fix(explore): require a value for simple adhoc filters before allowing save

The Save button in the adhoc filter popover stayed enabled when a
comparator-taking operator had no value, because `AdhocFilter.isValid()`
only rejected a `null` comparator. An unset comparator is `undefined`, not
`null`: selecting a subject resets it (and falls back to the `IN` operator),
and the value Select's clear affordance emits `undefined` as well.

This was most visible on boolean columns, whose operator list is restricted
to unary operators, so a freshly picked boolean column lands on `IN` with no
value and the popover looks complete. Saving sent a filter with no `val` to
the query API, which tripped a bare `assert isinstance(eq, (tuple, list))`
in the query builder and surfaced as a generic error instead of inline
client-side validation.

Extend the existing check to treat `undefined` like `null`, matching the
empty-array guard already applied to `IN`/`NOT IN` comparators. Unary
operators are unaffected: they short-circuit earlier via
DISABLE_INPUT_OPERATORS.

.github/CODEOWNERS

@@ -19,7 +19,7 @@
 
 # Notify PMC members of changes to extension-related files
 
-/docs/developer_portal/extensions/ @michael-s-molina @villebro @rusackas
+/docs/developer_docs/extensions/ @michael-s-molina @villebro @rusackas
 /superset-extensions-cli/ @michael-s-molina @villebro @rusackas @sadpandajoe
 /superset/extensions/ @michael-s-molina @villebro @rusackas @sadpandajoe
 /superset-frontend/src/extensions/ @michael-s-molina @villebro @rusackas @sadpandajoe

.github/labeler.yml

@@ -29,7 +29,7 @@
 "dependencies:python":
 - changed-files:
   - any-glob-to-any-file:
-    - 'superset/requirements/**'
+    - 'requirements/**'
     - 'superset/translations/requirements.txt'
     - 'RELEASING/requirements.txt'
 

.github/workflows/bump-python-package.yml

@@ -21,6 +21,9 @@ on:
   #schedule:
   #  - cron: '0 0 * * *'  # Runs daily at midnight UTC
 
+permissions:
+  contents: read
+
 jobs:
   bump-python-package:
     runs-on: ubuntu-slim

.github/workflows/check-db-migration-confict.yml

@@ -16,6 +16,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   check_db_migration_conflict:
     name: Check DB migration conflict

.github/workflows/codeql-analysis.yml

@@ -14,6 +14,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   changes:
     runs-on: ubuntu-26.04

.github/workflows/docker.yml

@@ -51,6 +51,53 @@ jobs:
           echo "matrix_config=${MATRIX_CONFIG}" >> $GITHUB_OUTPUT
           echo $GITHUB_OUTPUT
 
+  # Runs unconditionally (no dependency on `changes`, and no build-preset
+  # matrix restriction) so a regression in the PY_VER override logic is
+  # always caught on PRs. Without this, the real docker-build job only runs
+  # when the change detector flags docker/python/frontend changes (a
+  # workflow-only edit like this one does not), and even then the PR build
+  # matrix never includes the "py311"/"py312" presets that logic protects -
+  # so a break here would otherwise first surface on a push to master.
+  pyver-override-check:
+    name: verify docker build PY_VER override
+    runs-on: ubuntu-26.04
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Setup supersetbot
+        uses: ./.github/actions/setup-supersetbot/
+      - name: Assert PY_VER override applies to every preset except py311/py312
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          # Asserts against the actual buildx command line `supersetbot docker
+          # --dry-run` would run, not just this repo's own extra-flags helper,
+          # so a regression in supersetbot itself (dropping the py311/py312
+          # PY_VER pin, or reordering args so our override no longer lands
+          # last) is caught here too, instead of only surfacing on master.
+          assert_effective_py_ver() {
+            local preset="$1" expected="$2" extra_flags command actual
+            extra_flags="$(scripts/docker-build-extra-flags.sh "$preset" dummy-tag)"
+            command="$(supersetbot docker --preset "$preset" --platform linux/amd64 --extra-flags "$extra_flags" --dry-run)"
+            # docker buildx keeps the LAST value of a repeated --build-arg key.
+            actual="$(grep -oE -- '--build-arg PY_VER=[^[:space:]]+' <<<"$command" | tail -1)"
+            if [ "$actual" != "--build-arg PY_VER=$expected" ]; then
+              echo "::error::preset '$preset' expected effective --build-arg PY_VER=$expected, got: ${actual:-<none>} (full command: $command)"
+              exit 1
+            fi
+          }
+          for preset in dev lean websocket dockerize; do
+            assert_effective_py_ver "$preset" "3.11.14-slim-trixie"
+          done
+          assert_effective_py_ver py311 "3.11-slim-bookworm"
+          assert_effective_py_ver py312 "3.12-slim-bookworm"
+          echo "PY_VER override logic verified against the assembled buildx command for all build presets"
+
   docker-build:
     name: docker-build
     needs: [setup_matrix, changes]
@@ -124,19 +171,21 @@ jobs:
           # the whole job. buildx reuses the buildkit layer cache from the
           # failed attempt, so a retry mostly re-does just the failed push.
           #
-          # supersetbot's "dev"/"lean" presets pin their own --build-arg
-          # PY_VER, which lands ahead of --extra-flags on the assembled
-          # buildx command line; docker/buildx keeps the last value for a
-          # repeated --build-arg key, so appending PY_VER here overrides
-          # supersetbot's pin and keeps the build on the Dockerfile's own
-          # supported Python version.
+          # See scripts/docker-build-extra-flags.sh for why "py311"/"py312"
+          # are excluded from the PY_VER override applied to every other
+          # preset; that logic is also exercised on every PR by the
+          # always-on pyver-override-check job below, since this job itself
+          # only runs when the change detector flags docker/python/frontend
+          # changes and the PR build matrix never includes py311/py312.
+          EXTRA_FLAGS="$(scripts/docker-build-extra-flags.sh "$BUILD_PRESET" "$IMAGE_TAG")"
+
           for attempt in 1 2 3; do
             if supersetbot docker \
               $PUSH_OR_LOAD \
               --preset "$BUILD_PRESET" \
               --context "$EVENT" \
               --context-ref "$RELEASE" $FORCE_LATEST \
-              --extra-flags "--build-arg PY_VER=3.11.14-slim-trixie --build-arg INCLUDE_CHROMIUM=false --tag $IMAGE_TAG" \
+              --extra-flags "$EXTRA_FLAGS" \
               $PLATFORM_ARG; then
               break
             fi

.github/workflows/enforce-single-migration-head.yml

@@ -33,6 +33,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   enforce-single-migration-head:
     runs-on: ubuntu-26.04

.github/workflows/frontend-bundle-size-nightly.yml

@@ -0,0 +1,135 @@
+name: Frontend bundle size (nightly baseline + analyzer)
+
+# Refreshes the bundle-size baseline that superset-frontend.yml's `bundle-size`
+# job compares PRs against, and publishes a browsable bundle-analyzer treemap
+# report of the same build. Deliberately NOT triggered on every push to
+# master: a day-old baseline/report is fine for catching relative
+# regressions on PRs and for browsing what's actually in the bundle, and
+# building the production bundle on every one of the many pushes master
+# gets per day would burn CI time for no benefit a nightly refresh doesn't
+# already cover.
+on:
+  schedule:
+    - cron: "0 6 * * *"
+  workflow_dispatch: {}
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
+env:
+  TAG: apache/superset:bundle-size-nightly-${{ github.run_id }}
+
+permissions:
+  contents: read
+
+jobs:
+  refresh-baseline:
+    runs-on: ubuntu-26.04
+    timeout-minutes: 30
+    env:
+      NETLIFY_SITE_ID: ${{ secrets.NETLIFY_BUNDLE_ANALYZER_SITE_ID }}
+    steps:
+      - name: "Checkout master"
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          ref: master
+
+      - name: Build Docker Image
+        run: |
+          docker buildx build \
+            -t $TAG \
+            --cache-from=type=registry,ref=apache/superset-cache:3.11-slim-trixie \
+            --target superset-node-ci \
+            .
+
+      # Same cache the PR-time bundle-size job restores/writes -- webpack's
+      # persistent filesystem cache turns a warm production build into ~20s
+      # instead of several minutes. See superset-frontend.yml for the
+      # matching restore step and why it's keyed this way.
+      - name: Restore webpack build cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: superset-frontend/.temp_cache
+          key: >-
+            webpack-prod-cache-${{ hashFiles('superset-frontend/package-lock.json',
+            'superset-frontend/babel.config.js', 'superset-frontend/tsconfig.json',
+            'superset-frontend/webpack.config.js') }}
+
+      # Only ever pull the last recorded data point off the cache, keyed by
+      # run ID -- `restore-keys` prefix-matches the most recently created
+      # entry. Absent on the very first run ever; benchmark-action starts a
+      # fresh history in that case.
+      - name: Restore bundle size history
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: bundle-size-history.json
+          key: bundle-size-history-${{ github.run_id }}
+          restore-keys: |
+            bundle-size-history-
+
+      # BUNDLE_ANALYZER rides along in the same build as BUNDLE_SIZE_STATS --
+      # they're independent env-gated additions in webpack.config.js (one
+      # sets `config.stats`, the other pushes plugins), so one production
+      # build produces both the numeric stats.json and the analyzer's
+      # report.html. Only report.html is mounted out, not
+      # BUNDLE_ANALYZER's sibling `statistics.html` sunburst -- that file is
+      # documented in webpack.config.js as routinely exceeding 100MB for
+      # this app (it's .gitignore'd for exactly that reason), too large to
+      # publish as a static site page.
+      - name: Build production bundle with stats and analyzer report
+        run: |
+          mkdir -p ${{ github.workspace }}/superset-frontend/bundle-stats
+          mkdir -p ${{ github.workspace }}/superset-frontend/.temp_cache
+          mkdir -p ${{ github.workspace }}/superset/static/assets
+          docker run \
+          -v ${{ github.workspace }}/superset-frontend/bundle-stats:/app/superset-frontend/bundle-stats \
+          -v ${{ github.workspace }}/superset-frontend/.temp_cache:/app/superset-frontend/.temp_cache \
+          -v ${{ github.workspace }}/superset/static/assets:/app/superset/static/assets \
+          --rm $TAG \
+          bash -c \
+          "npm i && BUNDLE_SIZE_STATS=true BUNDLE_ANALYZER=true npm run build -- --json=bundle-stats/stats.json"
+
+      - name: Summarize bundle size
+        run: |
+          node superset-frontend/scripts/bundle-size-summary.js \
+            superset-frontend/bundle-stats/stats.json > bundle-size-summary.json
+          rm -rf superset-frontend/bundle-stats
+
+      # No PR to comment on here, so comment-on-alert is off -- the job
+      # summary (summary-always) is the only surface for this run.
+      - name: Update bundle size baseline
+        uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1
+        with:
+          tool: customSmallerIsBetter
+          output-file-path: bundle-size-summary.json
+          external-data-json-path: bundle-size-history.json
+          fail-on-alert: false
+          summary-always: true
+
+      - name: Save bundle size history
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: bundle-size-history.json
+          key: bundle-size-history-${{ github.run_id }}
+
+      # Publishes the treemap to Netlify (the same host already used for
+      # superset-storybook.netlify.app and docs previews, reusing the
+      # existing NETLIFY_AUTH_TOKEN). Skipped until
+      # NETLIFY_BUNDLE_ANALYZER_SITE_ID exists -- create a new (free)
+      # Netlify site named superset-bundle-analyzer and add its site ID as
+      # that secret to turn this on; nothing else in this workflow depends
+      # on it.
+      - name: Publish bundle analyzer report to Netlify
+        if: ${{ env.NETLIFY_SITE_ID != '' }}
+        env:
+          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
+        run: |
+          mkdir -p netlify-publish
+          cp superset/static/assets/report.html netlify-publish/index.html
+          # zizmor: ignore[adhoc-packages] - netlify-cli is a one-shot CI deploy
+          # tool, not an application dependency; a global/npx install has no
+          # lockfile context. Version pinned above the floor set by other
+          # ad-hoc installs in this repo (bump deliberately when upgrading).
+          npx --yes netlify-cli@27.0.1 deploy --prod --dir=netlify-publish

.github/workflows/github-action-validator.yml

@@ -45,5 +45,8 @@ jobs:
       - name: Run Script
         run: bash .github/workflows/github-action-validator.sh
 
+      - name: Test docs-deploy freshness gate
+        run: bash .github/workflows/scripts/check-docs-deploy-freshness.test.sh
+
       - name: Check for security issues on GHA workflows
         uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2

.github/workflows/issue-creation.yml

@@ -7,6 +7,9 @@ on:
   pull_request:
     types: [opened, edited]
 
+permissions:
+  contents: read
+
 jobs:
   superbot-orglabel:
     runs-on: ubuntu-slim

.github/workflows/labeler.yml

@@ -7,6 +7,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   labeler:
     permissions:

.github/workflows/latest-release-tag.yml

@@ -3,6 +3,9 @@ on:
   release:
     types: [published] # This makes it run only when a new released is published
 
+permissions:
+  contents: read
+
 jobs:
   latest-release:
     name: Add/update tag to new release

.github/workflows/pr-lint.yml

@@ -19,6 +19,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: false
 
+permissions:
+  contents: read
+
 jobs:
   lint-check:
     runs-on: ubuntu-slim

.github/workflows/scripts/check-docs-deploy-freshness.sh

@@ -0,0 +1,49 @@
+#!/bin/bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Shared freshness gate used by the Docs Deployment workflow
+# (superset-docs-deploy.yml) both up front (check-freshness) and again right
+# before the deploy step (recheck-freshness). Writes an output declaring
+# whether BUILD_SHA is still master's current tip, so a superseded run can
+# skip cleanly instead of racing (and clobbering, or being force-cancelled
+# by) a fresher run.
+#
+# Required env vars:
+#   BUILD_SHA     - the commit SHA this run is building
+#   REPO          - "owner/repo" to query, e.g. github.repository
+#   OUTPUT_NAME   - the GITHUB_OUTPUT key to write, e.g. "is-current"
+#   GITHUB_OUTPUT - path to append outputs to (set by the Actions runner)
+# Optional env vars:
+#   EVENT_NAME    - if "workflow_dispatch", bypasses the check and always
+#                   reports current, since a manual dispatch is a deliberate,
+#                   one-off action rather than something racing other triggers
+#   GH_TOKEN      - passed through to `gh`, needed to call the GitHub API
+
+set -euo pipefail
+
+if [ "${EVENT_NAME:-}" = "workflow_dispatch" ]; then
+  echo "${OUTPUT_NAME}=true" >>"$GITHUB_OUTPUT"
+  exit 0
+fi
+
+latest_sha="$(gh api "repos/${REPO}/commits/master" --jq .sha)"
+if [ "${latest_sha}" = "${BUILD_SHA}" ]; then
+  echo "${OUTPUT_NAME}=true" >>"$GITHUB_OUTPUT"
+else
+  echo "${OUTPUT_NAME}=false" >>"$GITHUB_OUTPUT"
+  echo "::notice::master has moved on to ${latest_sha} since ${BUILD_SHA} was triggered — skipping this stale run."
+fi

.github/workflows/scripts/check-docs-deploy-freshness.test.sh

@@ -0,0 +1,100 @@
+#!/bin/bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Exercises check-docs-deploy-freshness.sh against a stubbed `gh`, covering
+# the dispatch-bypass, current-tip and stale-tip branches so the output
+# contract (is-current / still-current) can't silently regress. Run
+# directly, no extra tooling required:
+#   bash .github/workflows/scripts/check-docs-deploy-freshness.test.sh
+
+set -euo pipefail
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+script_under_test="${script_dir}/check-docs-deploy-freshness.sh"
+
+failures=0
+
+# Runs the script under test with a stubbed `gh` reporting $1 as master's
+# latest sha, asserting that GITHUB_OUTPUT ends up containing exactly $4.
+run_case() {
+  local case_name="$1"
+  local latest_sha="$2"
+  local build_sha="$3"
+  local event_name="$4"
+  local expected_line="$5"
+
+  local workdir
+  workdir="$(mktemp -d)"
+  trap 'rm -rf "${workdir}"' RETURN
+
+  # Fake `gh` that just echoes back the requested "latest" sha regardless of
+  # arguments, so the script under test never touches the network.
+  cat >"${workdir}/gh" <<EOF
+#!/bin/bash
+echo '${latest_sha}'
+EOF
+  chmod +x "${workdir}/gh"
+
+  local output_file="${workdir}/github_output"
+  : >"${output_file}"
+
+  if PATH="${workdir}:${PATH}" \
+    GITHUB_OUTPUT="${output_file}" \
+    OUTPUT_NAME="is-current" \
+    REPO="apache/superset" \
+    BUILD_SHA="${build_sha}" \
+    EVENT_NAME="${event_name}" \
+    GH_TOKEN="fake-token" \
+    bash "${script_under_test}"; then
+    :
+  else
+    echo "FAIL (${case_name}): script exited non-zero"
+    failures=$((failures + 1))
+    return
+  fi
+
+  local actual
+  actual="$(cat "${output_file}")"
+  if [ "${actual}" = "${expected_line}" ]; then
+    echo "PASS (${case_name})"
+  else
+    echo "FAIL (${case_name}): expected '${expected_line}', got '${actual}'"
+    failures=$((failures + 1))
+  fi
+}
+
+# `gh` prints "should-not-be-called" for the dispatch case above the trick:
+# it's never actually invoked since the bypass short-circuits before the
+# `gh api` call, but the fake still needs a body.
+run_case "workflow_dispatch bypasses the check" \
+  "unused" "abc123" "workflow_dispatch" \
+  "is-current=true"
+
+run_case "build sha matches master's tip" \
+  "abc123" "abc123" "push" \
+  "is-current=true"
+
+run_case "build sha is stale" \
+  "def456" "abc123" "push" \
+  "is-current=false"
+
+if [ "${failures}" -gt 0 ]; then
+  echo "${failures} case(s) failed"
+  exit 1
+fi
+
+echo "All cases passed"

.github/workflows/showtime-cleanup.yml

@@ -17,6 +17,9 @@ env:
   GITHUB_ORG: ${{ github.repository_owner }}
   GITHUB_REPO: ${{ github.event.repository.name }}
 
+permissions:
+  contents: read
+
 jobs:
   cleanup-expired:
     name: Clean up expired showtime environments

.github/workflows/showtime-trigger.yml

@@ -26,6 +26,9 @@ env:
   GITHUB_REPO: ${{ github.event.repository.name }}
   GITHUB_ACTOR: ${{ github.actor }}
 
+permissions:
+  contents: read
+
 jobs:
   sync:
     name: 🎪 Sync PR to desired state

.github/workflows/superset-docs-deploy.yml

@@ -18,16 +18,6 @@ on:
 
   workflow_dispatch: {}
 
-# Serialize deploys: the action pushes to apache/superset-site without
-# rebasing, so concurrent runs race on the final push and the loser fails
-# with `! [rejected] asf-site -> asf-site (fetch first)`. Cancel any
-# in-progress run as soon as a newer one starts — the destination repo
-# isn't touched until the final push step, so canceling mid-build is safe,
-# and the freshest content always wins.
-concurrency:
-  group: docs-deploy-asf-site
-  cancel-in-progress: true
-
 permissions:
   contents: read
   actions: read
@@ -48,17 +38,69 @@ jobs:
 
         env:
           SUPERSET_SITE_BUILD: ${{ (secrets.SUPERSET_SITE_BUILD != '' && secrets.SUPERSET_SITE_BUILD != '') || '' }}
+
+  # Master gets frequent, sometimes bursty pushes, and each one can trigger a
+  # deploy attempt. Rather than let every superseded attempt get force-killed
+  # by the build-deploy concurrency group below (which shows up as a
+  # `cancelled` — i.e. red/failing-looking — check on that commit), have each
+  # run check up front whether it's still building master's current tip and,
+  # if not, skip cleanly. Deliberately outside the docs-deploy-asf-site
+  # concurrency group so it runs immediately for every trigger without
+  # blocking or being blocked by anything.
+  check-freshness:
+    runs-on: ubuntu-26.04
+    outputs:
+      is-current: ${{ steps.check.outputs.is-current }}
+    steps:
+      # Sparse checkout: this job's only job is to be fast, so it fetches
+      # nothing but the freshness-check script itself.
+      - name: Checkout freshness-check script
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          sparse-checkout: |
+            .github/workflows/scripts
+          sparse-checkout-cone-mode: false
+      - name: "Check whether this is still master's current commit"
+        id: check
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BUILD_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+          EVENT_NAME: ${{ github.event_name }}
+          REPO: ${{ github.repository }}
+          OUTPUT_NAME: is-current
+        run: .github/workflows/scripts/check-docs-deploy-freshness.sh
+
   build-deploy:
-    needs: config
+    needs: [config, check-freshness]
+    # Only the run for master's current tip proceeds; anything superseded
+    # already skipped at check-freshness above instead of landing here.
     # For workflow_run triggers, only deploy when the triggering run originated
     # from this repository (not a fork), ensuring the checked-out code and any
     # local actions executed with deploy credentials are trusted.
     if: >-
       needs.config.outputs.has-secrets &&
+      needs.check-freshness.outputs.is-current == 'true' &&
       (github.event_name != 'workflow_run' ||
        github.event.workflow_run.head_repository.full_name == github.repository)
     name: Build & Deploy
     runs-on: ubuntu-26.04
+    # Serialize deploys: the action pushes to apache/superset-site without
+    # rebasing, so concurrent runs race on the final push and the loser fails
+    # with `! [rejected] asf-site -> asf-site (fetch first)`. Queue instead of
+    # canceling: a run that already passed check-freshness can still be
+    # sitting in the queue for a runner when a newer run starts and finishes
+    # first. cancel-in-progress would let that stale, queued run kill the
+    # newer run's in-progress deploy the moment it's finally scheduled, and
+    # then skip itself at the re-check below — losing the deploy entirely.
+    # Queuing means the stale run just waits its turn and then no-ops at the
+    # re-check, so the fresher content that already deployed is never
+    # clobbered or lost. The check-freshness gate above means it should be
+    # rare for more than one run to reach this point, so the queue stays
+    # short in practice.
+    concurrency:
+      group: docs-deploy-asf-site
+      cancel-in-progress: false
     steps:
       - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
         with:
@@ -130,7 +172,24 @@ jobs:
         working-directory: docs
         run: |
           yarn build
+      # The check-freshness job above narrows the window but doesn't close it: an
+      # older run can observe is-current=true, then sit through this build while a
+      # newer run's own freshness check also passes and it deploys and finishes
+      # first. If this (stale) run then wins entry into the concurrency group, it
+      # would overwrite the newer content that already deployed. Re-check right
+      # before the one step that actually mutates superset-site, so a stale run
+      # skips deploying instead of clobbering a fresher one that already ran.
+      - name: "Re-check freshness immediately before deploying"
+        id: recheck-freshness
+        if: github.event_name != 'workflow_dispatch'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BUILD_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+          REPO: ${{ github.repository }}
+          OUTPUT_NAME: still-current
+        run: .github/workflows/scripts/check-docs-deploy-freshness.sh
       - name: deploy docs
+        if: github.event_name == 'workflow_dispatch' || steps.recheck-freshness.outputs.still-current == 'true'
         uses: ./.github/actions/github-action-push-to-another-repository
         env:
           API_TOKEN_GITHUB: ${{ secrets.SUPERSET_SITE_BUILD }}

