)

-Source for the Developer Portal documentation is [located here](https://github.com/apache/superset/tree/master/docs/developer_docs).
+Source for the Developer Portal documentation is [located here](https://github.com/apache/superset/tree/master/docs/developer_portal).
@@ -104,30 +104,6 @@ RUN if [ "${BUILD_TRANSLATIONS}" = "true" ]; then \
    rm -rf /app/superset/translations/*/*/*.[po,mo];


-######################################################################
-# superset-websocket builds the realtime WebSocket (Node) server that
-# ships in the official image, launched via docker/entrypoints/run-websocket.sh
-######################################################################
-FROM node:24-trixie-slim AS superset-websocket
-
-# Harden `npm ci` against transient npm-registry network blips (e.g. ECONNRESET).
-ENV npm_config_fetch_retries=5 \
-    npm_config_fetch_retry_mintimeout=20000 \
-    npm_config_fetch_retry_maxtimeout=120000 \
-    npm_config_fetch_timeout=600000
-
-WORKDIR /app/superset-websocket
-
-# Install against the lockfile first (cached until it changes), then bundle the
-# TypeScript server into a single self-contained CJS file (esbuild inlines every
-# dependency), so the runtime image needs only the Node binary and dist/ — no
-# node_modules to ship.
-COPY superset-websocket/package.json superset-websocket/package-lock.json ./
-RUN --mount=type=cache,target=/root/.npm npm ci
-COPY superset-websocket/ ./
-RUN npm run build
-
-
 ######################################################################
 # Base python layer
 ######################################################################
@@ -231,44 +207,9 @@ RUN /app/docker/apt-install.sh \
 # The database file will be created at runtime when examples are loaded from Parquet files
 RUN mkdir -p /app/data && chown -R superset:superset /app/data

-# --- Realtime WebSocket server (part of the official image) ---------------
-# The realtime transport (superset-websocket) is a Node service, bundled by
-# esbuild into a single self-contained file. Copy the Node runtime plus that
-# bundle so every image built from this stage can launch it via an alternate
-# entrypoint (docker/entrypoints/run-websocket.sh) rather than needing a separate
-# image. This lives here rather than in a single downstream stage so the lean and
-# dev images both ship it — docker-compose-non-dev.yml runs the websocket service
-# from the dev target.
-RUN /app/docker/apt-install.sh libstdc++6
-COPY --from=superset-websocket /usr/local/bin/node /usr/local/bin/node
-COPY --from=superset-websocket --chown=superset:superset \
-    /app/superset-websocket/dist /app/superset-websocket/dist
-
-HEALTHCHECK CMD /app/docker/docker-healthcheck.sh
-CMD ["/app/docker/entrypoints/run-server.sh"]
-EXPOSE ${SUPERSET_PORT}
-
-######################################################################
-# Final lean image...
-######################################################################
-FROM python-common AS lean
-
-# Install Python dependencies using docker/pip-install.sh.
-# Requirements are installed *before* the application source is copied
-# below so that source-only changes don't bust this (slow, network-bound)
-# cache layer or defeat --cache-from.
-COPY requirements/base.txt requirements/
-
-# Copy superset-core package needed for editable install in base.txt
-COPY superset-core superset-core
-
-RUN --mount=type=cache,target=${SUPERSET_HOME}/.cache/uv \
-    /app/docker/pip-install.sh --requires-build-essential -r requirements/base.txt
-
-# Copy compiled frontend assets and application source now that
-# dependencies have been resolved and cached above.
+# Copy compiled things from previous stages
 COPY --from=superset-node /app/superset/static/assets superset/static/assets
-# Copy service.worker.js optionally as it doesn't exist when DEV_MODE=true
+# Copy service.worker.js optionall as it doesn't exist when DEV_MODE=true
 COPY --from=superset-node /app/superset/static/service-worker.j[s] superset/static/service-worker.js

 # TODO, when the next version comes out, use --exclude superset/translations
@@ -280,11 +221,26 @@ RUN rm superset/translations/*/*/*.po
 COPY --from=superset-node /app/superset/translations superset/translations
 COPY --from=python-translation-compiler /app/translations_mo superset/translations

-# Install the superset package itself. --no-deps because its dependencies
-# were already installed from requirements/base.txt above, so this layer
-# stays fast even though the source copy above changes on every edit.
+HEALTHCHECK CMD /app/docker/docker-healthcheck.sh
+CMD ["/app/docker/entrypoints/run-server.sh"]
+EXPOSE ${SUPERSET_PORT}
+
+######################################################################
+# Final lean image...
+######################################################################
+FROM python-common AS lean
+
+# Install Python dependencies using docker/pip-install.sh
+COPY requirements/base.txt requirements/
+
+# Copy superset-core package needed for editable install in base.txt
+COPY superset-core superset-core
+
 RUN --mount=type=cache,target=${SUPERSET_HOME}/.cache/uv \
-    uv pip install -e . --no-deps
+    /app/docker/pip-install.sh --requires-build-essential -r requirements/base.txt
+# Install the superset package
+RUN --mount=type=cache,target=${SUPERSET_HOME}/.cache/uv \
+    uv pip install -e .
 RUN python -m compileall /app/superset

 USER superset
@@ -300,46 +256,22 @@ RUN /app/docker/apt-install.sh \
    pkg-config \
    default-libmysqlclient-dev

-# Copy development requirements and install them *before* the application
-# source is copied below, so source-only edits don't bust this cache layer.
+# Copy development requirements and install them
 COPY requirements/*.txt requirements/

 # Copy local packages needed for editable installs in development.txt
 COPY superset-core superset-core
 COPY superset-extensions-cli superset-extensions-cli

-# requirements/development.txt is generated by `uv pip compile` and embeds
-# `-e .` (an editable install of this same package) as its first line. That
-# self-reference needs the full superset/ source tree, which hasn't been
-# copied in yet at this point, so it's stripped here; the real editable
-# install of `.` runs below, once the source is present.
+# Install Python dependencies using docker/pip-install.sh
 RUN --mount=type=cache,target=${SUPERSET_HOME}/.cache/uv \
-    grep -vxF -- "-e ." requirements/development.txt > requirements/development-deps.txt && \
-    /app/docker/pip-install.sh --requires-build-essential -r requirements/development-deps.txt
-
-# Copy compiled frontend assets and application source now that
-# dependencies have been resolved and cached above.
-COPY --from=superset-node /app/superset/static/assets superset/static/assets
-# Copy service.worker.js optionally as it doesn't exist when DEV_MODE=true
-COPY --from=superset-node /app/superset/static/service-worker.j[s] superset/static/service-worker.js
-
-# TODO, when the next version comes out, use --exclude superset/translations
-COPY superset superset
-# TODO in the meantime, remove the .po files
-RUN rm superset/translations/*/*/*.po
-
-# Merging translations from backend and frontend stages
-COPY --from=superset-node /app/superset/translations superset/translations
-COPY --from=python-translation-compiler /app/translations_mo superset/translations
-
-# Install the superset package together with its postgres extra, using the
-# same uv cache mount as the requirements install above. --no-deps because
-# all dependencies (including the postgres extra's psycopg2-binary) are
-# already installed from requirements/development.txt above.
-# NOTE: source is bind-mounted over /app/superset in DEV_MODE, so a
-# compileall pass here would be wasted work; unlike `lean`, `dev` skips it.
+    /app/docker/pip-install.sh --requires-build-essential -r requirements/development.txt
+# Install the superset package
 RUN --mount=type=cache,target=${SUPERSET_HOME}/.cache/uv \
-    uv pip install -e .[postgres] --no-deps
+    uv pip install -e .
+
+RUN uv pip install .[postgres]
+RUN python -m compileall /app/superset

 USER superset

@@ -31,8 +31,6 @@ under the License.
 [![Open PRs](https://img.shields.io/github/issues-pr/apache/superset)](https://github.com/apache/superset/pulls)
 [![Get on Slack](https://img.shields.io/badge/slack-join-orange.svg)](https://bit.ly/join-superset-slack)
 [![Documentation](https://img.shields.io/badge/docs-apache.org-blue.svg)](https://superset.apache.org)
-[![Storybook](https://img.shields.io/badge/storybook-live-ff4785.svg)](https://superset-storybook.netlify.app)
-[![Bundle Analyzer](https://img.shields.io/badge/bundle%20analyzer-nightly-8dd6f9.svg)](https://superset-bundle-analyzer.netlify.app)

 <picture width="500">
  <source
@@ -441,11 +441,6 @@ categories:
      url: https://bestpair.info/
      contributors: ["@stevensuting"]

-    - name: Veremes
-      url: https://www.veremes.com/
-      logo: veremes.svg
-      contributors: ["@verdier"]
-
    - name: Virtuoso QA
      url: https://www.virtuosoqa.com

@@ -84,16 +84,6 @@ The `sql_lab` role is *additive*: it grants the SQL Lab permission set on top of

 Deployments may grant or revoke individual view-menu permissions, which shifts the boundary for that deployment but does not redefine the model. Any custom role created by an operator inherits the same principle: its capabilities are whatever the operator has explicitly granted it. The Public principal follows the same rule: operators may grant the Public role read access to specific datasets or dashboards (typically for anonymous reporting use cases), which shifts the boundary for that deployment without redefining the model.

-### Async Execution and Realtime Notifications
-
-Asynchronous execution paths do not create a separate data-access capability. A background task is a continuation of an already-authorized action, such as reading chart data or executing SQL through SQL Lab. The initiating route, command, or scheduler must enforce the same route-level and object-level checks the synchronous path would enforce before it creates the task, and the worker must execute under the initiating principal's effective identity when row-level security, impersonation, embedded guest-token scope, or similar controls affect the result.
-
-Task metadata is itself a request-scoped resource. Non-admin users and embedded guests may read or cancel only tasks they are subscribed to or that otherwise represent work they are entitled to observe; Admin may observe and manage tasks as part of the trusted operational boundary. A bug that lets a principal create, read, join, cancel, or receive task state for work outside the role and capability matrix is in scope.
-
-Realtime transports, including WebSocket delivery backed by Redis or Valkey Pub/Sub, are notification mechanisms rather than authorization sources. WebSocket notification access is controlled by `can_read` on the `Realtime` resource. The broadcast scope is authenticated-global, not public: it reaches every authenticated realtime socket, and an anonymous request receives no realtime principal, no JWT cookie, and therefore no socket, so it never receives these messages (true anonymous/Public-role realtime is not offered and would require a separate, restricted model). Broadcast Pub/Sub messages, such as list-view entity-change events, must be context-free nudges; sensitive or authoritative state must not be published on the broadcast scope. Targeted Pub/Sub messages may carry task state only when the producer names routing keys derived from an authorized identity, such as a task subscriber's principal channel (or a per-tab channel derived from it); the producer validates every routing key against the task's own subscriber principals before publishing, and the websocket server forwards the payload only to sockets bound to those keys. Full data and result payloads must still be fetched through the normal protected REST API or cache-read path. Redis Streams used for task completion, dependency, and lock-release signalling are likewise coordination signals; the metastore or cache entry they wake a consumer to read remains the source of truth.
-
-The realtime notification permission is distinct from the permission to read the underlying object. It controls whether a principal receives push notifications, not whether they may read the object once they call the protected REST API. Existing websocket connections are authorized by the JWT accepted at upgrade time; permission revocation after token minting is bounded by `WEBSOCKET_JWT_EXPIRATION_SECONDS` plus the websocket server's socket-check interval. Redis Streams are internal server-to-server coordination primitives and should not be directly exposed as an end-user subscription surface.
-
 ### Vulnerability Scope

 The test for whether a finding is in scope is a single question:
@@ -24,398 +24,6 @@ assists people when migrating to a new version.