.github/workflows/superset-e2e.yml

@@ -26,6 +26,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   changes:
     runs-on: ubuntu-26.04

.github/workflows/superset-frontend.yml

@@ -212,3 +212,100 @@ jobs:
       - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
         with:
           expand-composite-actions: true
+
+  # Compares a PR's own bundle size against the last nightly-recorded
+  # baseline (see frontend-bundle-size-nightly.yml, which owns actually
+  # persisting new baselines). PR-only: a push to master doesn't need this
+  # check re-run against itself, and re-persisting the baseline on every
+  # push to master -- which happens many times a day -- would burn a full
+  # production build for no benefit nightly refresh doesn't already cover.
+  bundle-size:
+    needs: frontend-build
+    if: needs.frontend-build.outputs.should-run == 'true' && github.event_name == 'pull_request'
+    runs-on: ubuntu-26.04
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+
+      - name: Download Docker Image Artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: docker-image
+
+      - name: Load Docker Image
+        run: |
+          zstd -d < docker-image.tar.zst | docker load
+
+      # webpack's persistent filesystem cache (superset-frontend/webpack.config.js)
+      # turns a warm production build into ~20s instead of several minutes,
+      # but GH-hosted runners are fresh VMs with nothing carried over between
+      # jobs -- without restoring it explicitly, every single PR would pay
+      # the full cold-build cost. Keyed on the same files webpack's own
+      # `buildDependencies` invalidates on, so a stale cache is never used.
+      - name: Restore webpack build cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: superset-frontend/.temp_cache
+          key: >-
+            webpack-prod-cache-${{ hashFiles('superset-frontend/package-lock.json',
+            'superset-frontend/babel.config.js', 'superset-frontend/tsconfig.json',
+            'superset-frontend/webpack.config.js') }}
+
+      # Only ever pull the last recorded data point off the cache, keyed by
+      # run ID -- `restore-keys` prefix-matches the most recently created
+      # entry, which is always the latest nightly run. Absent before the
+      # first nightly run ever happens; benchmark-action starts a fresh
+      # history in that case.
+      - name: Restore bundle size history
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: bundle-size-history.json
+          key: bundle-size-history-${{ github.run_id }}
+          restore-keys: |
+            bundle-size-history-
+
+      - name: Build production bundle with stats
+        run: |
+          mkdir -p ${{ github.workspace }}/superset-frontend/bundle-stats
+          mkdir -p ${{ github.workspace }}/superset-frontend/.temp_cache
+          docker run \
+          -v ${{ github.workspace }}/superset-frontend/bundle-stats:/app/superset-frontend/bundle-stats \
+          -v ${{ github.workspace }}/superset-frontend/.temp_cache:/app/superset-frontend/.temp_cache \
+          --rm $TAG \
+          bash -c \
+          "npm i && BUNDLE_SIZE_STATS=true npm run build -- --json=bundle-stats/stats.json"
+
+      - name: Summarize bundle size
+        run: |
+          node superset-frontend/scripts/bundle-size-summary.js \
+            superset-frontend/bundle-stats/stats.json > bundle-size-summary.json
+          rm -rf superset-frontend/bundle-stats
+
+      # Comparison + alert only -- this job never persists. See
+      # frontend-bundle-size-nightly.yml for why.
+      #
+      # comment-on-alert is gated to same-repo PRs: on a fork PR,
+      # GITHUB_TOKEN is forced read-only regardless of the `permissions`
+      # block above, so once the alert threshold is crossed the action's
+      # `pulls.createReview` call 403s. That error isn't gated by
+      # fail-on-alert (which only governs the deliberate alert-threshold
+      # failure) -- it propagates and fails the job outright. Fork PRs
+      # still get the comparison via the job summary (summary-always).
+      - name: Compare bundle size against nightly baseline
+        uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1
+        with:
+          tool: customSmallerIsBetter
+          output-file-path: bundle-size-summary.json
+          external-data-json-path: bundle-size-history.json
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          comment-on-alert: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
+          alert-threshold: "110%"
+          fail-on-alert: false
+          summary-always: true

.github/workflows/superset-helm-release.yml

@@ -27,6 +27,9 @@ concurrency:
   group: helm-release
   cancel-in-progress: false
 
+permissions:
+  contents: read
+
 jobs:
   release:
     runs-on: ubuntu-26.04

.github/workflows/superset-playwright.yml

@@ -22,6 +22,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   changes:
     runs-on: ubuntu-26.04

.github/workflows/superset-python-presto-hive.yml

@@ -14,6 +14,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   changes:
     runs-on: ubuntu-26.04

.github/workflows/supersetbot.yml

@@ -13,6 +13,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   supersetbot:
     runs-on: ubuntu-26.04

.github/workflows/welcome-new-users.yml

@@ -5,6 +5,9 @@ on:
   pull_request_target:
     types: [opened]
 
+permissions:
+  contents: read
+
 jobs:
   welcome:
     runs-on: ubuntu-slim

AGENTS.md

@@ -167,7 +167,7 @@ The Developer Portal auto-generates MDX documentation from Storybook stories. **
 ### Generator Location
 - Script: `docs/scripts/generate-superset-components.mjs`
 - Wrapper: `docs/src/components/StorybookWrapper.jsx`
-- Output: `docs/developer_portal/components/`
+- Output: `docs/developer_docs/components/`
 
 ## Architecture Patterns
 

CONTRIBUTING.md

@@ -35,4 +35,4 @@ The Developer Portal includes comprehensive guides for:
 - [Code Review Process](https://superset.apache.org/developer_portal/contributing/code-review)
 - [Development How-tos](https://superset.apache.org/developer_portal/contributing/howtos)
 
-Source for the Developer Portal documentation is [located here](https://github.com/apache/superset/tree/master/docs/developer_portal).
+Source for the Developer Portal documentation is [located here](https://github.com/apache/superset/tree/master/docs/developer_docs).

README.md

@@ -31,6 +31,8 @@ under the License.
 [![Open PRs](https://img.shields.io/github/issues-pr/apache/superset)](https://github.com/apache/superset/pulls)
 [![Get on Slack](https://img.shields.io/badge/slack-join-orange.svg)](https://bit.ly/join-superset-slack)
 [![Documentation](https://img.shields.io/badge/docs-apache.org-blue.svg)](https://superset.apache.org)
+[![Storybook](https://img.shields.io/badge/storybook-live-ff4785.svg)](https://superset-storybook.netlify.app)
+[![Bundle Analyzer](https://img.shields.io/badge/bundle%20analyzer-nightly-8dd6f9.svg)](https://superset-bundle-analyzer.netlify.app)
 
 <picture width="500">
   <source

UPDATING.md

@@ -24,6 +24,8 @@ assists people when migrating to a new version.
 
 ## Next
 
+- `SAMPLES_ROW_LIMIT` is now the default for `/datasource/samples` requests without a valid explicit `per_page`, rather than a hard per-request ceiling; explicit limits are honored up to the existing global row-limit ceiling, matching `/chart/data` SAMPLES requests.
+
 ### OAuth2 database callback metrics include their outcome
 
 The unqualified `DatabaseRestApi.oauth2` StatsD counter has been replaced with
@@ -31,6 +33,7 @@ The unqualified `DatabaseRestApi.oauth2` StatsD counter has been replaced with
 `DatabaseRestApi.oauth2.error`. Update monitoring rules and dashboards that consume
 the old counter to use the outcome-specific replacements.
 
+- [42930](https://github.com/apache/superset/pull/42930): Dataset import data-URI fetches no longer honor an HTTP(S) proxy when `DATASET_IMPORT_ALLOW_INTERNAL_DATA_URLS` is `False` (the default): the connection is now made directly to the destination so the peer-address check validates the real target instead of a proxy's. Deployments that require an egress proxy to reach legitimate external data URLs for dataset import should set `DATASET_IMPORT_ALLOW_INTERNAL_DATA_URLS = True` or otherwise ensure those URLs resolve without one.
 - [42935](https://github.com/apache/superset/pull/42935): The MCP service now refuses to start (`MCPAuthConfigError`) when `MCP_JWT_ISSUER` trusts more than one issuer and no `MCP_USER_RESOLVER` is configured, instead of only logging a warning. This was already a documented misconfiguration (the default resolver isn't issuer-scoped, so distinct trusted issuers minting the same username/email would resolve to the same Superset user); deployments trusting multiple issuers must configure an `MCP_USER_RESOLVER` that derives its identity from the token's `iss` claim before upgrading. Single-issuer deployments are unaffected.
 - [42393](https://github.com/apache/superset/pull/42393): Exported dataset YAML now carries a `uuid` for each metric and column so that custom folder assignments (which reference metrics/columns by UUID) survive an import into another workspace. This affects any export bundle that contains datasets, not just a dataset export: chart, dashboard, database and full-asset exports all embed the same dataset YAML, so a dashboard exported from this release also fails to import into an older one even though no dataset was exported directly. As with `folders` and `currency_code_column`, the affected `datasets/` files fail schema validation (`Unknown field: uuid`) when imported into Superset releases that predate this change; regenerate or hand-edit exports for older targets in mixed-version fleets.
 - [42300](https://github.com/apache/superset/pull/42300): Timeseries charts (line/area/bar) with a Y-axis bound in effect — either an explicit `yAxisBounds` or one derived from `truncateYAxis` — now clamp out-of-range data points to that bound instead of letting ECharts drop the point (and the line segments around it) entirely. Any existing chart with a configured Y-axis bound and data outside it will look different after upgrading: a gap becomes a point pinned to the boundary. The clamp also rewrites the value ECharts reads for that point's tooltip and data label, so the displayed value is the bound rather than the true observation.

docs/admin_docs/configuration/configuring-superset.mdx

@@ -97,6 +97,54 @@ for more information on how to configure it.
 
 At the very least, you'll want to change `SECRET_KEY` and `SQLALCHEMY_DATABASE_URI`. Continue reading for more about each of these.
 
+## Localizing D3 date and time labels
+
+`BABEL_DEFAULT_LOCALE` controls Superset's application translations, while
+`D3_TIME_FORMAT` provides localized date and time names to visualizations that
+use the D3 formatter registry, including Calendar Heatmap. Configure both when
+you want the application and chart labels to use the same locale.
+
+`D3_TIME_FORMAT` accepts partial overrides. For example, Russian month names
+can be configured in `superset_config.py` as follows:
+
+```python
+BABEL_DEFAULT_LOCALE = "ru"
+
+D3_TIME_FORMAT = {
+    "months": [
+        "Январь",
+        "Февраль",
+        "Март",
+        "Апрель",
+        "Май",
+        "Июнь",
+        "Июль",
+        "Август",
+        "Сентябрь",
+        "Октябрь",
+        "Ноябрь",
+        "Декабрь",
+    ],
+    "shortMonths": [
+        "Янв",
+        "Фев",
+        "Мар",
+        "Апр",
+        "Май",
+        "Июн",
+        "Июл",
+        "Авг",
+        "Сен",
+        "Окт",
+        "Ноя",
+        "Дек",
+    ],
+}
+```
+
+Restart Superset after changing `superset_config.py` so the frontend receives
+the updated formatter configuration.
+
 ## Chart-data query timing
 
 Set `CHART_DATA_INCLUDE_TIMING = True` to add an optional versioned timing object

docs/admin_docs/configuration/dashboard-performance.mdx

@@ -0,0 +1,184 @@
+---
+title: Dashboard Performance
+hide_title: true
+sidebar_position: 5
+version: 1
+---
+
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# Dashboard Performance
+
+A dashboard's perceived speed is determined by three independent things: how
+many charts have to render, how many queries the backend can execute
+concurrently, and how quickly the underlying data warehouse can return
+results. Superset gives you levers for the first two; the third belongs to
+your warehouse. This page covers the dashboard-side levers and the practical
+guidance around them.
+
+## Is there a maximum chart count per dashboard?
+
+**No hard limit is enforced** — Superset has no configuration key that
+caps the number of charts on a dashboard. In practice, dashboards behave
+well up to a few dozen charts. Beyond that, you'll typically feel friction
+on the initial load and during cross-filter / time-range updates, even with
+the lazy-loading optimizations described below.
+
+Rough thresholds to keep in mind:
+
+- **Under ~25 charts**: usually no perceptible problem.
+- **25–50 charts**: still fine, but you start to want tabs to break the
+  page into chunks the user actually looks at.
+- **Over ~50 charts**: split into multiple dashboards or use tabs
+  aggressively. The bottleneck is rarely Superset itself — it's the
+  warehouse executing dozens of queries in parallel and the browser
+  rendering dozens of chart frames.
+
+These are guidelines, not guarantees. A dashboard of 100 sparkline-style
+charts hitting a fast cache behaves very differently from a dashboard of
+20 heavy aggregations against a cold warehouse.
+
+## Lazy rendering — `DASHBOARD_VIRTUALIZATION`
+
+Superset's dashboard layout is virtualized at the row level. Charts that
+are far below the user's current scroll position render a placeholder
+instead of their visualization until the user scrolls them into view, and
+go back to a placeholder if scrolled well past. The chart component itself
+stays mounted throughout — only the visualization is swapped for a
+placeholder — so this alone does **not** reduce backend query load; see
+[Deferred data fetch](#deferred-data-fetch--dashboard_virtualization_defer_data)
+below for that. This is on by default.
+
+**Feature flag**: `DASHBOARD_VIRTUALIZATION` (default: `True`)
+
+The flag is `stable` and marked for path-to-deprecation — meaning the
+behavior will eventually be non-optional, but the flag still exists so
+operators can disable it if a specific layout misbehaves.
+
+**Behavior** (from `superset-frontend/src/dashboard/components/gridComponents/Row/Row.tsx`):
+
+- A chart's visualization is rendered when its row scrolls within **1
+  viewport height** of the visible area.
+- A chart's visualization is swapped back for a placeholder when its row
+  scrolls more than **4 viewport heights** away from the visible area.
+- Tabs that aren't currently selected don't render their content at all
+  (see below).
+- The placeholder-swap-back is skipped in **embedded** mode (so an
+  embedded dashboard keeps its charts rendered once they've been seen,
+  which avoids re-rendering on scroll-up). Both halves are skipped for
+  **headless / bot** rendering (so screenshot / report jobs load every
+  chart).
+
+## Deferred data fetch — `DASHBOARD_VIRTUALIZATION_DEFER_DATA`
+
+By default, `DASHBOARD_VIRTUALIZATION` only controls whether a chart's
+*visualization* is rendered — the chart component still mounts and issues
+its data request immediately, regardless of scroll position.
+`DASHBOARD_VIRTUALIZATION_DEFER_DATA` is a supplementary flag that skips
+the data request itself for charts that aren't currently in view, useful
+for backends where opening a connection or compiling a query is expensive
+even if the result would be thrown away. It only has an effect when
+`DASHBOARD_VIRTUALIZATION` is also enabled — with virtualization off,
+every chart is treated as in view, so there's nothing left to defer.
+
+**Feature flag**: `DASHBOARD_VIRTUALIZATION_DEFER_DATA` (default: `False`)
+
+Enable this if you see warehouse load spike on dashboard *open* even
+though most charts are off-screen.
+
+## Per-tab lazy loading
+
+**This is on by default and has no flag.** A tab's content is not rendered
+until the user activates that tab, so charts inside an unselected tab do
+not fetch data on dashboard open. When the user clicks the tab, that
+tab's charts mount and fetch in the normal way.
+
+Practically: tabs are the single most effective tool for a large
+dashboard. Splitting 60 charts across 4 tabs effectively turns dashboard
+open into "load ~15 charts," and the remaining ones lazy-load only if the
+user goes looking.
+
+## Is there a switch to cap concurrent chart queries?
+
+**No.** Superset does not implement a frontend-side concurrent-request
+limiter. Each chart issues its own data request when it mounts, and the
+browser handles parallelism — typically ~6 in-flight requests per origin
+under HTTP/1.1, though HTTP/2 or HTTP/3 (if your deployment terminates
+TLS that way) can multiplex considerably more over a single connection.
+Backend throughput is bounded by your
+Gunicorn worker count for synchronous query execution, or by your Celery
+worker pool when [async queries](./async-queries-celery.mdx) are enabled.
+
+If you need to throttle warehouse load, the right place is:
+
+1. The warehouse itself (connection pool / concurrency limits).
+2. Superset's Celery configuration (smaller worker pool when async
+   queries are on).
+3. Splitting heavy charts across tabs or separate dashboards (each
+   dashboard load only fetches what's visible).
+
+## Splitting strategies
+
+When a dashboard outgrows comfortable performance, the options in order
+of effort:
+
+**1. Move sections into tabs.** Same dashboard, but only the active tab's
+charts fetch. This is the cheapest change and often the only one needed.
+
+**2. Cache aggressively.** A Redis cache backend (see
+[Caching](./cache.mdx)) means repeat dashboard loads serve from cache
+rather than re-hitting the warehouse. This is especially impactful for
+dashboards opened by many users in close succession.
+
+**3. Enable async queries.** [Async query execution](./async-queries-celery.mdx)
+via Celery decouples query duration from request lifetime, so a slow
+chart doesn't block the page. The user sees other charts come in as
+their queries complete.
+
+**4. Split into multiple dashboards.** Group related charts into purpose-
+specific dashboards rather than one mega-dashboard. Link them from a
+landing dashboard or a navigation menu.
+
+**5. Pre-aggregate at the warehouse level.** If the same expensive
+aggregation appears across many charts, materialize it as a view or
+scheduled table in the warehouse so each chart query is a cheap lookup.
+
+## Operational notes
+
+- The feature flags above are set in `superset_config.py`, e.g.:
+
+  ```python
+  FEATURE_FLAGS = {
+      "DASHBOARD_VIRTUALIZATION": True,
+      "DASHBOARD_VIRTUALIZATION_DEFER_DATA": True,
+  }
+  ```
+
+- See [Feature Flags](./feature-flags.mdx) for the full list of supported
+  flags and their lifecycle stages.
+- Server-side screenshot jobs (alerts, scheduled reports, thumbnails)
+  render the dashboard in a headless, webdriver-controlled browser, which
+  intentionally bypasses row virtualization so the rendered artifact
+  includes every chart, not just the ones above the fold. User-triggered
+  "download as image/PDF" is different: it captures whatever's currently
+  rendered in the user's own browser, so it's still subject to
+  virtualization like any other page view. Metadata/YAML dashboard export
+  doesn't render the frontend at all, so virtualization doesn't apply to
+  it either.

docs/admin_docs/security/security.mdx

@@ -400,7 +400,7 @@ Once enabled, each user manages their own keys from their profile page:
 1. Open the user menu (top-right) and click **Info** to navigate to the User Info page
 2. Expand the **API Keys** section
 3. Click **+ API Key**
-4. Enter a name and (optionally) an expiration date
+4. Enter a name and optionally select resource scopes
 5. Copy the generated token — it is shown only once
 
 Only users with the `can_read` and `can_write` permissions on `ApiKey` (granted by default to Admins) can manage API keys.
@@ -415,6 +415,18 @@ Authorization: Bearer <your-api-key>
 
 This works for all REST API endpoints and the MCP server. The request is executed with the permissions of the user who created the key.
 