 ## Next

-### Tagging is on by default
-
-`TAGGING_SYSTEM` now ships **on**. The Tags menu entry, the tag columns and
-filters on the chart, dashboard and saved-query lists, and the Tags field in the
-chart and dashboard property modals are all visible without configuration, and
-tags are included in asset export and import.
-
-**What operators should expect:**
-
- **Implicit tags accrue.** Saving a chart, dashboard, dataset or saved query,
-  and favoriting an asset, write rows to `tag` and `tagged_object` (`type:chart`,
-  `editor:<user id>`, `favorited_by:<user id>`). These have always been created
-  when the flag was on; they are simply no longer opt-in.
- **Exports gain a `tags` key and a `tags.yaml` file.** Chart and dashboard
-  export bundles carry custom tags. Importers on 6.0 and later understand both;
-  older importers skip the unrecognized `tags.yaml` file but reject chart and
-  dashboard YAML that contains a `tags` key, so strip that key before importing
-  a bundle into Superset 5.x or earlier.
- **The flag is honored at write time.** The tagging SQLA event listeners are
-  always attached at startup; the ones that create tags check `TAGGING_SYSTEM`
-  when they fire, so the flag, including a runtime override through
-  `GET_FEATURE_FLAGS_FUNC` or `IS_FEATURE_ENABLED_FUNC`, takes effect without a
-  restart. The cleanup listeners run regardless of the flag, so deleting an
-  asset never leaves orphaned `tagged_object` rows behind.
-
-Set `FEATURE_FLAGS = {"TAGGING_SYSTEM": False}` to restore the previous
-behavior. Existing tag rows are left untouched.
-
-### Global Async Queries re-platformed onto the Global Task Framework (breaking)
-
-Global Async Queries (GAQ) no longer runs on its own bespoke async-events
-plumbing. Async chart data is now executed as Global Task Framework (GTF) tasks
-(one task per `QueryObject`), the browser learns of completion by polling
-`GET /api/v1/task/status_changes` (optionally accelerated by the WebSocket
-transport below) and re-issuing the original `/chart/data` request against the
-now-warm per-query cache, and the realtime WebSocket server is a generic,
-feature-agnostic task push transport rather than a GAQ-specific event tail.
-
-Breaking removals (no deprecation window):
-
- The `/api/v1/async_event/` REST API, `AsyncQueryManager`, and the
-  `qc-<hash>` query-context descriptor replay endpoint
-  (`GET /api/v1/chart/data/<cache_key>`) are removed. Any client that consumed a
-  `result_url` from a `202` response must move to the re-request model (the
-  built-in frontend already does).
- The following config keys are removed: `GLOBAL_ASYNC_QUERIES_CACHE_BACKEND`,
-  `GLOBAL_ASYNC_QUERIES_TRANSPORT`, `GLOBAL_ASYNC_QUERIES_WEBSOCKET_URL`,
-  `GLOBAL_ASYNC_QUERIES_REDIS_STREAM_PREFIX`,
-  `GLOBAL_ASYNC_QUERIES_REDIS_STREAM_LIMIT`,
-  `GLOBAL_ASYNC_QUERIES_REDIS_STREAM_LIMIT_FIREHOSE`,
-  `GLOBAL_ASYNC_QUERIES_REGISTER_REQUEST_HANDLERS`,
-  `GLOBAL_ASYNC_QUERIES_JWT_*`, and
-  `GLOBAL_ASYNC_QUERY_MANAGER_CLASS`. The coordinator (locks, GTF, and now GAQ)
-  uses `DISTRIBUTED_COORDINATION_CONFIG` exclusively.
-
-Enabling async chart data in the new flow:
-
-```python
-# feature flag: makes async chart data available (auto-enables GLOBAL_TASK_FRAMEWORK)
-FEATURE_FLAGS = {"GLOBAL_ASYNC_QUERIES": True}
-
-# a Redis connection for distributed coordination (locks, GTF signalling,
-# and the realtime pub/sub); required for async execution in production
-DISTRIBUTED_COORDINATION_CONFIG = {
-    "CACHE_TYPE": "RedisCache",
-    "CACHE_REDIS_HOST": "localhost",
-    "CACHE_REDIS_PORT": 6379,
-    "CACHE_REDIS_DB": 0,
-}
-```
-
-Async is now **opt-in per request**: `GLOBAL_ASYNC_QUERIES` only makes async
-*available*; whether a given `/chart/data` request runs async is decided by an
-`async_mode` request flag (endpoint default `false`, so programmatic API clients
-keep the synchronous `200` flow unless they opt in). The built-in frontend
-resolves the `async_mode` it sends from a policy chain — per-dashboard override →
-deployment default `GLOBAL_ASYNC_QUERIES_DEFAULT` (default `true`) → the feature
-flag — so the UI keeps its existing async behavior by default.
-
-**Embedded (guest token) async requires explicit role grants.** Async chart-data
-completion is observed through `GET /api/v1/task/status_changes` (gated by
-`can_read Task`) and, when the WebSocket transport is enabled, over the socket
-(gated by `can_read Realtime`). An authenticated Gamma user has `can_read Task` by
-default; the default guest role (`Public`) does **not**. So an embedded guest only
-runs async when the operator grants its role `can_read Task` (and `can_read
-Realtime` for the socket) — otherwise the request transparently falls back to the
-synchronous `200` flow rather than returning a `202` the guest could never resolve.
-
-Enabling the realtime WebSocket transport (optional; when enabled it becomes the
-completion transport for async chart-data — see the note on the interval poll):
-
-> **Note:** the realtime WebSocket transport is opt-in (`WEBSOCKET_ENABLE`
-> defaults to `False`). When it is **disabled**, async chart-data completion is
-> driven entirely by the `status_changes` interval poll (the source of truth).
-> When it is **enabled**, completion is delivered over the socket and the
-> recurring interval poll does not run; a one-shot `status_changes` catch-up on
-> waiter registration and on socket reconnect reconciles anything missed while
-> disconnected. The socket accelerates delivery over the authoritative
-> `status_changes` API rather than replacing it: Redis Pub/Sub is best-effort
-> (at-most-once, no replay), so a disconnect is reconciled by the catch-up on
-> reconnect/registration. In the rare case a `task.status` is missed while the
-> socket stays open, the request's give-up runs one final `status_changes` read
-> before timing out — so a chart whose query actually finished still resolves; only
-> if that read can't confirm completion does the request end in a bounded error (a
-> page reload re-establishes state).
-
-```python
-WEBSOCKET_ENABLE = True
-WEBSOCKET_URL = "ws://<same-host>:8080/"
-WEBSOCKET_JWT_SECRET = "<output of: openssl rand -base64 42>"
-```
-
-The built-in Gamma role receives `can_read Realtime`; grant that permission to
-custom roles that should receive websocket notifications.
-
-Run the `superset-websocket` Node server on the **same browser-visible host**
-(so its JWT channel cookie is shared) and point its `redis` config at the same
-instance as `DISTRIBUTED_COORDINATION_CONFIG`, plus `jwtSecret` /
-`jwtCookieName` matching the Flask config (`WEBSOCKET_JWT_SECRET` /
-`WEBSOCKET_JWT_COOKIE_NAME`, default `superset-ws-token`). During websocket JWT
-secret rotation, set the websocket server's `previousJwtSecret` /
-`PREVIOUS_JWT_SECRET` to the old key while Flask continues minting cookies with
-`WEBSOCKET_JWT_SECRET`. The server is bundled in the official Superset image
-and launched via an alternate entrypoint — no separate image is required:
-`docker run <superset-image> /app/docker/entrypoints/run-websocket.sh` (or the
-opt-in `websocket` profile in `docker compose`). It **subscribes** to a single
-Redis Pub/Sub channel, `realtime`, which carries a self-describing
-`{topic, scope, routes, payload}` envelope (both the broadcast `entity.changed`
-nudges and the targeted `task.status` messages), and forwards `{topic, payload}`
-to browsers after routing — so a Redis ACL for the websocket server must allow
-subscribing to `realtime` (this replaces the earlier `entity-changes:*` /
-`task-status` channels); see `superset-websocket/README.md`.
-
-Orphaned GTF tasks (a worker killed mid-execution) are now detected and cleaned
-up server-side. While a worker holds a task it writes a liveness heartbeat
-(`tasks.last_heartbeat`, every `GTF_TASK_HEARTBEAT_INTERVAL` seconds, default
-`15`); a dedicated `reap_orphaned_tasks` Celery beat job reaps any active task
-whose heartbeat is older than `GTF_ORPHAN_TASK_TIMEOUT` (default `60`) — revoking
-its Celery job, marking it `FAILURE` so waiters unblock, and (on engines that
-support query cancellation) cancelling the abandoned warehouse query out-of-band.
-Enable the `reap_orphaned_tasks` beat schedule on a short interval (e.g. every
-minute); it is separate from `prune_tasks` (a heavier retention delete run
-infrequently). The heartbeat write is issued out-of-band and deliberately does
-not advance `changed_on`.
-
-Async chart-data query tasks are now cancellable: a per-query timeout
-(`GLOBAL_ASYNC_QUERIES_QUERY_TIMEOUT`, default `None` = unbounded) or a user
-cancel aborts the task, and on database engines that support query cancellation
-(e.g. PostgreSQL, MySQL, Snowflake, Redshift) the abort also cancels the running
-warehouse query over a fresh connection — including when the worker died (the
-reaper cancels it). Engines without cancel support are unaffected — the task is
-still freed, but the query runs to completion.
-
- Calculated (expression) dataset columns are now wrapped in parentheses when
-  compiled to SQL (`(<expression>)`), in `SELECT`, `GROUP BY`, `ORDER BY`,
-  `COUNT(DISTINCT ...)`, and the series-limit (top-N) prequery/JOIN paths. This
-  fixes a correctness bug where a bare boolean operator (e.g. `OR`) inside a
-  calculated column used as a series dimension leaked into the surrounding
-  operator precedence (`state = 'CA' OR state = 'NY' = 1` mis-parsing as
-  `state = 'CA' OR (state = 'NY' = 1)`). Query results are otherwise unchanged,
-  but the generated SQL text for calculated-column queries differs; deployments
-  that key on the exact compiled SQL (custom result-cache keys, logging, or SQL
-  diffing) may observe the added parentheses. Physical columns are unaffected,
-  as are calculated columns used as a temporal (time/x-axis) dimension, which
-  resolve through a separate time-grain path (`get_timestamp_expression`).
-
- **[BREAKING] `SemanticLayer` and `SemanticView` are now classified in the
-  Flask-AppBuilder role sets**, so `sync_role_definitions` (run on
-  `superset init` and on startup) stops granting the built-in **Gamma** role
-  write access to them. `SemanticLayer` is treated like `Database`
-  (`READ_ONLY_MODEL_VIEWS`): create/edit/delete become **admin-only**, while
-  read stays broadly available (its configuration is returned masked).
-  `SemanticView` is treated like `Dataset` (`GAMMA_READ_ONLY_MODEL_VIEWS`):
-  writes are Alpha-tier, reads Gamma-tier. Its custom read endpoints
-  (`views`, `connections`) are mapped to `can_read` so they remain
-  accessible under the read-only classification. A deployment relying on
-  Gamma users creating or editing semantic layers/views must grant those
-  permissions through a custom role. A migration retires the now-unused
-  `can_views` / `can_connections` permissions left on the `SemanticLayer`
-  view menu by earlier builds. Two upgrade-time notes on that migration:
-  it seeds the `SemanticLayer` view menu and its `can_read` PVM if absent, so
-  even a fresh or flag-off install gains that permission (harmless — the
-  endpoints 404 while `SEMANTIC_LAYERS` is off); and retiring the stale
-  permissions remaps any role that held them onto `can_read`, a small
-  widening — a custom role granted only `can_views` or `can_connections` gains
-  `can_read` (the semantic-layer list and its masked-configuration detail),
-  which it could not previously reach. Operators who hand-rolled semantic-layer
-  roles should re-audit them after upgrading. The feature remains gated behind
-  the default-off `SEMANTIC_LAYERS` flag.
-
-### Archived dataset purge requires impact confirmation
-
-`GET /api/v1/dataset/<uuid>/purge-impact` returns the charts and distinct
-dashboards affected by permanently deleting an archived dataset, together with
-an opaque `impact_token`. The dataset purge endpoint now requires that token in
-the JSON body as `confirmed_impact_token`. API clients that call
-`POST /api/v1/dataset/<uuid>/purge` must fetch and display the impact first;
-requests with a missing or malformed token are rejected with 400.
-
-The server rechecks the dependency identities immediately before mutation. If
-they changed, purge performs no deletion and returns 409 with a refreshed impact
-payload. Clients must display the new impact and obtain renewed confirmation
-before retrying. Preview or recheck failures fail closed rather than treating
-unknown impact as zero. Chart and dashboard purge endpoints are unchanged.
-
- The dashboard datasource-based visibility fallback now fails closed: a dashboard whose member charts’ datasources cannot be resolved (deleted datasource rows, missing `datasource_id`, or unsupported datasource types) is no longer accessible to users without explicit editor/viewer rights, and a dashboard composed of semantic-view charts now requires `datasource_access` on (at least one of) its semantic views or their parent semantic layer — previously any authenticated user could open such a dashboard’s shell. Because the fallback now considers every member chart rather than only table-backed ones, a user holding `datasource_access` on any single member datasource — including a semantic view or its parent layer — can open a mixed dashboard that previously denied them. Dashboards with no charts remain accessible, and dashboards with explicit viewers are unaffected. Conversely, holders of `all_datasource_access` now see every published no-viewer dashboard in the dashboard list — including chart-less ones previously hidden by the inner joins — matching what the object-level gate already allowed them to open.
- Version restore (`POST /api/v1/{chart,dashboard,dataset}/<uuid>/versions/<version_uuid>/restore`) now refuses an **externally managed** entity (`is_managed_externally = True`) with HTTP 403, enforcing server-side what the docs already promised. Previously the refusal existed only in the browser, so an otherwise-authorized editor could restore such an entity by calling the endpoint directly and have the restore overwritten on the next external sync. Soft-delete recovery is deliberately unaffected — it changes visibility, not content.
- `SAMPLES_ROW_LIMIT` is now the default for `/datasource/samples` requests without a valid explicit `per_page`, rather than a hard per-request ceiling; explicit limits are honored up to the existing global row-limit ceiling, matching `/chart/data` SAMPLES requests.
- The `cockroachdb` extra (`pip install apache-superset[cockroachdb]`) now installs `sqlalchemy-cockroachdb` instead of the abandoned `cockroachdb` package, whose SQLAlchemy dialect could not be imported under SQLAlchemy 2.0. Existing environments with the old package installed should `pip uninstall cockroachdb && pip install sqlalchemy-cockroachdb` (or simply reinstall the extra) to restore CockroachDB connectivity.
-
-### Native Value filter "Select all" always targets the whole column
-
-The native "Value" filter's bulk "Select all" / "Clear" controls now operate on the entire loaded set of column values regardless of any text typed into the filter's search box. Previously the "Select all (N)" count briefly flickered to the search-scoped count before settling on the full-column count, and clicking "Select all" while searching could select only the currently matching subset. Search-scoped bulk selection was never a supported feature; the count is now stable and always matches what "Select all" selects (the full column). No configuration change is required.
-
-### MCP tool results preserve stored string values
-
-Structured MCP tool results no longer add `<UNTRUSTED-CONTENT>` wrappers or
-rewrite delimiter-looking text inside string fields. Tool-result content remains
-user-controlled data, but clients must convey that trust boundary outside domain
-values instead of recognizing or removing marker strings.
-
-Clients that handled the former delimiter convention should stop stripping marker
-text: the same text can be legitimate stored content. Response models and content
-types are unchanged, and no metadata-database migration is required. Automated
-read-modify-write workflows should be paused or pinned away from older instances
-until every serving instance is upgraded; a mixed-version response has no reliable
-signal that tells a client whether its text is decorated. Redis-backed MCP response
-caches use a new internal namespace after the upgrade, so upgraded instances do not
-reuse older cached results.
-
-Values that a client already wrote back with presentation wrappers cannot be
-distinguished safely from intentional content. Operators should review possible
-`<UNTRUSTED-CONTENT>` / `</UNTRUSTED-CONTENT>` wrappers and
-`[ESCAPED-UNTRUSTED-CONTENT-OPEN]` /
-`[ESCAPED-UNTRUSTED-CONTENT-CLOSE]` substitutions rather than applying an automatic
-marker-removal migration.
-
-### OAuth2 database callback metrics include their outcome
-
-The unqualified `DatabaseRestApi.oauth2` StatsD counter has been replaced with
-`DatabaseRestApi.oauth2.success`, `DatabaseRestApi.oauth2.warning`, and
-`DatabaseRestApi.oauth2.error`. Update monitoring rules and dashboards that consume
-the old counter to use the outcome-specific replacements.
-
- [42930](https://github.com/apache/superset/pull/42930): Dataset import data-URI fetches no longer honor an HTTP(S) proxy when `DATASET_IMPORT_ALLOW_INTERNAL_DATA_URLS` is `False` (the default): the connection is now made directly to the destination so the peer-address check validates the real target instead of a proxy's. Deployments that require an egress proxy to reach legitimate external data URLs for dataset import should set `DATASET_IMPORT_ALLOW_INTERNAL_DATA_URLS = True` or otherwise ensure those URLs resolve without one.
- [42935](https://github.com/apache/superset/pull/42935): The MCP service now refuses to start (`MCPAuthConfigError`) when `MCP_JWT_ISSUER` trusts more than one issuer and no `MCP_USER_RESOLVER` is configured, instead of only logging a warning. This was already a documented misconfiguration (the default resolver isn't issuer-scoped, so distinct trusted issuers minting the same username/email would resolve to the same Superset user); deployments trusting multiple issuers must configure an `MCP_USER_RESOLVER` that derives its identity from the token's `iss` claim before upgrading. Single-issuer deployments are unaffected.
- [42429](https://github.com/apache/superset/pull/42429): The Country Map chart's Iran GeoJSON now gives Alborz province its own ISO 3166-2 code, `IR-32`, instead of `IR-30`. `ISO` is the join key used to color/filter provinces on this chart, so any existing dataset keyed on `IR-30` for Alborz will silently stop matching after upgrading; re-key that data to `IR-32`.
- [43388](https://github.com/apache/superset/pull/43388): The MCP service now refuses to start (`MCPAuthConfigError`) if `MCP_DEV_USERNAME` and `MCP_AUTH_ENABLED = True` are both set, and separately if `MCP_AUTH_ENABLED = True` but no usable JWT key material is configured (RSA key/JWKS, or an explicit `MCP_JWT_SECRET` for HMAC) — both previously started with authentication silently weaker than configured. Deployments combining a dev-mode username with JWT auth enabled, or enabling JWT auth without key material, must pick one before upgrading: unset `MCP_DEV_USERNAME` for a real auth deployment, or unset `MCP_AUTH_ENABLED` (or configure the key material) for a dev-mode one. Response caching (`MCP_CACHE_CONFIG["enabled"] = True`) now also excludes every tool with a side effect by default, not only a partial list, so a previously-cached mutating tool call is no longer served from cache; no config change is needed to pick this up.
- [42393](https://github.com/apache/superset/pull/42393): Exported dataset YAML now carries a `uuid` for each metric and column so that custom folder assignments (which reference metrics/columns by UUID) survive an import into another workspace. This affects any export bundle that contains datasets, not just a dataset export: chart, dashboard, database and full-asset exports all embed the same dataset YAML, so a dashboard exported from this release also fails to import into an older one even though no dataset was exported directly. As with `folders` and `currency_code_column`, the affected `datasets/` files fail schema validation (`Unknown field: uuid`) when imported into Superset releases that predate this change; regenerate or hand-edit exports for older targets in mixed-version fleets.
- [42300](https://github.com/apache/superset/pull/42300): Timeseries charts (line/area/bar) with a Y-axis bound in effect — either an explicit `yAxisBounds` or one derived from `truncateYAxis` — now clamp out-of-range data points to that bound instead of letting ECharts drop the point (and the line segments around it) entirely. Any existing chart with a configured Y-axis bound and data outside it will look different after upgrading: a gap becomes a point pinned to the boundary. The clamp also rewrites the value ECharts reads for that point's tooltip and data label, so the displayed value is the bound rather than the true observation.
- [42087](https://github.com/apache/superset/pull/42087): Stored calculated-column and metric expressions are validated when a query is built, under the same sub-query policy already applied to adhoc expressions. Previously only the dataset update path checked them on save, so expressions written by v1 import, by dataset duplication, or before that check existed were never validated. Since `ALLOW_ADHOC_SUBQUERY` defaults to `False` (see [19242](https://github.com/apache/superset/pull/19242)), a dataset whose stored expression contains a sub-query works before upgrading and afterwards fails at chart render with `Custom SQL fields cannot contain sub-queries.` There is no migration step, and the error does not name the offending dataset column, so audit stored expressions before upgrading: either rewrite them without the sub-query, or set `ALLOW_ADHOC_SUBQUERY = True` to keep the previous behaviour for both stored and adhoc expressions.
-
-### Selenium support removed — Playwright is now required for screenshots
-
-Selenium support has been removed. **Playwright is now required** for all
-report and thumbnail screenshot generation. Install it with:
-
-```bash
-pip install playwright && playwright install chromium
-```
-
-**Breaking config changes:**
-
- `PLAYWRIGHT_REPORTS_AND_THUMBNAILS` feature flag removed (Playwright is the only backend now)
- `WEBDRIVER_TYPE` config key removed (Playwright always uses Chromium)
- `WEBDRIVER_CONFIGURATION` config key removed (Selenium-only)
- `SCREENSHOT_PAGE_LOAD_WAIT` config key removed (Selenium-only)
- `SCREENSHOT_SELENIUM_RETRIES` config key removed (Selenium-only)
- `SCREENSHOT_WAIT_FOR_ERROR_MODAL_VISIBLE` config key removed (Selenium-only)
- `SCREENSHOT_WAIT_FOR_ERROR_MODAL_INVISIBLE` config key removed (Selenium-only)
- `MachineAuthProvider.authenticate_webdriver()` removed; use `authenticate_browser_context()` instead
-
-**What operators should do before upgrading:**
-
-1. Install Playwright: `pip install playwright && playwright install chromium`
-2. Remove any references to the removed config keys from custom `superset_config.py`
-3. If you subclassed `MachineAuthProvider`, remove any `authenticate_webdriver` override and migrate auth logic to `authenticate_browser_context`
-
-### CSV/XLSX report exports of Table charts keep raw numeric values
-
-Table and Pivot Table charts sent as text in a report email now apply the
-chart's number and currency formatting so the values match what a user sees in
-Explore. As part of this, the CSV and XLSX result formats return early before
-formatting: previously the Table post-processor applied `d3NumberFormat` to
-every result format, so CSV/XLSX exports contained pre-formatted strings.
-CSV/XLSX exports now preserve numeric values and column types, which is better
-for downstream analysis but is a visible change for anyone who relied on the
-formatted text in those files. The rendered email body (the only place the
-formatting is intended for) is unaffected.
-
-### SQLAlchemy bumped to 2.0, flask-sqlalchemy to 3.1.1
-
-Superset's core ORM dependencies move from SQLAlchemy 1.4 to 2.0 and
-flask-sqlalchemy `<3.0` to 3.1.1, completing the migration tracked in
-[discussion #40273](https://github.com/apache/superset/discussions/40273).
-
-**Custom `db_engine_specs`, plugins, or extensions that import SQLAlchemy
-internals directly** should review the
-[SQLAlchemy 1.4-to-2.0 migration guide](https://docs.sqlalchemy.org/en/20/changelog/migration_20.html)
-for API changes that affect them — most 1.4 code already runs unmodified
-under 2.0's compatibility mode, but patterns like `Engine.execute()`,
-string-keyed `Row` access, and `MetaData(bind=)` are removed outright.
-
-**Several optional DB-connector extras remain capped below their
-SQLAlchemy-2.0-only releases**, either because that bump is a separate
-follow-up ([#42891](https://github.com/apache/superset/pull/42891): dremio,
-exasol, firebird, redshift, risingwave) or because the upstream dialect
-package has no SQLAlchemy 2.0 support yet at all (aurora-data-api, d1,
-kusto, solr; ocient's 2.0 compatibility is unverified). Installing one of
-these extras continues to pull a SQLAlchemy-1.4-line version of that
-dialect; each package's constraint in `pyproject.toml` documents why.
-
-No application-level configuration changes are required for deployments
-that don't touch SQLAlchemy directly.
-
-### New metric aggregates: MEDIAN, Sample Standard Deviation, Sample Variance
-
-`MEDIAN`, `STDDEV_SAMP`, and `VAR_SAMP` are now available anywhere a metric
-aggregate is chosen (every chart type, SQL Lab, MCP), not only in Pivot
-Table's controls. Support is opt-in per database engine *spec class*,
-verified against a live instance before being enabled: Postgres, MySQL
-(`STDDEV_SAMP`/`VAR_SAMP` only, no `MEDIAN`), DuckDB, and Redshift (inherits
-Postgres's support, not yet separately verified) ship enabled in this
-release. Engine specs that subclass one of those (e.g. MariaDB, Aurora
-MySQL/Postgres, TimescaleDB) inherit the same support, on the same
-not-yet-independently-verified basis. Picking one of these aggregates on a
-database that has not opted in returns a clear "not supported on this
-database" error rather than a failed query. See
-`docs/sip/median-stddev-variance-aggregates.md` for the full design
-rationale, including why this is safe to add without reintroducing the
-totals/subtotals correctness bug fixed by #41184 (SIP-216).
-
-### Soft delete is on by default, and purging is live
-
-`SOFT_DELETE` now ships **on** (`DEFAULT_FEATURE_FLAGS`), so deleting a
-dashboard, chart, or dataset archives it rather than removing it. Archived
-objects are hidden from normal listings, recoverable from **Recently Archived**,
-and permanently removed once the retention window elapses.
-`SOFT_DELETE_PURGE_DRY_RUN` also flips to `False`, so the nightly
-`deletion_retention.purge_soft_deleted` task deletes for real instead of only
-logging `would_purge` counts.
-
-**What operators should do before upgrading:**
-
- **Size the first live purge.** The first real run removes every entity that
-  aged past `SOFT_DELETE_RETENTION_DAYS` (default 30) since soft delete began
-  capturing, which on a busy deployment can be a large batch in one window. To
-  see the size first, set `SOFT_DELETE_PURGE_DRY_RUN = True`, read the
-  `would_purge` counts from one nightly run, then set it back.
- **Check a replaced `CELERY_CONFIG`.** A deployment that redefines it rather
-  than inheriting must carry both `superset.tasks.deletion_retention` in
-  `imports` and the `deletion_retention.purge_soft_deleted` beat entry;
-  a startup warning now names whichever is absent.
-
-**Both switches are retained.** `SOFT_DELETE = False` restores hard-delete
-behaviour and `SOFT_DELETE_PURGE_DRY_RUN = True` suspends purging, at any time.
-One caveat on turning soft delete back off: objects archived while it was on are
-**resurrected** into normal listings, since the rows were never removed — an
-emergency stop rather than a clean rollback.
-
-### Version history is on by default
-
-`VERSION_HISTORY` and `ENABLE_VERSIONING_CAPTURE` now both ship **on**. Every
-save of a chart, dashboard, or dataset writes version rows, and the version
-history panel appears on Explore and Dashboard pages. The two flip together
-deliberately: a panel with capture off renders an empty "No history yet" that
-misrepresents the entity as unchanged.
-
-**What operators should expect:**
-
- **Storage growth.** Capture writes shadow rows per save, so the metadata
-  database grows with edit volume. The `version_history.prune_old_versions`
-  beat task removes rows whose transaction is older than
-  `SUPERSET_VERSION_HISTORY_RETENTION_DAYS` (default 30).
- **Check a replaced `CELERY_CONFIG`.** Carry both the
-  `superset.tasks.version_history_retention` import and the
-  `version_history.prune_old_versions` beat entry; see
-  [Version-history retention (pruning)](#version-history-retention-pruning) for
-  the startup-warning behavior.
- **`PUT` responses change shape.** Entity updates now return populated
-  `old_version_uuid` / `new_version_uuid` fields and an `ETag` header, which
-  were null or absent while capture was off.
-
-`ENABLE_VERSIONING_CAPTURE` is **retained permanently** as an operational
-kill-switch — not removed with the rollout toggles. Setting it to a falsy value
-stops capture within a restart, without a revert-and-redeploy. Unlike the
-soft-delete toggle, turning it off is a clean stop: existing version rows remain
-readable and no entity state is altered. Restore is unavailable (404) while
-capture is off. A full rollback also sets
-`FEATURE_FLAGS = {"VERSION_HISTORY": False}` to hide the panel — capture off
-with the panel left on shows an empty or stale history.
-
 ### Scheduled report execution now enforces one application deadline

 Scheduled report (not alert) executions are now governed by a single
@@ -441,62 +49,8 @@ Behavior changes to be aware of:
  fail fast at the first phase check rather than erroring at setup.
 - Dashboard reports whose charts have not mounted are no longer captured
  blank: readiness is polled until the deadline, and the report fails loudly
-  if charts never mount. Large tiled reports also retry Chromium screenshot
-  stalls and suspicious uniform tiles, while persistent screenshot timeouts
-  fail loudly. Large tiled thumbnails use the same bounded retries, but retain
-  their previous failure contract after a persistent timeout.
-
-### Embedded (guest token) API responses no longer echo database errors
-
-API responses served to a guest-token principal now carry a generic
-`An error occurred while fetching the data.` in place of the underlying error
-(`You don't have permission to access this resource.` on a 401/403), and drop
-the `stacktrace` and error `extra` payloads. Engine errors routinely quote
-catalog, schema, table and column names of the warehouse, which embedded
-viewers should not see. Errors Superset authors itself — access denials, OAuth2
-redirects, timeouts, payload validation — keep their message and type, though
-their `extra` is still reduced to the fields the client needs. Responses to
-every non-guest principal are unchanged, and the full error is still logged
-server-side.
-
-### `UnsavedChangesModal` no longer accepts a `zIndex` prop
-
-`@superset-ui/core`'s `UnsavedChangesModal` dropped its `zIndex` prop (and the
-hardcoded default it fed) in favor of letting Ant Design's own stacking
-handle placement. Callers passing `zIndex` to override the modal's layering
-will now get a TypeScript error and must remove the prop; keeping a manual
-override was exactly the footgun this change removes (see #42510). No
-callers in the Superset frontend codebase itself passed this prop.
-
-### Row-level security now filters table reads a same-named CTE used to hide
-
-`extract_tables_from_statement()` decided whether a reference was a CTE by matching its
-bare name against the enclosing scope's CTE names; it now resolves the name through
-`Scope.cte_sources`. Three kinds of real table read whose bare name collided with a CTE's
-were mistaken for the CTE and dropped from a statement's tables, so they were neither
-RLS-filtered nor access-checked: a schema- or catalog-qualified reference, a non-recursive
-CTE's own name inside its body, and a forward reference to a later `WITH` item.
-
-```sql
-WITH orders AS (SELECT 1 AS d) SELECT * FROM (SELECT * FROM public.orders) AS z
-WITH orders AS (SELECT * FROM orders) SELECT * FROM orders
-WITH q1 AS (SELECT key FROM q2), q2 AS (SELECT 1 AS key) SELECT * FROM q1
-```
-
-Each read is now reported, so it is filtered when `RLS_IN_SQLLAB` is enabled, matched
-against `DISALLOWED_SQL_TABLES`, and requires dataset access under
-`raise_for_access(force_dataset_match=True)`. A query that previously ran, reading those
-rows unfiltered, may now be filtered or rejected. There is no opt-out — the previous
-behavior was a row-level-security bypass.
-
-### Table aliases keep their quoting through the row-level security rewrite
-
-Both RLS transformers took the table alias as a string with its quoting stripped and
-emitted it verbatim; they now carry the parsed identifier. Emitted SQL is unchanged for an
-unquoted identifier; a quoted one keeps its quoting, and a column-alias list
-(`FROM t AS x (c1, c2)`) survives the rewrite instead of being dropped. This repairs
-row-level security for any aliased table on Snowflake, and for at least one statement shape
-on MSSQL where the rewrite previously raised `AttributeError`.
+  if charts never mount. Thumbnails and non-report screenshots keep their
+  previous behavior.

 ### Principal listing APIs now honour related-field filters

@@ -546,24 +100,12 @@ A new dashboard action exports every chart's data to a single multi-sheet
 requires a running Celery worker and a configured SMTP transport, since the task
 emails the requesting user a pre-signed download link. New config keys:
 `EXCEL_EXPORT_S3_BUCKET`, `EXCEL_EXPORT_S3_KEY_PREFIX`,
-`EXCEL_EXPORT_LINK_TTL_SECONDS`, `EXCEL_EXPORT_S3_CLIENT_KWARGS`,
-`EXCEL_EXPORT_TABLE_VIZ_TYPES`, and `EXCEL_EXPORT_QUERY_CONTEXT_BUILDER`.
+`EXCEL_EXPORT_LINK_TTL_SECONDS`, `EXCEL_EXPORT_S3_CLIENT_KWARGS`, and
+`EXCEL_EXPORT_TABLE_VIZ_TYPES`.

 The feature depends on `boto3`, which is **not** installed by default; install it
 with `pip install apache-superset[excel-export]`.

-Charts store their `query_context` only once they have been (re-)saved in
-Explore, so older charts may have none. For a fixed, conservative set of viz
-types (`table`, `big_number_total`, `big_number`, `pie`) the export rebuilds a
-query context from the chart's saved form data so those charts still export.
-The rebuild is a single-query mapping and does **not** reproduce plugin
-post-processing (pivot, rolling, forecast) or multi-query charts, so any chart of
-another type without a saved query context is skipped and listed in the email for
-the user to re-save. To cover those types, set `EXCEL_EXPORT_QUERY_CONTEXT_BUILDER`
-to a callable that receives the chart's form data and returns a query-context
-payload (or `None` to fall back to the built-in rebuild) — for example one backed
-by a service that runs the chart's real frontend `buildQuery`.
-
 A second mode, **Export Images to Excel**, embeds non-table charts as rendered
 images (which viz types stay tabular is controlled by
 `EXCEL_EXPORT_TABLE_VIZ_TYPES`). It renders through the headless webdriver, so the
@@ -719,10 +261,6 @@ are the intended model going forward; deprecating and removing implicit viewersh
 in a later major version.

 - [41044](https://github.com/apache/superset/issues/41044): Removes the deprecated `AVOID_COLORS_COLLISION` feature flag (it defaulted to `True`). Color-collision avoidance is now permanently enabled; any config override setting it to `False` is ignored.
- [41714](https://github.com/apache/superset/pull/41714): **Breaking — the legacy `explore_json` chart-data pipeline is removed** at its long-declared `5.0.0` EOL. The `/superset/explore_json/` and `/superset/explore_json/data/<cache_key>` endpoints, `superset/viz.py`, the `Slice.viz` property, the `get_viz` factory, the `load_explore_json_into_cache` celery task and the `viz=` overload of `security_manager.raise_for_access` are gone. Anything importing `superset.viz` must migrate to the QueryContext / `pandas_postprocessing` pipeline behind `/api/v1/chart/data`. All 15 remaining legacy charts were migrated first: most keep their `viz_type` and renderer (no action needed for saved charts), while saved nvd3 Bubble charts are auto-migrated to the ECharts Bubble Chart (`bubble_v2`) and saved "Time-series Percent Change" (`compare`) charts to the ECharts Line Chart, which restores the nvd3 renderer's interactive percent re-basing via a draggable baseline. The deck.gl Multiple Layers chart now fetches its layers entirely client-side, refitting the viewport as each layer's data arrives, and caps the number of sub-slices fanned out per chart at `DECK_MULTI_MAX_SLICES` (default 50, configurable); dashboard filter badges no longer aggregate child-layer filter metadata.
-
- [41714](https://github.com/apache/superset/pull/41714): Charts migrated in place keep a `NULL` saved query context until they are next opened in Explore (which regenerates it automatically) or re-saved. Until then, cache warm-up and annotation layers referencing such a chart report an actionable error rather than warming/rendering; opening the chart once resolves it.
- [41714](https://github.com/apache/superset/pull/41714): **Breaking for third-party viz plugins** — the `useLegacyApi` field of `ChartMetadata` in `@superset-ui/core` is removed. Plugins that set it must provide a `buildQuery` and consume `/api/v1/chart/data`. The migrated first-party packages also drop their `legacy-` prefix: `@superset-ui/legacy-plugin-chart-{calendar,chord,country-map,horizon,paired-t-test,parallel-coordinates,partition,rose,world-map}` → `@superset-ui/plugin-chart-*`, and `@superset-ui/legacy-preset-chart-nvd3` → `@superset-ui/preset-chart-nvd3`. The `can_explore_json` permission is no longer created or granted; custom roles referencing it should switch to the `can_read` permissions on `Chart`.

 - [41813](https://github.com/apache/superset/pull/41813): `redis` (the Python client, `redis-py`) is bumped from 5.3.1 to 8.0.1. redis-py 8 changes several connection defaults; Superset's own Redis-backed features (`GLOBAL_ASYNC_QUERIES_CACHE_BACKEND`, `DISTRIBUTED_COORDINATION_CONFIG`, and the MCP Redis store) explicitly pin the pre-upgrade behavior so this bump is a no-op for them: the wire protocol stays RESP2 (not the new RESP3 default, which requires Redis/Sentinel 6+ to speak `HELLO`) and there is still no socket timeout by default (redis-py 8 defaults to 5s, which could otherwise newly time out large cached payloads or slow networks). The no-timeout default can now be overridden via two new config keys, `CACHE_REDIS_SOCKET_TIMEOUT` / `CACHE_REDIS_SOCKET_CONNECT_TIMEOUT`, on any `CacheConfig` dict using `CACHE_TYPE: RedisCache` or `RedisSentinelCache`. Separately, redis-py 6+ changed the default for `ssl_check_hostname` from `False` to `True` for SSL connections using `ssl_cert_reqs="required"` (the default) — this is a security improvement, so it has **not** been reverted; deployments with `CACHE_REDIS_SSL=True` whose certificates lack a hostname matching the connection address should set `CACHE_REDIS_SSL_CERT_REQS="none"` (disables cert verification entirely, matching hostname-check bypass) or replace the certificate. General-purpose cache/results backends configured via `CACHE_CONFIG` / `DATA_CACHE_CONFIG` / `RESULTS_BACKEND` with `CACHE_TYPE: RedisCache` go through `flask-caching`'s own Redis backend (outside Superset's code) and are subject to the same new defaults; pass `socket_timeout` / `protocol` via `CACHE_OPTIONS` there if needed. Celery broker and result-backend connections (built by `kombu`, also outside Superset's code) keep their no-socket-timeout behavior (`kombu` passes `socket_timeout=None` explicitly) but do **not** pin the wire protocol, so they follow redis-py's RESP3 default — which requires a Redis server new enough to speak `HELLO` (Redis 6+). Deployments using a pre-6.0 Redis server (EOL) as a Celery broker should upgrade the server before taking this bump.

@@ -742,7 +280,7 @@ in a later major version.

 - **`SqlaTable.sql_url` query-string format.** `SqlaTable.sql_url` now URL-encodes `table_name` and joins it as a query parameter rather than concatenating a second `?`. Previously, with `Database.sql_url` returning `/sqllab/?dbid=<id>`, the concatenation produced `/sqllab/?dbid=<id>?table_name=<raw>` — a malformed second `?` that broke the query parser. External code that parsed the legacy `<base>?table_name=<raw>` shape now sees properly percent-encoded values (e.g. `/` → `%2F`, ` ` → `+` or `%20`); decode with `urllib.parse.parse_qsl`.

- **New config flag `EMBEDDED_DISABLE_PERMALINK_ORIGIN_REWRITE` (default `False`).** Share/permalink URLs now substitute `window.location.origin` for the backend-supplied origin so a proxied or subdirectory-deployed Superset never hands the user an unreachable internal hostname. Operators whose reverse proxy correctly forwards `X-Forwarded-Host` _and_ who want permalinks to carry the backend's literal origin can opt out by setting `EMBEDDED_DISABLE_PERMALINK_ORIGIN_REWRITE = True` in `superset_config.py`. Default `False` (rewrite is on); flipping the default would regress the dominant proxied/subdir deployment to an unreachable host.
+- **New config flag `EMBEDDED_DISABLE_PERMALINK_ORIGIN_REWRITE` (default `False`).** Share/permalink URLs now substitute `window.location.origin` for the backend-supplied origin so a proxied or subdirectory-deployed Superset never hands the user an unreachable internal hostname. Operators whose reverse proxy correctly forwards `X-Forwarded-Host` *and* who want permalinks to carry the backend's literal origin can opt out by setting `EMBEDDED_DISABLE_PERMALINK_ORIGIN_REWRITE = True` in `superset_config.py`. Default `False` (rewrite is on); flipping the default would regress the dominant proxied/subdir deployment to an unreachable host.

 - [41651](https://github.com/apache/superset/pull/41651): **New do-not-translate standard for translation catalogs.** Strings that must stay identical to the source — icon names (e.g. `bolt`), enum/option values (`step-after`), SQL keywords, API field names (`error_message`), code constants, and example placeholders — are now marked with a `#. do-not-translate` extracted comment. The list lives in the `superset/translations/do-not-translate.txt` registry; `scripts/translations/apply_do_not_translate.py` stamps the marker onto `messages.pot` during `babel_update.sh`, and `pybabel update` propagates it to every `.po`, so the status is consistent across all languages. The AI backfill (`backfill_po.py`) and translators leave these entries untranslated (source fallback). The legacy per-catalog convention (a `# Не переводить` translator comment in the `ru` catalog) is still honored for back-compat but is superseded by this standard; contributors adding new machine-read strings should add the msgid to the registry rather than annotating individual catalogs.

@@ -779,7 +317,7 @@ Theme tokens are unaffected — antd 6 removed none of the tokens Superset expos

 ### Guest-token RLS rules reject unknown fields

-The `rls` rules passed to `POST /api/v1/security/guest_token/` are now validated strictly: a rule may only contain `dataset` and `clause`. Previously unknown fields were silently dropped, so a mistyped or legacy scope key (most commonly `datasource` instead of `dataset`) produced a rule with no `dataset`, which is treated as a _global_ rule applied to every dataset the embedded resource can reach. Such a request now returns HTTP 400 identifying the offending field instead of issuing a token with an unintended global rule. Integrators that were sending extra fields in RLS rules must remove them; valid dataset-scoped (`{"dataset": 41, "clause": "..."}`) and global (`{"clause": "..."}`) rules are unaffected.
+The `rls` rules passed to `POST /api/v1/security/guest_token/` are now validated strictly: a rule may only contain `dataset` and `clause`. Previously unknown fields were silently dropped, so a mistyped or legacy scope key (most commonly `datasource` instead of `dataset`) produced a rule with no `dataset`, which is treated as a *global* rule applied to every dataset the embedded resource can reach. Such a request now returns HTTP 400 identifying the offending field instead of issuing a token with an unintended global rule. Integrators that were sending extra fields in RLS rules must remove them; valid dataset-scoped (`{"dataset": 41, "clause": "..."}`) and global (`{"clause": "..."}`) rules are unaffected.

 ### MCP service requires `MCP_JWT_AUDIENCE` when JWT auth is enabled

@@ -877,10 +415,9 @@ ALTER TABLE tagged_object DROP CONSTRAINT <constraint_name>;
 -- MySQL: find names via `SHOW CREATE TABLE tagged_object;`
 ALTER TABLE tagged_object DROP FOREIGN KEY <constraint_name>;
 ```
+### Entity version-history infrastructure (gated off by default)

-### Entity version-history infrastructure
-
-Introduces the schema and SQLAlchemy-Continuum wiring that captures version history for charts, dashboards, and datasets, plus read-only `GET /api/v1/{chart,dashboard,dataset}/<uuid>/versions/` endpoints. Capture is governed by the `ENABLE_VERSIONING_CAPTURE` config value — an operational kill-switch (a release toggle that became a permanent ops switch), not a feature flag; see "Version history is on by default" above for the shipped default. With capture off, no save writes version rows; the endpoints continue to serve already-captured rows read-only. The migration is additive; existing entity `PUT` responses gain `old_version_uuid` / `new_version_uuid` body fields and an `ETag` header (both null/absent when capture is off).
+Introduces the schema and SQLAlchemy-Continuum wiring that captures version history for charts, dashboards, and datasets, plus read-only `GET /api/v1/{chart,dashboard,dataset}/<uuid>/versions/` endpoints. This ships **inert**: a new config flag `ENABLE_VERSIONING_CAPTURE` defaults to `False`, so no save writes any version rows and the endpoints return empty. It is an operational kill-switch (a release toggle that becomes a permanent ops switch), not a feature flag — set it to `True` to enable capture once validated. The migration is additive; existing entity `PUT` responses gain `old_version_uuid` / `new_version_uuid` body fields and an `ETag` header (both null/absent when capture is off).

 A few save- and import-path internals change **unconditionally** (independent of the flag), because the versioned mappers must behave correctly whether or not capture is enabled:

@@ -894,14 +431,14 @@ These are behavior changes that take effect on upgrade regardless of `ENABLE_VER

 A read-only companion to the version-history endpoints: each entity type gains a `GET /api/v1/{chart,dashboard,dataset}/<uuid>/activity/` endpoint returning a chronological, access-filtered stream of edits — the entity's own edits plus, for charts and dashboards, transitive edits to related entities during their association windows. Datasets have no related layer in V2, so `include=related` returns an empty stream for a dataset and `include=all` reduces to the dataset's own edits.

-| Param                | Type                         | Default    | Purpose                                                                                                |
-| -------------------- | ---------------------------- | ---------- | ------------------------------------------------------------------------------------------------------ |
-| `since` / `until`    | ISO 8601                     | —          | Bound `issued_at`                                                                                      |
-| `include`            | `self` \| `related` \| `all` | `all`      | Own edits, related edits, or both                                                                      |
-| `q`                  | string                       | —          | Case-insensitive search over the full history, applied before pagination (so `count` reflects matches) |
-| `page` / `page_size` | integer                      | `0` / `25` | Pagination (`page_size` clamped to 200)                                                                |
+| Param | Type | Default | Purpose |
+|---|---|---|---|
+| `since` / `until` | ISO 8601 | — | Bound `issued_at` |
+| `include` | `self` \| `related` \| `all` | `all` | Own edits, related edits, or both |
+| `q` | string | — | Case-insensitive search over the full history, applied before pagination (so `count` reflects matches) |
+| `page` / `page_size` | integer | `0` / `25` | Pagination (`page_size` clamped to 200) |

-Authorization reuses the resource's `can_read` permission and per-object `raise_for_access`; related-entity rows are visibility-filtered to what the caller may see. The stream reflects captured history; with capture off it remains readable but stops accruing new entries.
+Authorization reuses the resource's `can_read` permission and per-object `raise_for_access`; related-entity rows are visibility-filtered to what the caller may see. The stream is empty unless version capture is on (`ENABLE_VERSIONING_CAPTURE`).

 ### Version-history retention (pruning)

@@ -911,17 +448,17 @@ Entity version history (the `version_transaction` / `*_version` shadow tables th
 |---|---|---|
 | `SUPERSET_VERSION_HISTORY_RETENTION_DAYS` | `30` | Version rows whose owning `version_transaction.issued_at` is older than this many days are pruned. Each entity's live row (`end_transaction_id IS NULL`) is always preserved, as are the live rows of its children and associations; closed historical rows (including the baseline) age out. Set to `0` or a negative value to disable pruning. |

-The task ships in the default `CeleryConfig` (both the `superset.tasks.version_history_retention` import and the beat entry). A deployment that overrides `CELERY_CONFIG` without the beat entry logs a startup warning. When the override explicitly defines `imports`, a missing retention module is also reported; an absent `imports` setting is not diagnosed because Celery may register tasks through `include`, autodiscovery, or worker startup imports. Retention only prunes whatever history exists — capture itself is gated separately by `ENABLE_VERSIONING_CAPTURE`, which now ships on.
+The task ships in the default `CeleryConfig` (both the `superset.tasks.version_history_retention` import and the beat entry). A deployment that overrides `CELERY_CONFIG` without the beat entry logs a startup warning. When the override explicitly defines `imports`, a missing retention module is also reported; an absent `imports` setting is not diagnosed because Celery may register tasks through `include`, autodiscovery, or worker startup imports. Retention only prunes whatever history exists — capture itself is gated separately by `ENABLE_VERSIONING_CAPTURE` (ships off).

 ### Deletion retention (soft-deleted entities are eventually purged)

 Soft-deleted dashboards, charts, and datasets are now permanently removed after a retention window (default 30 days; `SOFT_DELETE_RETENTION_DAYS`, `0` disables; settable per workspace at runtime via the `deletion-retention set-window` CLI, which takes precedence). The `deletion_retention.purge_soft_deleted` Celery beat task runs daily and removes each aged-out entity together with its M:N join rows, owned children, datasource permission, and version-history shadow rows. After purge an entity is **unrecoverable** — its detail and `/restore` endpoints return 404 and its version history is gone.

-Purging is **live by default** (`SOFT_DELETE_PURGE_DRY_RUN=False`), so the retention promise above is real on a stock deployment. Set it to `True` to have the task log `would_purge` counts and delete nothing — the lever is retained, so an operator can return to dry-run at any time. Note `would_purge` is an **upper bound** — it counts every entity past the retention window without evaluating deletion blockers, so a real run may purge fewer (entities referenced by report schedules or set as a user's welcome dashboard are blocked and reported separately). The task only acts while the `SOFT_DELETE` rollout flag is on; it now ships on by default.
+The introducing release **defaults to dry-run** (`SOFT_DELETE_PURGE_DRY_RUN=True`): the task logs `would_purge` counts but deletes nothing, so operators can validate against production before activating real purging by setting it to `False`. Note `would_purge` is an **upper bound** — it counts every entity past the retention window without evaluating deletion blockers, so a real run may purge fewer (entities referenced by report schedules or set as a user's welcome dashboard are blocked and reported separately). The task only acts while the temporary `SOFT_DELETE` rollout flag is on.

 Deployments that replace the default `CELERY_CONFIG` must ensure workers register `superset.tasks.deletion_retention` and schedule the `deletion_retention.purge_soft_deleted` task themselves. The shipped Docker development config uses `imports` and includes both entries. While `SOFT_DELETE` is statically enabled, a missing beat entry logs a startup warning; when the override explicitly defines `imports`, a missing purge module is also reported.

-Operators can immediately erase a specific entity for compliance (GDPR) via `superset deletion-retention force-purge --uuid <uuid>`; this applies legacy hard-delete semantics — a live chart referencing a force-purged dataset is left without a datasource until re-pointed (the chart is not modified), and it purges the named entity even when it was never soft-deleted. Every scheduled evaluation writes a provisional, content-free record to the new `purge_audit_log` table before the cascade starts. Meaningful retained outcomes survive the entity they name. Blocked audit records carry a stable machine-readable `reason` code (`report_schedule`, `user_attribute`, or `cascade_integrity_failure` for an unexpected cascade failure caused by a database integrity constraint) so the audit table alone answers why an entity was not purged; records finalized before the column existed keep a NULL reason. Apply the migration before rolling out the new code: the audit model declares the column, so a worker on the new code with an un-migrated table fails its write-ahead write and the scheduled purge fails closed until the migration lands. During a rolling deploy, workers still on the old code write reason-less blocked rows and suppress on status alone; both effects are self-healing, since a NULL-reason record never matches a reason code and the next all-new-code run re-anchors the entity. Consecutive scheduled evaluations blocked with the same status **and reason** suppress only the redundant current provisional record — a reason change writes one new blocked record carrying the new code; completed outcomes, outcome transitions, and every force-purge attempt remain independent and immutable. Retained transition records are not automatically expired, so entities whose block reason changes repeatedly can accumulate multiple audit rows. The **scheduled** purge fails closed when its provisional record cannot be written, while **force-purge** proceeds even if the audit write fails — the operator is present and deletion outranks audit for a compliance erasure. Operators can monitor `deletion_retention.blocked_audit_suppressed` and `deletion_retention.blocked_audit_dedupe_fallback` to verify suppression and fail-safe fallback behavior without changing the existing blocked-workload gauge.
+Operators can immediately erase a specific entity for compliance (GDPR) via `superset deletion-retention force-purge --uuid <uuid>`; this applies legacy hard-delete semantics — a live chart referencing a force-purged dataset is left without a datasource until re-pointed (the chart is not modified), and it purges the named entity even when it was never soft-deleted. Every purge writes an immutable, content-free audit record to the new `purge_audit_log` table that survives the entity it names: the **scheduled** purge fails closed (an entity whose audit row cannot be written is skipped and retried next run), while **force-purge** proceeds even if the audit write fails — the operator is present and deletion outranks audit for a compliance erasure.

 ### Recently Archived view and permanent delete (purge) endpoints

@@ -983,7 +520,6 @@ Operators can tune or disable the policy via config:
 ### Data uploads bounded by UPLOAD_MAX_FILE_SIZE_BYTES

 Single data-file uploads (CSV, Excel, columnar) are now bounded by the `UPLOAD_MAX_FILE_SIZE_BYTES` config option, which defaults to `100 * 1024 * 1024` (100 MB). Files larger than this are rejected with a `413` before their contents are buffered into memory. Set `UPLOAD_MAX_FILE_SIZE_BYTES = None` to disable the check and restore unbounded uploads.
-
 ### Currency symbol position follows the locale when unset

 When a chart's currency control leaves the **Prefix or suffix** field empty, the currency symbol position is now derived from the deployment locale's own convention via `Intl.NumberFormat` instead of always defaulting to a suffix. For example, under the default `en-US` locale `USD`, `GBP`, and `EUR` render as a prefix (`$ 1,000`), while eurozone locales such as `fr-FR` render `EUR` as a suffix (`1 000 €`). An explicit Prefix/Suffix selection is always honored and is unaffected.
@@ -1109,7 +645,7 @@ SQLALCHEMY_ENCRYPTED_FIELD_ENGINE = "aes"
   ```bash
   superset re-encrypt-secrets --engine aes-gcm
   ```
-   A live instance keeps writing _new_ secrets as AES-CBC during the window between step 2 and the restart in step 4; this second pass sweeps those up (it is idempotent, so already-migrated values are skipped).
+   A live instance keeps writing *new* secrets as AES-CBC during the window between step 2 and the restart in step 4; this second pass sweeps those up (it is idempotent, so already-migrated values are skipped).

 Schedule the cutover in a quiet window. Runtime reads use only the single configured engine, so in a multi-worker deployment there is an unavoidable brief decrypt-outage between the migration commit and the last worker restarting with the new config — each migrator run is transactional, but the fleet-wide cutover is not zero-downtime.

@@ -1117,7 +653,7 @@ The migration is transactional (all-or-nothing) and idempotent — it can be saf

 ### Soft delete and restore for datasets

-**The soft-delete behavior in this section applies only when the `SOFT_DELETE` feature flag is enabled. The flag defaults to `True`** (`@lifecycle: testing`), so on a default deployment `DELETE /api/v1/dataset/<id>` uses the recoverable soft-delete behavior described below. Setting `SOFT_DELETE` to `False` restores legacy permanent hard-delete behavior for subsequent deletes.
+**The soft-delete behavior in this section applies only when the `SOFT_DELETE` feature flag is enabled. The flag defaults to `False`** (`@lifecycle: development`), so on a default deployment `DELETE /api/v1/dataset/<id>` continues to **hard-delete permanently** — nothing is recoverable. Enable `SOFT_DELETE` to get the behavior described below.

 **Flag-toggle caveat:** the soft-delete visibility filter is evaluated per query while the flag is on. If datasets are soft-deleted during a flag-on window and the flag is later turned **off**, those rows reappear as live datasets in all lists, lookups, and relationship loads (including charts that reference them). The `POST /<uuid>/restore` endpoint and the `dataset_deleted_state` list filter remain functional regardless of the flag, deliberately, so rows soft-deleted during a flag-on window stay discoverable and restorable after a rollback of the flag.

@@ -1137,17 +673,17 @@ With the flag enabled: `DELETE /api/v1/dataset/<id>` no longer hard-deletes the

 **Schema migration:** the migration adds a nullable `deleted_at` column and an index on it (`ix_tables_deleted_at`) to the `tables` table. The column add is instant; the index build runs inline (no `CONCURRENTLY`) and may briefly block writes on the `tables` table (INSERT/UPDATE/DELETE are queued while the index builds; reads are unaffected) on large Postgres deployments. MySQL InnoDB builds the index online (no blocking). Production deployments with many thousands of datasets should run this migration during a maintenance window.

-**Rollback note:** if the application code is rolled back after datasets have been soft-deleted, the older code path's visibility filter no longer applies and previously hidden rows become visible to the older code. Pair the rollback with a data decision (restore the rows, hard-delete them, or also downgrade the migration) rather than assuming the old hard-delete semantics still hold. **Downgrading the migration destroys the deletion markers**: `downgrade()` drops the `deleted_at` column, so any not-yet-restored soft-deleted datasets silently become live, active datasets with no record they were ever deleted. Reconcile the trash (restore or hard-delete each row) _before_ downgrading, and disable the `SOFT_DELETE` flag first so no new soft deletes land mid-rollback.
+**Rollback note:** if the application code is rolled back after datasets have been soft-deleted, the older code path's visibility filter no longer applies and previously hidden rows become visible to the older code. Pair the rollback with a data decision (restore the rows, hard-delete them, or also downgrade the migration) rather than assuming the old hard-delete semantics still hold. **Downgrading the migration destroys the deletion markers**: `downgrade()` drops the `deleted_at` column, so any not-yet-restored soft-deleted datasets silently become live, active datasets with no record they were ever deleted. Reconcile the trash (restore or hard-delete each row) *before* downgrading, and disable the `SOFT_DELETE` flag first so no new soft deletes land mid-rollback.

 **SQL Lab / dataset-creation flows:** creating a dataset over a table whose dataset sits in the trash is refused. The SQL Lab "save as dataset" flow (`get_or_create_dataset`) and file uploads return a **422 naming the hidden twin and the restore endpoint**; the plain create, update, and duplicate paths currently fail with the generic "already exists" 422. In all cases the remediation is the same: restore the hidden dataset (or use a different table name). Perm-string maintenance also covers hidden rows: renaming a database rewrites `perm`/`schema_perm`/`catalog_perm` on soft-deleted datasets and their charts, so a later restore does not resurrect stale permission strings.

-**Importer behavior:** importing a dataset YAML whose UUID matches an existing **soft-deleted** dataset is treated as an implicit restore-with-update — **and this happens even when `overwrite` is not set**. This is a deliberate asymmetry with active rows: an active dataset imported without `overwrite=true` is returned unchanged, but a soft-deleted UUID match is restored _and_ has the upload's contents applied regardless of the `overwrite` argument, on the reasoning that re-importing a deleted dataset's exact UUID is an explicit request to bring it back. The restore preserves the original PK, the chart back-reference, `table_columns`, and `sql_metrics`. Non-editors get `ImportFailedError`. Callers without `can_write` get `ImportFailedError` instead of silently receiving the soft-deleted row.
+**Importer behavior:** importing a dataset YAML whose UUID matches an existing **soft-deleted** dataset is treated as an implicit restore-with-update — **and this happens even when `overwrite` is not set**. This is a deliberate asymmetry with active rows: an active dataset imported without `overwrite=true` is returned unchanged, but a soft-deleted UUID match is restored *and* has the upload's contents applied regardless of the `overwrite` argument, on the reasoning that re-importing a deleted dataset's exact UUID is an explicit request to bring it back. The restore preserves the original PK, the chart back-reference, `table_columns`, and `sql_metrics`. Non-editors get `ImportFailedError`. Callers without `can_write` get `ImportFailedError` instead of silently receiving the soft-deleted row.

 **Uniqueness-validation changes that apply regardless of the feature flag:** two dataset uniqueness checks were tightened alongside this work and are active even with `SOFT_DELETE` off. (1) Create/update uniqueness treats a dataset whose `catalog` is `NULL` as belonging to the database's default catalog, so a legacy twin pair (`catalog=NULL` vs. `catalog=<default>`, same database/schema/name) that older versions allowed now fails validation with "already exists" when either row is edited — resolve by renaming or removing one of the twins. (2) Duplicating a dataset now checks name collisions scoped to the target (database, catalog, schema) instead of globally by name alone: duplicates into other databases that were previously blocked are now allowed.

 ### Soft delete and restore for charts

-**Everything in this section applies only when the `SOFT_DELETE` feature flag is enabled. The flag defaults to `True`** (`@lifecycle: testing`), so on a default deployment `DELETE /api/v1/chart/<id>` uses the recoverable soft-delete behavior described below. Setting `SOFT_DELETE` to `False` restores legacy permanent hard-delete behavior for subsequent deletes.
+**Everything in this section applies only when the `SOFT_DELETE` feature flag is enabled. The flag defaults to `False`** (`@lifecycle: development`), so on a default deployment `DELETE /api/v1/chart/<id>` continues to **hard-delete permanently** — nothing is recoverable. Enable `SOFT_DELETE` to get the behavior described below.

 **Flag-toggle caveat:** the soft-delete visibility filter is evaluated per query while the flag is on. If charts are soft-deleted during a flag-on window and the flag is later turned **off**, those rows reappear as live charts in all lists, lookups, and relationship loads (including dashboards that contained them). The `POST /<uuid>/restore` endpoint and the `chart_deleted_state` list filter remain functional regardless of the flag, deliberately, so rows soft-deleted during a flag-on window stay discoverable and restorable after a rollback of the flag.

@@ -1161,17 +697,15 @@ With the flag enabled: `DELETE /api/v1/chart/<id>` no longer hard-deletes the ch

 **Schema migration:** the migration adds a nullable `deleted_at` column and an index on it (`ix_slices_deleted_at`) to the `slices` table. The column add is instant; the index build runs inline (no `CONCURRENTLY`) and may briefly block writes on the `slices` table (INSERT/UPDATE/DELETE are queued while the index builds; reads are unaffected) on large Postgres deployments. MySQL InnoDB builds the index online (no blocking).

-**Rollback note:** if the application code is rolled back after charts have been soft-deleted, the older code path's visibility filter no longer applies and previously hidden rows become visible to the older code. Pair the rollback with a data decision (restore the rows, hard-delete them, or also downgrade the migration) rather than assuming the old hard-delete semantics still hold. **Downgrading the migration destroys the deletion markers**: `downgrade()` drops the `deleted_at` column, so any not-yet-restored soft-deleted charts silently become live, active charts with no record they were ever deleted. Reconcile the trash (restore or hard-delete each row) _before_ downgrading, and disable the `SOFT_DELETE` flag first so no new soft deletes land mid-rollback.
+**Rollback note:** if the application code is rolled back after charts have been soft-deleted, the older code path's visibility filter no longer applies and previously hidden rows become visible to the older code. Pair the rollback with a data decision (restore the rows, hard-delete them, or also downgrade the migration) rather than assuming the old hard-delete semantics still hold. **Downgrading the migration destroys the deletion markers**: `downgrade()` drops the `deleted_at` column, so any not-yet-restored soft-deleted charts silently become live, active charts with no record they were ever deleted. Reconcile the trash (restore or hard-delete each row) *before* downgrading, and disable the `SOFT_DELETE` flag first so no new soft deletes land mid-rollback.

-**Importer behavior:** importing a chart YAML whose UUID matches an existing **soft-deleted** chart is treated as an implicit restore-with-update — **and this happens even when `overwrite` is not set**. This is a deliberate asymmetry with active rows: an active chart imported without `overwrite=true` is returned unchanged, but a soft-deleted UUID match is restored _and_ has the upload's contents applied regardless of the `overwrite` argument, on the reasoning that re-importing a deleted chart's exact UUID is an explicit request to bring it back. The restore preserves the original PK and all out-of-archive references (`dashboard_slices` junctions, `report.chart_id`, tag rows). The operation is permission-gated: non-editors get `ImportFailedError`, and callers without `can_write` get `ImportFailedError` instead of silently receiving the soft-deleted row.
+**Importer behavior:** importing a chart YAML whose UUID matches an existing **soft-deleted** chart is treated as an implicit restore-with-update — **and this happens even when `overwrite` is not set**. This is a deliberate asymmetry with active rows: an active chart imported without `overwrite=true` is returned unchanged, but a soft-deleted UUID match is restored *and* has the upload's contents applied regardless of the `overwrite` argument, on the reasoning that re-importing a deleted chart's exact UUID is an explicit request to bring it back. The restore preserves the original PK and all out-of-archive references (`dashboard_slices` junctions, `report.chart_id`, tag rows). The operation is permission-gated: non-editors get `ImportFailedError`, and callers without `can_write` get `ImportFailedError` instead of silently receiving the soft-deleted row.

 - [39914](https://github.com/apache/superset/pull/39914) `ALERT_REPORT_SLACK_V2` now defaults to `True` and the legacy Slack v1 integration (`Slack` recipient type, `files.upload` API) is deprecated for removal in the next major. Slack blocked new apps from `files.upload` in May 2024 and fully retired the method for all apps on November 12, 2025; because the v1 path sends files through `files.upload`, v1 file-bearing sends now fail at the API level — only text-only `chat_postMessage` still works via the legacy path. Grant your Slack bot the `channels:read` and `groups:read` scopes so existing `Slack` recipients can be auto-upgraded to `SlackV2` on next send. Operators who explicitly override the flag to `False`, or whose Slack bot is missing those scopes, will see deprecation warnings while text-only sends continue through the legacy path.

- [42089](https://github.com/apache/superset/pull/42089) automatically upgrades resolvable Slack v1 recipients, preserves text-only v1 delivery with execution warnings when migration cannot finish, and rejects retired v1 file uploads with actionable scope guidance. Slack delivery uses at-most-once terminal writes and a schedule-wide retry budget configured by `SLACK_SEND_RETRY_MAX_TIME`, clamped to the report's remaining working timeout. Deployments using `SupersetMetastoreCache` for the Slack channel cache must schedule the `slack.cache_channels` Celery task to repopulate misses outside report transactions; see [Alerts and Reports](https://superset.apache.org/admin-docs/configuration/alerts-reports#slack-delivery-timeouts-and-retries).
-
 ### Soft delete and restore for dashboards

-**Everything in this section applies only when the `SOFT_DELETE` feature flag is enabled. The flag defaults to `True`** (`@lifecycle: testing`), so on a default deployment `DELETE /api/v1/dashboard/<id>` uses the recoverable soft-delete behavior described below. Setting `SOFT_DELETE` to `False` restores legacy permanent hard-delete behavior for subsequent deletes.
+**Everything in this section applies only when the `SOFT_DELETE` feature flag is enabled. The flag defaults to `False`** (`@lifecycle: development`), so on a default deployment `DELETE /api/v1/dashboard/<id>` continues to **hard-delete permanently** — nothing is recoverable. Enable `SOFT_DELETE` to get the behavior described below.

 **Flag-toggle caveat:** the soft-delete visibility filter is evaluated per query while the flag is on. If dashboards are soft-deleted during a flag-on window and the flag is later turned **off**, those rows reappear as live dashboards in all lists and lookups (including slug lookups — if a soft-deleted dashboard's slug was reused while the flag was on, both rows become visible with the same slug). The `POST /<uuid>/restore` endpoint and the `dashboard_deleted_state` list filter remain functional regardless of the flag, deliberately, so rows soft-deleted during a flag-on window stay discoverable and restorable after a rollback of the flag.

@@ -1189,7 +723,7 @@ The partial-index replacement is dialect-dependent: PostgreSQL uses a native `WH

 **Slug semantics:** on PostgreSQL and MySQL 8.0.13+, the slug of a soft-deleted dashboard is **free for reuse**. A new active dashboard can claim it immediately. Restoring a soft-deleted dashboard whose slug has since been claimed returns **422 with a clean error** (`DashboardSlugConflictError`) — rename one of the dashboards and retry; the restore is not silently rejected by a database-level constraint violation.

-**Importer behavior:** importing a dashboard YAML whose UUID matches an existing **soft-deleted** dashboard is treated as an implicit restore-with-update — **and this happens even when `overwrite` is not set**. This is a deliberate asymmetry with active rows: an active dashboard imported without `overwrite=true` is returned unchanged (the import never mutates it), but a soft-deleted UUID match is restored _and_ has the upload's contents applied regardless of the `overwrite` argument, on the reasoning that re-importing a deleted dashboard's exact UUID is an explicit request to bring it back. The restore preserves the original PK and all pre-deletion relationship rows (`dashboard_slices` junctions, editor/viewer subjects, tags). Callers whose imports must never mutate existing state should treat bundles that may contain previously deleted UUIDs accordingly. The operation is permission-gated: it requires `can_write` and editorship of the deleted row (or admin) — non-editors get `ImportFailedError`, and callers without `can_write` get `ImportFailedError` instead of silently receiving the soft-deleted row.
+**Importer behavior:** importing a dashboard YAML whose UUID matches an existing **soft-deleted** dashboard is treated as an implicit restore-with-update — **and this happens even when `overwrite` is not set**. This is a deliberate asymmetry with active rows: an active dashboard imported without `overwrite=true` is returned unchanged (the import never mutates it), but a soft-deleted UUID match is restored *and* has the upload's contents applied regardless of the `overwrite` argument, on the reasoning that re-importing a deleted dashboard's exact UUID is an explicit request to bring it back. The restore preserves the original PK and all pre-deletion relationship rows (`dashboard_slices` junctions, editor/viewer subjects, tags). Callers whose imports must never mutate existing state should treat bundles that may contain previously deleted UUIDs accordingly. The operation is permission-gated: it requires `can_write` and editorship of the deleted row (or admin) — non-editors get `ImportFailedError`, and callers without `can_write` get `ImportFailedError` instead of silently receiving the soft-deleted row.

 ### Engine spec capability flag: `supports_offset`

@@ -1201,10 +735,10 @@ A new `BaseEngineSpec.supports_offset` attribute (default `True`) indicates whet

 A new feature flag `GRANULAR_EXPORT_CONTROLS` introduces three fine-grained permissions that replace the legacy `can_csv` permission:

-| Permission           | Controls                     |
-| -------------------- | ---------------------------- |
-| `can_export_data`    | CSV, Excel, JSON exports     |
-| `can_export_image`   | Screenshot/PDF exports       |
+| Permission | Controls |
+|---|---|
+| `can_export_data` | CSV, Excel, JSON exports |
+| `can_export_image` | Screenshot/PDF exports |
 | `can_copy_clipboard` | Copy-to-clipboard operations |

 When the feature flag is enabled, these permissions are enforced on both the frontend (disabled buttons with tooltips) and backend (403 responses from API endpoints). When disabled, legacy `can_csv` behavior is preserved.
@@ -1233,8 +767,6 @@ Custom time ranges that use the "Now" or "Today" anchor (for the Start, End, or

 Charts and dashboards using these anchors will compute a different (correct) timestamp after upgrading; if a chart's filters or drill-downs were tuned to compensate for the old offset, review them after upgrading.

- [43916](https://github.com/apache/superset/pull/43916): The `docker-compose` dev loop now skips re-running `superset load_examples` on every `docker compose up` once the example data and dashboards are present in the databases (set `SUPERSET_FORCE_LOAD_EXAMPLES=yes` to reload them anyway), and the `superset-node` service now defaults `DISABLE_TS_CHECKER=true` like `docker-compose-light.yml` already did, skipping webpack's TypeScript type-checking pass in dev by default.
-
 ## 6.1.0

 ### ClickHouse minimum driver version bump
@@ -1250,17 +782,14 @@ The Kenya country map has been updated to reflect the 47 counties established un
 MCP (Model Context Protocol) tools now include enhanced observability instrumentation for monitoring and debugging:

 **Two-layer instrumentation:**
-
 1. **Middleware layer** (`LoggingMiddleware`): Automatically logs all MCP tool calls with `duration_ms` and `success` status in the audit log (Action Log UI, logs table)
 2. **Sub-operation tracking**: All 19 MCP tools include granular `event_logger.log_context()` blocks for tracking individual operations like validation, database writes, and query execution

 **Action naming convention:**
-
 - Tool-level logs: `mcp_tool_call` (via middleware)
 - Sub-operation logs: `mcp.{tool_name}.{operation}` (e.g., `mcp.generate_chart.validation`, `mcp.execute_sql.query_execution`)

 **Querying MCP logs:**
-
 ```sql
 -- Top slowest MCP operations
 SELECT action, COUNT(*) as calls, AVG(duration_ms) as avg_ms
@@ -1295,7 +824,6 @@ A new `DISTRIBUTED_COORDINATION_CONFIG` configuration provides a unified Redis-b
 The distributed coordination is used by the Global Task Framework (GTF) for abort notifications and task completion signaling, and will eventually replace `GLOBAL_ASYNC_QUERIES_CACHE_BACKEND` as the standard signaling backend. Configuring this is recommended for Redis enabled production deployments.