+#### API Key Scopes
+
+The creation dialog can restrict an API key to MCP resource actions such as
+`superset:dashboard:read` or `superset:chart:write`. A scope is an additional
+restriction: it never grants a permission that the creating user does not
+already have through Superset RBAC. Write scopes also cover update and delete
+operations for that resource; `superset:sqllab:write` covers SQL execution.
+
+Keys created without scopes retain legacy RBAC-only behavior. The scoped-key
+restrictions described here are enforced by the MCP server; regular REST API
+routes continue to apply their existing Superset RBAC checks.
+
 #### Use Cases
 
 - **CI/CD pipelines** — automated chart/dashboard exports and imports

docs/developer_docs/contributing/development-setup.md

@@ -519,6 +519,30 @@ sh -c "$(curl -fsSL https://raw.githubusercontent.com/nvm-sh/nvm/v0.37.0/install
 
 For those interested, you may also try out [avn](https://github.com/nvm-sh/nvm#deeper-shell-integration) to automatically switch to the node version that is required to run Superset frontend.
 
+##### zstd
+
+`npm run dev-server` proxies requests to your local Superset server and rewrites the HTML it returns, so it has to decompress responses sent with `Content-Encoding: zstd`. It does that with [`simple-zstd`](https://www.npmjs.com/package/simple-zstd), which wraps the system `zstd` binary instead of bundling one. That binary has to be on your `PATH`:
+
+```bash
+# macOS
+brew install zstd
+
+# Ubuntu/Debian
+sudo apt install zstd
+
+# Windows
+choco install zstd
+```
+
+`simple-zstd` looks for the binary when it is first imported, not when a response is decompressed, so a missing `zstd` stops the dev server at startup with:
+
+```
+Error: Can not access zstd! Is it installed?
+    at Object.<anonymous> (.../node_modules/simple-zstd/dist/src/index.js:102:11)
+```
+
+The message names the dependency, but it surfaces from inside `webpack.proxy-config.js` while the webpack config is loading, which reads like a build-tooling failure rather than a missing system package.
+
 #### Install dependencies
 
 Install third-party dependencies listed in `package.json` via:

docs/developer_docs/guidelines/frontend/component-style-guidelines.md

@@ -198,7 +198,7 @@ Each component should come with its dedicated storybook file.
 
 **One component per story:** Each storybook file should only contain one component unless substantially different variants are required
 
-**Component variants:** If the component behavior is substantially different when certain props are used, it is best to separate the story into different types. See the `superset-frontend/src/components/Select/Select.stories.tsx` as an example.
+**Component variants:** If the component behavior is substantially different when certain props are used, it is best to separate the story into different types. See the `superset-frontend/packages/superset-ui-core/src/components/Select/Select.stories.tsx` as an example.
 
 **Isolated state:** The storybook should show how the component works in an isolated state and with as few dependencies as possible
 