 Example configuration in `superset_config.py`:
-
 ```python
 DISTRIBUTED_COORDINATION_CONFIG = {
    "CACHE_TYPE": "RedisCache",
@@ -1310,11 +838,9 @@ See `superset/config.py` for complete configuration options.
 ### WebSocket config for GAQ with Docker

 [35896](https://github.com/apache/superset/pull/35896) and [37624](https://github.com/apache/superset/pull/37624) updated documentation on how to run and configure Superset with Docker. Specifically for the WebSocket configuration, a new `docker/superset-websocket/config.example.json` was added to the repo, so that users could copy it to create a `docker/superset-websocket/config.json` file. The existing `docker/superset-websocket/config.json` was removed and git-ignored, so if you're using GAQ / WebSocket make sure to:
-
 - Stash/backup your existing `config.json` file, to re-apply it after (will get git-ignored going forward)
 - Update the `volumes` configuration for the `superset-websocket` service in your `docker-compose.override.yml` file, to include the `docker/superset-websocket/config.json` file. For example:
-
-```yaml
+``` yaml
 services:
  superset-websocket:
    volumes:
@@ -1327,9 +853,7 @@ services:
 ### Example Data Loading Improvements

 #### New Directory Structure
-
 Examples are now organized by name with data and configs co-located:
-
 ```
 superset/examples/
 ├── _shared/              # Shared database & metadata configs
@@ -1342,14 +866,12 @@ superset/examples/
 ```

 #### Simplified Parquet-based Loading
-
 - Auto-discovery: create `superset/examples/my_dataset/data.parquet` to add a new example
 - Parquet is an Apache project format: compressed (~27% smaller), self-describing schema
 - YAML configs define datasets, charts, and dashboards declaratively
 - Removed Python-based data generation from individual example files

 #### Test Data Reorganization
-
 - Moved `big_data.py` to `superset/cli/test_loaders.py` - better reflects its purpose as a test utility
 - Fixed inverted logic for `--load-test-data` flag (now correctly includes .test.yaml files when flag is set)
 - Clarified CLI flags:
@@ -1359,7 +881,6 @@ superset/examples/
  - `--load-big-data` / `-b`: Generate synthetic stress-test data

 #### Bug Fixes
-
 - Fixed numpy array serialization for PostgreSQL (converts complex types to JSON strings)
 - Fixed KeyError for `allow_csv_upload` field in database configs (now optional with default)
 - Fixed test data loading logic that was incorrectly filtering files
@@ -1369,7 +890,6 @@ superset/examples/
 The MCP (Model Context Protocol) service enables AI assistants and automation tools to interact programmatically with Superset.

 #### New Features
-
 - MCP service infrastructure with FastMCP framework
 - Tools for dashboards, charts, datasets, SQL Lab, and instance metadata
 - Optional dependency: install with `pip install apache-superset[fastmcp]`
@@ -1379,7 +899,6 @@ The MCP (Model Context Protocol) service enables AI assistants and automation to
 #### New Configuration Options

 **Development** (single-user, local testing):
-
 ```python
 # superset_config.py
 MCP_DEV_USERNAME = "admin"  # User for MCP authentication
@@ -1388,7 +907,6 @@ MCP_SERVICE_PORT = 5008
 ```

 **Production** (JWT-based, multi-user):
-
 ```python
 # superset_config.py
 MCP_AUTH_ENABLED = True
@@ -1434,14 +952,12 @@ superset mcp run --port 5008 --use-factory-config
 The MCP service runs as a **separate process** from the Superset web server.

 **Important**:
-
 - Requires same Python environment and configuration as Superset
 - Shares database connections with main Superset app
 - Can be scaled independently from web server
 - Requires `fastmcp` package (optional dependency)

 **Installation**:
-
 ```bash
 # Install with MCP support
 pip install apache-superset[fastmcp]
@@ -1455,7 +971,6 @@ Use systemd, supervisord, or Kubernetes to manage the MCP service process.
 See `superset/mcp_service/PRODUCTION.md` for deployment guides.

 **Security**:
-
 - Development: Uses `MCP_DEV_USERNAME` for single-user access
 - Production: **MUST** configure JWT authentication
 - See `superset/mcp_service/SECURITY.md` for details
@@ -1475,10 +990,8 @@ See `superset/mcp_service/PRODUCTION.md` for deployment guides.
 - [35062](https://github.com/apache/superset/pull/35062): Changed the function signature of `setupExtensions` to `setupCodeOverrides` with options as arguments.

 ### Breaking Changes
-
 - [37370](https://github.com/apache/superset/pull/37370): The `APP_NAME` configuration variable no longer controls the browser window/tab title or other frontend branding. Application names should now be configured using the theme system with the `brandAppName` token. The `APP_NAME` config is still used for backend contexts (MCP service, logs, etc.) and serves as a fallback if `brandAppName` is not set.
  - **Migration:**
-
  ```python
  # Before (Superset 5.x)
  APP_NAME = "My Custom App"
@@ -1522,16 +1035,16 @@ See `superset/mcp_service/PRODUCTION.md` for deployment guides.

 Eight M:N association tables move from a synthetic `id INTEGER PRIMARY KEY` to a composite `PRIMARY KEY (fk1, fk2)` on their two foreign-key columns. The surrogate `id` is dropped, and the redundant `UNIQUE (fk1, fk2)` on the two tables that carried one is removed (now subsumed by the PK).

-| Table                  | Composite PK                    |
-| ---------------------- | ------------------------------- |
-| `dashboard_roles`      | `(dashboard_id, role_id)`       |
-| `dashboard_slices`     | `(dashboard_id, slice_id)`      |
-| `dashboard_user`       | `(user_id, dashboard_id)`       |
+| Table | Composite PK |
+|---|---|
+| `dashboard_roles` | `(dashboard_id, role_id)` |
+| `dashboard_slices` | `(dashboard_id, slice_id)` |
+| `dashboard_user` | `(user_id, dashboard_id)` |
 | `report_schedule_user` | `(user_id, report_schedule_id)` |
-| `rls_filter_roles`     | `(role_id, rls_filter_id)`      |
-| `rls_filter_tables`    | `(table_id, rls_filter_id)`     |
-| `slice_user`           | `(user_id, slice_id)`           |
-| `sqlatable_user`       | `(user_id, table_id)`           |
+| `rls_filter_roles` | `(role_id, rls_filter_id)` |
+| `rls_filter_tables` | `(table_id, rls_filter_id)` |
+| `slice_user` | `(user_id, slice_id)` |
+| `sqlatable_user` | `(user_id, table_id)` |

 **Before upgrading:**

@@ -1542,7 +1055,6 @@ Eight M:N association tables move from a synthetic `id INTEGER PRIMARY KEY` to a
 For large `dashboard_slices` / `report_schedule_user` tables, see the operator runbook in [#39859](https://github.com/apache/superset/pull/39859) — pre-flight inventory queries, per-dialect lock-window sizing, and the duplicate / NULL-FK roll-up — to plan the maintenance window.

 ## 6.0.0
-
 - [33055](https://github.com/apache/superset/pull/33055): Upgrades Flask-AppBuilder to 5.0.0. The AUTH_OID authentication type has been deprecated and is no longer available as an option in Flask-AppBuilder. OpenID (OID) is considered a deprecated authentication protocol - if you are using AUTH_OID, you will need to migrate to an alternative authentication method such as OAuth, LDAP, or database authentication before upgrading.
 - [34871](https://github.com/apache/superset/pull/34871): Fixed Jest test hanging issue from Ant Design v5 upgrade. MessageChannel is now mocked in test environment to prevent rc-overflow from causing Jest to hang. Test environment only - no production impact.
 - [34782](https://github.com/apache/superset/pull/34782): Dataset exports now include the dataset ID in their file name (similar to charts and dashboards). If managing assets as code, make sure to rename existing dataset YAMLs to include the ID (and avoid duplicated files).
@@ -1551,8 +1063,8 @@ For large `dashboard_slices` / `report_schedule_user` tables, see the operator r
  - Change any hex color values to one of: `"success"`, `"processing"`, `"error"`, `"warning"`, `"default"`
  - Custom colors are no longer supported to maintain consistency with Ant Design components
 - [34561](https://github.com/apache/superset/pull/34561) Added tiled screenshot functionality for Playwright-based reports to handle large dashboards more efficiently. When enabled (default: `SCREENSHOT_TILED_ENABLED = True`), dashboards with 20+ charts or height exceeding 5000px will be captured using multiple viewport-sized tiles and combined into a single image. This improves report generation performance and reliability for large dashboards.
-  Note: Pillow is now a required dependency (previously optional) to support image processing for tiled screenshots.
-  `thumbnails` optional dependency is now deprecated and will be removed in the next major release (7.0).
+Note: Pillow is now a required dependency (previously optional) to support image processing for tiled screenshots.
+`thumbnails` optional dependency is now deprecated and will be removed in the next major release (7.0).
 - [33084](https://github.com/apache/superset/pull/33084) The DISALLOWED_SQL_FUNCTIONS configuration now includes additional potentially sensitive database functions across PostgreSQL, MySQL, SQLite, MS SQL Server, and ClickHouse. Existing queries using these functions may now be blocked. Review your SQL Lab queries and dashboards if you encounter "disallowed function" errors after upgrading
 - [34235](https://github.com/apache/superset/pull/34235) CSV exports now use `utf-8-sig` encoding by default to include a UTF-8 BOM, improving compatibility with Excel.
 - [34258](https://github.com/apache/superset/pull/34258) changing the default in Dockerfile to INCLUDE_CHROMIUM="false" (from "true") in the past. This ensures the `lean` layer is lean by default, and people can opt-in to the `chromium` layer by setting the build arg `INCLUDE_CHROMIUM=true`. This is a breaking change for anyone using the `lean` layer, as it will no longer include Chromium by default.
@@ -138,7 +138,6 @@ services:
        condition: service_started
    volumes: *superset-volumes
    environment:
-      SUPERSET_FORCE_LOAD_EXAMPLES: "${SUPERSET_FORCE_LOAD_EXAMPLES:-}"
      DATABASE_HOST: db-light
      DATABASE_DB: superset_light
      POSTGRES_DB: superset_light
@@ -137,41 +137,6 @@ services:
    healthcheck:
      disable: true