docs/docs/faq.mdx

@@ -46,13 +46,43 @@ import FAQSchema from '@site/src/components/FAQSchema';
       answer:
         'You need to register a free account at Mapbox.com, obtain an API key, and add it to your .env file at the key MAPBOX_API_KEY.',
     },
+    {
+      question: 'How to limit the timed refresh on a dashboard?',
+      answer:
+        'To exclude specific slices from the timed refresh process, add the timed_refresh_immune_slices key to the dashboard JSON Metadata field with the slice IDs to exclude.',
+    },
+    {
+      question: "Why does 'flask fab' or Superset freeze, hang, or not respond when started (my home directory is NFS mounted)?",
+      answer:
+        'By default, Superset creates and uses an SQLite database at ~/.superset/superset.db. SQLite is known to not work well if used on NFS due to broken file locking. Override the path with the SUPERSET_HOME environment variable or change SQLALCHEMY_DATABASE_URI in superset_config.py.',
+    },
+    {
+      question: 'What if the table schema changed?',
+      answer:
+        'Go to Data -> Datasets, click the edit icon next to the dataset whose schema has changed, and hit Sync columns from source from the Columns tab. The new columns will get merged.',
+    },
     {
       question: 'What database engine can I use as a backend for Superset?',
       answer:
         'Superset is tested using MySQL, PostgreSQL, and SQLite backends for storing its internal metadata. While Superset supports many databases as data sources, only these are recommended for the metadata store in production.',
     },
     {
-      question: 'Does Superset work with my database?',
+      question: 'How can I configure OAuth authentication and authorization?',
+      answer:
+        'Take a look at the Flask-AppBuilder OAuth configuration example, which shows how to configure OAuth authentication and authorization in Superset.',
+    },
+    {
+      question: 'Is there a way to force the dashboard to use specific colors?',
+      answer:
+        'It is possible on a per-dashboard basis by providing a mapping of labels to colors in the JSON Metadata attribute using the label_colors key. You can use a full hex color, a named color, or the index in the current color palette.',
+    },
+    {
+      question: 'How do I expand all chart descriptions on a dashboard by default?',
+      answer:
+        'Add the expand_all_slices key to the dashboard JSON Metadata field with a value of true. Charts that have already been manually expanded or collapsed keep that per-chart override regardless of the setting.',
+    },
+    {
+      question: 'Does Superset work with [insert database engine here]?',
       answer:
         'Superset supports any database with a Python SQLAlchemy dialect and DBAPI driver. Check the Connecting to Databases documentation for the full list of supported databases.',
     },
@@ -61,15 +91,30 @@ import FAQSchema from '@site/src/components/FAQSchema';
       answer:
         'Yes, Superset has a public REST API documented using Swagger. Enable FAB_API_SWAGGER_UI in superset_config.py to access interactive API documentation at /swagger/v1.',
     },
+    {
+      question: 'How can I see usage statistics (e.g., monthly active users)?',
+      answer:
+        'This functionality is not included with Superset, but you can extract and analyze the logs table in Superset\u2019s metadata database to see what actions have occurred.',
+    },
+    {
+      question: 'What does Hours Offset in the Edit Dataset view do?',
+      answer:
+        'In the Edit Dataset view, the hours offset lets you configure the number of hours to be added or subtracted from the time column. This can be used, for example, to convert UTC time to local time.',
+    },
     {
       question: 'Does Superset collect any telemetry data?',
       answer:
         'Superset uses Scarf by default to collect basic telemetry data to help maintainers understand version usage. Users can opt out by setting the SCARF_ANALYTICS environment variable to false.',
     },
     {
-      question: 'Does Superset have a trash bin to recover deleted assets?',
+      question: 'Does Superset have an archive panel or trash bin from which a user can recover deleted assets?',
       answer:
-        'No, there is no built-in way to recover deleted dashboards, charts, or datasets. It is recommended to take periodic backups of the metadata database and use export functionality for recovery.',
+        'No. Currently, there is no way to recover a deleted Superset dashboard, chart, dataset, or database from the UI. It is recommended to take periodic backups of the metadata database and use export functionality for recovery.',
+    },
+    {
+      question: 'I ran a security scan of the Superset container image and it showed dozens of "high" and "critical" vulnerabilities! Can you release a version of Superset without these?',
+      answer:
+        'These are dependency CVEs in software that Superset uses, mostly in the Linux kernel or Python. Superset addresses them by regularly updating dependencies and welcomes pull requests that fix dependency CVEs. The Superset security team focuses primarily on vulnerabilities in Superset itself.',
     },
   ]}
 />
@@ -214,8 +259,7 @@ frontend falls back to a built-in default of `5000` milliseconds.
 SUPERSET_DASHBOARD_MANUAL_REFRESH_STAGGER_MS = 0
 ```
 
-**Why does ‘flask fab’ or superset freeze/hang/not responding when started (my home directory is
-NFS mounted)?**
+## Why does `flask fab` or Superset freeze, hang, or not respond when started (my home directory is NFS mounted)?
 
 By default, Superset creates and uses an SQLite database at `~/.superset/superset.db`. SQLite is
 known to [not work well if used on NFS](https://www.sqlite.org/lockingv3.html) due to broken file

docs/package.json

@@ -58,12 +58,12 @@
     "@fontsource/inter": "^5.3.0",
     "@mdx-js/react": "^3.1.1",
     "@saucelabs/theme-github-codeblock": "^0.3.0",
-    "@storybook/addon-docs": "^10.5.6",
+    "@storybook/addon-docs": "^10.5.7",
     "@superset-ui/core": "^0.20.4",
     "@swc/core": "^1.15.47",
-    "antd": "^6.5.3",
-    "baseline-browser-mapping": "^2.11.12",
-    "caniuse-lite": "^1.0.30001806",
+    "antd": "^6.6.0",
+    "baseline-browser-mapping": "^2.11.13",
+    "caniuse-lite": "^1.0.30001809",
     "docusaurus-plugin-openapi-docs": "^5.1.3",
     "docusaurus-theme-openapi-docs": "^5.1.3",
     "js-yaml": "^5.2.3",
@@ -77,7 +77,7 @@
     "react-table": "^7.8.0",
     "remark-import-partial": "^0.0.2",
     "reselect": "^5.2.0",
-    "storybook": "^10.5.6",
+    "storybook": "^10.5.7",
     "swagger-ui-react": "^5.32.12",
     "swc-loader": "^0.2.7",
     "tinycolor2": "^1.4.2",
@@ -89,14 +89,14 @@
     "@eslint/js": "^9.39.2",
     "@types/js-yaml": "^4.0.9",
     "@types/react": "^19.1.8",
-    "@typescript-eslint/eslint-plugin": "^8.66.0",
-    "@typescript-eslint/parser": "^8.66.0",
+    "@typescript-eslint/eslint-plugin": "^8.67.0",
+    "@typescript-eslint/parser": "^8.67.0",
     "eslint": "^9.39.2",
     "eslint-plugin-react": "^7.37.5",
     "globals": "^17.9.0",
-    "oxfmt": "^0.62.0",
+    "oxfmt": "^0.63.0",
     "typescript": "~6.0.3",
-    "typescript-eslint": "^8.66.0",
+    "typescript-eslint": "^8.67.0",
     "webpack": "^5.109.2"
   },
   "browserslist": {

docs/static/resources/openapi.json

@@ -3407,22 +3407,26 @@
             "nullable": true,
             "type": "string"
           },
+          "description": {
+            "nullable": true,
+            "type": "string"
+          },
+          "editors": {
+            "items": {
+              "$ref": "#/components/schemas/DashboardRestApi.get_list.Subject"
+            },
+            "type": "array"
+          },
           "id": {
             "type": "integer"
           },
           "is_managed_externally": {
             "type": "boolean"
           },
-          "owners": {
-            "$ref": "#/components/schemas/DashboardRestApi.get_list.User2"
-          },
           "published": {
             "nullable": true,
             "type": "boolean"
           },
-          "roles": {
-            "$ref": "#/components/schemas/DashboardRestApi.get_list.Role"
-          },
           "slug": {
             "maxLength": 255,
             "nullable": true,
@@ -3432,10 +3436,10 @@
             "readOnly": true
           },
           "tags": {
-            "$ref": "#/components/schemas/DashboardRestApi.get_list.Tag"
-          },
-          "thumbnail_url": {
-            "readOnly": true
+            "items": {
+              "$ref": "#/components/schemas/DashboardRestApi.get_list.Tag"
+            },
+            "type": "array"
           },
           "url": {
             "readOnly": true
@@ -3444,21 +3448,46 @@
             "format": "uuid",
             "nullable": true,
             "type": "string"
+          },
+          "viewers": {
+            "items": {
+              "$ref": "#/components/schemas/DashboardRestApi.get_list.Subject1"
+            },
+            "type": "array"
           }
         },
         "type": "object"
       },
-      "DashboardRestApi.get_list.Role": {
+      "DashboardRestApi.get_list.Subject": {
         "properties": {
           "id": {
             "type": "integer"
           },
-          "name": {
-            "maxLength": 64,
+          "label": {
+            "maxLength": 255,
             "type": "string"
+          },
+          "type": {
+            "type": "integer"
           }
         },
-        "required": ["name"],
+        "required": ["label", "type"],
+        "type": "object"
+      },
+      "DashboardRestApi.get_list.Subject1": {
+        "properties": {
+          "id": {
+            "type": "integer"
+          },
+          "label": {
+            "maxLength": 255,
+            "type": "string"
+          },
+          "type": {
+            "type": "integer"
+          }
+        },
+        "required": ["label", "type"],
         "type": "object"
       },
       "DashboardRestApi.get_list.Tag": {
@@ -3511,23 +3540,6 @@
         "required": ["first_name", "last_name"],
         "type": "object"
       },
-      "DashboardRestApi.get_list.User2": {
-        "properties": {
-          "first_name": {
-            "maxLength": 64,
-            "type": "string"
-          },
-          "id": {
-            "type": "integer"
-          },
-          "last_name": {
-            "maxLength": 64,
-            "type": "string"
-          }
-        },
-        "required": ["first_name", "last_name"],
-        "type": "object"
-      },
       "DashboardRestApi.post": {
         "properties": {
           "certification_details": {
@@ -16506,7 +16518,7 @@
                     },
                     "result": {
                       "items": {
-                        "type": "object"
+                        "$ref": "#/components/schemas/DashboardRestApi.get_list"
                       },
                       "type": "array"
                     }

docs/yarn.lock

@@ -1142,6 +1142,11 @@
   resolved "https://registry.yarnpkg.com/@babel/runtime/-/runtime-7.29.7.tgz#12022450c45a4da6d8d8287b18a4ff2ddb23f768"
   integrity sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==
 
+"@babel/runtime@^8.0.0":
+  version "8.0.0"
+  resolved "https://registry.yarnpkg.com/@babel/runtime/-/runtime-8.0.0.tgz#d7bd513e6843662346552c2798ab895716cf97f2"
+  integrity sha512-sL6cvO2IfkSu/iU+zs2S/w01B7A8V7suXSIKEN4hPFFdZoiPGxrj5pAG0lCaqLWiEIrjKzdznIWuaLcxPR53qw==
+
 "@babel/template@^7.29.7":
   version "7.29.7"
   resolved "https://registry.yarnpkg.com/@babel/template/-/template-7.29.7.tgz#4d9d4004f645cdd304de958c725162784ecac700"
@@ -3170,100 +3175,100 @@
   resolved "https://registry.yarnpkg.com/@oxc-resolver/binding-win32-x64-msvc/-/binding-win32-x64-msvc-11.23.0.tgz#8b66dbfa7b796139e719063fc0e44084e80a1c15"
   integrity sha512-gUGJpr+Rn6zMxm5juApV0K3U845i8t47o8k+rbO0BHbi4PoJIfSPeQmrE2dgohQm2g5k6iviNFyXCGqvmaYUpw==
 
-"@oxfmt/binding-android-arm-eabi@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-android-arm-eabi/-/binding-android-arm-eabi-0.62.0.tgz#3f5b9d3ba944f42ad3fa2697b9fef88a8c9d4ce0"
-  integrity sha512-pdsv0C4gPjJ8H1+sd8u0BDx+yLACTL+rgeMIOL1ln4ihSnhw8CWXtYWgvcSkyTfgGBIzFKab+d8rx9Xl4en/Kw==
+"@oxfmt/binding-android-arm-eabi@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-android-arm-eabi/-/binding-android-arm-eabi-0.63.0.tgz#136176dc94fdc41e21415cc770d86f5066282e0f"
+  integrity sha512-YmRth4ZPGgEXcgmkhvANbC9uD67dxmSobW7DQuyt5tOBOKvPnIpk5SVHBj88E+7wMNRI2FhqaDbOhQFBix+b8A==
 
-"@oxfmt/binding-android-arm64@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-android-arm64/-/binding-android-arm64-0.62.0.tgz#4c7e2c567f645ed051be100318e9e3f716630c1b"
-  integrity sha512-WC3YQ7uS/KtDrjmqwBviwFKe9qeoi+eXx8aX1z/ffG23Md75myjrJaQqTuJvdOLPoa4EYTjDWH0dHXfwulCVog==
+"@oxfmt/binding-android-arm64@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-android-arm64/-/binding-android-arm64-0.63.0.tgz#10bc42457179210061c801122a64304619e3bdab"
+  integrity sha512-icbahX8X2X3sRamOMecvdYeZXWjPDazRDIfvWfy7Ca1nc/ZDT2Y9k5Nt7s46EqFd7NQPdgk+CM3/SgIT5LPCaQ==
 
-"@oxfmt/binding-darwin-arm64@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-darwin-arm64/-/binding-darwin-arm64-0.62.0.tgz#6c8007ae65ed17f9d1ecc6c680da19ec19276c67"
-  integrity sha512-GM8Yf3LjjaR1I8PD0SfeoIlwhsh9GvSF+cQ8sf624Yxnjsyumn95aFzYfKJVefblfDIiOAnZ7QVm2sa21Er/0Q==
+"@oxfmt/binding-darwin-arm64@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-darwin-arm64/-/binding-darwin-arm64-0.63.0.tgz#5f9084d9a760a1836387f8970a7f9d614ec3d909"
+  integrity sha512-WV+Ze5v5gI2qoj8jpAovt8KBTW8pjEz/AiMXXjeTQS+Bmf/MmZXTS40S8xNPDszX+W8WDv2Bbk6qKrMTtUGu1A==
 
-"@oxfmt/binding-darwin-x64@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-darwin-x64/-/binding-darwin-x64-0.62.0.tgz#0661a0274e8625921c5a054aeb21a36251946e6b"
-  integrity sha512-d5THp7F8bCxLqNogEXDORRsQD6dosf3EyFtnXfBer6v+8tGdcWIjoDX9WaXrrF/26zOmL8qHpPTKCEvpBDmZkQ==
+"@oxfmt/binding-darwin-x64@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-darwin-x64/-/binding-darwin-x64-0.63.0.tgz#badd4a02218a9a62319817d5c337b30159a54a21"
+  integrity sha512-CJGSBdDxXOWIpoFXHpverimCvz084KA7L483rqJ44c3jDtzv6d4qOSoR/V9ywSHfV+Ks1lwIj2P49BFhunLNAA==
 
-"@oxfmt/binding-freebsd-x64@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-freebsd-x64/-/binding-freebsd-x64-0.62.0.tgz#f3345001102ac3e6c2947920d6d1676e9cf97e75"
-  integrity sha512-1DnrtXGZooOZ0fHgAXZUaDQzBVh1CM2MNW4oBXyQ2aWKvCHjyljvT9fgBkOM0fEOb96X5eqtcfJ0YUVt9jj66g==
+"@oxfmt/binding-freebsd-x64@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-freebsd-x64/-/binding-freebsd-x64-0.63.0.tgz#a17261e95c8ebef1f76d8aaac746a64fdb6ba51e"
+  integrity sha512-BDfKY+KhL2078cgswBBFQPAYuxCy93bS/iC5frdSeSbTLcGrR6VC2hsuPTanoJmg84+wSyWl0wWC1eR+uTnkRg==
 
-"@oxfmt/binding-linux-arm-gnueabihf@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-0.62.0.tgz#ddc03bc2a899f2071d6706c06dfdec3a7f3e8b5a"
-  integrity sha512-4pQDHOYRH+Huqe0StIaWyvk2CVl/aTaqSrbZpA3/pLS2xH24ME7lBgYprhQF2fRkHBzhGGGKliwxFsDdHwx59g==
+"@oxfmt/binding-linux-arm-gnueabihf@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-0.63.0.tgz#baeee34bb08e0769af878623f442e83bc0aacd7a"
+  integrity sha512-Ov1cQEXT4mj7cojAokWSS1eoxkoyvbDfAbxNsGIKY2o36kvdAaFzPxRN6NxFRk9fD72B8oCoTTX/NuYTUWlpsg==
 
-"@oxfmt/binding-linux-arm-musleabihf@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-arm-musleabihf/-/binding-linux-arm-musleabihf-0.62.0.tgz#5e82208d612c4caf64ada75e129e34d1a9eefb2c"
-  integrity sha512-X0jAaZJFMCVKhB6YyWVTQ/wN2DLsBcZKSMqTS76bF6riT+XZdtg2FPEdjDvdVbunO9cG+tWiVaEs4Zs38lxYog==
+"@oxfmt/binding-linux-arm-musleabihf@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-arm-musleabihf/-/binding-linux-arm-musleabihf-0.63.0.tgz#e70d5697ec4b6bb5f87a3f019e01b3f956b8e44b"
+  integrity sha512-0LE7ro3+6L79jcMANycAZfRaC7zxr9YZ2+vEL5uMD9QlEep+rS/r1kSJsnuLl991NXJZD60euh0PC1GHrR20vw==
 
-"@oxfmt/binding-linux-arm64-gnu@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-0.62.0.tgz#eb379bc58aa962e753d58b4cc68ff4081bc19a5d"
-  integrity sha512-682Z8T5s8T5ATArYtsejKvbIfd8LEAXyyDkKkoZVq8HND7Vx8TYLlrDjDSeYfodMeVwHOgkj13lJYR8cj6vUSg==
+"@oxfmt/binding-linux-arm64-gnu@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-0.63.0.tgz#638a8ed4f3d256c50aeb6d2c19cfc65792c902e1"
+  integrity sha512-izPk+2Z4gjuZK32Fqh5qXoMpT/2NXzLh++ob57HiEiVSQZ1iYXu8EKMzb+K5AvWyIEXhdDIt7ADjGGtFhkT9Bw==
 
-"@oxfmt/binding-linux-arm64-musl@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-arm64-musl/-/binding-linux-arm64-musl-0.62.0.tgz#dc1c62510405e874bf6a53a34f548032eb6dfed7"
-  integrity sha512-lk25fAl7KWaLWVJcW0CHEXB7QlQZtx5eDkjpaGMK0hzXTjUe0Wmlu8IKuFHoviSOcEJedRTs4VE/506VqGxGew==
+"@oxfmt/binding-linux-arm64-musl@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-arm64-musl/-/binding-linux-arm64-musl-0.63.0.tgz#af5a9b787f5233f27a3360ad56235fc1b011f760"
+  integrity sha512-alPmbOuWXFXiSo+lOtv6X71C7SYMEDW2WVvywOvf9BwKgEhSNGhMTLeFVSjKUMCamcjbbgVdsWF8GN1uy8xshg==
 
-"@oxfmt/binding-linux-ppc64-gnu@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-0.62.0.tgz#9f9afee327090024db86b70ec81a57ad06bb2f00"
-  integrity sha512-SFyNqHQLwySceWNLhiSldx7wPXRAzP0L0WcW9GegP3uWrpZGJiZlQO85NbHAFPEfxR9PhZ9qSnZryEh7+v+4Gw==
+"@oxfmt/binding-linux-ppc64-gnu@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-0.63.0.tgz#c1a211206134a5577e355a495989e0d733218d60"
+  integrity sha512-BdzCPvolJc4AWZ+YMzgUDJcDzbQWrFjYuqBHoNHNqP1aCaluQRJNs4k3vNU5IG7vTpjf9zeD73D7MFM1TecZpg==
 
-"@oxfmt/binding-linux-riscv64-gnu@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-riscv64-gnu/-/binding-linux-riscv64-gnu-0.62.0.tgz#4427d42ee3bad0e55b38dc76fe14a7e5318c360c"
-  integrity sha512-KYj55C1ywJfHo6+aKDuEmUtVEdJALsC5GwayDGsI6FGz2GxFqNr/mA8nxVsNbJzm7sE5MRqTQ9ziImSzhYXysA==
+"@oxfmt/binding-linux-riscv64-gnu@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-riscv64-gnu/-/binding-linux-riscv64-gnu-0.63.0.tgz#4863f0311e5c1b88f75ef822959b3ca4fd938937"
+  integrity sha512-7sIgfLzqtNKSkMGsGVyRpHwpjNezRg2XONvUOheFZs95TSZpM0JAuPpA8KrQFsWc4wPU95roX2O69JgH8igOgw==
 
-"@oxfmt/binding-linux-riscv64-musl@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-riscv64-musl/-/binding-linux-riscv64-musl-0.62.0.tgz#a117f82909f075cf07c333842d89a5638429e21d"
-  integrity sha512-BhZDNo5GOU5nC378RhD0/XpvaEBHsH3HLgJp8YZX3A0InC7oivzA63HsRmiXFLtLSHAstEVrDf6fbC7Rs8Jh/A==
+"@oxfmt/binding-linux-riscv64-musl@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-riscv64-musl/-/binding-linux-riscv64-musl-0.63.0.tgz#ad05a017d12553e2f544743c4940adb552aa1d1c"
+  integrity sha512-9Tcg0y0WcVa6Mm9AgcgFMseDS+VkFJZpKZ8We9SpDY4gg5jewSwln+0sO04QLcTS1BtfDl9MwR+NfID8L7PUTg==
 
-"@oxfmt/binding-linux-s390x-gnu@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-0.62.0.tgz#3fac79fefe7ffc3f0a9393678ebd782aac918fcd"
-  integrity sha512-UyAFmyHkgSgUJ/wOM4p3U8AC2yAFvRH5PNBs7TnK0fObTT/XSWcdr/lAzPSWaekHaZFaMeFZyk9n93Joq3J93A==
+"@oxfmt/binding-linux-s390x-gnu@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-0.63.0.tgz#2803f539db15bc66db115888fa8f84d6531ed2b9"
+  integrity sha512-qWKC1pEOpx1qYhXaugPhHUeXwSfqEOk2wJH2LqVXGPV5iQYfdAZdt+d2XDiX4DTSWA2QDMUcFB+wEORh3Xn/sA==
 
-"@oxfmt/binding-linux-x64-gnu@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-x64-gnu/-/binding-linux-x64-gnu-0.62.0.tgz#8da207bef27941f0265c129d1c7c82c7cf91d1ce"
-  integrity sha512-1iYMP0leytWazFubD/WnINJuIrzRPuoL1aWEJdlGezEzDbTxcd29R4r8IUzP2oWeKst5V02uMJgR2NILlPlG6w==
+"@oxfmt/binding-linux-x64-gnu@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-x64-gnu/-/binding-linux-x64-gnu-0.63.0.tgz#c22a06a60ae2d6b3de522095e0c50a816040a033"
+  integrity sha512-S9wXYOiGSqYGS4Fx/TFsY+xDd/7dE5s+rUgbA4TsHiVF9e8J3ZcKmP7dsP/7iqLI9Wz7Ic7TzEr3mdthRCTdrA==
 
-"@oxfmt/binding-linux-x64-musl@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-x64-musl/-/binding-linux-x64-musl-0.62.0.tgz#e55cf9b7c8c2204fdbb5d4818f8c5ba02aa49360"
-  integrity sha512-4rA/URtJSTVNVAQz6Q8wf7SaRvOXVy+TizriT9hs/Y1XhLR/R+92uWKRQG8yFWRAIEBbFHJ6WevQcl/G9SXEfw==
+"@oxfmt/binding-linux-x64-musl@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-linux-x64-musl/-/binding-linux-x64-musl-0.63.0.tgz#48d3eeaf8e3757f638cf92de5ee4858befc9c0a3"
+  integrity sha512-5eGyTJuMZNwBSHCivXt8Yuta6GeTYksOPXRk2MIhajiyFGQx7bjaHIwY+ZusAoFHhT157A9x6sktLjYo9D5oMQ==
 
-"@oxfmt/binding-openharmony-arm64@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-openharmony-arm64/-/binding-openharmony-arm64-0.62.0.tgz#4998769ee1b5894efcd6cb99729d5a75f4c09dd1"
-  integrity sha512-mSZuFHU2ar1KLUjXpI2QBQcJ1VsOB3mOCgQXuXCpKs19dgh4u+OaovNfrWDfiJb+ihJ2+f7YFcaO9bS2dlTCXA==
+"@oxfmt/binding-openharmony-arm64@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-openharmony-arm64/-/binding-openharmony-arm64-0.63.0.tgz#02be9e140ae35ba30f52bdce27612fece4a01ab3"
+  integrity sha512-Rz7hx+Dv3DoW/S6pwVAyjfFXp7/trdQ1zg+vNmsdsdDNlUccugp4XNqambSuEAeP0DaG9k72AtNyfDXCEg0AGw==
 
-"@oxfmt/binding-win32-arm64-msvc@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-0.62.0.tgz#e09eaabdde76c885c4f8a190518c2eb2de08548a"
-  integrity sha512-OfwuhkcjDlqC4EgDojtiV9mzpLqeB9KqTOWPOjLEYBVdDCVSxqW3qzp/xcIxsbtI0UgGCnKvAqYKyY25kf5JZw==
+"@oxfmt/binding-win32-arm64-msvc@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-0.63.0.tgz#2226eaf52b6345a2cb926499216b2486cf0dbec2"
+  integrity sha512-T/IuizKN9mr4Xw6YYnptkXRNdLkyIlUZ7c8zfTOBpoytZyJ1BAsMUvsMDEx0X4YvSMpaivm+DR8112rQfzC25g==
 
-"@oxfmt/binding-win32-ia32-msvc@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-win32-ia32-msvc/-/binding-win32-ia32-msvc-0.62.0.tgz#f36e306308923977365270d8b26290f4ca2fcfa5"
-  integrity sha512-P9uDDNFRzghO3X8QAzhkjKhK7JvtABsVn8UYtFX7uor12IAnwNt8nNIctvfWj1JkQU/kE+fmLRPiw7XlrIHsZw==
+"@oxfmt/binding-win32-ia32-msvc@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-win32-ia32-msvc/-/binding-win32-ia32-msvc-0.63.0.tgz#58d263bb5ecd7330c02f9dcd8cda10f66e42e74b"
+  integrity sha512-XjrO5FJ5Wl9vsAxtCP1G/eaeT6y1K2s9CICUHGE42cEjou32/J6S+B1KnrOAboj6E7uhJnwPbRSvznWcxNdA0g==
 
-"@oxfmt/binding-win32-x64-msvc@0.62.0":
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/@oxfmt/binding-win32-x64-msvc/-/binding-win32-x64-msvc-0.62.0.tgz#bb6545e581d5ee7111084dbabeec7fe548bae418"
-  integrity sha512-dlI5SY7XYQCiCBafntWagCR6HcAJB/NpsLtdlPx8x08+Osz8Ok1HHz1GZuusegCe/VoJ6pAnF5a4pd5OZAq7qQ==
+"@oxfmt/binding-win32-x64-msvc@0.63.0":
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/@oxfmt/binding-win32-x64-msvc/-/binding-win32-x64-msvc-0.63.0.tgz#02a166c8a8049c55d0096d1ba9d8e73f3a4d26a7"
+  integrity sha512-sgsHCQy432OTQH4Ikk3tZptp3GqwnhwUDuY0loBH41zyHWfMZY9v8Dy78wsnSofHejvFozZGgJgBB1A0LQRwMQ==
 
 "@parcel/watcher-android-arm64@2.5.6":
   version "2.5.6"
@@ -3532,13 +3537,13 @@
   dependencies:
     "@babel/runtime" "^7.24.4"
 
-"@rc-component/cascader@~1.17.0":
-  version "1.17.0"
-  resolved "https://registry.yarnpkg.com/@rc-component/cascader/-/cascader-1.17.0.tgz#52c0eceada2c7b4b37ebe822c19a6544b9562edf"
-  integrity sha512-3cVNG0zrQF1PoXq262L3wGCU+/YLEC1mGSVHDl577dQmA0ZKkXFbY6nwyXo+beCcM7buo49t24jkr+QZdL7O8w==
+"@rc-component/cascader@~1.22.0":
+  version "1.22.0"
+  resolved "https://registry.yarnpkg.com/@rc-component/cascader/-/cascader-1.22.0.tgz#eec0b6f4d2df5903aa12cfed321a578705926937"
+  integrity sha512-SffrA57aS9oub3VuI7ajPhJTPtaNxngSvtRhD40Rd8dwJ5vfWPSrVanWgeepdWFGBt7EHftIK5RUU0u3rCTwWw==
   dependencies:
-    "@rc-component/select" "~1.8.0"
-    "@rc-component/tree" "~1.3.2"
+    "@rc-component/select" "~1.10.0"
+    "@rc-component/tree" "~1.4.0"
     "@rc-component/util" "^1.11.1"
     clsx "^2.1.1"
 
@@ -3614,14 +3619,14 @@
     "@rc-component/util" "^1.11.1"
     clsx "^2.1.1"
 
-"@rc-component/image@~1.9.0":
-  version "1.9.0"
-  resolved "https://registry.yarnpkg.com/@rc-component/image/-/image-1.9.0.tgz#110785d735d20336afcdbac84e8fbfd059a7a44e"
-  integrity sha512-khF7w7xkBH5B1bsBcI1FSUZdkyd1aqpl2eYyILCqCzzQH3XdfehGUaZTnptyaJJfs09/R5hv9jXWyazOMFIClQ==
+"@rc-component/image@~1.10.0":
+  version "1.10.0"
+  resolved "https://registry.yarnpkg.com/@rc-component/image/-/image-1.10.0.tgz#5d7a82d20e4c91f75875ea64eb1dadd7af676b1d"
+  integrity sha512-BjeZCRQ+hw+4WAhvrw8rJvy5fckA2xpf/X2XQEOABUHvLTNB9inB98X3Mp54jYQ7g10DfWERQWHXeC4ylxp1Uw==
   dependencies:
     "@rc-component/motion" "^1.0.0"
     "@rc-component/portal" "^2.1.2"
-    "@rc-component/util" "^1.10.1"
+    "@rc-component/util" "^1.11.1"
     clsx "^2.1.1"
 
 "@rc-component/input-number@~1.6.2":
@@ -3633,7 +3638,7 @@
     "@rc-component/util" "^1.4.0"
     clsx "^2.1.1"
 
-"@rc-component/input@~1.3.0", "@rc-component/input@~1.3.1":
+"@rc-component/input@~1.3.1":
   version "1.3.1"
   resolved "https://registry.yarnpkg.com/@rc-component/input/-/input-1.3.1.tgz#230b8b59cdde8521d50f0eede63ddacb61cc0cd3"
   integrity sha512-iFvTUT9W+JC/MSin2aGAk8NqsVlTzcExNC9DZariON1IWirju9NoNeEk47an4Q8iHazkoVI/y1LnDi88+CPcig==
@@ -3642,15 +3647,27 @@
     "@rc-component/util" "^1.11.1"
     clsx "^2.1.1"
 
-"@rc-component/mentions@~1.10.0":
-  version "1.10.0"
-  resolved "https://registry.yarnpkg.com/@rc-component/mentions/-/mentions-1.10.0.tgz#46b1117cfb0c716b476e97f342555eccc2f41c97"
-  integrity sha512-CI1njYUVY0NjHtLhNoVmXlJyy568Sfep9Wsak6vmGjtT6uazx98djGYlCXz2xkHhEm73g91Y3MTvzUyE5avI7w==
+"@rc-component/listy@~1.2.3":
+  version "1.2.3"
+  resolved "https://registry.yarnpkg.com/@rc-component/listy/-/listy-1.2.3.tgz#e9c8ef4f409c231b44dded37e63ae2875bbe0334"
+  integrity sha512-IXiMjV5s0rczLBlfh7G5nB4M3365mrEeedjwKtf5I+Ns3PqRUsebR2h5u8CeFarsVfLUPC2I5p0h09TNoOWyvQ==
   dependencies:
-    "@rc-component/input" "~1.3.0"
+    "@rc-component/motion" "^1.1.4"
+    "@rc-component/portal" "^2.0.0"
+    "@rc-component/resize-observer" "^1.0.0"
+    "@rc-component/util" "^1.3.1"
+    "@rc-component/virtual-list" "^1.4.0"
+    clsx "^2.1.1"
+
+"@rc-component/mentions@~1.11.0":
+  version "1.11.0"
+  resolved "https://registry.yarnpkg.com/@rc-component/mentions/-/mentions-1.11.0.tgz#cee0c4710f26766ad8550d386cfec5ff86fd58d9"
+  integrity sha512-IC2qXuEBMFHxPIXEFfYWj6Sr7UiDZnOqJHCYQBbwPzopBJOPZIR6mV9U4QH1bYQRlKYlYnIsajWDMgVGgWQyWQ==
+  dependencies:
+    "@rc-component/input" "~1.3.1"
     "@rc-component/menu" "~1.4.0"
     "@rc-component/trigger" "^3.0.0"
-    "@rc-component/util" "^1.3.0"
+    "@rc-component/util" "^1.11.1"
     clsx "^2.1.1"
 
 "@rc-component/menu@~1.4.0", "@rc-component/menu@~1.4.1":
@@ -3724,7 +3741,7 @@
     "@rc-component/util" "^1.11.1"
     clsx "^2.1.1"
 
-"@rc-component/portal@^2.1.0", "@rc-component/portal@^2.1.2", "@rc-component/portal@^2.1.3", "@rc-component/portal@^2.2.0", "@rc-component/portal@^2.2.1":
+"@rc-component/portal@^2.0.0", "@rc-component/portal@^2.1.0", "@rc-component/portal@^2.1.2", "@rc-component/portal@^2.1.3", "@rc-component/portal@^2.2.0", "@rc-component/portal@^2.2.1":
   version "2.2.1"
   resolved "https://registry.yarnpkg.com/@rc-component/portal/-/portal-2.2.1.tgz#37c34b4c8cd73f53cc7072c96dd0e9ac332669ec"
   integrity sha512-ck+r1kW/JSv0wxPji3KN2ss9K6Z0qqwusw/mf/0JobXhZ8hC2ejZwCJObW/SvDi0uhA0VzmCnx0CaCci95tcmA==
@@ -3772,10 +3789,10 @@
     "@rc-component/util" "^1.3.0"
     clsx "^2.1.1"
 
-"@rc-component/select@~1.8.0", "@rc-component/select@~1.8.2":
-  version "1.8.2"
-  resolved "https://registry.yarnpkg.com/@rc-component/select/-/select-1.8.2.tgz#f016992dae5c57186535512d73783e2fc7e4c59e"
-  integrity sha512-HQ9zuYqjfZTlcEMWlU1GAPBajd2OHIMVHyjZSGVTCVARwkfCgvXZMTEn0cduy3L+ejAKkaZluOQvxovZoaJaQw==
+"@rc-component/select@~1.10.0":
+  version "1.10.1"
+  resolved "https://registry.yarnpkg.com/@rc-component/select/-/select-1.10.1.tgz#323b2f458a637e8e752f8341094783741c613c34"
+  integrity sha512-H+yQsl+qED9NilQ3g6zdpsMwUgwVjrcMTkNHAWRVU/MoNCYgTbDgU+MIMgZDK+rVdd2JUfI/MkysMcZZ0cyQKw==
   dependencies:
     "@rc-component/overflow" "^1.0.0"
     "@rc-component/trigger" "^3.0.0"
@@ -3807,10 +3824,10 @@
     "@rc-component/util" "^1.3.0"
     clsx "^2.1.1"
 
-"@rc-component/table@~1.10.4":
-  version "1.10.4"
-  resolved "https://registry.yarnpkg.com/@rc-component/table/-/table-1.10.4.tgz#8c4e33bc150aa39f579c15426421348a789de326"
-  integrity sha512-HwoTnrwc29zeoXkXGhWqzJh8FIibGUxi1jM4LtoSzmR9d5Vv5osUQpZxnXKBP8iOCvyD6BQzZm1nXJRcnrxpAg==
+"@rc-component/table@~1.11.0":
+  version "1.11.1"
+  resolved "https://registry.yarnpkg.com/@rc-component/table/-/table-1.11.1.tgz#7b5c2a7c26fd37b6a403082029b5a72fcb330a4d"
+  integrity sha512-OWdS6DMmeWb7bJBGqPxYZpQbzBlBiXZUu2sqo6Ii7Sjs9GeK1IsrXrWk26SL2c6KEseabswdxrRj7WUm9LdECw==
   dependencies:
     "@rc-component/context" "^2.0.1"
     "@rc-component/resize-observer" "^1.0.0"
@@ -3818,10 +3835,10 @@
     "@rc-component/virtual-list" "^1.0.1"
     clsx "^2.1.1"
 
-"@rc-component/tabs@~1.11.0":
-  version "1.11.0"
-  resolved "https://registry.yarnpkg.com/@rc-component/tabs/-/tabs-1.11.0.tgz#c157b2fadcdc2f3ab6c69d0098f73e03c6aa0c12"
-  integrity sha512-hA/drZYOVa/MMIb4M2fWf3yaTyTG4qVuIABmghvEhyfw2nBob5VTH69lMCDjSVKmgODjO6nWlCV+gVn3xBrj5Q==
+"@rc-component/tabs@~1.12.0":
+  version "1.12.0"
+  resolved "https://registry.yarnpkg.com/@rc-component/tabs/-/tabs-1.12.0.tgz#41a1a77ed1afc4f1b8b727003a058c631aceea1b"
+  integrity sha512-XL7Kqy5fnUE2WTlO1/fCGrrfNlGFebdr7JseGkEIjzcVMAtIFQJ8sqCSOmxcXstjU6fonD/4rnhZHxj7sDTajQ==
   dependencies:
     "@rc-component/dropdown" "~1.0.0"
     "@rc-component/menu" "~1.4.0"
@@ -3830,13 +3847,13 @@
     "@rc-component/util" "^1.11.1"
     clsx "^2.1.1"
 
-"@rc-component/tooltip@~1.4.0":
-  version "1.4.0"
-  resolved "https://registry.yarnpkg.com/@rc-component/tooltip/-/tooltip-1.4.0.tgz#c8cf15c6773218a5a36271467f06e663f99c28e7"
-  integrity sha512-8Rx5DCctIlLI4raR0I0xHjVTf1aF48+gKCNeAAo5bmF5VoR5YED+A/XEqzXv9KKqrJDRcd3Wndpxh2hyzrTtSg==
+"@rc-component/tooltip@~1.5.0":
+  version "1.5.0"
+  resolved "https://registry.yarnpkg.com/@rc-component/tooltip/-/tooltip-1.5.0.tgz#422aa0760b310e0a1d0f9f7223e7f0d455de57a2"
+  integrity sha512-agQ/+mBqrEQfTX4D3KhQ7j+ZbX4/VHjoJ7Noa2wIdZ1/FbQTOd7Sn92rp+jtCoqAVTLUgSOydePIgZ204gi2EQ==
   dependencies:
-    "@rc-component/trigger" "^3.7.1"
-    "@rc-component/util" "^1.3.0"
+    "@rc-component/trigger" "^3.10.0"
+    "@rc-component/util" "^1.11.1"
     clsx "^2.1.1"
 
 "@rc-component/tour@~2.4.0":
@@ -3849,27 +3866,27 @@
     "@rc-component/util" "^1.7.0"
     clsx "^2.1.1"
 
-"@rc-component/tree-select@~1.11.0":
-  version "1.11.0"
-  resolved "https://registry.yarnpkg.com/@rc-component/tree-select/-/tree-select-1.11.0.tgz#9080cdf1d28f2ddd6d8a4879b7aa90d3170f7db9"
-  integrity sha512-EhS0X0wtUhBfK4S5TlpSY3MR9ndPMGgujtt1PJW3Ej+ToAlnS/6ohYURtCoXBYGqazUwHmgQGVUDsfpVwhWPkg==
+"@rc-component/tree-select@~1.16.0":
+  version "1.16.1"
+  resolved "https://registry.yarnpkg.com/@rc-component/tree-select/-/tree-select-1.16.1.tgz#dcaea96e396e98108cb29cc051840d4fbdda38cc"
+  integrity sha512-a1Oi6EJhqAhdOxxupdJi6fP0RPHMKn5TcfkX2+llaQ4lF4nwfH7b6SCHcnsybaa2s+pk1yZYwVyeOYkDnEBRdg==
   dependencies:
-    "@rc-component/select" "~1.8.0"
-    "@rc-component/tree" "~1.3.2"
+    "@rc-component/select" "~1.10.0"
+    "@rc-component/tree" "~1.4.0"
     "@rc-component/util" "^1.11.1"
     clsx "^2.1.1"
 
-"@rc-component/tree@~1.3.2":
-  version "1.3.2"
-  resolved "https://registry.yarnpkg.com/@rc-component/tree/-/tree-1.3.2.tgz#4b0c13564314eff61ca948c18ef923b87c9d7e44"
-  integrity sha512-bJFj46wEkpBPnWyTm18XmgAgNQ/4YvprxMOPPY2a6rmhGJYxLuNKEFiL5Qej4Qctu9wHJm8WW+v2SYskafE0kA==
+"@rc-component/tree@~1.4.0":
+  version "1.4.0"
+  resolved "https://registry.yarnpkg.com/@rc-component/tree/-/tree-1.4.0.tgz#c0031180e681389bf0bdcb867a0087525b45c8a9"
+  integrity sha512-dGsJGDJQedA0BqqVgj3F8BvHXTSZijyhTXdbAdkcx8lynzZkty/CV3Z3LOm/fxz+BCfl3dfGiAQpb7Q5XNvl0Q==
   dependencies:
     "@rc-component/motion" "^1.0.0"
     "@rc-component/util" "^1.11.1"
     "@rc-component/virtual-list" "^1.2.0"
     clsx "^2.1.1"
 
-"@rc-component/trigger@^3.0.0", "@rc-component/trigger@^3.10.1", "@rc-component/trigger@^3.6.15", "@rc-component/trigger@^3.7.1":
+"@rc-component/trigger@^3.0.0", "@rc-component/trigger@^3.10.0", "@rc-component/trigger@^3.10.1", "@rc-component/trigger@^3.6.15":
   version "3.10.1"
   resolved "https://registry.yarnpkg.com/@rc-component/trigger/-/trigger-3.10.1.tgz#cb28e1bc0745a2af6897dd7ec774f9b56dc88f86"
   integrity sha512-mXlDN0IXdtV8Yqqm8195ECCyrbmfvvfKvwVvSlH0+qvKD6BUF8gRhEjSy0FOcD1+CcDRHgTiX99LoxfQrmh3Cw==
@@ -3888,7 +3905,7 @@
     "@rc-component/util" "^1.11.1"
     clsx "^2.1.1"
 
-"@rc-component/util@^1.10.1", "@rc-component/util@^1.11.0", "@rc-component/util@^1.11.1", "@rc-component/util@^1.12.0", "@rc-component/util@^1.2.0", "@rc-component/util@^1.2.1", "@rc-component/util@^1.3.0", "@rc-component/util@^1.4.0", "@rc-component/util@^1.7.0", "@rc-component/util@^1.9.0":
+"@rc-component/util@^1.11.0", "@rc-component/util@^1.11.1", "@rc-component/util@^1.12.0", "@rc-component/util@^1.2.0", "@rc-component/util@^1.2.1", "@rc-component/util@^1.3.0", "@rc-component/util@^1.3.1", "@rc-component/util@^1.4.0", "@rc-component/util@^1.7.0", "@rc-component/util@^1.9.0":
   version "1.12.0"
   resolved "https://registry.yarnpkg.com/@rc-component/util/-/util-1.12.0.tgz#58e453585810bcb8a35ff1aafd5e01187457b86f"
   integrity sha512-AEjPL8JVdohIITaiXokyjL9WQ6tKWWjAYK9QU16tGNE9JaQABBQy+hA4H2Lup5MgXy9yY3iLrbZJheuU13hTdQ==
@@ -3906,6 +3923,16 @@
     "@rc-component/util" "^1.4.0"
     clsx "^2.1.1"
 
+"@rc-component/virtual-list@^1.4.0":
+  version "1.5.1"
+  resolved "https://registry.yarnpkg.com/@rc-component/virtual-list/-/virtual-list-1.5.1.tgz#71c5844a8d6bd5b3501dfb66419d3a4612b2bb18"
+  integrity sha512-boqHxdtyWC88u8quYgEO49bcBy5fzRiOcnBge+N4nLzs2k8hUQ/yw7JE9dM6yCBE4jSm5YSHVCVMS+suBuJGKA==
+  dependencies:
+    "@babel/runtime" "^8.0.0"
+    "@rc-component/resize-observer" "^1.0.1"
+    "@rc-component/util" "^1.4.0"
+    clsx "^2.1.1"
+
 "@redocly/ajv@^8.18.1":
   version "8.18.3"
   resolved "https://registry.yarnpkg.com/@redocly/ajv/-/ajv-8.18.3.tgz#a925753d9a33375219f1b2ba91aef320f9929577"
@@ -4095,23 +4122,23 @@
   resolved "https://registry.yarnpkg.com/@standard-schema/utils/-/utils-0.3.0.tgz#3d5e608f16c2390c10528e98e59aef6bf73cae7b"
   integrity sha512-e7Mew686owMaPJVNNLs55PUvgz371nKgwsc4vxE49zsODpJEnxgxRo2y/OKrqueavXgZNMDVj3DdHFlaSAeU8g==
 
-"@storybook/addon-docs@^10.5.6":
-  version "10.5.6"
-  resolved "https://registry.yarnpkg.com/@storybook/addon-docs/-/addon-docs-10.5.6.tgz#445d4e0992a0862a22bffcea321ee2cb034846b5"
-  integrity sha512-zyUJBrrpC9NTrmsREaVFNr+9WW6pikJtmRvo7GgZGqthEyhjQKSarHrW0aNWkwae2ep3jp1CZi8vIUVG1Dnp0w==
+"@storybook/addon-docs@^10.5.7":
+  version "10.5.7"
+  resolved "https://registry.yarnpkg.com/@storybook/addon-docs/-/addon-docs-10.5.7.tgz#6d599c94fc871c248ce06a5c081f57655c83f40a"
+  integrity sha512-KNARJfjICaizinsR3INMEiipZm1ObYo+xw+E26gteu50Bcy2dIZUtk5uHY5XdtardU3AXX6yRXoBZ2HCY3lbHA==
   dependencies:
     "@mdx-js/react" "^3.0.0"
-    "@storybook/csf-plugin" "10.5.6"
+    "@storybook/csf-plugin" "10.5.7"
     "@storybook/icons" "^2.0.2"
-    "@storybook/react-dom-shim" "10.5.6"
+    "@storybook/react-dom-shim" "10.5.7"
     react "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
     react-dom "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
     ts-dedent "^2.0.0"
 
-"@storybook/csf-plugin@10.5.6":
-  version "10.5.6"
-  resolved "https://registry.yarnpkg.com/@storybook/csf-plugin/-/csf-plugin-10.5.6.tgz#9fca28f5fd7d545a32638bb4f08902f6887072b2"
-  integrity sha512-PJLyOmcKe1OZDBw7RaGX/gjuiJuVfS5pVgc4W2RnHYOFpU6F5Bv9+9MqQwp0i7tWZBWc4fsCJudgVqwgjuTROA==
+"@storybook/csf-plugin@10.5.7":
+  version "10.5.7"
+  resolved "https://registry.yarnpkg.com/@storybook/csf-plugin/-/csf-plugin-10.5.7.tgz#bc73f164d1b5f8e2931b2774f4b389a06453cf6e"
+  integrity sha512-IaX8FlM0H36HNFhJ2+4L9bCldqfvHGqcLg841SJNyK/DhfMlM7JsvY/GDH2ZFuWrUf8FSOx96GRRnHq6XfRKag==
   dependencies:
     unplugin "^2.3.5"
 
@@ -4125,10 +4152,10 @@
   resolved "https://registry.yarnpkg.com/@storybook/icons/-/icons-2.1.0.tgz#edfc2450a39c5e780f28c6cbc49acd7bff59b41a"
   integrity sha512-Fxh9vYpX9bQqFeHRiY8h2ApeRGDzRSMLwJwNZ/AIRqnyOKHxRKL+yFe+ctEkVJmuptRE9u1Hrn8ZZNHyfDKKNg==
 
-"@storybook/react-dom-shim@10.5.6":
-  version "10.5.6"
-  resolved "https://registry.yarnpkg.com/@storybook/react-dom-shim/-/react-dom-shim-10.5.6.tgz#3685605c9dd27298fada7fef264801b2e7d62cbb"
-  integrity sha512-dV3oOHc5ImggxEqeIiUj4vvnQO5SKScFtqAkxgIWLju1wiSZSIqQ5Q4Mp12Rhs9hQrjF039DueH7f2xJJZfvSw==
+"@storybook/react-dom-shim@10.5.7":
+  version "10.5.7"
+  resolved "https://registry.yarnpkg.com/@storybook/react-dom-shim/-/react-dom-shim-10.5.7.tgz#9a5aa0e0f89c09e71c6cbfc6bb1abeb537e5aabf"
+  integrity sha512-lxOkyh+wu/MiBXvYQHjZfD+DRKOa4bHBzbuGuiHXnHXmdOcTRdcrQTsoeN2FPtfugmmOG66cZUEgDwNX+k5eRA==
 
 "@superset-ui/core@^0.20.4":
   version "0.20.4"
@@ -5658,110 +5685,100 @@
   dependencies:
     "@types/yargs-parser" "*"
 
-"@typescript-eslint/eslint-plugin@8.66.0", "@typescript-eslint/eslint-plugin@^8.66.0":
-  version "8.66.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.66.0.tgz#76e86aa5a2459fbf5bbd7a839c0dc0cce1d56224"
-  integrity sha512-p088eaGrzYz1s+7cov0aMOCkNGTJlVxF4jgubf28c8L0Cv9Rloj8YBHnv4hXLq6IIEE1AsjNWavO+k+8kP2Y0A==
+"@typescript-eslint/eslint-plugin@8.67.0", "@typescript-eslint/eslint-plugin@^8.67.0":
+  version "8.67.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.67.0.tgz#52f9f0e47d5a7571c4336e69bfeea581509ef2cf"
+  integrity sha512-Un7Heoyj65NREbKAyIrFxeM143NZpExWmy1Nep4DLeQOeLlTeumPjoNKnBrU5D5moWXbPJgRa5Uwcdu0faVNGQ==
   dependencies:
     "@eslint-community/regexpp" "^4.12.2"
-    "@typescript-eslint/scope-manager" "8.66.0"
-    "@typescript-eslint/type-utils" "8.66.0"
-    "@typescript-eslint/utils" "8.66.0"
-    "@typescript-eslint/visitor-keys" "8.66.0"
+    "@typescript-eslint/scope-manager" "8.67.0"
+    "@typescript-eslint/type-utils" "8.67.0"
+    "@typescript-eslint/utils" "8.67.0"
+    "@typescript-eslint/visitor-keys" "8.67.0"
     ignore "^7.0.5"
     natural-compare "^1.4.0"
     ts-api-utils "^2.5.0"
 
-"@typescript-eslint/parser@8.66.0", "@typescript-eslint/parser@^8.66.0":
-  version "8.66.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/parser/-/parser-8.66.0.tgz#88e3865ecf73b0118134e7cb831da87a961a57a1"
-  integrity sha512-X6ypGChaWYk6PBtUg2BwuTZEFFcHJAtGTVJ9/lCTOufhZ4i9fNolQNnktq+kkMCwMj7V8Svsq7+TxSDslmhE0g==
+"@typescript-eslint/parser@8.67.0", "@typescript-eslint/parser@^8.67.0":
+  version "8.67.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/parser/-/parser-8.67.0.tgz#0158022ec9927e0afcd58a8cc2ad57e01d892f5c"
+  integrity sha512-fUBfTuuEulWqX6V8+O3PtScV01tzYYRUDTAirHFKoRAt7nOzoGiPt0M/bB47wWNy0coOOcgEwAMUtBpykMxl6w==
   dependencies:
-    "@typescript-eslint/scope-manager" "8.66.0"
-    "@typescript-eslint/types" "8.66.0"
-    "@typescript-eslint/typescript-estree" "8.66.0"
-    "@typescript-eslint/visitor-keys" "8.66.0"
+    "@typescript-eslint/scope-manager" "8.67.0"
+    "@typescript-eslint/types" "8.67.0"
+    "@typescript-eslint/typescript-estree" "8.67.0"
+    "@typescript-eslint/visitor-keys" "8.67.0"
     debug "^4.4.3"
 
-"@typescript-eslint/project-service@8.66.0":
-  version "8.66.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/project-service/-/project-service-8.66.0.tgz#828f788895df52d9eb2b543445a3a5a13e35ab4e"
-  integrity sha512-7MthGPTt4BP69lSryqpqq8HQqxuzynssckL/jyDyk3+TNMQ3y2jFWkptCrktWvBrP+EH787Nl5N5Qpw7WZg+5g==