-  # Realtime WebSocket transport, launched from the official image via its
-  # alternate entrypoint (no separate image needed). Opt-in — start it with
-  # `docker compose --profile websocket up`. To actually use it, the Superset
-  # app must also set WEBSOCKET_ENABLE=true, WEBSOCKET_URL, and a matching
-  # WEBSOCKET_JWT_SECRET (== the JWT_SECRET below) in docker/.env-local.
-  superset-websocket:
-    build:
-      <<: *common-build
-    container_name: superset_websocket
-    profiles:
-      - websocket
-    # Neither a volume mount nor the root user is needed: the entrypoint and the
-    # Node bundle it runs are both baked into the image, and the server is
-    # configured entirely through the environment below.
-    command: ["/app/docker/entrypoints/run-websocket.sh"]
-    environment:
-      REDIS_HOST: redis
-      REDIS_PORT: 6379
-      PORT: 8080
-      JWT_COOKIE_NAME: superset-ws-token
-      # Dev-only default; must match the app's WEBSOCKET_JWT_SECRET and be
-      # replaced with a strong secret (>= 32 bytes) outside local development.
-      JWT_SECRET: ${WEBSOCKET_JWT_SECRET:-dev-only-websocket-secret-change-me!}
-      # Optional verify-only old key for websocket JWT secret rotation.
-      PREVIOUS_JWT_SECRET: ${WEBSOCKET_PREVIOUS_JWT_SECRET:-}
-    restart: unless-stopped
-    ports:
-      - 8080:8080
-    depends_on:
-      redis:
-        condition: service_started
-    # Overrides the image-level HEALTHCHECK, which probes the Superset app.
-    healthcheck:
-      test: ["CMD-SHELL", "curl -f http://localhost:8080/health"]
-
 volumes:
  superset_home:
    external: false
@@ -183,8 +183,6 @@ services:
        condition: service_started
    user: *superset-user
    volumes: *superset-volumes
-    environment:
-      SUPERSET_FORCE_LOAD_EXAMPLES: "${SUPERSET_FORCE_LOAD_EXAMPLES:-}"
    healthcheck:
      disable: true

@@ -204,7 +202,6 @@ services:
      BUILD_SUPERSET_FRONTEND_IN_DOCKER: true
      NPM_RUN_PRUNE: false
      SCARF_ANALYTICS: "${SCARF_ANALYTICS:-}"
-      DISABLE_TS_CHECKER: "${DISABLE_TS_CHECKER:-true}"
      # configuring the dev-server to use the host.docker.internal to connect to the backend
      superset: "http://superset:8088"
      # Webpack dev server must bind to 0.0.0.0 to be accessible from outside the container
@@ -73,12 +73,6 @@ SUPERSET_ENV=development
 # Swagger UI is opt-in (off by default); enable it for local development.
 SUPERSET_ENABLE_SWAGGER_UI=true
 SUPERSET_LOAD_EXAMPLES=yes
-# Once the example data and dashboards are present in the databases,
-# `docker-init.sh` skips `superset load_examples` on later runs. Set to "yes"
-# (or run `SUPERSET_FORCE_LOAD_EXAMPLES=yes docker compose up`) to reload the
-# examples anyway, e.g. after changing the example datasets or after a partial
-# load.
-#SUPERSET_FORCE_LOAD_EXAMPLES=no
 CYPRESS_CONFIG=false
 SUPERSET_PORT=8088
 MAPBOX_API_KEY=''
@@ -66,44 +66,14 @@ echo_step "3" "Starting" "Setting up roles and perms"
 superset init
 echo_step "3" "Complete" "Setting up roles and perms"

-# Loading examples parses and inserts every example dataset, chart and
-# dashboard and is one of the slowest steps of `docker compose up`. Rather
-# than trusting a marker file (which goes stale as soon as the database volume
-# is recreated), ask the databases themselves: when both the example data and
-# the dashboards imported from it are present, the previous load completed and
-# there is nothing left to redo. Any failure here (missing tables, unreachable
-# database, import error) simply reports "not loaded" so the full load runs.
-examples_already_loaded() {
-    python - <<'PY' 2>/dev/null
-import sys
-
-from superset.app import create_app
-from superset.sql.parse import Table
-
-app = create_app()
-with app.app_context():
-    from superset import db
-    from superset.models.dashboard import Dashboard
-    from superset.utils.database import get_example_database
-
-    has_dashboard = (
-        db.session.query(Dashboard).filter_by(slug="world_health").first() is not None
-    )
-    has_data = get_example_database().has_table(Table("wb_health_population"))
-    sys.exit(0 if has_dashboard and has_data else 1)
-PY
-}
-
 if [ "$SUPERSET_LOAD_EXAMPLES" = "yes" ]; then
+    # Load some data to play with
    echo_step "4" "Starting" "Loading examples"

-    # Cypress runs always load, since they need a distinct set of test data
-    # (`--load-test-data`) in a separate database. Set
-    # SUPERSET_FORCE_LOAD_EXAMPLES=yes to reload the examples regardless.
+
+    # If Cypress run which consumes superset_test_config – load required data for tests
    if [ "$CYPRESS_CONFIG" == "true" ]; then
        superset load_examples --load-test-data
-    elif [ "$SUPERSET_FORCE_LOAD_EXAMPLES" != "yes" ] && examples_already_loaded; then
-        echo "Examples already loaded, skipping (set SUPERSET_FORCE_LOAD_EXAMPLES=yes to reload them)"
    else
        superset load_examples
    fi
@@ -19,14 +19,6 @@
 #
 HYPHEN_SYMBOL='-'

-STATSD_ARGS=()
-STATSD_HOST="${SERVER_STATSD_HOST//[[:space:]]/}"
-if [ -n "${STATSD_HOST}" ]; then
-    STATSD_PORT="${SERVER_STATSD_PORT//[[:space:]]/}"
-    STATSD_PORT="${STATSD_PORT:-8125}"
-    STATSD_ARGS=(--statsd-host "${STATSD_HOST}:${STATSD_PORT}" --statsd-prefix "${SERVER_STATSD_PREFIX:-superset}")
-fi
-
 exec gunicorn \
    --bind "${SUPERSET_BIND_ADDRESS:-0.0.0.0}:${SUPERSET_PORT:-8088}" \
    --access-logfile "${ACCESS_LOG_FILE:-$HYPHEN_SYMBOL}" \
@@ -41,5 +33,4 @@ exec gunicorn \
    --max-requests-jitter ${WORKER_MAX_REQUESTS_JITTER:-0} \
    --limit-request-line ${SERVER_LIMIT_REQUEST_LINE:-0} \
    --limit-request-field_size ${SERVER_LIMIT_REQUEST_FIELD_SIZE:-0} \
-    "${STATSD_ARGS[@]}" \
    "${FLASK_APP}"
@@ -1,44 +0,0 @@
-#!/usr/bin/env bash
-#
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-#
-# Launch the realtime WebSocket server (superset-websocket) bundled in the
-# official image. Run it with:
-#
-#   docker run <superset-image> /app/docker/entrypoints/run-websocket.sh
-#
-# Configure via environment variables — see superset-websocket/src/config.ts for
-# the authoritative, complete set (Redis connection, logging, connection limits,
-# StatsD, etc.). The values that MUST match the Flask app's config are:
-#   JWT_SECRET      == WEBSOCKET_JWT_SECRET
-#   JWT_COOKIE_NAME == WEBSOCKET_JWT_COOKIE_NAME (default superset-ws-token)
-#   REALTIME_CHANNEL_PREFIX == Flask REALTIME_CHANNEL_PREFIX (default empty; set a
-#     per-deployment value on both sides to isolate a shared Redis/Valkey)
-# Optional rotation setting:
-#   PREVIOUS_JWT_SECRET == old WEBSOCKET_JWT_SECRET accepted for verification
-# and the Redis connection (REDIS_HOST/REDIS_PORT/...) must point at the same
-# instance as the app's DISTRIBUTED_COORDINATION_CONFIG.
-set -e
-
-# Run from a writable directory so that opting into file logging with the
-# default relative LOG_FILENAME (LOG_TO_FILE=true) writes somewhere the
-# unprivileged `superset` user can create files, rather than the read-only /app.
-# The config.json lookup is unaffected (it resolves relative to the bundle).
-cd "${SUPERSET_HOME:-/app/superset_home}"
-
-exec node /app/superset-websocket/dist/index.cjs start
@@ -118,7 +118,6 @@ FEATURE_FLAGS = {
    "ALERT_REPORTS": True,
    "DATASET_FOLDERS": True,
    "ENABLE_EXTENSIONS": True,
-    "MOBILE_CONSUMPTION_MODE": True,
    "SEMANTIC_LAYERS": True,
 }
 EXTENSIONS_PATH = "/app/docker/extensions"
@@ -15,8 +15,8 @@
    "db": 0,
    "ssl": false
  },
+  "redisStreamPrefix": "async-events-",
  "jwtAlgorithms": ["HS256"],
  "jwtSecret": "CHANGE-ME-IN-PRODUCTION-GOTTA-BE-LONG-AND-SECRET",
-  "previousJwtSecret": "",
-  "jwtCookieName": "superset-ws-token"
+  "jwtCookieName": "async-token"
 }
@@ -62,8 +62,8 @@ yarn version:remove:developer_docs <version> # Remove developer docs version
 yarn version:remove:components <version>     # Remove components version

 # Quality Checks
-yarn typecheck   # TypeScript validation
-yarn lint        # Lint TypeScript/JavaScript files
+yarn typecheck            # TypeScript validation
+yarn eslint              # Lint TypeScript/JavaScript files
 ```

 ## 📁 Documentation Structure
@@ -431,7 +431,7 @@ yarn build
 yarn typecheck

 # Linting issues
-yarn lint
+yarn eslint
 ```

 ### Version Issues
@@ -14,20 +14,6 @@ Users can configure automated alerts and reports to send dashboards or charts to

 Alerts and reports are disabled by default. To turn them on, you'll need to change configuration settings and install a suitable headless browser in your environment.

-## Content Format Options
-
-When scheduling an alert or report, you can choose the format used to deliver the dashboard or chart:
-
- **PDF** – a full-page screenshot rendered as a PDF attachment. Available for both dashboards and charts.
- **PNG** – a screenshot delivered as an attachment. Emails embed the image inline in the message body; Slack and webhook recipients receive it as an uploaded file. Available for both dashboards and charts.
- **CSV** – chart data attached as a `.csv` file. Available for charts only.
- **XLSX (Excel)** – chart data attached as a `.xlsx` file. Available for charts only. If the chart's data spans multiple server-paginated files, email delivery detects the bundle and renames the attachment to `.zip`; Slack and webhook deliveries always name the file with an `.xlsx` extension even when the contents are a multi-file ZIP archive.
- **Text** – chart data embedded directly in the email or Slack message body. Available only for charts using a text-based visualization type (e.g. Table, Pivot Table, Paired t-test).
-
-Dashboard reports and alerts are limited to the PDF and PNG formats; the CSV, XLSX, and Text options are only available when scheduling a report or alert for an individual chart.
-
-For alerts (not scheduled reports), PNG/PDF screenshots and chart CSV/XLSX data are only generated when the `ALERTS_ATTACH_REPORTS` [feature flag](/admin-docs/configuration/configuring-superset#feature-flags) is enabled (the default); with it disabled, an alert notification is still sent, but without the attachment.
-
 ## Requirements

 ### Commons
@@ -42,7 +28,6 @@ For alerts (not scheduled reports), PNG/PDF screenshots and chart CSV/XLSX data
 - Users can customize the email subject by including date code placeholders, which will automatically be replaced with the corresponding UTC date when the email is sent. To enable this functionality, activate the `"DATE_FORMAT_IN_EMAIL_SUBJECT"` [feature flag](/admin-docs/configuration/configuring-superset#feature-flags). This enables date formatting in email subjects, preventing all reporting emails from being grouped into the same thread (optional for the reporting feature).
  - Use date codes from [strftime.org](https://strftime.org/) to create the email subject.
  - If no date code is provided, the original string will be used as the email subject.
- Each alert/report has an "Include a link back to Superset" option (enabled by default) controlling whether the call-to-action link is included in email and Slack notifications. The link text in emails is configurable via `EMAIL_REPORTS_CTA`; the Slack message always uses "Explore in Superset". Uncheck the option when recipients should not receive a link to your Superset host, e.g. for external audiences.

 ##### Disable dry-run mode

@@ -97,28 +82,6 @@ SLACK_CACHE_TIMEOUT = int(timedelta(days=2).total_seconds())
 SLACK_API_RATE_LIMIT_RETRY_COUNT = 5
 ```

-When the cache backend is `SupersetMetastoreCache`, report execution does not
-write channel listings into the cache because that backend commits the report's
-database session. Schedule the dedicated warm-up task so cache misses are
-repopulated outside report transactions:
-
-```python
-from celery.schedules import crontab
-
-from superset.config import CeleryConfig
-
-class CustomCeleryConfig(CeleryConfig):
-    beat_schedule = {
-        **CeleryConfig.beat_schedule,
-        "slack.cache_channels": {
-            "task": "slack.cache_channels",
-            "schedule": crontab(minute="0", hour="*"),
-        },
-    }
-
-CELERY_CONFIG = CustomCeleryConfig
-```
-
 #### Slack Enterprise Grid (org-scoped tokens)

 On a Slack Enterprise Grid org, an org-scoped token spans multiple workspaces, so
@@ -134,38 +97,6 @@ SLACK_TEAM_ID = "T01234567"
 This defaults to `None` and only needs to be set when using an org-scoped token;
 it is accepted but ignored for standard workspace-level tokens.

-#### Slack delivery timeouts and retries
-
-Slack delivery uses a request timeout and an application retry budget:
-
-```python
-# Timeout for one Slack API request, in seconds
-SLACK_API_TIMEOUT = 30
-
-# Retry budget shared by every Slack destination and upload phase
-SLACK_SEND_RETRY_MAX_TIME = 150
-
-# Number of explicit HTTP 429 responses retried using Slack's Retry-After value
-SLACK_API_RATE_LIMIT_RETRY_COUNT = 2
-
-# Cooldown after an on-demand channel-cache refresh
-SLACK_CHANNEL_REFRESH_COOLDOWN_SECONDS = 300
-```
-
-All channels and upload phases in one report execution share a single
-`SLACK_SEND_RETRY_MAX_TIME` budget. This prevents a large recipient list from
-multiplying the report's wall-clock retry time. The budget is also clamped to
-the report's remaining working timeout, leaving Celery's configured timeout lag
-available for final state persistence. The effective configured budget is at
-least one second longer than `SLACK_API_TIMEOUT`.
-
-To avoid posting the same report twice, Superset does not replay terminal
-`chat.postMessage` or `files.completeUploadExternal` operations after ambiguous
-server or transport failures. Explicit Slack HTTP 429 responses remain
-retryable. These delivery settings and semantics apply to Slack v2 reports and
-legacy text-only Slack delivery, independently of the
-`ALERT_REPORT_SLACK_V2` feature flag.
-
 ### Webhook integration

 Superset can send alert and report notifications to any HTTP endpoint — useful for chat platforms, incident management tools, or custom automation.
@@ -243,16 +174,6 @@ ALERT_REPORTS_WEBHOOK_HTTPS_ONLY = True

 When enabled, Superset rejects webhook configurations that use `http://` URLs.

-#### Request Timeout
-
-Webhook deliveries use a socket timeout so a request can't hang forever if the webhook target is unreachable, which would otherwise leave the report schedule stuck in a `WORKING` state. Configure it with:
-
-```python
-ALERT_REPORTS_WEBHOOK_TIMEOUT = 60  # seconds
-```
-
-Set to `None` to disable the timeout (not recommended).
-
 #### Retry Behavior

 Superset automatically retries webhook deliveries on `429 Too Many Requests` and `5xx` server errors using exponential backoff. Retries are bounded to roughly 120 seconds of cumulative wall-clock time (worst case ~210 seconds, because the bound is checked against the time elapsed before each attempt, so the final request can begin just under the limit and still run its full request timeout), after which the delivery is abandoned.
@@ -476,16 +397,6 @@ to determine which hosts are internal.

 There are many reasons that reports might not be working. Try these steps to check for specific issues.

-### Blank PDF or PNG captures
-
-Playwright report captures are checked for blank image content as well as chart
-readiness. Captures detected as blank where chart content is expected are retried
-up to three total attempts, within the execution deadline. If they remain blank,
-the report fails instead of delivering the blank or partial attachment. This also
-applies to alerts that attach reports. Check worker logs for
-`ScreenshotBlankCaptureError` and `report_capture_validation` when investigating
-these failures.
-
 ### Confirm feature flag is enabled and you have sufficient permissions

 If you don't see "Alerts & Reports" under the _Manage_ section of the Settings dropdown in the Superset UI, you need to enable the `ALERT_REPORTS` feature flag (see above). Enable another feature flag and check to see that it took effect, to verify that your config file is getting loaded.
@@ -496,39 +407,6 @@ Log in as an admin user to ensure you have adequate permissions.

 This is the best source of information about the problem. In a docker compose deployment, you can do this with a command like `docker logs superset_worker --since 1h`.

-### CSV and Excel chart-data request failures
-
-The worker uses the saved query context to POST to the chart-data export endpoint,
-falling back to the legacy GET export when a query context cannot be generated.
-`ALERT_REPORTS_CSV_REQUEST_TIMEOUT` (60 seconds by default) limits socket operations;
-the report execution budget and its delivery/cleanup reserves also cap the request.
-Connection and read timeouts are reported as CSV/Excel generation timeouts.
-These attachment timeouts are logged at error level and explicitly mark the report
-task as failed, while the report execution retains its ERROR state and separate
-error-notification history. Other HTTP 408 exception handling is unchanged.
-
-To tolerate short-lived transport failures, operators can opt in with
-`ALERT_REPORTS_CSV_REQUEST_RETRY = True` (default: `False`). This permits **one** retry
-for transient connection/read failures and HTTP 429, 500, 502, 503, or 504. Other
-HTTP statuses are not retried. Backoff is 0.5 seconds, extended to at most 2 seconds
-for a numeric `Retry-After`; longer, invalid, or date-based delays are not retried
-inline. Both attempts and backoff share the initial request timeout allowance and
-respect the remaining execution budget. Unbounded requests are not retried.
-A request that consumes its entire timeout does **not** get another full timeout.
-Socket timeouts are not wall-clock cancellation: existing report task limits still
-interrupt in-flight work. A timed-out server query can continue running, so enabling
-retries can increase database load. Leave retries disabled unless appropriate for
-your deployment; disable the setting to roll back retry behavior.
-
-Worker diagnostics include schedule/chart identifiers, a fixed endpoint path (no
-query string), error category, HTTP status, timeout, elapsed duration, and attempt.
-For HTTP errors, at most 4097 response bytes are read to enforce a 4096-byte limit.
-Only recognized Superset error types from up to four JSON errors are retained;
-free-form messages, extra fields, and non-JSON or oversized bodies are redacted or
-omitted. Cookies, authentication headers, URLs, SQL, and query payloads are not
-included in these transport diagnostics. HTTP 400 therefore remains a failure to
-investigate, not a reason to repeat the same request.
-
 ### Check web browser and webdriver installation

 To take a screenshot, the worker visits the dashboard or chart using a headless browser, then takes a screenshot. If you are able to send a chart as CSV, XLSX, or text but can't send as PNG, your problem may lie with the browser.
@@ -54,8 +54,8 @@ celery --app=superset.tasks.celery_app:app beat

 To setup a result backend, you need to pass an instance of a derivative of `BaseCache` (`from
 flask_caching.backends.base import BaseCache`) to the RESULTS_BACKEND configuration key in your
-superset_config.py. You can use Memcached, Redis, S3, MinIO, memory
-or the file system (in a single server-type setup or for testing), or to write your own
+superset_config.py. You can use Memcached, Redis, S3 (https://pypi.python.org/pypi/s3werkzeugcache),
+memory or the file system (in a single server-type setup or for testing), or to write your own
 caching interface. Your `superset_config.py` may look something like:

 ```python
@@ -89,12 +89,6 @@ issues arise. Please clear your existing results cache store when upgrading an e
 - SQL Lab will _only run your queries asynchronously if_ you enable **Asynchronous Query Execution**
  in your database settings (Sources > Databases > Edit record).

- In order to use dedicated results backend, additional python libraries must be installed. These libraries can be installed using pip.
-  - [redis-py](https://pypi.org/project/redis/) for Redis.
-  - [pylibmc](https://pypi.org/project/pylibmc/) for memcached
-  - [s3werkzeugcache](https://pypi.python.org/pypi/s3werkzeugcache) for S3
-  - [minio-flask-cache](https://github.com/greggailly/minio-flask-cache) for MinIO or other S3 compatible service
-
 ## Celery Flower

 Flower is a web based tool for monitoring the Celery cluster which you can install from pip:
@@ -15,8 +15,9 @@ fail-fast behavior ensures operators are immediately aware of infrastructure iss

 Superset uses [Flask-Caching](https://flask-caching.readthedocs.io/) for caching purposes.
 Flask-Caching supports various caching backends, including Redis (recommended), Memcached,
-SimpleCache (in-memory), MinIO/S3, or the local filesystem.
-[Custom cache backends](https://flask-caching.readthedocs.io/en/latest/#custom-cache-backends) are also supported.
+SimpleCache (in-memory), or the local filesystem.
+[Custom cache backends](https://flask-caching.readthedocs.io/en/latest/#custom-cache-backends)
+are also supported.

 Caching can be configured by providing dictionaries in
 `superset_config.py` that comply with [the Flask-Caching config specifications](https://flask-caching.readthedocs.io/en/latest/#configuring-flask-caching).
@@ -46,7 +47,6 @@ In order to use dedicated cache stores, additional python libraries must be inst
 - For Redis: we recommend the [redis](https://pypi.python.org/pypi/redis) Python package
 - Memcached: we recommend using [pylibmc](https://pypi.org/project/pylibmc/) client library as
  `python-memcached` does not handle storing binary data correctly.
- MinIO (S3): we recommend using the [minio-flask-cache](https://github.com/greggailly/minio-flask-cache) package

 These libraries can be installed using pip.

@@ -76,58 +76,6 @@ value defined in `DATA_CACHE_CONFIG`.
 Note, that by setting the cache timeout to `-1`, caching for charting data can be disabled, either
 per chart, dataset or database, or by default if set in `DATA_CACHE_CONFIG`.

-Native filter option queries (the dropdown values for native filters) go through this same
-chart-data cache, but their freshness needs often differ from regular chart queries, especially for
-datasets whose visible values change frequently, including RLS-constrained datasets. Set
-`NATIVE_FILTER_OPTIONS_CACHE_TIMEOUT` in `superset_config.py` to give these queries a dedicated
-timeout, checked before the chart/dataset/database chain and the `DATA_CACHE_CONFIG` default above:
-
-```python
-NATIVE_FILTER_OPTIONS_CACHE_TIMEOUT = 60  # seconds
-```
-
- `None` (default): native filter option queries fall through to the normal
-  chart/dataset/database/`DATA_CACHE_CONFIG` resolution chain.
- `-1`: disables caching for native filter option queries entirely.
- `0`: passed directly to the cache backend; behavior is backend-specific, so use `-1` if the intent
-  is to disable caching.
- A positive integer: cache native filter option queries for that many seconds.
-
-This setting only applies to requests detected as native filter option queries. It takes precedence
-over the per-chart/dataset/database timeouts, but not over an explicit per-request
-`custom_cache_timeout` override (e.g. "Force refresh").
-
-## Async Query Result Cache TTL
-
-When [Global Async Queries](/admin-docs/configuration/configuring-superset#feature-flags) is
-enabled, a chart-data request that runs asynchronously does not return the result inline. Instead the
-query executes on a background task that **writes the result to the data cache**, and the browser
-then re-issues the same request to read that result back out of the cache once the task succeeds.
-
-This read-back is what makes the result-cache TTL matter for correctness, not just performance: if
-the effective TTL is shorter than the full async round trip (task execution + the client's poll
-interval + the re-fetch), the entry can be **evicted before the client reads it**, leaving the chart
-stuck re-running instead of loading. To prevent this, async requests floor their result-cache TTL to
-`GLOBAL_ASYNC_QUERIES_MIN_CACHE_TTL` (seconds, default `300` — five minutes):
-
-```python
-GLOBAL_ASYNC_QUERIES_MIN_CACHE_TTL = 300  # seconds
-```
-
-How the floor interacts with the timeouts above:
-
- It applies **only to async execution**. Synchronous `/chart/data` requests keep their normal
-  chart/dataset/database/`DATA_CACHE_CONFIG` timeout even when Global Async Queries is enabled.
- A **longer** effective TTL from that chain is kept as-is — the floor only raises TTLs that are
-  shorter than it.
- A TTL of `0` ("cache forever") is left untouched.
-
-Tuning guidance: raise this value if your workload's async round trip can exceed five minutes (very
-long-running queries or slow warehouses), otherwise those charts may intermittently fail to load. Be
-aware of the trade-off — because the floor can raise an async result's TTL above a shorter cache
-retention policy, it keeps async results in the cache longer and modestly increases cache
-(Redis/Valkey) usage. Do not lower it below your worst-case async round trip.
-
 ## Limiting Cached Result Size

 Very large chart or SQL query results can flood the cache backend (Redis/Memcached), evicting many
@@ -186,50 +134,6 @@ CELERY_CONFIG = CustomCeleryConfig
 This will cache the top 5 most popular dashboards every hour. For other
 strategies, check the `superset/tasks/cache.py` file.