+"@typescript-eslint/project-service@8.67.0":
+  version "8.67.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/project-service/-/project-service-8.67.0.tgz#1552db007ca9206a1c6c7acf49e210bd17a8c56f"
+  integrity sha512-cvE8c7ulYeXN9fYuszhCeCsbzyVEXuhrRCybnBre7TUmqb5nRmBfQAwCj0O3WJFDeyAZt4VYv51vMCC9LHSdYw==
   dependencies:
-    "@typescript-eslint/tsconfig-utils" "^8.66.0"
-    "@typescript-eslint/types" "^8.66.0"
+    "@typescript-eslint/tsconfig-utils" "^8.67.0"
+    "@typescript-eslint/types" "^8.67.0"
     debug "^4.4.3"
 
-"@typescript-eslint/scope-manager@8.66.0":
-  version "8.66.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/scope-manager/-/scope-manager-8.66.0.tgz#4fffcc6ebd0df9fe7983c0256967567ea6f5ac63"
-  integrity sha512-8TGcH25j9zqJ/IULB/ppyhRvxA8QYfFEZ7nfbg6/BN9spDgb8fPWQXlE5l8TWBL50EtUx007uZ1o9VOwrq2/9g==
+"@typescript-eslint/scope-manager@8.67.0":
+  version "8.67.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/scope-manager/-/scope-manager-8.67.0.tgz#4d4c2da09560d10dd7d947cba2d29d14d25af16d"
+  integrity sha512-EgvsleTwS4E+WzzSvem8fAUubLwatMNF1B5hHSLQxcvs7q2dtRhGyujHwLJSYlG41niJ7GP24Aha2+0mb1b2kg==
   dependencies:
-    "@typescript-eslint/types" "8.66.0"
-    "@typescript-eslint/visitor-keys" "8.66.0"
+    "@typescript-eslint/types" "8.67.0"
+    "@typescript-eslint/visitor-keys" "8.67.0"
 
-"@typescript-eslint/tsconfig-utils@8.66.0":
-  version "8.66.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.66.0.tgz#3a89066c507aa30541dc176804685b4b444e1e52"
-  integrity sha512-9D5gLYZG4rOjcoag8MQ/fWI8WqA9wcPDyOGyWtWFhvM1lHRbliqUSPIY5J3zqCU1tvSwzXxnnjhQhz5Ne7mJ4g==
-
-"@typescript-eslint/tsconfig-utils@^8.66.0":
+"@typescript-eslint/tsconfig-utils@8.67.0", "@typescript-eslint/tsconfig-utils@^8.67.0":
   version "8.67.0"
   resolved "https://registry.yarnpkg.com/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.67.0.tgz#f45a3eba6b9132fb47141ec03ce2f275f1ea991d"
   integrity sha512-vV+LUSv5njUWsknE71fqKTlXUva+R76SaeORd6Zojcunk/6DvKFXONU3BrAs2H49mbygUXt6gbYunzwqNwlhdg==
 
-"@typescript-eslint/type-utils@8.66.0":
-  version "8.66.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/type-utils/-/type-utils-8.66.0.tgz#b2315303eca72fad9afa7be4f58f053c8f2a0479"
-  integrity sha512-LG2dWfjZQQp0ADtAu/EWJVayefGL2UEZ3CDeI44D9v3rXB/WYUqE/jpO28KrEKul5AySrmI+Zh1v6v+xW2U9+g==
+"@typescript-eslint/type-utils@8.67.0":
+  version "8.67.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/type-utils/-/type-utils-8.67.0.tgz#96bed105275559df3bcf0449b73a6414d35c59ce"
+  integrity sha512-aVWDXbRmdXO9siTfX4ditQI1T9+zVcNazT48EJCD0v40/9RIFoUgZ05CmGEq9H2gixRpjUn/iplwvlcvutJW/Q==
   dependencies:
-    "@typescript-eslint/types" "8.66.0"
-    "@typescript-eslint/typescript-estree" "8.66.0"
-    "@typescript-eslint/utils" "8.66.0"
+    "@typescript-eslint/types" "8.67.0"
+    "@typescript-eslint/typescript-estree" "8.67.0"
+    "@typescript-eslint/utils" "8.67.0"
     debug "^4.4.3"
     ts-api-utils "^2.5.0"
 
-"@typescript-eslint/types@8.66.0":
-  version "8.66.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/types/-/types-8.66.0.tgz#3cacab94d3b564c1d48c56eb37b89f89a6d48479"
-  integrity sha512-H6gcYaSDOyvL3AD/jHUtUFo2jqGgn/F6nuyuZSu0QTesxL+cP4dQoIMrODRofuJC09g64+WgZ6tE19Y1N2YIFQ==
-
-"@typescript-eslint/types@^8.66.0":
+"@typescript-eslint/types@8.67.0", "@typescript-eslint/types@^8.67.0":
   version "8.67.0"
   resolved "https://registry.yarnpkg.com/@typescript-eslint/types/-/types-8.67.0.tgz#4a8d00cc1faba5c14feabc60f85b7a32652f34b6"
   integrity sha512-sBtgslww8nsMYUjhdPBiSyUqSzT8uR6g93A2QXnQC8+cGdjz0CyaOdqHDRJb1AtORbZCNUJBBeFA/tNR2uQmww==
 
-"@typescript-eslint/typescript-estree@8.66.0":
-  version "8.66.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/typescript-estree/-/typescript-estree-8.66.0.tgz#1a38c3a97dc6c669b66d585d7f90ebc4fbb32a50"
-  integrity sha512-8/x4INiiQb10jGgXYD7116/zQ+OL84ZIFn0za68wwFHCanT/VLbBEroWht8RV8fn0/ZCAoazHLQgwUC0UQcDfg==
+"@typescript-eslint/typescript-estree@8.67.0":
+  version "8.67.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/typescript-estree/-/typescript-estree-8.67.0.tgz#116c3a47c06119c5a050e8851861d6497dd64bc2"
+  integrity sha512-EKQBCE9yNlRJYm7jdTW5AhDacDUmSwQb0FAJAmK2EKYrNXIsa2vxcSZx6PvJ/dEdI6lS+Y9W+EXckLj0iPFGcw==
   dependencies:
-    "@typescript-eslint/project-service" "8.66.0"
-    "@typescript-eslint/tsconfig-utils" "8.66.0"
-    "@typescript-eslint/types" "8.66.0"
-    "@typescript-eslint/visitor-keys" "8.66.0"
+    "@typescript-eslint/project-service" "8.67.0"
+    "@typescript-eslint/tsconfig-utils" "8.67.0"
+    "@typescript-eslint/types" "8.67.0"
+    "@typescript-eslint/visitor-keys" "8.67.0"
     debug "^4.4.3"
     minimatch "^10.2.2"
     semver "^7.7.3"
     tinyglobby "^0.2.15"
     ts-api-utils "^2.5.0"
 
-"@typescript-eslint/utils@8.66.0":
-  version "8.66.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/utils/-/utils-8.66.0.tgz#e277d67427043cdca2580ee91aa62921e4689969"
-  integrity sha512-jasearZPolBw5NJNYGMwxzHMF83niVWmMU1VdHzG1CyfI2VS7f7nZltnKtHcg20hW+7Uo5GfK4MeDPoU3qI8EA==
+"@typescript-eslint/utils@8.67.0":
+  version "8.67.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/utils/-/utils-8.67.0.tgz#3e478a3d69d330a1fc50c12746cc2ee0732ccfcd"
+  integrity sha512-U9D1FdwEWBwok3hxxSdhclMb0twvt9QnjIQ0VfQ1AiX2epnpSgv2ubVDsayOFyY8K6FX+AQ7E0FKWVG3iKsj1A==
   dependencies:
     "@eslint-community/eslint-utils" "^4.9.1"
-    "@typescript-eslint/scope-manager" "8.66.0"
-    "@typescript-eslint/types" "8.66.0"
-    "@typescript-eslint/typescript-estree" "8.66.0"
+    "@typescript-eslint/scope-manager" "8.67.0"
+    "@typescript-eslint/types" "8.67.0"
+    "@typescript-eslint/typescript-estree" "8.67.0"
 
-"@typescript-eslint/visitor-keys@8.66.0":
-  version "8.66.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/visitor-keys/-/visitor-keys-8.66.0.tgz#4c494e94745fb2724a4f37a310091e56b644d18a"
-  integrity sha512-dkKR8q+lKciskj1Y3vthHktl+3cMLWGyVUP23bRiPZ5O9BRT++4EqDDV+TVeIKBL1VXVEqrJlz8MYbcnvJcAlg==
+"@typescript-eslint/visitor-keys@8.67.0":
+  version "8.67.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/visitor-keys/-/visitor-keys-8.67.0.tgz#601d40af9acf82a28da2286f3edafc69bba9017f"
+  integrity sha512-fkv8dHRDqfGtTHuJeebdrQ7cX6Ad4WAS00rgHh9UGvMycF1mjBfsxry1XsLIFhWZ6Judlh6UdzK+TYlbpCXgnA==
   dependencies:
-    "@typescript-eslint/types" "8.66.0"
+    "@typescript-eslint/types" "8.67.0"
     eslint-visitor-keys "^5.0.0"
 
 "@ungap/structured-clone@^1.0.0":
@@ -6164,10 +6181,10 @@ ansis@^3.2.0:
   resolved "https://registry.yarnpkg.com/ansis/-/ansis-3.17.0.tgz#fa8d9c2a93fe7d1177e0c17f9eeb562a58a832d7"
   integrity sha512-0qWUglt9JEqLFr3w1I1pbrChn1grhaiAR2ocX1PP/flRmxgtwTzPFFFnfIlD6aMOLQZgSuCRlidD70lvx8yhzg==
 
-antd@^6.5.3:
-  version "6.5.3"
-  resolved "https://registry.yarnpkg.com/antd/-/antd-6.5.3.tgz#3c7d2ec4a20be116f72b7fbbdb4497d65ffd6dae"
-  integrity sha512-Q5r8sztf9Yk9B70bSUjnPYMCJ4A/eZM7uMoTj8UAhlSKR9aftjEuBEPcNSmRux7hB+87rxO8vN1X4HNjR97qyQ==
+antd@^6.6.0:
+  version "6.6.0"
+  resolved "https://registry.yarnpkg.com/antd/-/antd-6.6.0.tgz#8acb84c54b36594b5c1a9084c8acb6a03b79961b"
+  integrity sha512-UDwWIbpmrCHB9ZQ+bPh4vQfB6DTI2ulIyoQ0Tc9xxalFblttiNGHl3ySBD9SyV/8+gUjFzfSx1+iU1Fog2i46w==
   dependencies:
     "@ant-design/colors" "^8.0.1"
     "@ant-design/cssinjs" "^2.1.2"
@@ -6176,7 +6193,7 @@ antd@^6.5.3:
     "@ant-design/icons" "^6.3.2"
     "@ant-design/react-slick" "~2.0.0"
     "@babel/runtime" "^7.29.2"
-    "@rc-component/cascader" "~1.17.0"
+    "@rc-component/cascader" "~1.22.0"
     "@rc-component/checkbox" "~2.0.0"
     "@rc-component/collapse" "~1.2.0"
     "@rc-component/color-picker" "~3.1.1"
@@ -6184,10 +6201,11 @@ antd@^6.5.3:
     "@rc-component/drawer" "~1.4.2"
     "@rc-component/dropdown" "~1.0.3"
     "@rc-component/form" "~1.8.6"
-    "@rc-component/image" "~1.9.0"
+    "@rc-component/image" "~1.10.0"
     "@rc-component/input" "~1.3.1"
     "@rc-component/input-number" "~1.6.2"
-    "@rc-component/mentions" "~1.10.0"
+    "@rc-component/listy" "~1.2.3"
+    "@rc-component/mentions" "~1.11.0"
     "@rc-component/menu" "~1.4.1"
     "@rc-component/motion" "^1.3.3"
     "@rc-component/mutate-observer" "^2.0.1"
@@ -6199,16 +6217,16 @@ antd@^6.5.3:
     "@rc-component/rate" "~1.0.1"
     "@rc-component/resize-observer" "^1.1.2"
     "@rc-component/segmented" "~1.3.0"
-    "@rc-component/select" "~1.8.2"
+    "@rc-component/select" "~1.10.0"
     "@rc-component/slider" "~1.1.1"
     "@rc-component/steps" "~1.2.2"
     "@rc-component/switch" "~1.0.3"
-    "@rc-component/table" "~1.10.4"
-    "@rc-component/tabs" "~1.11.0"
-    "@rc-component/tooltip" "~1.4.0"
+    "@rc-component/table" "~1.11.0"
+    "@rc-component/tabs" "~1.12.0"
+    "@rc-component/tooltip" "~1.5.0"
     "@rc-component/tour" "~2.4.0"
-    "@rc-component/tree" "~1.3.2"
-    "@rc-component/tree-select" "~1.11.0"
+    "@rc-component/tree" "~1.4.0"
+    "@rc-component/tree-select" "~1.16.0"
     "@rc-component/trigger" "^3.10.1"
     "@rc-component/upload" "~1.1.1"
     "@rc-component/util" "^1.12.0"
@@ -6504,10 +6522,10 @@ base64-js@^1.3.1, base64-js@^1.5.1:
   resolved "https://registry.yarnpkg.com/base64-js/-/base64-js-1.5.1.tgz#1b1b440160a5bf7ad40b650f095963481903930a"
   integrity sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==
 
-baseline-browser-mapping@^2.10.38, baseline-browser-mapping@^2.11.12, baseline-browser-mapping@^2.9.19:
-  version "2.11.12"
-  resolved "https://registry.yarnpkg.com/baseline-browser-mapping/-/baseline-browser-mapping-2.11.12.tgz#42ac48770bf73d292f60ce8ba4dc5e7ebb242ec3"
-  integrity sha512-r7WnVImvVCeFpf2DOXfy41aPWzeNg3H/A2X4dKmy1QL0MSyyk/e7z8ihJ3N6Nn2PsdhkVlqnEfnUE4a05P2aTA==
+baseline-browser-mapping@^2.10.38, baseline-browser-mapping@^2.11.13, baseline-browser-mapping@^2.9.19:
+  version "2.11.13"
+  resolved "https://registry.yarnpkg.com/baseline-browser-mapping/-/baseline-browser-mapping-2.11.13.tgz#660073103c1bee93e54df55f117b7528adf6af19"
+  integrity sha512-k9HNuUVMlqVjQ9UHzfPjIqiDbWw7WqT1AoT7GL8VwvF3r0ZfArtgiSPAlmupyNquNgOJHTuH4CKYf8ttMTWBTQ==
 
 batch@0.6.1:
   version "0.6.1"
@@ -6745,10 +6763,10 @@ caniuse-api@^3.0.0:
     lodash.memoize "^4.1.2"
     lodash.uniq "^4.5.0"
 
-caniuse-lite@^1.0.0, caniuse-lite@^1.0.30001799, caniuse-lite@^1.0.30001806:
-  version "1.0.30001806"
-  resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001806.tgz#1bc8e502b723fa393455dfbedd5ccec0c29bb74e"
-  integrity sha512-72Cuvd95zbSYPKq6Fhg8eDJRlzgWDf7/mtoZv6Qe/DYNCEBdNxoA3+rZAU2ZhGCpZlns3EssFavaZomckT5Uuw==
+caniuse-lite@^1.0.0, caniuse-lite@^1.0.30001799, caniuse-lite@^1.0.30001809:
+  version "1.0.30001809"
+  resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001809.tgz#e6cf71f14ddfe008f114dd2a846923be3c03a07b"
+  integrity sha512-xxWVywk6a6Arlk+hymeycyn/VgqEfLDxupvhH/xiY5SJ/18kmi9o6MiO320DCUzypORHLtvh0I4i04tUhCNHNQ==
 
 ccount@^2.0.0:
   version "2.0.1"
@@ -12244,32 +12262,32 @@ oxc-resolver@^11.19.1:
     "@oxc-resolver/binding-win32-arm64-msvc" "11.23.0"
     "@oxc-resolver/binding-win32-x64-msvc" "11.23.0"
 
-oxfmt@^0.62.0:
-  version "0.62.0"
-  resolved "https://registry.yarnpkg.com/oxfmt/-/oxfmt-0.62.0.tgz#9945728022d26dc0a1d5bc486db112e7e340507a"
-  integrity sha512-vxgGHTmnDU9j4CX7dDBLzxgmHxfda/yPcgJkGCMUSCwRmz+euo/V08xXLNgXTeqAB9Fhf3Pe2nO1RNKLCVgphQ==
+oxfmt@^0.63.0:
+  version "0.63.0"
+  resolved "https://registry.yarnpkg.com/oxfmt/-/oxfmt-0.63.0.tgz#c7338e6c43a68d5cf8dc61c08b617d77cb54e323"
+  integrity sha512-kgdDwv35wvVf6554U2Ab8Jnd0zTM+TsEQWwaB70RAjK3gICFAFGO+2Hd3Be27GMoXj3XRL9IKSNRVl7KBQL6iw==
   dependencies:
     tinypool "2.1.0"
   optionalDependencies:
-    "@oxfmt/binding-android-arm-eabi" "0.62.0"
-    "@oxfmt/binding-android-arm64" "0.62.0"
-    "@oxfmt/binding-darwin-arm64" "0.62.0"
-    "@oxfmt/binding-darwin-x64" "0.62.0"
-    "@oxfmt/binding-freebsd-x64" "0.62.0"
-    "@oxfmt/binding-linux-arm-gnueabihf" "0.62.0"
-    "@oxfmt/binding-linux-arm-musleabihf" "0.62.0"
-    "@oxfmt/binding-linux-arm64-gnu" "0.62.0"
-    "@oxfmt/binding-linux-arm64-musl" "0.62.0"
-    "@oxfmt/binding-linux-ppc64-gnu" "0.62.0"
-    "@oxfmt/binding-linux-riscv64-gnu" "0.62.0"
-    "@oxfmt/binding-linux-riscv64-musl" "0.62.0"
-    "@oxfmt/binding-linux-s390x-gnu" "0.62.0"
-    "@oxfmt/binding-linux-x64-gnu" "0.62.0"
-    "@oxfmt/binding-linux-x64-musl" "0.62.0"
-    "@oxfmt/binding-openharmony-arm64" "0.62.0"
-    "@oxfmt/binding-win32-arm64-msvc" "0.62.0"
-    "@oxfmt/binding-win32-ia32-msvc" "0.62.0"
-    "@oxfmt/binding-win32-x64-msvc" "0.62.0"
+    "@oxfmt/binding-android-arm-eabi" "0.63.0"
+    "@oxfmt/binding-android-arm64" "0.63.0"
+    "@oxfmt/binding-darwin-arm64" "0.63.0"
+    "@oxfmt/binding-darwin-x64" "0.63.0"
+    "@oxfmt/binding-freebsd-x64" "0.63.0"
+    "@oxfmt/binding-linux-arm-gnueabihf" "0.63.0"
+    "@oxfmt/binding-linux-arm-musleabihf" "0.63.0"
+    "@oxfmt/binding-linux-arm64-gnu" "0.63.0"
+    "@oxfmt/binding-linux-arm64-musl" "0.63.0"
+    "@oxfmt/binding-linux-ppc64-gnu" "0.63.0"
+    "@oxfmt/binding-linux-riscv64-gnu" "0.63.0"
+    "@oxfmt/binding-linux-riscv64-musl" "0.63.0"
+    "@oxfmt/binding-linux-s390x-gnu" "0.63.0"
+    "@oxfmt/binding-linux-x64-gnu" "0.63.0"
+    "@oxfmt/binding-linux-x64-musl" "0.63.0"
+    "@oxfmt/binding-openharmony-arm64" "0.63.0"
+    "@oxfmt/binding-win32-arm64-msvc" "0.63.0"
+    "@oxfmt/binding-win32-ia32-msvc" "0.63.0"
+    "@oxfmt/binding-win32-x64-msvc" "0.63.0"
 
 p-cancelable@^3.0.0:
   version "3.0.0"
@@ -14765,10 +14783,10 @@ stop-iteration-iterator@^1.1.0:
     es-errors "^1.3.0"
     internal-slot "^1.1.0"
 
-storybook@^10.5.6:
-  version "10.5.6"
-  resolved "https://registry.yarnpkg.com/storybook/-/storybook-10.5.6.tgz#c91f22f617f3718dd06c58c87b46ff66f4ce7bf5"
-  integrity sha512-VhYwqxPySa24CVXKoWD6gCZXx9//DTmo43YpusGuAoHDYj5Osjt8wuBRQVeGoaLUWnHiPWv8S+GYHrJEaBM6Rg==
+storybook@^10.5.7:
+  version "10.5.7"
+  resolved "https://registry.yarnpkg.com/storybook/-/storybook-10.5.7.tgz#adfc465e51f337291c095278c23f1b8024ef2da7"
+  integrity sha512-oiKvWIwIoOhFP1i6dASYyMXwPHKEtVZMshqSB7EvIVYjWRh0l9H7gHEt1z4Gh2rLGFMekWdsm4s94rvwpR7gkg==
   dependencies:
     "@storybook/global" "^5.0.0"
     "@storybook/icons" "^2.0.2"
@@ -15467,15 +15485,15 @@ types-ramda@^0.30.1:
   dependencies:
     ts-toolbelt "^9.6.0"
 
-typescript-eslint@^8.66.0:
-  version "8.66.0"
-  resolved "https://registry.yarnpkg.com/typescript-eslint/-/typescript-eslint-8.66.0.tgz#0809b6d25c8a0924690ba30dc1f05607093c11fb"
-  integrity sha512-QlEbBPz/RuJ1XUHj29nm3t0F/O/cSlEnntozqPOYHnnTGAXFamnMBu5i9Vn6vhUPHGAjR+Vl+5J8vPN/BMUrJw==
+typescript-eslint@^8.67.0:
+  version "8.67.0"
+  resolved "https://registry.yarnpkg.com/typescript-eslint/-/typescript-eslint-8.67.0.tgz#1e92de09ee0ff2d96cc0848f5e9f345ea930d963"
+  integrity sha512-S2udFs8tCKEKffuJ4TB1idGUZiXdCPGi3IPBGWXarbLQ5UPXORV8QEVzJ4gCRduURMb5EkpNCdjbk0eDIuI8Yg==
   dependencies:
-    "@typescript-eslint/eslint-plugin" "8.66.0"
-    "@typescript-eslint/parser" "8.66.0"
-    "@typescript-eslint/typescript-estree" "8.66.0"
-    "@typescript-eslint/utils" "8.66.0"
+    "@typescript-eslint/eslint-plugin" "8.67.0"
+    "@typescript-eslint/parser" "8.67.0"
+    "@typescript-eslint/typescript-estree" "8.67.0"
+    "@typescript-eslint/utils" "8.67.0"
 
 typescript@~6.0.3:
   version "6.0.3"

pyproject.toml

@@ -42,7 +42,7 @@ dependencies = [
     # ``google-auth`` 2.53+ dropped it, so Superset must declare it
     # explicitly to keep fresh ``pip install apache-superset`` working
     # without the ``base.txt`` lock file (#40962).
-    "cachetools>=7.1.6, <8",
+    "cachetools>=7.1.7, <8",
     "celery>=5.6.3, <6.0.0",
     "click>=8.4.2",
     "click-option-group",
@@ -75,7 +75,7 @@ dependencies = [
     "humanize",
     "isodate",
     "jsonpath-ng>=1.8.0, <2",
-    "Mako>=1.2.2",
+    "Mako>=1.4.1",
     "markdown>=3.10.3",
     # marshmallow 4 compatibility: see superset/marshmallow_compatibility.py for a
     # Flask-AppBuilder workaround. Tracking issue:
@@ -135,10 +135,10 @@ athena = ["pyathena[pandas]>=3.35.4, <4"]
 # superset/db_engine_specs/aurora.py's known_incompatibilities metadata.
 aurora-data-api = ["preset-sqlalchemy-aurora-data-api>=0.2.8,<0.3"]
 bigquery = [
-    "pandas-gbq>=0.35.0",
+    "pandas-gbq>=0.35.1",
     # 1.17.1 is likely the final release: googleapis/python-bigquery-sqlalchemy
     # was archived 2026-05-16. Both 1.17.0 and 1.17.1 support SQLAlchemy 1.4/2.0.
-    "sqlalchemy-bigquery>=1.17.1",
+    "sqlalchemy-bigquery>=1.17.2",
     "google-cloud-bigquery>=3.42.3",
 ]
 clickhouse = ["clickhouse-connect>=1.6.0, <2.0"]
@@ -185,7 +185,7 @@ excel = ["xlrd>=2.0.2, <2.1"]
 # installing this extra is only required to actually run exports.
 excel-export = ["boto3"]
 fastmcp = [
-    "fastmcp>=3.4.5,<4.0",
+    "fastmcp>=3.4.6,<4.0",
     # tiktoken backs the response-size-guard token estimator. Without
     # it, the middleware falls back to a coarser character-based
     # heuristic that under-counts JSON-heavy MCP responses.
@@ -221,7 +221,7 @@ ocient = [
     # unpinned sqlalchemy>=1.4 declared, but SQLAlchemy 2.0 support is
     # unverified. Lower confidence than the other bumps in this PR.
     "sqlalchemy-ocient>=3.0.0, <4",
-    "pyocient>=1.0.15, <4",
+    "pyocient>=3.9.0, <4",
     "shapely",
     "geojson",
 ]

requirements/base.in

@@ -28,7 +28,7 @@ numexpr>=2.9.0
 # Security: CVE-2026-34073 (MEDIUM) - Improper Certificate Validation
 cryptography>=50.0.0,<51.0.0
 # Security: Snyk - XSS vulnerability in Mako templates
-mako>=1.3.11,<2.0.0
+mako>=1.4.1,<2.0.0
 # Security: CVE-2024-52338 (CRITICAL) - Deserialization of untrusted data in IPC/Parquet readers
 pyarrow>=24.0.0,<26.0.0
 # Security: CVE-2026-27459 - pyopenssl certificate validation

requirements/base.txt

@@ -44,7 +44,7 @@ cachelib==0.13.0
     # via
     #   flask-caching
     #   flask-session
-cachetools==7.1.6
+cachetools==7.1.7
     # via apache-superset (pyproject.toml)
 cattrs==25.1.1
     # via requests-cache
@@ -207,7 +207,7 @@ kombu==5.6.2
     # via celery
 limits==5.1.0
     # via flask-limiter
-mako==1.3.12
+mako==1.4.1
     # via
     #   -r requirements/base.in
     #   apache-superset (pyproject.toml)

requirements/development.txt

@@ -99,7 +99,7 @@ cachelib==0.13.0
     #   -c requirements/base-constraint.txt
     #   flask-caching
     #   flask-session
-cachetools==7.1.6
+cachetools==7.1.7
     # via
     #   -c requirements/base-constraint.txt
     #   apache-superset
@@ -239,9 +239,9 @@ et-xmlfile==2.0.0
     #   openpyxl
 exceptiongroup==1.3.0
     # via fastmcp-slim
-fastmcp==3.4.5
+fastmcp==3.4.7
     # via apache-superset
-fastmcp-slim==3.4.5
+fastmcp-slim==3.4.7
     # via fastmcp
 filelock==3.20.3
     # via
@@ -510,7 +510,7 @@ limits==5.1.0
     #   flask-limiter
 lz4==4.4.5
     # via trino
-mako==1.3.12
+mako==1.4.1
     # via
     #   -c requirements/base-constraint.txt
     #   alembic
@@ -640,7 +640,7 @@ pandas==2.3.3
     #   db-dtypes
     #   pandas-gbq
     #   prophet
-pandas-gbq==0.35.0
+pandas-gbq==0.35.1
     # via apache-superset
 parameterized==0.9.0
     # via apache-superset
@@ -964,7 +964,7 @@ sqlalchemy==2.0.51
     #   sqlalchemy-bigquery
     #   sqlalchemy-continuum
     #   sqlalchemy-utils
-sqlalchemy-bigquery==1.17.1
+sqlalchemy-bigquery==1.17.2
     # via apache-superset
 sqlalchemy-continuum==1.7.0
     # via

scripts/docker-build-extra-flags.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# Computes the `--extra-flags` value passed to `supersetbot docker` for a
+# given build preset. Factored out of .github/workflows/docker.yml so the