-### Warming Up Native Filter Options
-
-Native filter Value-type dropdown option queries (e.g. `SELECT DISTINCT column FROM table`) are
-cached the same way as chart data, via `DATA_CACHE_CONFIG`. However, the strategies above only warm
-up chart render queries, so the first user to open a dashboard's filter dropdown after a cache entry
-expires still triggers a fresh database query.
-
-The `native_filter_options` strategy pre-populates the cache for these dropdown queries. It reads
-each dashboard's `native_filter_configuration`, builds the same `filter_select` chart-data query the
-frontend would send, and executes it as the configured `SUPERSET_CACHE_WARMUP_USER`:
-
-```python
-class CustomCeleryConfig(CeleryConfig):
-    beat_schedule = {
-        **CeleryConfig.beat_schedule,
-        'cache-warmup-native-filters': {
-            'task': 'cache-warmup',
-            'schedule': crontab(minute=0, hour=3),  # daily at 03:00
-            'kwargs': {
-                'strategy_name': 'native_filter_options',
-                'dashboard_ids': [1, 2, 3],
-            },
-        },
-    }
-```
-
-Requirements and limitations:
-
- `SUPERSET_CACHE_WARMUP_USER` must be set to a user with access to the dashboards and datasets
-  referenced by the native filters.
- `DATA_CACHE_CONFIG` must use a backend that actually persists entries (Redis recommended); the
-  default `NullCache` discards writes, so warming has nothing to warm. The effective timeout also
-  needs to be positive — `NATIVE_FILTER_OPTIONS_CACHE_TIMEOUT = -1` disables cache writes for these
-  queries entirely, even with a working backend.
- Schedule the warm-up at least as often as the effective native filter cache timeout (whichever of
-  `NATIVE_FILTER_OPTIONS_CACHE_TIMEOUT`, the chart/dataset/database timeout, or `DATA_CACHE_CONFIG`'s
-  default applies). A looser schedule still leaves a window of cold, unwarmed queries between expiry
-  and the next run — the daily example above assumes a TTL of a day or more.
- Cache entries are warmed under the warm-up user's own cache partition, the same entry that user
-  would create by opening the filter dropdown manually. Users with a different role set or row-level
-  security context may still see a cache miss on first load.
- Cascading/dependent native filters and search-term variants of filter option queries are not
-  warmed by this strategy.
-
 ## Caching Thumbnails

 This is an optional feature that can be turned on by activating its [feature flag](/admin-docs/configuration/configuring-superset#feature-flags) on config:
@@ -347,25 +251,14 @@ high-performance distributed operations. This configuration enables:

 - **Distributed locking**: Moves lock operations from the metadata database to Redis, improving
  performance and reducing metastore load
- **Event-driven notifications**: Task completion and abort signals are delivered over Redis
-  **Streams**, so waiters (sync join-and-wait, task-dependency DAGs, abort listeners) wake when a
-  signal lands instead of polling the metadata database. Because stream entries are persisted, a
-  waiter that reads slightly late, reconnects, or fails over still receives the signal. Without this
-  backend, these operations poll the metadata database instead.
+- **Real-time event notifications**: Enables instant pub/sub messaging for task abort signals and
+  completion notifications instead of polling-based approaches

 :::note
-This requires Redis or Valkey specifically—it uses Redis-specific features (Streams, pub/sub,
-`SET NX EX`) that are not available in general Flask-Caching backends.
+This requires Redis or Valkey specifically—it uses Redis-specific features (pub/sub, `SET NX EX`)
+that are not available in general Flask-Caching backends.
 :::

-Each signal stream keeps only its latest entry and is given a TTL, so signal streams for tasks that
-are never awaited do not accumulate in Redis/Valkey. Set the retention window with
-`DISTRIBUTED_COORDINATION_SIGNAL_TTL` (seconds, default 24 hours):
-
-```python
-DISTRIBUTED_COORDINATION_SIGNAL_TTL = 24 * 60 * 60
-```
-
 ### Configuration

 The distributed coordination uses Flask-Caching style configuration for consistency with other cache
@@ -408,23 +301,6 @@ DISTRIBUTED_COORDINATION_CONFIG = {
 }
 ```

-By default, connections opened for `DISTRIBUTED_COORDINATION_CONFIG` have no socket
-timeout. This can be overridden with `CACHE_REDIS_SOCKET_TIMEOUT` and
-`CACHE_REDIS_SOCKET_CONNECT_TIMEOUT`, both in seconds:
-
-```python
-DISTRIBUTED_COORDINATION_CONFIG = {
-    "CACHE_TYPE": "RedisCache",
-    "CACHE_REDIS_HOST": "localhost",
-    "CACHE_REDIS_PORT": 6379,
-    "CACHE_REDIS_SOCKET_TIMEOUT": 5,  # seconds
-    "CACHE_REDIS_SOCKET_CONNECT_TIMEOUT": 5,  # seconds
-}
-```
-
-These apply to `RedisSentinelCache` connections as well, covering both the sentinel-node
-connections and the resolved master connection.
-
 ### Distributed Lock TTL

 You can configure the default lock TTL (time-to-live) in seconds. Locks automatically expire after
@@ -97,54 +97,6 @@ for more information on how to configure it.

 At the very least, you'll want to change `SECRET_KEY` and `SQLALCHEMY_DATABASE_URI`. Continue reading for more about each of these.

-## Localizing D3 date and time labels
-
-`BABEL_DEFAULT_LOCALE` controls Superset's application translations, while
-`D3_TIME_FORMAT` provides localized date and time names to visualizations that
-use the D3 formatter registry, including Calendar Heatmap. Configure both when
-you want the application and chart labels to use the same locale.
-
-`D3_TIME_FORMAT` accepts partial overrides. For example, Russian month names
-can be configured in `superset_config.py` as follows:
-
-```python
-BABEL_DEFAULT_LOCALE = "ru"
-
-D3_TIME_FORMAT = {
-    "months": [
-        "Январь",
-        "Февраль",
-        "Март",
-        "Апрель",
-        "Май",
-        "Июнь",
-        "Июль",
-        "Август",
-        "Сентябрь",
-        "Октябрь",
-        "Ноябрь",
-        "Декабрь",
-    ],
-    "shortMonths": [
-        "Янв",
-        "Фев",
-        "Мар",
-        "Апр",
-        "Май",
-        "Июн",
-        "Июл",
-        "Авг",
-        "Сен",
-        "Окт",
-        "Ноя",
-        "Дек",
-    ],
-}
-```
-
-Restart Superset after changing `superset_config.py` so the frontend receives
-the updated formatter configuration.
-
 ## Chart-data query timing

 Set `CHART_DATA_INCLUDE_TIMING = True` to add an optional versioned timing object
@@ -355,22 +307,6 @@ to simplify the process of setting up a non-default root path across the service
 In `docker/.env-local` set `SUPERSET_APP_ROOT` to the desired prefix and then bring the
 services up with `docker compose up --detach`.

-### Swagger UI
-
-By default, Superset's Swagger UI and OpenAPI spec (enabled via `FAB_API_SWAGGER_UI`) are
-served by Flask-AppBuilder and don't account for a non-root `APPLICATION_ROOT` prefix. If
-you're running Superset behind a URL prefix and want the Swagger UI and OpenAPI spec to
-resolve correctly, set:
-
-```python
-FAB_API_SWAGGER_UI_SUPERSET_APP_ROOT = True
-```
-
-in your `superset_config.py` file. This serves an `APPLICATION_ROOT`-aware Swagger UI and
-OpenAPI spec at `/swagger/<version>` and `/api/<version>/_openapi` respectively, resolved
-through the configured prefix. This flag only takes effect when `FAB_API_SWAGGER_UI` is
-also enabled, and defaults to `False`.
-
 ## Custom OAuth2 Configuration

 Superset is built on Flask-AppBuilder (FAB), which supports many providers out of the box
@@ -566,55 +502,6 @@ def FLASK_APP_MUTATOR(app: Flask) -> None:
    app.before_request_funcs.setdefault(None, []).append(make_session_permanent)
 ```

-## Carrying extra data through chart and dashboard exports
-
-Deployments often attach their own metadata to charts and dashboards — an owning
-team, a catalogue entry, a cost centre — and need it to survive an export/import
-round trip between environments. `EXTRA_ASSET_EXPORT_FIELDS` and
-`EXTRA_ASSET_IMPORT_HANDLER` let you do that without forking the export commands.
-
-The export hook receives the model and the asset type (`"chart"` or `"dashboard"`)
-and returns a mapping, which is serialised under the `extra` key of the asset's
-YAML. The import hook receives the model, the asset type and that same mapping,
-once the asset exists and has an id:
-
-```python
-# superset_config.py
-def _export_fields(model, asset_type):
-    return {"owning_team": lookup_team(model)}
-
-
-def _import_handler(model, asset_type, extra):
-    if team := extra.get("owning_team"):
-        assign_team(model, team)
-
-
-EXTRA_ASSET_EXPORT_FIELDS = _export_fields
-EXTRA_ASSET_IMPORT_HANDLER = _import_handler
-```
-
-The exported YAML then carries:
-
-```yaml
-slice_name: Revenue by region
-...
-extra:
-  owning_team: analytics-platform
-```
-
-A few things worth knowing:
-
- **Both hooks are optional and default to `None`.** With neither configured,
-exported files are byte-for-byte what they were before, and imports behave
-identically.
- **Everything lives under the single `extra` key.** The import schemas reject
-unknown top-level fields, so namespacing under `extra` keeps that strictness
-while leaving you free to change the shape of your own payload later.
- **An export hook returning `None` or an empty mapping writes nothing**, so
-assets without your metadata do not gain an empty `extra` block.
- **The import handler runs after the asset is created or updated**, which means
-you can rely on `model.id`. Raising from it will fail the import.
-
 ## Customizing the landing page (index view)

 The page served at `/` is rendered by an index view. By default Superset registers
@@ -18,7 +18,7 @@ code is less ambiguous and is unique to all regions in the world.
 ## Included Maps

 The current list of countries can be found in the src
-[plugin-chart-country-map/src/countries.ts](https://github.com/apache/superset/blob/master/superset-frontend/plugins/plugin-chart-country-map/src/countries.ts)
+[legacy-plugin-chart-country-map/src/countries.ts](https://github.com/apache/superset/blob/master/superset-frontend/plugins/legacy-plugin-chart-country-map/src/countries.ts)

 The Country Maps visualization already ships with the maps for the following countries:

@@ -31,10 +31,10 @@ The Country Maps visualization already ships with the maps for the following cou
 ## Adding a New Country

 To add a new country to the list, you'd have to edit files in
-[@superset-ui/plugin-chart-country-map](https://github.com/apache/superset/tree/master/superset-frontend/plugins/plugin-chart-country-map).
+[@superset-ui/legacy-plugin-chart-country-map](https://github.com/apache/superset/tree/master/superset-frontend/plugins/legacy-plugin-chart-country-map).

-1. Generate a new GeoJSON file for your country following the guide in [this Jupyter notebook](https://github.com/apache/superset/blob/master/superset-frontend/plugins/plugin-chart-country-map/scripts/Country%20Map%20GeoJSON%20Generator.ipynb).
-2. Edit the countries list in [plugin-chart-country-map/src/countries.ts](https://github.com/apache/superset/blob/master/superset-frontend/plugins/plugin-chart-country-map/src/countries.ts).
+1. Generate a new GeoJSON file for your country following the guide in [this Jupyter notebook](https://github.com/apache/superset/blob/master/superset-frontend/plugins/legacy-plugin-chart-country-map/scripts/Country%20Map%20GeoJSON%20Generator.ipynb).
+2. Edit the countries list in [legacy-plugin-chart-country-map/src/countries.ts](https://github.com/apache/superset/blob/master/superset-frontend/plugins/legacy-plugin-chart-country-map/src/countries.ts).
 3. Install superset-frontend dependencies: `cd superset-frontend && npm install`
 4. Verify your countries in Superset plugins storybook: `npm run plugins:storybook`.
 5. Build and install Superset from source code.
@@ -1,184 +0,0 @@
---
-title: Dashboard Performance
-hide_title: true
-sidebar_position: 5
-version: 1
---
-
-<!--
-Licensed to the Apache Software Foundation (ASF) under one
-or more contributor license agreements.  See the NOTICE file
-distributed with this work for additional information
-regarding copyright ownership.  The ASF licenses this file
-to you under the Apache License, Version 2.0 (the
-"License"); you may not use this file except in compliance
-with the License.  You may obtain a copy of the License at
-
-  http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing,
-software distributed under the License is distributed on an
-"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-KIND, either express or implied.  See the License for the
-specific language governing permissions and limitations
-under the License.
-->
-
-# Dashboard Performance
-
-A dashboard's perceived speed is determined by three independent things: how
-many charts have to render, how many queries the backend can execute
-concurrently, and how quickly the underlying data warehouse can return
-results. Superset gives you levers for the first two; the third belongs to
-your warehouse. This page covers the dashboard-side levers and the practical
-guidance around them.
-
-## Is there a maximum chart count per dashboard?
-
-**No hard limit is enforced** — Superset has no configuration key that
-caps the number of charts on a dashboard. In practice, dashboards behave
-well up to a few dozen charts. Beyond that, you'll typically feel friction
-on the initial load and during cross-filter / time-range updates, even with
-the lazy-loading optimizations described below.
-
-Rough thresholds to keep in mind:
-
- **Under ~25 charts**: usually no perceptible problem.
- **25–50 charts**: still fine, but you start to want tabs to break the
-  page into chunks the user actually looks at.
- **Over ~50 charts**: split into multiple dashboards or use tabs
-  aggressively. The bottleneck is rarely Superset itself — it's the
-  warehouse executing dozens of queries in parallel and the browser
-  rendering dozens of chart frames.
-
-These are guidelines, not guarantees. A dashboard of 100 sparkline-style
-charts hitting a fast cache behaves very differently from a dashboard of
-20 heavy aggregations against a cold warehouse.
-
-## Lazy rendering — `DASHBOARD_VIRTUALIZATION`
-
-Superset's dashboard layout is virtualized at the row level. Charts that
-are far below the user's current scroll position render a placeholder
-instead of their visualization until the user scrolls them into view, and
-go back to a placeholder if scrolled well past. The chart component itself
-stays mounted throughout — only the visualization is swapped for a
-placeholder — so this alone does **not** reduce backend query load; see
-[Deferred data fetch](#deferred-data-fetch--dashboard_virtualization_defer_data)
-below for that. This is on by default.
-
-**Feature flag**: `DASHBOARD_VIRTUALIZATION` (default: `True`)
-
-The flag is `stable` and marked for path-to-deprecation — meaning the
-behavior will eventually be non-optional, but the flag still exists so
-operators can disable it if a specific layout misbehaves.
-
-**Behavior** (from `superset-frontend/src/dashboard/components/gridComponents/Row/Row.tsx`):
-
- A chart's visualization is rendered when its row scrolls within **1
-  viewport height** of the visible area.
- A chart's visualization is swapped back for a placeholder when its row
-  scrolls more than **4 viewport heights** away from the visible area.
- Tabs that aren't currently selected don't render their content at all
-  (see below).
- The placeholder-swap-back is skipped in **embedded** mode (so an
-  embedded dashboard keeps its charts rendered once they've been seen,
-  which avoids re-rendering on scroll-up). Both halves are skipped for
-  **headless / bot** rendering (so screenshot / report jobs load every
-  chart).
-
-## Deferred data fetch — `DASHBOARD_VIRTUALIZATION_DEFER_DATA`
-
-By default, `DASHBOARD_VIRTUALIZATION` only controls whether a chart's
-*visualization* is rendered — the chart component still mounts and issues
-its data request immediately, regardless of scroll position.
-`DASHBOARD_VIRTUALIZATION_DEFER_DATA` is a supplementary flag that skips
-the data request itself for charts that aren't currently in view, useful
-for backends where opening a connection or compiling a query is expensive
-even if the result would be thrown away. It only has an effect when
-`DASHBOARD_VIRTUALIZATION` is also enabled — with virtualization off,
-every chart is treated as in view, so there's nothing left to defer.
-
-**Feature flag**: `DASHBOARD_VIRTUALIZATION_DEFER_DATA` (default: `False`)
-
-Enable this if you see warehouse load spike on dashboard *open* even
-though most charts are off-screen.
-
-## Per-tab lazy loading
-
-**This is on by default and has no flag.** A tab's content is not rendered
-until the user activates that tab, so charts inside an unselected tab do
-not fetch data on dashboard open. When the user clicks the tab, that
-tab's charts mount and fetch in the normal way.
-
-Practically: tabs are the single most effective tool for a large
-dashboard. Splitting 60 charts across 4 tabs effectively turns dashboard
-open into "load ~15 charts," and the remaining ones lazy-load only if the
-user goes looking.
-
-## Is there a switch to cap concurrent chart queries?
-
-**No.** Superset does not implement a frontend-side concurrent-request
-limiter. Each chart issues its own data request when it mounts, and the
-browser handles parallelism — typically ~6 in-flight requests per origin
-under HTTP/1.1, though HTTP/2 or HTTP/3 (if your deployment terminates
-TLS that way) can multiplex considerably more over a single connection.
-Backend throughput is bounded by your
-Gunicorn worker count for synchronous query execution, or by your Celery
-worker pool when [async queries](./async-queries-celery.mdx) are enabled.
-
-If you need to throttle warehouse load, the right place is:
-
-1. The warehouse itself (connection pool / concurrency limits).
-2. Superset's Celery configuration (smaller worker pool when async
-   queries are on).
-3. Splitting heavy charts across tabs or separate dashboards (each
-   dashboard load only fetches what's visible).
-
-## Splitting strategies
-
-When a dashboard outgrows comfortable performance, the options in order
-of effort:
-
-**1. Move sections into tabs.** Same dashboard, but only the active tab's
-charts fetch. This is the cheapest change and often the only one needed.
-
-**2. Cache aggressively.** A Redis cache backend (see
-[Caching](./cache.mdx)) means repeat dashboard loads serve from cache
-rather than re-hitting the warehouse. This is especially impactful for
-dashboards opened by many users in close succession.
-
-**3. Enable async queries.** [Async query execution](./async-queries-celery.mdx)
-via Celery decouples query duration from request lifetime, so a slow
-chart doesn't block the page. The user sees other charts come in as
-their queries complete.
-
-**4. Split into multiple dashboards.** Group related charts into purpose-
-specific dashboards rather than one mega-dashboard. Link them from a
-landing dashboard or a navigation menu.
-
-**5. Pre-aggregate at the warehouse level.** If the same expensive
-aggregation appears across many charts, materialize it as a view or
-scheduled table in the warehouse so each chart query is a cheap lookup.
-
-## Operational notes
-
- The feature flags above are set in `superset_config.py`, e.g.:
-
-  ```python
-  FEATURE_FLAGS = {
-      "DASHBOARD_VIRTUALIZATION": True,
-      "DASHBOARD_VIRTUALIZATION_DEFER_DATA": True,
-  }
-  ```
-
- See [Feature Flags](./feature-flags.mdx) for the full list of supported
-  flags and their lifecycle stages.
- Server-side screenshot jobs (alerts, scheduled reports, thumbnails)
-  render the dashboard in a headless, webdriver-controlled browser, which
-  intentionally bypasses row virtualization so the rendered artifact
-  includes every chart, not just the ones above the fold. User-triggered
-  "download as image/PDF" is different: it captures whatever's currently
-  rendered in the user's own browser, so it's still subject to
-  virtualization like any other page view. Metadata/YAML dashboard export
-  doesn't render the frontend at all, so virtualization doesn't apply to
-  it either.
@@ -50,34 +50,13 @@ Superset can be configured to log events to [StatsD](https://github.com/statsd/s
 if desired. Most endpoints hit are logged as
 well as key events like query start and end in SQL Lab.

-Superset can also collect gunicorn [metrics](https://gunicorn.org/instrumentation/).
-To enable these, the following environment variables should be set:
-
-```bash
-SERVER_STATSD_HOST=localhost
-SERVER_STATSD_PORT=8125
-SERVER_STATSD_PREFIX=superset
-```
-
-To setup StatsD logging for Superset, it’s a matter of configuring the logger in your `superset_config.py`.
+To setup StatsD logging, it’s a matter of configuring the logger in your `superset_config.py`.
+If not already present, you need to ensure that the `statsd`-package is installed in Superset's python environment.

 ```python
-import os
 from superset.stats_logger import StatsdStatsLogger
-
-try:
-    STATSD_PORT = int(os.environ.get("SERVER_STATSD_PORT", "8125"))
-except ValueError:
-    STATSD_PORT = 8125
-
-STATS_LOGGER = StatsdStatsLogger(
-    host=os.environ.get("SERVER_STATSD_HOST", "localhost"),
-    port=STATSD_PORT,
-    prefix=os.environ.get("SERVER_STATSD_PREFIX", "superset"),
-)
+STATS_LOGGER = StatsdStatsLogger(host='localhost', port=8125, prefix='superset')
 ```

-[statsd](https://pypi.org/project/statsd/) in version ~3.3.0 must be installed.
-
 Note that it’s also possible to implement your own logger by deriving
 `superset.stats_logger.BaseStatsLogger`.
@@ -83,26 +83,6 @@ The optional username flag **-u** sets the user used for the datasource import.
 superset import_datasources -p <path / filename> -u 'admin'
 ```

-## Importing a Directory of Assets
-
-The `import_directory` command imports a directory of exported assets (databases, datasets,
-dashboards, charts) in the same layout produced by the ZIP-based export. Saved queries and tags
-included in a full export are not imported by this command:
-
-```bash
-superset import_directory <path / directory>
-```
-
-As with `import_datasources`, the optional username flag **-u** sets the user assigned as the
-owner of the imported assets. The default is 'admin'. Example:
-
-```bash
-superset import_directory <path / directory> -u 'admin'
-```
-
-If the specified user does not exist, the command fails immediately with an error rather than
-importing the assets without an owner.
-
 ## Dashboard Import Overwrite Behavior

 When importing a dashboard ZIP with the **overwrite** option enabled, any existing charts that are part of the dashboard are **replaced** rather than duplicated. This applies to:
@@ -253,58 +253,6 @@ def my_custom_auth_factory(app):
 MCP_AUTH_FACTORY = my_custom_auth_factory
 ```

-### Embedded Guest Authentication
-
-Superset's [embedded dashboards](/user-docs/using-superset/embedding) feature mints short-lived **guest tokens** for anonymous/embedded viewers. The MCP server can accept these same guest tokens, so an embedded guest (e.g. an in-app chatbot next to an embedded dashboard) can call MCP tools scoped to the dashboards/resources named in its token.
-
-This is opt-in and reuses the existing core guest-token configuration -- there is no MCP-specific guest secret or audience.
-
-```python
-# superset_config.py
-FEATURE_FLAGS = {"EMBEDDED_SUPERSET": True}   # required -- guest tokens only exist when this is on
-MCP_EMBEDDED_GUEST_AUTH_ENABLED = True        # opt-in for the MCP transport (default False)
-```
-
-Present the guest token the same way as any other bearer token:
-
-```bash
-curl -X POST http://localhost:5008/mcp \
-  -H 'Content-Type: application/json' \
-  -H 'Authorization: Bearer YOUR_GUEST_TOKEN' \
-  -d '{"jsonrpc": "2.0", "method": "tools/list", "id": 1}'
-```
-
-**How it works**
-
- A dedicated guest-token verifier validates the token against the same `GUEST_TOKEN_JWT_SECRET` / `GUEST_TOKEN_JWT_ALGO` / `GUEST_TOKEN_JWT_AUDIENCE` config used by embedded dashboards, replays the embedded structural checks, and enforces revocation (global version bumps and per-dashboard `guest_token_revoked_before` cutoffs). It runs *before* the JWT verifier described above, since guest tokens are signed with a different key/algorithm and would otherwise be rejected at the transport.
- A verified guest resolves to a Superset guest user as the highest-priority identity, so it's never downgraded to API-key / `MCP_DEV_USERNAME` / dev-mode resolution. Data access is scoped by the same checks (dataset allowlist, dashboard access, row-level security) that apply to embedded dashboard views.
- Guests are restricted to a default-deny allow-list, `MCP_GUEST_ALLOWED_TOOLS`, regardless of `MCP_RBAC_ENABLED`. Sensitive enumeration tools like `find_users` and `get_instance_info` are denied simply by being absent from the default list.
- Setting `MCP_AUTH_FACTORY` bypasses this whole path: a configured factory is tried first, and the default factory that wires up the guest-token verifier is never reached. If you rely on a custom auth factory (e.g. your own OIDC provider) alongside guest auth, that factory must verify guest tokens itself -- otherwise they're rejected regardless of `MCP_EMBEDDED_GUEST_AUTH_ENABLED`.
-
-```python
-# superset_config.py
-MCP_GUEST_ALLOWED_TOOLS = {
-    "get_dashboard_info",
-    "get_dashboard_layout",
-    "list_dashboards",
-    "list_charts",
-    "get_chart_info",
-    "get_chart_data",
-    "get_chart_preview",
-}  # default
-```
-
-**Deployment requirements**
-
- The MCP server and the service that mints guest tokens (the Superset web app) must share `GUEST_TOKEN_JWT_SECRET` and `GUEST_TOKEN_JWT_AUDIENCE`. Set `GUEST_TOKEN_JWT_AUDIENCE` explicitly -- if it's unset, audience validation falls back to the URL host, which can differ between the two services and cause every guest token to fail validation.
- The `GUEST_ROLE_NAME` role (default `Public`) must exist -- a guest token is rejected if it does not.
- Don't set `MCP_DEV_USERNAME` on a deployment that also serves embedded guests.
- Restart the MCP process after toggling `EMBEDDED_SUPERSET` or `MCP_EMBEDDED_GUEST_AUTH_ENABLED` -- guest auth is wired up once at startup.
-
-:::warning
-`GUEST_TOKEN_JWT_SECRET` guards both the web embedding and MCP guest-auth surfaces. With `MCP_EMBEDDED_GUEST_AUTH_ENABLED` on, leaving it at its insecure default isn't just a forgery risk -- the MCP server refuses to start (`MCPAuthConfigError`) until you set a real secret shared with the guest-token minting service.
-:::
-
 ---

 ## Connecting AI Clients
@@ -540,8 +488,6 @@ MCP_STORE_CONFIG = {

 When `CACHE_REDIS_URL` is set, the MCP server uses a Redis-backed EventStore for session management, allowing replicas to share state. Without Redis, each pod manages its own in-memory sessions and stateful MCP interactions may fail when requests hit different replicas.

-`MCP_STATELESS_HTTP` (default `True`) controls whether requests get a fresh, ephemeral transport per HTTP round trip or a transport that stays alive for the session's lifetime. The default suits multi-pod deployments because it doesn't require session affinity -- any pod can handle any request. Its tradeoff: a client disconnecting mid-tool-call can crash not just its own session but other concurrent sessions on the same worker. Setting it to `False` avoids that, but it requires session-affinity (sticky session) routing on `Mcp-Session-Id` at the mesh/ingress layer, since a session's follow-up requests must land on the same pod that created it. See [`MCP_STATELESS_HTTP`](#core) below.
-
 ---

 ## Configuration Reference
@@ -557,11 +503,8 @@ All MCP settings go in `superset_config.py`. Defaults are defined in `superset/m
 | `MCP_SERVICE_URL`    | `None`        | Public base URL for MCP-generated links (set this when behind a reverse proxy)                                                                                                                                                                                               |
 | `MCP_DEBUG`          | `False`       | Enable debug logging                                                                                                                                                                                                                                                         |
 | `MCP_DEV_USERNAME`   | --            | Superset username for development mode (no auth)                                                                                                                                                                                                                             |
-| `MCP_STATELESS_HTTP` | `True`        | Streamable-HTTP session mode. `True` gives each request a fresh, ephemeral transport, torn down as soon as that request completes; a client disconnecting mid-tool-call can crash not just its own session but other concurrent sessions on the same worker. `False` keeps the transport alive for the session's lifetime, avoiding that crash, but requires session-affinity routing on `Mcp-Session-Id` for multi-pod deployments (see [Multi-Pod (Kubernetes)](#multi-pod-kubernetes)). |
 | `MCP_RBAC_ENABLED`   | `True`        | Enforce Superset's role-based access control on MCP tool calls. When `True`, each tool checks that the authenticated user has the required FAB permission before executing. Disable only for testing or trusted-network deployments.                                         |
 | `MCP_DISABLED_TOOLS` | `set()`       | Set of tool names to remove from the MCP server at startup. Disabled tools are never advertised to AI clients during tool discovery. Useful when a custom extension tool should replace a built-in Superset tool. See [Disabling built-in tools](#disabling-built-in-tools). |
-| `MCP_DISABLED_CHART_PLUGINS` | `frozenset()` | Set of chart type plugin names (e.g. `"handlebars"`) to hide from `generate_chart`. Does not affect `get_chart_type_schema`. See [Disabling chart type plugins](#disabling-chart-type-plugins). |
-| `MCP_CHART_PLUGIN_ENABLED_FUNC` | `None`        | Callable `(chart_type: str) -> bool` evaluated per registry lookup for dynamic enable/disable decisions. Takes precedence over `MCP_DISABLED_CHART_PLUGINS` when set. See [Disabling chart type plugins](#disabling-chart-type-plugins). |

 ### Authentication

@@ -578,8 +521,6 @@ All MCP settings go in `superset_config.py`. Defaults are defined in `superset/m
 | `MCP_JWT_DEBUG_ERRORS` | `False`   | Log detailed JWT errors server-side (never exposed in HTTP responses per RFC 6750)                                                                                                                                               |
 | `MCP_AUTH_FACTORY`     | `None`    | Custom auth provider factory `(flask_app) -> auth_provider`. Takes precedence over built-in JWT                                                                                                                                  |
 | `MCP_USER_RESOLVER`    | `None`    | Custom function `(app, access_token) -> username` to extract a Superset username from a validated JWT token. When `None`, the default resolver checks `preferred_username`, `username`, `email`, and `sub` claims in that order. |
-| `MCP_EMBEDDED_GUEST_AUTH_ENABLED` | `False` | Accept embedded [guest tokens](#embedded-guest-authentication) as Bearer auth. Also requires the `EMBEDDED_SUPERSET` feature flag. |
-| `MCP_GUEST_ALLOWED_TOOLS` | see [default list](#embedded-guest-authentication) | The only tool names callable by embedded guests (default-deny), regardless of `MCP_RBAC_ENABLED`. |

 ### Response Size Guard

@@ -635,7 +576,7 @@ MCP_CACHE_CONFIG = {
 | Key                  | Default   | Description                                                 |
 | -------------------- | --------- | ----------------------------------------------------------- |
 | `enabled`            | `False`   | Enable response caching                                     |
-| `CACHE_KEY_PREFIX`   | `None`    | Base prefix for shared Redis; Superset appends an internal response-contract namespace |
+| `CACHE_KEY_PREFIX`   | `None`    | Optional prefix for cache keys (useful for shared Redis)    |
 | `list_tools_ttl`     | `300`     | Cache TTL in seconds for `tools/list`                       |
 | `list_resources_ttl` | `300`     | Cache TTL for `resources/list`                              |
 | `list_prompts_ttl`   | `300`     | Cache TTL for `prompts/list`                                |
@@ -777,34 +718,6 @@ Every MCP request passes through a middleware stack before reaching the tool fun

 Additional middleware classes (`RateLimitMiddleware`, `FieldPermissionsMiddleware`, `PrivateToolMiddleware`) are implemented in `superset/mcp_service/middleware.py` but are not added to the default pipeline. They are available for operators who want to layer them in via a custom startup path.

-### Tool Result Value Contract
-
-Structured tool results preserve Superset domain values exactly. In particular,
-string fields are not wrapped in trust delimiters, and text that resembles a
-delimiter is returned as literal application data. This lets clients safely use a
-read result as the basis for an update without persisting presentation markup.
-
-All tool-result content should still be treated as user-controlled data with no
-instruction authority. MCP clients should communicate that trust boundary through
-their model instructions or presentation layer, outside the returned field values;
-fixed or generated marker strings inside a value are ambiguous and must not be used
-as a trust signal.
-
-For compatibility, clients that supported the former
-`<UNTRUSTED-CONTENT>` convention should stop recognizing or stripping those strings.
-The response schemas and content types have not changed. Because marker-looking text
-can be legitimate application data, a client cannot reliably distinguish a legacy
-decorated response from a clean one. Pause automated read-modify-write workflows, or
-route them only to upgraded instances, until every serving instance is upgraded.
-
-Redis-backed MCP response caches include an internal response-contract namespace, so
-an upgraded instance does not reuse responses cached by an older release. Older
-instances can still return legacy values while they remain in service. After the
-upgrade, review previously written values for wrapper text and both
-`[ESCAPED-UNTRUSTED-CONTENT-OPEN]` and
-`[ESCAPED-UNTRUSTED-CONTENT-CLOSE]`; do not remove these strings automatically,
-because they may be intentional content.
-
 ### Error Sanitization

 The `GlobalErrorHandlerMiddleware` automatically redacts sensitive information from all error messages before they reach the LLM client. The following are replaced with generic messages:
@@ -839,20 +752,11 @@ For a 3-pod Kubernetes deployment with the defaults above, expect up to 3 × (5
 Enable response caching for read-heavy workloads (dashboards/datasets that don't change frequently). With the in-memory backend (default when `MCP_STORE_CONFIG` is disabled), caching is per-process. Use Redis-backed caching for consistent cache hits across multiple pods:

 ```python
-MCP_CACHE_CONFIG = {
-    "enabled": True,
-    # Cache keys don't include the requesting principal and hits are served
-    # ahead of auth/RBAC, so a shared cache can return one caller's response
-    # to another. Required for caching to actually start -- only appropriate
-    # when every request is guaranteed to come from the same principal.
-    "dangerously_share_cache_across_principals": True,
-    "CACHE_KEY_PREFIX": "mcp_cache_",
-    "call_tool_ttl": 3600,
-}
+MCP_CACHE_CONFIG = {"enabled": True, "call_tool_ttl": 3600}
 MCP_STORE_CONFIG = {"enabled": True, "CACHE_REDIS_URL": "redis://redis:6379/0"}
 ```

-Every tool with a side effect (create/update/delete/execute) is always excluded from caching regardless of this setting -- see the `excluded_tools` default in `superset/mcp_service/mcp_config.py` for the current list.
+Mutating tools (`generate_chart`, `update_chart`, `execute_sql`, `generate_dashboard`) are always excluded from caching regardless of this setting.

 ---

@@ -952,43 +856,6 @@ MCP_DISABLED_TOOLS = {"extensions.myorg.myextension.some_tool"}
 Specifying a tool name that does not exist logs a warning at startup and is otherwise ignored — it will not prevent the server from starting.
 :::

-## Disabling chart type plugins
-
-The `generate_chart` tool dispatches per chart type (`xy`, `table`, `pie`, `gauge`, `pivot_table`, `interactive_pivot`, `mixed_timeseries`, `handlebars`, `big_number`, `histogram`, `box_plot`, `waterfall`) to a registered chart type plugin. Gauge requests use the public MCP discriminator `chart_type: "gauge"`; Superset stores the corresponding native Explore visualization as `viz_type: "gauge_chart"`. Two settings let operators enable or disable individual chart type plugins at runtime, without a code deploy.
-
-Gauge data inspection and JSON/CSV/XLSX exports preserve source groups, including NULL and non-finite metric values, using the same row-count and completeness semantics as other chart types. The default XLSX exporter writes non-finite floats as `nan`, `inf`, or `-inf` text, matching CSV and distinguishing them from blank NULL cells. Only previews and compile checks skip NULL, NaN, non-finite, and other nonnumeric dial values while preserving finite groups. In preview/compile paths, a nonempty result containing no finite dial returns an error; genuinely empty results retain the no-data behavior. Compile checks inspect the configured dial limit (at most 10), rather than only two groups. Grouped Vega previews center each needle within its own facet and extend it to the midpoint of the dial band. Automatic all-zero ranges span 0–1. Empty or whitespace-only temporal ranges, like `No filter`, are neutral sentinels; missing or non-string native temporal comparators are invalid.
-
-Gauge previews retain data-derived automatic bounds even when configured interval thresholds extend beyond the visible range; Vega previews clip those thresholds into adjacent, non-overlapping bands. Explicit min/max bounds still constrain intervals. All-zero data with both bounds omitted uses a nondegenerate preview range of 0–1. On same-dataset Gauge updates, clearing or changing the dashboard temporal binding preserves user-authored temporal ranges; dataset rebinds discard old query roles and filters. The native `"No filter"` sentinel is a neutral dashboard temporal binding, not a conflicting restriction. Duplicate generated neutral bindings self-heal on updates without removing user-authored ranges. Restating the existing dataset ID without a config is allowed; changing the Gauge dataset still requires a complete config. Native restrictive temporal filters that conflict with the top-level range or another restrictive temporal filter are rejected rather than silently dropped. Unsupported native filter operators are rejected with an indexed error. Native `TEMPORAL_RANGE` adhoc filters require an explicit string comparator; `"No filter"`, empty strings, and whitespace represent an unrestricted range.
-
-### Static deny-list
-
-Set `MCP_DISABLED_CHART_PLUGINS` in your `superset_config.py` to a set of chart type names:
-
-```python
-# superset_config.py
-
-# Emergency kill switch: hide "handlebars" from all callers
-MCP_DISABLED_CHART_PLUGINS = {"handlebars"}
-```
-
-Disabled chart types stay registered but are filtered out at lookup time: they're never listed in `generate_chart`'s supported chart types, and `generate_chart` calls for them are rejected. `get_chart_type_schema` consults its own static schema/example map rather than the registry filter, so a disabled chart type's schema remains queryable through that tool even though `generate_chart` will reject it.
-
-### Dynamic predicate
-
-For per-request control (A/B tests, gradual rollout, entitlement checks), set `MCP_CHART_PLUGIN_ENABLED_FUNC` to a callable. It's evaluated as `enabled_func(chart_type: str) -> bool` on every registry lookup, and it takes precedence over `MCP_DISABLED_CHART_PLUGINS` when set:
-
-```python
-# superset_config.py
-from flask import g
-
-
-def MCP_CHART_PLUGIN_ENABLED_FUNC(chart_type: str) -> bool:
-    flags = getattr(g, "feature_flags", {})
-    return flags.get(f"mcp_chart_{chart_type}", True)
-```
-
-The callable must be cheap and in-process (consult already-loaded feature flags or request-local context) -- do not perform network I/O per call. If it raises, the registry fails closed (the plugin is hidden) and logs a warning.
-
 ## Security Best Practices

 - **Use TLS** for all production MCP endpoints -- place the server behind a reverse proxy with HTTPS
@@ -315,76 +315,6 @@ Here's a concrete example:
  WHERE country_code = 'US'
  ```

-**Guest User Attributes**
-
-The `{{ get_guest_user_attribute('attribute_name') }}` macro returns a specific attribute value from the guest user context.
-This is useful when working with embedded Superset where guest tokens can contain custom attributes that need to be
-accessed in SQL queries.
-
-This macro only works when the current user is a guest user (authenticated via guest token). If the current user is
-not a guest user, or if the specified attribute doesn't exist, the macro will return `None` or the provided default value.
-
-If you have caching enabled in your Superset configuration, then by default the resolved value (whether it
-came from the guest token, a null attribute, or the provided default) will be used by Superset when
-calculating the cache key. A cache key is a unique identifier that determines if there's a cache hit in the
-future and Superset can retrieve cached data. Including the resolved value on every branch ensures two guests
-whose tokens render different SQL never share a cache entry.
-
-You can disable the inclusion of the attribute value in the calculation of the
-cache key by adding the following parameter to your Jinja code, but only do so
-when the value cannot affect the query results:
-
-```
-{{ get_guest_user_attribute('department', add_to_cache_keys=False) }}
-```
-
-You can also provide a default value if the attribute is not found:
-
-```
-{{ get_guest_user_attribute('region', default='US') }}
-```
-
-Here's a concrete example of using guest user attributes in a query:
-
-```sql
-SELECT *
-FROM sales_data
-WHERE region = '{{ get_guest_user_attribute("user_region", default="global") }}'
-  AND department = '{{ get_guest_user_attribute("department") }}'
-```
-
-:::warning[Security Warning]
-
-Guest token attributes come from the embedding application. By default,
-`get_guest_user_attribute()` escapes string values — including strings nested inside
-arrays and object values, and caller-supplied defaults — through the database dialect's
-literal rendering (the same mechanism as `url_param()`). This covers dialect-specific
-escape characters such as the backslash on MySQL/MariaDB, so the example above is safe
-to interpolate directly. If you pass `escape_result=False`, or interpolate non-string
-values (numbers, booleans), you are responsible for validating or allowlisting the
-values, since they originate outside Superset.
-
-If a guest attribute is an array and you plan to pipe it through the `|where_in` filter
-(for example `full_name IN {{ get_guest_user_attribute('names')|where_in }}`), call
-`get_guest_user_attribute('names', escape_result=False)`. `where_in` already applies its
-own dialect-safe quoting, so escaping the values twice can corrupt them (a value such as
-`O'Brien` would come back doubly escaped and match nothing).
-
-Only individual string values are escaped as SQL literals. Interpolating an entire array
-or object directly (rather than through `|where_in`, or by accessing a specific element)
-renders Python's string form of that structure, which is not valid SQL, and object keys
-are not escaped at all. Use `|where_in` for arrays, `|tojson` where you need a
-JSON-stringified value, or read individual keys/elements out of the structure yourself.
-
-The same double-escaping problem described above for `|where_in` applies to `|tojson`:
-pass `escape_result=False` before piping to `|tojson` (for example
-`{{ get_guest_user_attribute('profile', escape_result=False)|tojson }}`), since JSON
-already handles its own quoting and re-escaping a value first would corrupt it (a nested
-string such as `O'Brien` would come back as the altered `O''Brien` in the serialized
-JSON).
-
-:::
-
 ### Explicitly Including Values in Cache Key

 The `{{ cache_key_wrapper() }}` function explicitly instructs Superset to add a value to the
@@ -88,27 +88,6 @@ THEME_DARK = {
 # - OS preference detection is automatically enabled
 ```

-### Default Theme Mode
-
-By default, Superset mimics the visitor's OS/browser preference (light or dark) for
-sessions that don't have a saved user preference. Use `THEME_DEFAULT_MODE` to override
-that starting point instance-wide for the standard application:
-
-```python
-# Default theme mode for sessions without a saved user preference.
-# One of "default" (always light), "dark" (always dark), or "system" (mimic OS preference).
-THEME_DEFAULT_MODE = "dark"
-```
-
- `"system"` (the default) preserves the existing behavior of following the OS/browser
-  preference, provided a dark theme is configured (`THEME_DARK` is not `None`). If no dark
-  theme is available, Superset always starts in light mode regardless of this setting.
- `"default"` or `"dark"` forces that starting mode for first-time visitors; users can still switch themes manually afterward if both `THEME_DEFAULT` and `THEME_DARK` are available.
- A user's own saved preference, once they toggle the theme switcher, always takes precedence over `THEME_DEFAULT_MODE`.
- `THEME_DEFAULT_MODE` has no effect on embedded dashboards: the embed SDK sets the
-  starting mode via its own `themeMode` URL parameter, which takes precedence and falls
-  back to light mode when the parameter is absent.
-
 ### App Branding

 The application name shown in the browser title bar and navigation can be
@@ -138,18 +117,6 @@ The existing `APP_NAME` Python config key continues to work for backward compati
 Email and alert/report notification subjects are driven by backend settings such as
 `EMAIL_REPORTS_SUBJECT_PREFIX` and `APP_NAME`, not by this theme token.

-To hide the entire brand area in the navbar (both the logo image and the
-brand text), set `HIDE_NAVBAR_LOGO` in `superset_config.py`:
-
-```python
-# Hide the entire brand area in the navbar, including the logo image and the
-# brand text (brandAppName / APP_NAME). Defaults to False.
-HIDE_NAVBAR_LOGO = True
-```
-
-`HIDE_NAVBAR_LOGO` is a Python config flag rather than a theme token, so it
-cannot be set through the theme CRUD UI or `THEME_DEFAULT`/`THEME_DARK`.
-
 ### Migration from Configuration to UI

 When `ENABLE_UI_THEME_ADMINISTRATION = True`:
@@ -252,39 +219,6 @@ Font URLs are validated against a configurable allowlist. By default, fonts from

 This feature works with the stock Docker image - no custom build required!

-## Results Grid Configuration Overrides
-
-Superset exposes a handful of opt-in tokens that customize the appearance of
-the results grid in SQL Lab. These tokens have no effect unless explicitly
-set, since the results grid otherwise falls back to its built-in defaults.
-
-```python
-THEME_DEFAULT = {
-    "token": {
-        "colorPrimary": "#2893B3",
-        # ... other Ant Design tokens
-
-        # Results grid overrides
-        "resultsGridRowHeight": 32,
-        "resultsGridHeaderFontSize": 13,
-        "resultsGridHeaderFontWeight": 600,
-        "resultsGridBorderRadius": 4,
-        "resultsGridNoStriping": True,
-    }
-}
-```
-
-| Token | Type | Description |
-| --- | --- | --- |
-| `resultsGridRowHeight` | `number` | Row and header height, in pixels. |
-| `resultsGridHeaderFontSize` | `number` | Header cell font size, in pixels. |
-| `resultsGridHeaderFontWeight` | `number` | Header cell font weight. |
-| `resultsGridBorderRadius` | `number` | Border radius applied to the grid and its wrapper, in pixels. |
-| `resultsGridNoStriping` | `boolean` | When `true`, disables alternating row background striping. |
-
-These tokens can also be set through the theme CRUD interface's JSON editor,
-alongside any other Superset-specific tokens.
-
 ## ECharts Configuration Overrides

 :::note
@@ -499,118 +433,6 @@ THEME_DEFAULT = {

 This feature provides powerful theming capabilities while maintaining the flexibility of ECharts' extensive configuration options.