+# PY_VER override logic below can be exercised by an always-on CI check
+# (docker.yml's docker-build job only runs when the change detector's
+# docker/python/frontend outputs are true, and the PR build matrix never
+# includes py311/py312 at all, so a regression here would otherwise go
+# unnoticed until the fix actually runs on master) without duplicating -
+# and risking drift from - the logic used by the real build step.
+#
+# supersetbot's "py311"/"py312" presets pin their own --build-arg PY_VER,
+# which lands ahead of --extra-flags on the assembled buildx command line;
+# docker/buildx keeps the last value for a repeated --build-arg key, so
+# appending PY_VER here would override supersetbot's pin and silently make
+# "py311"/"py312" build the exact same image as "lean". Every other preset
+# gets the override so its build lands on the Dockerfile's own supported
+# Python version.
+#
+# Usage: docker-build-extra-flags.sh <build_preset> <image_tag>
+
+set -euo pipefail
+
+BUILD_PRESET="${1:?usage: docker-build-extra-flags.sh <build_preset> <image_tag>}"
+IMAGE_TAG="${2:?usage: docker-build-extra-flags.sh <build_preset> <image_tag>}"
+
+EXTRA_FLAGS="--build-arg INCLUDE_CHROMIUM=false --tag $IMAGE_TAG"
+if [ "$BUILD_PRESET" != "py311" ] && [ "$BUILD_PRESET" != "py312" ]; then
+  EXTRA_FLAGS="--build-arg PY_VER=3.11.14-slim-trixie $EXTRA_FLAGS"
+fi
+
+echo "$EXTRA_FLAGS"

superset-core/src/superset_core/semantic_layers/types.py

@@ -18,8 +18,9 @@
 from __future__ import annotations
 
 import enum
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from datetime import date, datetime, time, timedelta
+from typing import Any
 
 import isodate
 import pyarrow as pa
@@ -90,6 +91,8 @@ class Dimension:
     definition: str | None = None
     description: str | None = None
     grain: Grain | None = None
+    verbose_name: str | None = field(default=None, compare=False)
+    metadata: dict[str, Any] = field(default_factory=dict, compare=False)
 
 
 class AggregationType(str, enum.Enum):
@@ -121,6 +124,9 @@ class Metric:
     definition: str
     description: str | None = None
     aggregation: AggregationType | None = None
+    verbose_name: str | None = field(default=None, compare=False)
+    d3format: str | None = field(default=None, compare=False)
+    metadata: dict[str, Any] = field(default_factory=dict, compare=False)
 
 
 @dataclass(frozen=True)

superset-core/tests/semantic_layers/test_types.py

@@ -0,0 +1,97 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+import pyarrow as pa
+from superset_core.semantic_layers.types import Dimension, Metric
+
+
+def test_dimension_metadata_is_not_part_of_identity() -> None:
+    first = Dimension(
+        "sales.region",
+        "region",
+        pa.utf8(),
+        verbose_name="Region",
+        metadata={"display_name": "Region"},
+    )
+    second = Dimension(
+        "sales.region",
+        "region",
+        pa.utf8(),
+        verbose_name="Sales region",
+        metadata={"display_name": "Sales region"},
+    )
+
+    assert first == second
+    assert {first, second} == {first}
+
+
+def test_metric_metadata_is_not_part_of_identity() -> None:
+    first = Metric(
+        "sales.total_revenue",
+        "total_revenue",
+        pa.float64(),
+        "SUM(revenue)",
+        verbose_name="Total revenue",
+        d3format="$,.2f",
+        metadata={"unit": {"kind": "currency", "code": "USD"}},
+    )
+    second = Metric(
+        "sales.total_revenue",
+        "total_revenue",
+        pa.float64(),
+        "SUM(revenue)",
+        verbose_name="Revenue",
+        d3format=",.0f",
+        metadata={"unit": {"kind": "currency", "code": "EUR"}},
+    )
+
+    assert first == second
+    assert {first, second} == {first}
+
+
+def test_metric_accepts_superset_presentation_fields() -> None:
+    metric = Metric(
+        "sales.total_revenue",
+        "total_revenue",
+        pa.float64(),
+        "SUM(revenue)",
+        verbose_name="Total revenue",
+        d3format="$,.2f",
+    )
+
+    assert metric.verbose_name == "Total revenue"
+    assert metric.d3format == "$,.2f"
+
+
+def test_dimension_accepts_superset_presentation_fields() -> None:
+    dimension = Dimension(
+        "sales.region",
+        "region",
+        pa.utf8(),
+        verbose_name="Region",
+    )
+
+    assert dimension.verbose_name == "Region"
+
+
+def test_metadata_defaults_are_not_shared() -> None:
+    first = Metric("first", "first", pa.int64(), "COUNT(*)")
+    second = Metric("second", "second", pa.int64(), "COUNT(*)")
+
+    first.metadata["display_name"] = "First"
+
+    assert second.metadata == {}

superset-embedded-sdk/package-lock.json

@@ -19,6 +19,7 @@
         "@babel/preset-typescript": "7.29.7",
         "@types/node": "^25.4.0",
         "babel-loader": "^9.1.3",
+        "jsdom": "^26.1.0",
         "tscw-config": "^1.1.2",
         "typescript": "^5.9.3",
         "vitest": "^4.0.18",
@@ -26,6 +27,27 @@
         "webpack-cli": "^5.1.4"
       }
     },
+    "node_modules/@asamuzakjp/css-color": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/@asamuzakjp/css-color/-/css-color-3.2.0.tgz",
+      "integrity": "sha512-K1A6z8tS3XsmCMM86xoWdn7Fkdn9m6RSVtocUrJYIwZnFVkng/PvkEoWtOWmP+Scc6saYWHWZYbndEEXxl24jw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@csstools/css-calc": "^2.1.3",
+        "@csstools/css-color-parser": "^3.0.9",
+        "@csstools/css-parser-algorithms": "^3.0.4",
+        "@csstools/css-tokenizer": "^3.0.3",
+        "lru-cache": "^10.4.3"
+      }
+    },
+    "node_modules/@asamuzakjp/css-color/node_modules/lru-cache": {
+      "version": "10.4.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
+      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
+      "dev": true,
+      "license": "ISC"
+    },
     "node_modules/@babel/cli": {
       "version": "7.29.7",
       "resolved": "https://registry.npmjs.org/@babel/cli/-/cli-7.29.7.tgz",
@@ -1656,6 +1678,121 @@
         "node": ">=6.9.0"
       }
     },
+    "node_modules/@csstools/color-helpers": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-5.1.0.tgz",
+      "integrity": "sha512-S11EXWJyy0Mz5SYvRmY8nJYTFFd1LCNV+7cXyAgQtOOuzb4EsgfqDufL+9esx72/eLhsRdGZwaldu/h+E4t4BA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT-0",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@csstools/css-calc": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/@csstools/css-calc/-/css-calc-2.1.4.tgz",
+      "integrity": "sha512-3N8oaj+0juUw/1H3YwmDDJXCgTB1gKU6Hc/bB502u9zR0q2vd786XJH9QfrKIEgFlZmhZiq6epXl4rHqhzsIgQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@csstools/css-parser-algorithms": "^3.0.5",
+        "@csstools/css-tokenizer": "^3.0.4"
+      }
+    },
+    "node_modules/@csstools/css-color-parser": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-3.1.0.tgz",
+      "integrity": "sha512-nbtKwh3a6xNVIp/VRuXV64yTKnb1IjTAEEh3irzS+HkKjAOYLTGNb9pmVNntZ8iVBHcWDA2Dof0QtPgFI1BaTA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@csstools/color-helpers": "^5.1.0",
+        "@csstools/css-calc": "^2.1.4"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@csstools/css-parser-algorithms": "^3.0.5",
+        "@csstools/css-tokenizer": "^3.0.4"
+      }
+    },
+    "node_modules/@csstools/css-parser-algorithms": {
+      "version": "3.0.5",
+      "resolved": "https://registry.npmjs.org/@csstools/css-parser-algorithms/-/css-parser-algorithms-3.0.5.tgz",
+      "integrity": "sha512-DaDeUkXZKjdGhgYaHNJTV9pV7Y9B3b644jCLs9Upc3VeNGg6LWARAT6O+Q+/COo+2gg/bM5rhpMAtf70WqfBdQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@csstools/css-tokenizer": "^3.0.4"
+      }
+    },
+    "node_modules/@csstools/css-tokenizer": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@csstools/css-tokenizer/-/css-tokenizer-3.0.4.tgz",
+      "integrity": "sha512-Vd/9EVDiu6PPJt9yAh6roZP6El1xHrdvIVGjyBsHR0RYwNHgL7FJPyIIW4fANJNG6FtyZfvlRPpFI4ZM/lubvw==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@discoveryjs/json-ext": {
       "version": "0.5.6",
       "resolved": "https://registry.npmjs.org/@discoveryjs/json-ext/-/json-ext-0.5.6.tgz",
@@ -2501,6 +2638,16 @@
         "acorn": "^8.14.0"
       }
     },
+    "node_modules/agent-base": {
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
+      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14"
+      }
+    },
     "node_modules/ajv": {
       "version": "8.20.0",
       "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
@@ -2868,6 +3015,34 @@
         "node": ">= 8"
       }
     },
+    "node_modules/cssstyle": {
+      "version": "4.6.0",
+      "resolved": "https://registry.npmjs.org/cssstyle/-/cssstyle-4.6.0.tgz",
+      "integrity": "sha512-2z+rWdzbbSZv6/rhtvzvqeZQHrBaqgogqt85sqFNbabZOuFbCVFb8kPeEtZjiKkbrm395irpNKiYeFeLiQnFPg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@asamuzakjp/css-color": "^3.2.0",
+        "rrweb-cssom": "^0.8.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/data-urls": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/data-urls/-/data-urls-5.0.0.tgz",
+      "integrity": "sha512-ZYP5VBHshaDAiVZxjbRVcFJpc+4xGgT0bK3vzy1HLN8jTO975HEbuYzZJcHoQEY5K1a0z8YayJkyVETa08eNTg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "whatwg-mimetype": "^4.0.0",
+        "whatwg-url": "^14.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/debug": {
       "version": "4.4.3",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
@@ -2886,6 +3061,13 @@
         }
       }
     },
+    "node_modules/decimal.js": {
+      "version": "10.6.0",
+      "resolved": "https://registry.npmjs.org/decimal.js/-/decimal.js-10.6.0.tgz",
+      "integrity": "sha512-YpgQiITW3JXGntzdUmyUR1V812Hn8T1YVXhCu+wO3OpS4eU9l4YdD3qjyiKdV6mvV29zapkMeD390UVEf2lkUg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/detect-libc": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
@@ -2915,6 +3097,19 @@
         "node": ">=10.13.0"
       }
     },
+    "node_modules/entities": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-6.0.1.tgz",
+      "integrity": "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=0.12"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/entities?sponsor=1"
+      }
+    },
     "node_modules/envinfo": {
       "version": "7.13.0",
       "resolved": "https://registry.npmjs.org/envinfo/-/envinfo-7.13.0.tgz",
@@ -3316,6 +3511,60 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/html-encoding-sniffer": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/html-encoding-sniffer/-/html-encoding-sniffer-4.0.0.tgz",
+      "integrity": "sha512-Y22oTqIU4uuPgEemfz7NDJz6OeKf12Lsu+QC+s3BVpda64lTiMYCyGwg5ki4vFxkMwQdeZDl2adZoqUgdFuTgQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "whatwg-encoding": "^3.1.1"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/http-proxy-agent": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
+      "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.0",
+        "debug": "^4.3.4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/https-proxy-agent": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.2",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/iconv-lite": {
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
+      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/import-local": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/import-local/-/import-local-3.1.0.tgz",
@@ -3438,6 +3687,13 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/is-potential-custom-element-name": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/is-potential-custom-element-name/-/is-potential-custom-element-name-1.0.1.tgz",
+      "integrity": "sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/isexe": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
@@ -3498,6 +3754,46 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/jsdom": {
+      "version": "26.1.0",
+      "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-26.1.0.tgz",
+      "integrity": "sha512-Cvc9WUhxSMEo4McES3P7oK3QaXldCfNWp7pl2NNeiIFlCoLr3kfq9kb1fxftiwk1FLV7CvpvDfonxtzUDeSOPg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "cssstyle": "^4.2.1",
+        "data-urls": "^5.0.0",
+        "decimal.js": "^10.5.0",
+        "html-encoding-sniffer": "^4.0.0",
+        "http-proxy-agent": "^7.0.2",
+        "https-proxy-agent": "^7.0.6",
+        "is-potential-custom-element-name": "^1.0.1",
+        "nwsapi": "^2.2.16",
+        "parse5": "^7.2.1",
+        "rrweb-cssom": "^0.8.0",
+        "saxes": "^6.0.0",
+        "symbol-tree": "^3.2.4",
+        "tough-cookie": "^5.1.1",
+        "w3c-xmlserializer": "^5.0.0",
+        "webidl-conversions": "^7.0.0",
+        "whatwg-encoding": "^3.1.1",
+        "whatwg-mimetype": "^4.0.0",
+        "whatwg-url": "^14.1.1",
+        "ws": "^8.18.0",
+        "xml-name-validator": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "canvas": "^3.0.0"
+      },
+      "peerDependenciesMeta": {
+        "canvas": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/jsesc": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-3.1.0.tgz",
@@ -3977,6 +4273,13 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/nwsapi": {
+      "version": "2.2.24",
+      "resolved": "https://registry.npmjs.org/nwsapi/-/nwsapi-2.2.24.tgz",
+      "integrity": "sha512-7YRhZ3jS45LwmSCT4b2sVFHt/WuovaktDU07QrtOBY2PXskss5a9jfmR9jptyumwXST+rFjrmppMY1KT/yn35A==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/obug": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.1.tgz",
@@ -4033,6 +4336,19 @@
         "node": ">=6"
       }
     },
+    "node_modules/parse5": {
+      "version": "7.3.0",
+      "resolved": "https://registry.npmjs.org/parse5/-/parse5-7.3.0.tgz",
+      "integrity": "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "entities": "^6.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/inikulin/parse5?sponsor=1"
+      }
+    },
     "node_modules/path-exists": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
@@ -4142,6 +4458,16 @@
         "node": "^10 || ^12 || >=14"
       }
     },
+    "node_modules/punycode": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
+      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/readdirp": {
       "version": "3.6.0",
       "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz",
@@ -4314,6 +4640,33 @@
         "@rolldown/binding-win32-x64-msvc": "1.1.3"
       }
     },
+    "node_modules/rrweb-cssom": {
+      "version": "0.8.0",
+      "resolved": "https://registry.npmjs.org/rrweb-cssom/-/rrweb-cssom-0.8.0.tgz",
+      "integrity": "sha512-guoltQEx+9aMf2gDZ0s62EcV8lsXR+0w8915TC3ITdn2YueuNjdAYh/levpU9nFaoChh9RUS5ZdQMrKfVEN9tw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/saxes": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/saxes/-/saxes-6.0.0.tgz",
+      "integrity": "sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "xmlchars": "^2.2.0"
+      },
+      "engines": {
+        "node": ">=v12.22.7"
+      }
+    },
     "node_modules/schema-utils": {
       "version": "4.3.3",
       "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-4.3.3.tgz",
@@ -4447,6 +4800,13 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/symbol-tree": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/symbol-tree/-/symbol-tree-3.2.4.tgz",
+      "integrity": "sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/tapable": {
       "version": "2.3.0",
       "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.0.tgz",
@@ -4592,6 +4952,26 @@
         "node": ">=14.0.0"
       }
     },
+    "node_modules/tldts": {
+      "version": "6.1.86",
+      "resolved": "https://registry.npmjs.org/tldts/-/tldts-6.1.86.tgz",
+      "integrity": "sha512-WMi/OQ2axVTf/ykqCQgXiIct+mSQDFdH2fkwhPwgEwvJ1kSzZRiinb0zF2Xb8u4+OqPChmyI6MEu4EezNJz+FQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tldts-core": "^6.1.86"
+      },
+      "bin": {
+        "tldts": "bin/cli.js"
+      }
+    },
+    "node_modules/tldts-core": {
+      "version": "6.1.86",
+      "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-6.1.86.tgz",
+      "integrity": "sha512-Je6p7pkk+KMzMv2XXKmAE3McmolOQFdxkKw0R8EYNr7sELW46JqnNeTX8ybPiQgvg1ymCoF8LXs5fzFaZvJPTA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/to-regex-range": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
@@ -4605,6 +4985,32 @@
         "node": ">=8.0"
       }
     },
+    "node_modules/tough-cookie": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-5.1.2.tgz",
+      "integrity": "sha512-FVDYdxtnj0G6Qm/DhNPSb8Ju59ULcup3tuJxkFb5K8Bv2pUXILbf0xZWU8PX8Ov19OXljbUyveOFwRMwkXzO+A==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "tldts": "^6.1.32"
+      },
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/tr46": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/tr46/-/tr46-5.1.1.tgz",
+      "integrity": "sha512-hdF5ZgjTqgAntKkklYw0R03MG2x/bSzTtkxmIRw/sTNV8YXsCJ1tfLAX23lhxhHJlEf3CRCOCGGWw3vI3GaSPw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "punycode": "^2.3.1"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/tscw-config": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/tscw-config/-/tscw-config-1.1.2.tgz",
@@ -4931,6 +5337,19 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
+    "node_modules/w3c-xmlserializer": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/w3c-xmlserializer/-/w3c-xmlserializer-5.0.0.tgz",
+      "integrity": "sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "xml-name-validator": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/watchpack": {
       "version": "2.5.1",
       "resolved": "https://registry.npmjs.org/watchpack/-/watchpack-2.5.1.tgz",
@@ -4944,6 +5363,16 @@
         "node": ">=10.13.0"
       }
     },
+    "node_modules/webidl-conversions": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-7.0.0.tgz",
+      "integrity": "sha512-VwddBukDzu71offAQR975unBIGqfKZpM+8ZX6ySk8nYhVoo5CYaZyzt3YBvYtRtO+aoGlqxPg/B87NGVZ/fu6g==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/webpack": {
       "version": "5.105.0",
       "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.105.0.tgz",
@@ -5070,6 +5499,44 @@
         "node": ">=10.13.0"
       }
     },
+    "node_modules/whatwg-encoding": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/whatwg-encoding/-/whatwg-encoding-3.1.1.tgz",
+      "integrity": "sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ==",
+      "deprecated": "Use @exodus/bytes instead for a more spec-conformant and faster implementation",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "iconv-lite": "0.6.3"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/whatwg-mimetype": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-4.0.0.tgz",
+      "integrity": "sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/whatwg-url": {
+      "version": "14.2.0",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-14.2.0.tgz",
+      "integrity": "sha512-De72GdQZzNTUBBChsXueQUnPKDkg/5A5zp7pFDuQAj5UFoENpiACU0wlCvzpAGnTkj++ihpKwKyYewn/XNUbKw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tr46": "^5.1.0",
+        "webidl-conversions": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/which": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
@@ -5114,6 +5581,45 @@
       "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8=",
       "dev": true
     },
+    "node_modules/ws": {
+      "version": "8.21.1",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.1.tgz",
+      "integrity": "sha512-+0NTnW77fFN/DjQi6k/Sq/Yvk4Sgajw7urW8V+asjXnRgDs9gyGkdb7EzgfhA4goXsRIZKE28fzIXBHEzhuiWw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": ">=5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/xml-name-validator": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-5.0.0.tgz",