-## Component Sizing & Style Tokens
-
-:::note
-These tokens landed after the Superset 6.1 release and are only available on
-`master`; they are not present in any tagged release yet.
-:::
-
-Beyond colors and fonts, a handful of Superset-specific tokens let you tune the
-sizing, radius, and outline behavior of individual UI components. All of these
-tokens are optional — omit them and components fall back to their existing
-defaults, so applying them is a zero-visual-change operation until you opt in.
-
-### Button & DropdownButton Sizing
-
-```python
-THEME_DEFAULT = {
-    "token": {
-        # ... other tokens
-        "buttonControlHeight": 32,     # default button height, in px
-        "buttonControlHeightSM": 30,   # small/dropdown button height, in px
-        "buttonControlHeightXS": 22,   # xsmall button height, in px
-        "buttonPaddingInline": 18,     # horizontal padding, in px
-        "buttonPaddingInlineSM": 10,   # horizontal padding for small buttons, in px
-        "buttonFontSize": 14,
-        "buttonBorderRadius": 4,
-    }
-}
-```
-
-`buttonControlHeight` and `buttonBorderRadius` also drive the sizing of the
-menu-trigger button used by `PageHeaderWithActions`, so a single pair of tokens
-keeps page-header icon buttons visually consistent with regular buttons.
-
-For one-off overrides that shouldn't apply to every button in the app, pass a
-`styleConfig` prop directly to `Button` or `DropdownButton` instead of setting
-a theme token:
-
-```tsx
-<Button
-  styleConfig={{
-    controlHeight: 40,
-    paddingInline: 20,
-    fontSize: 16,
-    fontWeight: 700,
-    borderRadius: 8,
-    ctaMinWidth: 120,
-    ctaMinHeight: 40,
-    iconGap: 8,
-  }}
->
-  Click me
-</Button>
-
-<DropdownButton
-  styleConfig={{
-    controlHeight: 32,
-    fontSize: 14,
-    fontWeight: 500,
-    boxShadow: '0 2px 4px rgba(0,0,0,0.1)',
-  }}
-  menu={menuProps}
->
-  Options
-</DropdownButton>
-```
-
-`styleConfig` values take precedence over the equivalent theme tokens, which in
-turn take precedence over the built-in defaults.
-
-### Label Border Radius
-
-```python
-THEME_DEFAULT = {
-    "token": {
-        "labelBorderRadius": 4,  # defaults to 8px
-    }
-}
-```
-
-### Select Option Outline
-
-By default, hovering or navigating to an option in a `Select` dropdown draws a
-2px outline in `colorPrimary`. Set `selectOptionActiveOutline` to `False` for a
-more subtle hover style with no outline:
-
-```python
-THEME_DEFAULT = {
-    "token": {
-        "selectOptionActiveOutline": False,
-    }
-}
-```
-
-### Dashboard Tile Appearance
-
-Chart tiles on a dashboard (not text/markdown tiles) can be restyled via
-`dashboardTile*` tokens. All fall back to the existing look — a
-`colorBgContainer` background, a `1px solid colorBorder` border, and a
-hairline `box-shadow` while the tile is fading out (e.g. when a filter
-makes it irrelevant):
-
-```python
-THEME_DEFAULT = {
-    "token": {
-        "dashboardTileBg": "#ffffff",
-        "dashboardTileBorder": "1px solid #e0e0e0",
-        "dashboardTileBorderRadius": 8,
-        "dashboardTileBoxShadow": "0 1px 2px rgba(0, 0, 0, 0.08)",
-    }
-}
-```
-
 ## Advanced Features

 - **System Themes**: Manage system-wide default and dark themes via UI or configuration
@@ -196,9 +196,7 @@ One important variable is `SUPERSET_LOAD_EXAMPLES` which determines whether the
 container will populate example data and visualizations into the metadata database. These examples
 are helpful for learning and testing out Superset but unnecessary for experienced users and
 production deployments. The loading process can sometimes take a few minutes and a good amount of
-CPU, so you may want to disable it on a resource-constrained device. Once the example data and
-dashboards are present in the databases, later `superset_init` runs skip loading them; run
-`SUPERSET_FORCE_LOAD_EXAMPLES=yes docker compose up` to reload the examples anyway.
+CPU, so you may want to disable it on a resource-constrained device.

 For more advanced or dynamic configurations that are typically managed in a `superset_config.py` file
 located in your `PYTHONPATH`, note that it can be done by providing a
@@ -217,7 +215,7 @@ If you have a good solution for this, let us know!
 :::

 :::note
-Superset uses [Scarf Gateway](https://about.scarf.sh/) to collect telemetry
+Superset uses [Scarf Gateway](https://about.scarf.sh/scarf-gateway) to collect telemetry
 data. Knowing the installation counts for different Superset versions informs the project's
 decisions about patching and long-term support. Scarf purges personally identifiable information
 (PII) and provides only aggregated statistics.
@@ -87,7 +87,6 @@ The chart will publish appropriate services to expose the Superset UI internally

 - Configure the Service as a `LoadBalancer` or `NodePort`
 - Set up an `Ingress` for it - the chart includes a definition, but will need to be tuned to your needs (hostname, tls, annotations etc...)
- Set up a Gateway API `HTTPRoute` for it - see [Exposing Superset via Gateway API (HTTPRoute)](#exposing-superset-via-gateway-api-httproute) below
 - Run `kubectl port-forward superset-xxxx-yyyy :8088` to directly tunnel one pod's port into your localhost

 Depending how you configured external access, the URL will vary. Once you've identified the appropriate URL you can log in with:
@@ -136,7 +135,7 @@ init:
 ```

 :::note
-Superset uses [Scarf Gateway](https://about.scarf.sh/) to collect telemetry data. Knowing the installation counts for different Superset versions informs the project's decisions about patching and long-term support. Scarf purges personally identifiable information (PII) and provides only aggregated statistics.
+Superset uses [Scarf Gateway](https://about.scarf.sh/scarf-gateway) to collect telemetry data. Knowing the installation counts for different Superset versions informs the project's decisions about patching and long-term support. Scarf purges personally identifiable information (PII) and provides only aggregated statistics.

 There are two independent telemetry channels:

@@ -320,53 +319,6 @@ configOverrides:
    AUTH_USER_REGISTRATION_ROLE = "Admin"
 ```

-### Exposing Superset via Gateway API (HTTPRoute)
-
-As an alternative to `Ingress`, the chart can create a [Gateway API](https://gateway-api.sigs.k8s.io/)
-`HTTPRoute` that attaches to a Gateway already running in your cluster. This requires the Gateway
-API CRDs serving the configured `httproute.apiVersion` (`gateway.networking.k8s.io/v1` by default)
-to be installed, along with a Gateway resource for the route to attach to. If the Gateway lives in
-a different namespace than the `HTTPRoute` (as in the
-example below), its listener's `allowedRoutes` must explicitly permit routes from this release's
-namespace, or the `HTTPRoute` will install successfully but never attach.
-
-```yaml
-httproute:
-  enabled: true
-  parentRefs:
-    - name: my-gateway
-      namespace: gateway-system
-  hostnames:
-    - superset.example.com
-  rules:
-    - matches:
-        - path:
-            type: PathPrefix
-            value: /
-```
-
- `httproute.parentRefs` lists the Gateway(s) the route attaches to.
- `httproute.hostnames` matches against the HTTP `Host` header; it's templated, so values like
-  `{{ .Release.Name }}` can be used.
- `httproute.rules` are routing rules backed by the Superset service; each rule accepts standard
-  `matches`, `filters`, and `timeouts` fields, and an optional `weight` (defaults to `1`) applied to
-  its single backend reference. Since each rule maps to one backend, `weight` has no traffic-splitting
-  effect here; it only matters if you fork the template to add multiple `backendRefs` to a rule.
-  `timeouts` only joined the Gateway API Standard channel in v1.2, so it requires both v1.2+ CRDs
-  and a supporting controller; drop it if either predates that.
- If `supersetWebsockets.enabled` is set, an extra rule routing `supersetWebsockets.ingress.path`
-  (default `/ws`) to the `-ws` service is appended automatically, mirroring the `Ingress` behavior.
-  WebSocket upgrade support is controller-dependent under Gateway API; check your Gateway
-  implementation's docs in case it needs an explicit protocol opt-in for global async queries to
-  keep working behind a Gateway.
- If `supersetMcp.enabled` and `supersetMcp.httproute.enabled` are both set, an extra rule routing
-  `supersetMcp.httproute.path` to the `-mcp` service is appended as well. Don't expose this route
-  without first enabling MCP authentication — see the
-  [MCP Server Deployment & Authentication](/admin-docs/configuration/mcp-server#authentication) doc;
-  by default the MCP server runs in dev mode with auth disabled.
- Set `httproute.apiVersion` to `gateway.networking.k8s.io/v1beta1` if your cluster's Gateway API
-  installation hasn't promoted `HTTPRoute` to `v1` yet.
-
 ### Enable Alerts and Reports

 For this, as per the [Alerts and Reports doc](/admin-docs/configuration/alerts-reports), you will need to:
@@ -183,14 +183,13 @@ https://superset.apache.org/admin-docs/configuration/configuring-superset/#rotat
 | --------------------------------- | ------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- | ----------------------------------------- |
 | `SUPERSET_SECRET_KEY`             | Signs session cookies; key material for encrypting stored DB credentials (Fernet/AES) | Forged sessions (auth bypass / privilege escalation); decryption of exfiltrated metadata-DB secrets | Quarterly + post-incident                 |
 | `GUEST_TOKEN_JWT_SECRET`          | Signs embedded-dashboard guest tokens                                                 | Forged guest tokens → unauthorized dashboard/data access                                            | Quarterly + post-incident                 |
-| `WEBSOCKET_JWT_SECRET`            | Signs the realtime websocket channel JWT cookie                                       | Forged websocket tokens → unauthorized realtime notifications                                       | Quarterly + post-incident                 |
+| `GLOBAL_ASYNC_QUERIES_JWT_SECRET` | Signs the async-query channel JWT                                                     | Forged async-query tokens                                                                           | Quarterly + post-incident                 |
 | SMTP password                     | Outbound email for alerts & reports                                                   | Email relay abuse / spoofing                                                                        | Per organizational policy + post-incident |
 | Database connection passwords     | Access to analytical databases and the metadata DB                                    | Direct database access                                                                              | Per organizational policy + post-incident |

 Notes:

- Rotating `GUEST_TOKEN_JWT_SECRET` or `WEBSOCKET_JWT_SECRET` invalidates outstanding tokens of that type; schedule rotations accordingly.
- `WEBSOCKET_JWT_SECRET` can be rotated without disconnecting live sockets: set the outgoing value as `PREVIOUS_JWT_SECRET` on the websocket server so it keeps verifying old cookies, then remove it once they have aged out.
+- Rotating `GUEST_TOKEN_JWT_SECRET` or `GLOBAL_ASYNC_QUERIES_JWT_SECRET` invalidates outstanding tokens of that type; schedule rotations accordingly.
 - After a suspected compromise, rotate **all** of the above, not only `SUPERSET_SECRET_KEY`.
 - Keep the register under change control so new secrets introduced by future features are added to the rotation schedule.

@@ -198,87 +198,6 @@ Available per-entity overrides are:
 When an override is set, it replaces `SUBJECTS_RELATED_TYPES` for that picker. When it is `None`,
 the picker inherits the global default.

-#### Looking Up Subjects via API
-
-Superset exposes a read-only REST API for resolving subjects:
-
-```
-GET /api/v1/security/subject/
-```
-
-The main use case is **id mapping** — given a user, role, or group id, callers (including
-extensions) can look up the corresponding subject entity, and vice versa. Access is gated by
-the `can_read` permission on the `Subject` resource, which is granted to **Admins only** by
-default, since subjects enumerate every user, role, and group on the instance. Callers without
-that permission receive a `403`. Only `GET` (list, get, info) is exposed — there is no create,
-update, or delete, because subjects are derived automatically from users, roles, and groups and
-kept in sync internally.
-
-**Resolve the subject for a given principal id** using [Rison](https://github.com/Nanonid/rison)
-query syntax:
-
-```
-GET /api/v1/security/subject/?q=(filters:!((col:user_id,opr:eq,value:5)))
-GET /api/v1/security/subject/?q=(filters:!((col:role_id,opr:eq,value:3)))
-GET /api/v1/security/subject/?q=(filters:!((col:group_id,opr:eq,value:2)))
-```
-
-**Filter by subject type or active status:**
-
-```
-GET /api/v1/security/subject/?q=(filters:!((col:type,opr:eq,value:1)))
-GET /api/v1/security/subject/?q=(filters:!((col:active,opr:eq,value:!t)))
-```
-
-The `type` column is an integer enum: `1` for User, `2` for Role, `3` for Group
-(`superset.subjects.types.SubjectType`).
-
-**Search by label:**
-
-```
-GET /api/v1/security/subject/?q=(filters:!((col:label,opr:subject_all_text,value:finance)))
-```
-
-Each subject in the response includes flat scalar ids (`user_id`, `role_id`, `group_id`) rather
-than a nested object, so callers can match directly on whichever id they already have — only the
-id field matching the subject's `type` is populated; the others are `null`.
-
-#### Extending Editorship with EXTRA_EDITORS_RESOLVER
-
-Deployments that grant edit access to a dashboard or chart through a mechanism outside
-Superset's own Subject-based `editors` list — for example, a folder-permission system or an
-internal directory service — can plug that logic in with `EXTRA_EDITORS_RESOLVER`:
-
-```python
-def extra_editors_resolver(resource):
-    # `resource` is the Dashboard or Slice instance being checked.
-    # Return Subject instances, raw subject ids, or dicts with an `id` key.
-    return [...]
-
-
-EXTRA_EDITORS_RESOLVER = extra_editors_resolver
-```
-
-The resolver's result is unioned with the resource's own `editors` for editorship checks: it
-feeds `is_editor`, `raise_for_editorship`, save-as, and soft-delete restore. When
-`EXTRA_EDITORS_RESOLVER` is configured, the usual lockout-prevention behavior — automatically
-re-adding a non-admin who removes themselves from a resource's editors — is skipped, since the
-deployment has its own way of keeping the resource editable. This skip is global to the setting,
-not per-resource: it still applies on a resource where the resolver currently returns no
-subjects, so a resolver that can't guarantee an alternate editor for every resource can let the
-last editor remove themselves and leave it uneditable by non-admins.
-
-Resolved subject ids are also surfaced as `extra_editors` in the chart and dashboard `GET`
-responses, so API clients can distinguish resolver-granted editorship from the resource's own
-`editors` list. This field is attached after serialization and isn't part of the OpenAPI response
-schema, so generated API clients won't see it as a typed field.
-
-Because the resolver is arbitrary per-deployment Python rather than a SQL-expressible condition,
-editorship it grants cannot be reflected in list-view filtering (for example, the soft-deleted
-archive is scoped to editors via a SQL query). It does still run once per row on chart and
-dashboard list responses to populate `extra_editors`, so a slow or unavailable external resolver
-affects ordinary list requests, not just direct per-object checks.
-
 ### Dashboard Access Control

 Access to dashboards is managed via editors (subjects that have edit permissions to the dashboard).
@@ -436,7 +355,7 @@ Once enabled, each user manages their own keys from their profile page:
 1. Open the user menu (top-right) and click **Info** to navigate to the User Info page
 2. Expand the **API Keys** section
 3. Click **+ API Key**
-4. Enter a name and optionally select resource scopes
+4. Enter a name and (optionally) an expiration date
 5. Copy the generated token — it is shown only once

 Only users with the `can_read` and `can_write` permissions on `ApiKey` (granted by default to Admins) can manage API keys.
@@ -451,18 +370,6 @@ Authorization: Bearer <your-api-key>

 This works for all REST API endpoints and the MCP server. The request is executed with the permissions of the user who created the key.

-#### API Key Scopes
-
-The creation dialog can restrict an API key to MCP resource actions such as
-`superset:dashboard:read` or `superset:chart:write`. A scope is an additional
-restriction: it never grants a permission that the creating user does not
-already have through Superset RBAC. Write scopes also cover update and delete
-operations for that resource; `superset:sqllab:write` covers SQL execution.
-
-Keys created without scopes retain legacy RBAC-only behavior. The scoped-key
-restrictions described here are enforced by the MCP server; regular REST API
-routes continue to apply their existing Superset RBAC checks.
-
 #### Use Cases

 - **CI/CD pipelines** — automated chart/dashboard exports and imports
@@ -619,28 +526,6 @@ SELECT * FROM (
  queries run against tables that have associated datasets with RLS filters will then have
  the appropriate predicates injected automatically.

-#### RLS Indicator in the Dataset List and Explore
-
-When a dataset has one or more RLS filters that apply to it, Superset shows a lock
-icon badge next to the dataset name in the **Datasets** list and next to the dataset
-selector in **Explore**. Hovering over the badge shows a tooltip listing each
-applicable filter's name, filter type (Regular or Base), group key (if any), assigned
-subjects (labeled "Roles" in the tooltip, but may include users and groups too), and
-clause.
-
-This badge also surfaces filters that are inherited from the physical tables
-referenced by a virtual (SQL-based) dataset, as described above. Inherited filters
-are marked "from underlying table" in the tooltip, and a summary note is shown
-whenever any of the listed filters are inherited rather than assigned directly to
-the dataset. Inherited-filter detection depends on Superset's SQL parser being able
-to identify the referenced tables and match them to a physical dataset by name,
-schema, and database, so it's best-effort: unparseable or unmatched references won't
-surface a filter on the badge even if one would apply at query time.
-
-The badge is a visibility aid only — it does not change which filters are applied to
-a query. Use the RLS REST API described below if you need to confirm exactly which
-filters affect a dataset.
-
 #### Checking RLS Filters via the API

 You can use the RLS REST API to audit which filters are configured and which datasets
@@ -215,7 +215,7 @@ If you have a good solution for this, let us know!
 :::

 :::note
-Superset uses [Scarf Gateway](https://about.scarf.sh/) to collect telemetry
+Superset uses [Scarf Gateway](https://about.scarf.sh/scarf-gateway) to collect telemetry
 data. Knowing the installation counts for different Superset versions informs the project's
 decisions about patching and long-term support. Scarf purges personally identifiable information
 (PII) and provides only aggregated statistics.
@@ -135,7 +135,7 @@ init:
 ```

 :::note
-Superset uses [Scarf Gateway](https://about.scarf.sh/) to collect telemetry data. Knowing the installation counts for different Superset versions informs the project's decisions about patching and long-term support. Scarf purges personally identifiable information (PII) and provides only aggregated statistics.
+Superset uses [Scarf Gateway](https://about.scarf.sh/scarf-gateway) to collect telemetry data. Knowing the installation counts for different Superset versions informs the project's decisions about patching and long-term support. Scarf purges personally identifiable information (PII) and provides only aggregated statistics.

 To opt-out of this data collection in your Helm-based installation, edit the `repository:` line in your `helm/superset/values.yaml` file, replacing `apachesuperset.docker.scarf.sh/apache/superset` with `apache/superset` to pull the image directly from Docker Hub.
 :::
@@ -86,7 +86,6 @@
    "Israel",
    "Italy",
    "Italy (regions)",
-    "Italy (regions and autonomous provinces)",
    "Ivory Coast",
    "Japan",
    "Jordan",
@@ -570,6 +570,15 @@ curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \

 </details>

+<details>
+<summary><strong>AsyncEventsRestApi</strong> (1 endpoints) — Real-time event streaming via Server-Sent Events (SSE).</summary>
+
+| Method | Endpoint | Description |
+|--------|----------|-------------|
+| `GET` | [Read off of the Redis events stream](/developer-docs/api/read-off-of-the-redis-events-stream) | `/api/v1/async_event/` |
+
+</details>
+
 <details>
 <summary><strong>OpenApi</strong> (1 endpoints) — Access the OpenAPI specification.</summary>

@@ -99,16 +99,11 @@ Affecting the Docker build process:
 - **INCLUDE_CHROMIUM (default=false):** whether to include the Chromium headless browser in the build
 - **BUILD_TRANSLATIONS(default=false):** whether to compile the translations from the .po files available
 - **SUPERSET_LOAD_EXAMPLES (default=yes):** whether to load the examples into the database upon startup,
-  save some precious time on startup by `SUPERSET_LOAD_EXAMPLES=no docker compose up`. Once the example
-  data and dashboards are present in the databases, later `docker compose up` runs skip loading
-  them; run `SUPERSET_FORCE_LOAD_EXAMPLES=yes docker compose up` to reload the examples anyway.
+  save some precious time on startup by `SUPERSET_LOAD_EXAMPLES=no docker compose up`
 - **SUPERSET_LOG_LEVEL (default=info)**: Can be set to debug, info, warning, error, critical
  for more verbose logging
 - **SUPERSET_DEBUG_ENABLED (default=false)**: Enable Werkzeug debugger with interactive console.
  Set to `true` for debugging: `SUPERSET_DEBUG_ENABLED=true docker compose up`
- **DISABLE_TS_CHECKER (default=true)**: whether the `superset-node` webpack dev server skips
-  TypeScript type-checking, which speeds up rebuilds and saves several GB of memory. Set to
-  `false` to have webpack surface type errors during development.

 For more env vars that affect your configuration, see this
 [superset_config.py](https://github.com/apache/superset/blob/master/docker/pythonpath_dev/superset_config.py)
@@ -498,8 +493,8 @@ Frontend assets (TypeScript, JavaScript, CSS, and images) must be compiled in or

 First, be sure you are using the following versions of Node.js and npm:

- `Node.js`: Version 24 (see `superset-frontend/.nvmrc` for the exact version)
- `npm`: Version 11
+- `Node.js`: Version 22 (LTS)
+- `npm`: Version 10

 We recommend using [nvm](https://github.com/nvm-sh/nvm) to manage your node environment:

@@ -512,8 +507,8 @@ export NVM_DIR="$HOME/.nvm"
 [ -s "$NVM_DIR/bash_completion" ] && \. "$NVM_DIR/bash_completion"  # This loads nvm bash_completion

 cd superset-frontend
-nvm install
-nvm use
+nvm install --lts
+nvm use --lts
 ```

 Or if you use the default macOS starting with Catalina shell `zsh`, try:
@@ -524,30 +519,6 @@ sh -c "$(curl -fsSL https://raw.githubusercontent.com/nvm-sh/nvm/v0.37.0/install

 For those interested, you may also try out [avn](https://github.com/nvm-sh/nvm#deeper-shell-integration) to automatically switch to the node version that is required to run Superset frontend.

-##### zstd
-
-`npm run dev-server` proxies requests to your local Superset server and rewrites the HTML it returns, so it has to decompress responses sent with `Content-Encoding: zstd`. It does that with [`simple-zstd`](https://www.npmjs.com/package/simple-zstd), which wraps the system `zstd` binary instead of bundling one. That binary has to be on your `PATH`:
-
-```bash
-# macOS
-brew install zstd
-
-# Ubuntu/Debian
-sudo apt install zstd
-
-# Windows
-choco install zstd
-```
-
-`simple-zstd` looks for the binary when it is first imported, not when a response is decompressed, so a missing `zstd` stops the dev server at startup with:
-
-```
-Error: Can not access zstd! Is it installed?
-    at Object.<anonymous> (.../node_modules/simple-zstd/dist/src/index.js:102:11)
-```
-
-The message names the dependency, but it surfaces from inside `webpack.proxy-config.js` while the webpack config is loading, which reads like a build-tooling failure rather than a missing system package.
-
 #### Install dependencies

 Install third-party dependencies listed in `package.json` via:
@@ -114,8 +114,8 @@ function MyExtension() {

 ## Source Links

- [Story file](https://github.com/apache/superset/blob/master/superset-frontend/packages/superset-core/src/components/Alert/Alert.stories.tsx)
- [Component source](https://github.com/apache/superset/blob/master/superset-frontend/packages/superset-core/src/components/Alert/index.tsx)
+- [Story file](https://github.com/apache/superset/blob/master/superset-frontend/packages/superset-core/src/ui/components/Alert/Alert.stories.tsx)
+- [Component source](https://github.com/apache/superset/blob/master/superset-frontend/packages/superset-core/src/ui/components/Alert/index.tsx)

 ---

@@ -47,8 +47,8 @@ export function MyExtensionPanel() {

 Components in `@apache-superset/core/components` are automatically documented here. To add a new extension component:

-1. Add the component to `superset-frontend/packages/superset-core/src/components/`
-2. Export it from `superset-frontend/packages/superset-core/src/components/index.ts`
+1. Add the component to `superset-frontend/packages/superset-core/src/ui/components/`
+2. Export it from `superset-frontend/packages/superset-core/src/ui/components/index.ts`
 3. Create a Storybook story with an `Interactive` export:

 ```tsx
--- a/Show More
+++ b/Show More