+      "integrity": "sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/xmlchars": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz",
+      "integrity": "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/yallist": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",

superset-embedded-sdk/package.json

@@ -43,6 +43,7 @@
     "@babel/preset-typescript": "7.29.7",
     "@types/node": "^25.4.0",
     "babel-loader": "^9.1.3",
+    "jsdom": "^26.1.0",
     "tscw-config": "^1.1.2",
     "typescript": "^5.9.3",
     "vitest": "^4.0.18",

superset-embedded-sdk/src/index.test.ts

@@ -0,0 +1,213 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+// @vitest-environment jsdom
+
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import { Switchboard } from "@superset-ui/switchboard";
+import { embedDashboard } from "./index";
+
+vi.mock("@superset-ui/switchboard");
+
+function makeFakeJWT(claims: any) {
+  // not a valid jwt, but close enough for this code
+  const tokenifiedClaims = Buffer.from(JSON.stringify(claims)).toString(
+    "base64",
+  );
+  return `abc.${tokenifiedClaims}.xyz`;
+}
+
+describe("embedDashboard", () => {
+  let mountPoint: HTMLElement;
+  let mockSwitchboard: Switchboard;
+
+  beforeEach(() => {
+    mountPoint = document.createElement("div");
+    document.body.appendChild(mountPoint);
+
+    mockSwitchboard = {
+      emit: vi.fn(),
+      get: vi.fn(),
+      start: vi.fn(),
+      defineMethod: vi.fn(),
+    } as any;
+
+    // Constructor mocks must use `function`, since arrow functions cannot be
+    // invoked with `new`.
+    vi.mocked(Switchboard).mockImplementation(function () {
+      return mockSwitchboard;
+    } as any);
+
+    // Mock MessageChannel API
+    globalThis.MessageChannel = vi.fn(function (this: any) {
+      this.port1 = {};
+      this.port2 = {};
+    }) as any;
+
+    // Mock iframe load event and sandbox
+    const originalCreateElement = document.createElement.bind(document);
+    vi.spyOn(document, "createElement").mockImplementation(tagName => {
+      const element = originalCreateElement(tagName);
+      if (tagName === "iframe") {
+        // Mock sandbox DOMTokenList
+        (element as any).sandbox = {
+          add: vi.fn(),
+        };
+        // Mock contentWindow for postMessage
+        Object.defineProperty(element, "contentWindow", {
+          writable: true,
+          value: {
+            postMessage: vi.fn(),
+          },
+        });
+        setTimeout(() => {
+          element.dispatchEvent(new Event("load"));
+        }, 0);
+      }
+      return element;
+    });
+  });
+
+  afterEach(() => {
+    document.body.removeChild(mountPoint);
+    vi.restoreAllMocks();
+  });
+
+  test("setDataMask sends dataMask to iframe", async () => {
+    const fakeToken = makeFakeJWT({ exp: Date.now() / 1000 + 300 });
+    const mockFetchGuestToken = vi.fn().mockResolvedValue(fakeToken);
+    const testDataMask = {
+      "NATIVE_FILTER-1": {
+        filterState: {
+          value: ["value1", "value2"],
+        },
+      },
+    };
+
+    const dashboard = await embedDashboard({
+      id: "test-id",
+      supersetDomain: "https://superset.example.com",
+      mountPoint,
+      fetchGuestToken: mockFetchGuestToken,
+    });
+
+    dashboard.setDataMask(testDataMask);
+
+    expect(mockSwitchboard.get).toHaveBeenCalledWith("setDataMask", {
+      dataMask: testDataMask,
+    });
+  });
+
+  test("setDataMask sends empty dataMask", async () => {
+    const fakeToken = makeFakeJWT({ exp: Date.now() / 1000 + 300 });
+    const mockFetchGuestToken = vi.fn().mockResolvedValue(fakeToken);
+    const emptyDataMask = {};
+
+    const dashboard = await embedDashboard({
+      id: "test-id",
+      supersetDomain: "https://superset.example.com",
+      mountPoint,
+      fetchGuestToken: mockFetchGuestToken,
+    });
+
+    dashboard.setDataMask(emptyDataMask);
+
+    expect(mockSwitchboard.get).toHaveBeenCalledWith("setDataMask", {
+      dataMask: emptyDataMask,
+    });
+  });
+
+  test("setDataMask drops the change-trigger flags observeDataMask adds", async () => {
+    const fakeToken = makeFakeJWT({ exp: Date.now() / 1000 + 300 });
+    const mockFetchGuestToken = vi.fn().mockResolvedValue(fakeToken);
+    const observedMask = {
+      "NATIVE_FILTER-1": {
+        filterState: {
+          value: ["CA"],
+        },
+      },
+      crossFiltersChanged: false,
+      nativeFiltersChanged: true,
+    };
+
+    const dashboard = await embedDashboard({
+      id: "test-id",
+      supersetDomain: "https://superset.example.com",
+      mountPoint,
+      fetchGuestToken: mockFetchGuestToken,
+    });
+
+    dashboard.setDataMask(observedMask);
+
+    expect(mockSwitchboard.get).toHaveBeenCalledWith("setDataMask", {
+      dataMask: {
+        "NATIVE_FILTER-1": observedMask["NATIVE_FILTER-1"],
+      },
+    });
+  });
+
+  test("setDataMask sends complex dataMask with multiple filters", async () => {
+    const fakeToken = makeFakeJWT({ exp: Date.now() / 1000 + 300 });
+    const mockFetchGuestToken = vi.fn().mockResolvedValue(fakeToken);
+    const complexDataMask = {
+      "NATIVE_FILTER-1": {
+        filterState: {
+          value: ["CA", "NY"],
+        },
+      },
+      "NATIVE_FILTER-2": {
+        filterState: {
+          value: [2023, 2024],
+        },
+      },
+    };
+
+    const dashboard = await embedDashboard({
+      id: "test-id",
+      supersetDomain: "https://superset.example.com",
+      mountPoint,
+      fetchGuestToken: mockFetchGuestToken,
+    });
+
+    dashboard.setDataMask(complexDataMask);
+
+    expect(mockSwitchboard.get).toHaveBeenCalledWith("setDataMask", {
+      dataMask: complexDataMask,
+    });
+  });
+
+  test("setDataMask rejects when the embedded page does not support it", async () => {
+    const fakeToken = makeFakeJWT({ exp: Date.now() / 1000 + 300 });
+    const mockFetchGuestToken = vi.fn().mockResolvedValue(fakeToken);
+    vi.mocked(mockSwitchboard.get).mockRejectedValue(
+      new Error('Method "setDataMask" is not defined'),
+    );
+
+    const dashboard = await embedDashboard({
+      id: "test-id",
+      supersetDomain: "https://superset.example.com",
+      mountPoint,
+      fetchGuestToken: mockFetchGuestToken,
+    });
+
+    await expect(dashboard.setDataMask({})).rejects.toThrow(
+      'Method "setDataMask" is not defined',
+    );
+  });
+});

superset-embedded-sdk/src/index.ts

@@ -115,6 +115,12 @@ export type EmbeddedDashboard = {
   getActiveTabs: () => Promise<string[]>;
   observeDataMask: (callbackFn: ObserveDataMaskCallbackFn) => void;
   getDataMask: () => Promise<Record<string, any>>;
+  /**
+   * Applies a data mask to the dashboard.
+   * Rejects if the embedded Superset page does not support `setDataMask`,
+   * so a version mismatch surfaces instead of silently doing nothing.
+   */
+  setDataMask: (dataMask: Record<string, any>) => Promise<void>;
   getChartStates: () => Promise<Record<string, any>>;
   getChartDataPayloads: (params?: {
     chartId?: number;
@@ -355,6 +361,21 @@ export async function embedDashboard({
     ourPort.get<string>("getDashboardPermalink", { anchor });
   const getActiveTabs = () => ourPort.get<string[]>("getActiveTabs");
   const getDataMask = () => ourPort.get<Record<string, any>>("getDataMask");
+  // `observeDataMask` hands the host a mask with the change-trigger booleans
+  // mixed in, so feeding that payload straight back into `setDataMask` is a
+  // natural thing for a host to do. Keep only the entries that look like a
+  // filter's mask, so those flags never reach the dashboard as filter ids.
+  // Sent with `get` rather than `emit` so the iframe acknowledges the call:
+  // an embedded page that predates `setDataMask` replies with an error instead
+  // of dropping the message silently.
+  const setDataMask = (dataMask: Record<string, any>) =>
+    ourPort.get<void>("setDataMask", {
+      dataMask: Object.fromEntries(
+        Object.entries(dataMask).filter(
+          ([, mask]) => typeof mask === "object" && mask !== null,
+        ),
+      ),
+    });
   const getChartStates = () =>
     ourPort.get<Record<string, any>>("getChartStates");
   const getChartDataPayloads = (params?: { chartId?: number }) =>
@@ -396,6 +417,7 @@ export async function embedDashboard({
     getActiveTabs,
     observeDataMask,
     getDataMask,
+    setDataMask,
     getChartStates,
     getChartDataPayloads,
     setThemeConfig,

superset-frontend/package.json

@@ -110,7 +110,7 @@
     "@fontsource/fira-code": "^5.3.0",
     "@fontsource/ibm-plex-mono": "^5.3.0",
     "@fontsource/inter": "^5.3.0",
-    "@googleapis/sheets": "^13.0.2",
+    "@googleapis/sheets": "^14.0.0",
     "@great-expectations/jsonforms-antd-renderers": "^2.2.10",
     "@jsonforms/core": "^3.7.0",
     "@jsonforms/react": "^3.7.0",
@@ -158,7 +158,7 @@
     "@visx/xychart": "^4.0.0",
     "ag-grid-community": "36.1.0",
     "ag-grid-react": "36.1.0",
-    "antd": "^6.5.3",
+    "antd": "^6.6.0",
     "chrono-node": "^2.10.1",
     "classnames": "^2.2.5",
     "content-disposition": "^2.0.1",
@@ -176,7 +176,7 @@
     "geostyler-openlayers-parser": "^5.7.1",
     "geostyler-style": "11.0.2",
     "geostyler-wfs-parser": "^3.0.1",
-    "google-auth-library": "^11.0.0",
+    "google-auth-library": "^11.0.1",
     "immer": "^11.1.16",
     "interweave": "^13.1.1",
     "jquery": "^4.0.0",
@@ -185,7 +185,7 @@
     "json-stringify-pretty-compact": "^4.0.0",
     "lodash": "^4.18.1",
     "lodash-es": "^4.18.1",
-    "mapbox-gl": "^3.28.0",
+    "mapbox-gl": "^3.28.1",
     "markdown-to-jsx": "^9.10.2",
     "match-sorter": "^8.3.0",
     "memoize-one": "^6.0.0",
@@ -193,7 +193,7 @@
     "mustache": "^4.2.0",
     "nanoid": "^6.0.1",
     "ol": "^10.10.0",
-    "query-string": "9.4.1",
+    "query-string": "9.5.0",
     "re-resizable": "^6.11.2",
     "react": "^18.3.0",
     "react-arborist": "^3.16.0",
@@ -257,16 +257,16 @@
     "@istanbuljs/nyc-config-typescript": "^1.0.1",
     "@playwright/test": "^1.62.1",
     "@pmmmwh/react-refresh-webpack-plugin": "^0.6.2",
-    "@storybook/addon-docs": "10.5.6",
-    "@storybook/addon-links": "10.5.6",
-    "@storybook/react-webpack5": "10.5.6",
+    "@storybook/addon-docs": "10.5.7",
+    "@storybook/addon-links": "10.5.7",
+    "@storybook/react-webpack5": "10.5.7",
     "@storybook/test-runner": "0.24.4",
     "@svgr/webpack": "^8.1.0",
     "@swc/core": "^1.15.47",
     "@swc/plugin-emotion": "^14.15.0",
     "@swc/plugin-transform-imports": "^12.5.0",
     "@testing-library/dom": "^10.4.1",
-    "@testing-library/jest-dom": "^7.0.0",
+    "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^15.0.0",
     "@testing-library/user-event": "^12.8.3",
     "@types/content-disposition": "^0.5.9",
@@ -277,7 +277,7 @@
     "@types/json-bigint": "^1.0.4",
     "@types/lodash-es": "^4.17.12",
     "@types/mousetrap": "^1.6.15",
-    "@types/node": "^26.1.2",
+    "@types/node": "^26.2.0",
     "@types/react": "^18.3.0",
     "@types/react-dom": "^18.3.0",
     "@types/react-loadable": "^5.5.11",
@@ -289,19 +289,19 @@
     "@types/rison": "0.1.0",
     "@types/tinycolor2": "^1.4.3",
     "@types/unzipper": "^0.10.11",
-    "@typescript-eslint/eslint-plugin": "^8.66.0",
+    "@typescript-eslint/eslint-plugin": "^8.67.0",
     "@typescript-eslint/parser": "^8.63.0",
     "babel-jest": "^30.4.1",
     "babel-loader": "^10.1.1",
     "babel-plugin-dynamic-import-node": "^2.3.3",
     "babel-plugin-jsx-remove-data-test-id": "^3.0.0",
-    "baseline-browser-mapping": "^2.11.12",
+    "baseline-browser-mapping": "^2.11.13",
     "cheerio": "1.2.0",
     "concurrently": "^10.0.4",
     "copy-webpack-plugin": "^14.0.0",
     "cross-env": "^10.1.0",
     "css-loader": "^7.1.4",
-    "eslint": "^10.8.0",
+    "eslint": "^10.8.1",
     "eslint-import-resolver-alias": "^1.1.2",
     "eslint-import-resolver-typescript": "^4.4.5",
     "eslint-plugin-i18n-strings": "file:eslint-rules/eslint-plugin-i18n-strings",
@@ -312,7 +312,7 @@
     "eslint-plugin-no-only-tests": "^3.4.0",
     "eslint-plugin-react-prefer-function-component": "^5.0.0",
     "eslint-plugin-react-you-might-not-need-an-effect": "^1.0.1",
-    "eslint-plugin-storybook": "10.5.6",
+    "eslint-plugin-storybook": "10.5.7",
     "eslint-plugin-testing-library": "^7.16.2",
     "eslint-plugin-theme-colors": "file:eslint-rules/eslint-plugin-theme-colors",
     "fetch-mock": "^12.6.0",
@@ -331,8 +331,8 @@
     "mini-css-extract-plugin": "^2.10.2",
     "minimizer-webpack-plugin": "^5.6.1",
     "open-cli": "^9.0.0",
-    "oxfmt": "^0.62.0",
-    "oxlint": "^1.77.0",
+    "oxfmt": "^0.63.0",
+    "oxlint": "^1.78.0",
     "po2json": "^0.4.5",
     "postcss-styled-syntax": "^0.7.2",
     "process": "^0.11.10",
@@ -343,13 +343,13 @@
     "source-map": "^0.8.0",
     "source-map-support": "^0.5.21",
     "speed-measure-webpack-plugin": "^1.6.0",
-    "storybook": "10.5.6",
+    "storybook": "10.5.7",
     "style-loader": "^4.0.0",
     "stylelint": "^17.14.1",
     "swc-loader": "^0.2.7",
     "ts-jest": "^29.4.12",
     "tscw-config": "^1.1.2",
-    "tsx": "^4.23.9",
+    "tsx": "^4.23.12",
     "typescript": "5.4.5",
     "unzipper": "^0.12.5",
     "wait-on": "^9.1.0",
@@ -415,6 +415,7 @@
     "minimatch@>=10": {
       "brace-expansion": ">=5.0.8"
     },
+    "nanoid@>=3 <4": "3.3.18",
     "nwsapi": "^2.2.13",
     "puppeteer": "^22.4.1",
     "tar": "^7.5.16",

superset-frontend/packages/superset-ui-core/package.json

@@ -103,7 +103,7 @@
     "@types/d3-time-format": "^4.0.3",
     "@types/jquery": "^4.0.1",
     "@types/lodash": "^4.17.25",
-    "@types/node": "^26.1.2",
+    "@types/node": "^26.2.0",
     "@types/prop-types": "^15.7.15",
     "@types/react-syntax-highlighter": "^15.5.13",
     "@types/react-table": "^7.7.20",

superset-frontend/packages/superset-ui-core/src/chart/types/Base.ts

@@ -45,6 +45,13 @@ export interface ContextMenuFilters {
     filters: BinaryQueryObjectFilterClause[];
     groupbyFieldName: string;
     adhocFilterFieldName?: string;
+    /**
+     * Filters scoped to the clicked x-axis value (category or time bucket),
+     * as opposed to `filters`, which are scoped to the clicked series.
+     * When both are present, the Drill By UI lets the user choose which
+     * of the two (or both) to apply to the drilled chart.
+     */
+    xAxisFilters?: BinaryQueryObjectFilterClause[];
   };
 }
 

superset-frontend/packages/superset-ui-core/src/components/Select/AsyncSelect.test.tsx

@@ -107,12 +107,14 @@ const getAllSelectOptions = () =>
 
 const findSelectOption = (text: string) =>
   waitFor(() =>
-    within(getElementByClassName('.rc-virtual-list')).getByText(text),
+    within(getElementByClassName('.ant-select-dropdown-list')).getByText(text),
   );
 
 const querySelectOption = (text: string) =>
   waitFor(() =>
-    within(getElementByClassName('.rc-virtual-list')).queryByText(text),
+    within(getElementByClassName('.ant-select-dropdown-list')).queryByText(
+      text,
+    ),
   );
 
 const findAllSelectOptions = () =>
@@ -644,7 +646,7 @@ test('does not add a new option if the option already exists', async () => {
   await type(option);
   await waitFor(() => {
     const array = within(
-      getElementByClassName('.rc-virtual-list'),
+      getElementByClassName('.ant-select-dropdown-list'),
     ).getAllByText(option);
     expect(array.length).toBe(1);
   });
@@ -1398,7 +1400,7 @@ test('appends page>1 results during an active search and discards them when sear
   // scrollTop via e.currentTarget in its onFallbackScroll handler, which
   // then forwards to onPopupScroll (handlePagination here).
   const holder = document.querySelector(
-    '.rc-virtual-list-holder',
+    '.ant-select-dropdown-list-holder',
   ) as HTMLElement | null;
   if (!holder) throw new Error('virtual-list holder not rendered');
   Object.defineProperty(holder, 'scrollHeight', {

superset-frontend/packages/superset-ui-core/src/components/Select/Select.test.tsx

@@ -93,12 +93,14 @@ const deselectAllButtonText = (length: number) =>
 
 const findSelectOption = (text: string) =>
   waitFor(() =>
-    within(getElementByClassName('.rc-virtual-list')).getByText(text),
+    within(getElementByClassName('.ant-select-dropdown-list')).getByText(text),
   );
 
 const querySelectOption = (text: string) =>
   waitFor(() =>
-    within(getElementByClassName('.rc-virtual-list')).queryByText(text),
+    within(getElementByClassName('.ant-select-dropdown-list')).queryByText(
+      text,
+    ),
   );
 
 const getAllSelectOptions = () =>

superset-frontend/packages/superset-ui-core/src/utils/tooltip.ts

@@ -19,19 +19,71 @@
 import { t } from '@apache-superset/core/translation';
 import { sanitizeHtml } from './html';
 
+export type TooltipTruncationMode = 'off' | 'end' | 'start' | 'middle';
+
+export const TRUNCATION_MAX_CHARS = 40;
+
 const TRUNCATION_STYLE = `
   max-width: 300px;
   overflow: hidden;
   text-overflow: ellipsis;
 `;
 
+const NOWRAP_STYLE = `
+  white-space: nowrap;
+`;
+
+/**
+ * Shortens plain text so a tooltip label stays readable, placing the ellipsis
+ * where the caller asked for it.
+ *
+ * Only 'start' and 'middle' slice. 'end' is handled by CSS in tooltipHtml, and
+ * 'off' means no truncation at all, so both return the input untouched.
+ *
+ * The input must be plain text. Callers are responsible for truncating before
+ * any markup (such as the ECharts series marker) is prepended, and before
+ * sanitization — slicing a string that already contains markup would cut into
+ * a tag.
+ */
+export function truncateLabel(
+  text: string,
+  mode: TooltipTruncationMode = 'end',
+): string {
+  if (
+    (mode !== 'start' && mode !== 'middle') ||
+    text.length <= TRUNCATION_MAX_CHARS
+  ) {
+    return text;
+  }
+  const budget = TRUNCATION_MAX_CHARS - 1;
+  if (mode === 'start') {
+    return `…${text.slice(-budget)}`;
+  }
+  const head = Math.ceil(budget / 2);
+  const tail = Math.floor(budget / 2);
+  return `${text.slice(0, head)}…${text.slice(-tail)}`;
+}
+
+function getTruncationStyle(mode: TooltipTruncationMode): string {
+  if (mode === 'end') {
+    return TRUNCATION_STYLE;
+  }
+  if (mode === 'off') {
+    return '';
+  }
+  // 'start' and 'middle' are already sliced upstream; keep them on one line.
+  return NOWRAP_STYLE;
+}
+
 export function tooltipHtml(
   data: string[][],
   title?: string,
   focusedRow?: number,
+  truncation: TooltipTruncationMode = 'end',
 ) {
+  const truncationStyle = getTruncationStyle(truncation);
   const titleRow = title
-    ? `<span style="font-weight: 700;${TRUNCATION_STYLE}">${title}</span>`
+    ? `<span style="font-weight: 700;${truncationStyle}">${title}</span>`
     : '';
   return sanitizeHtml(`
     <div>
@@ -46,7 +98,7 @@ export function tooltipHtml(
                 const cellStyle = `
                   text-align: ${j > 0 ? 'right' : 'left'};
                   padding-left: ${j === 0 ? 0 : 16}px;
-                  ${TRUNCATION_STYLE}
+                  ${truncationStyle}
                 `;
                 return `<td style="${cellStyle}">${cell}</td>`;
               });

superset-frontend/packages/superset-ui-core/test/utils/tooltip.test.ts

@@ -16,7 +16,12 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { sanitizeHtml, tooltipHtml } from '@superset-ui/core';
+import {
+  sanitizeHtml,
+  tooltipHtml,
+  truncateLabel,
+  TRUNCATION_MAX_CHARS,
+} from '@superset-ui/core';
 
 const TITLE_STYLE =
   'style="font-weight: 700;max-width:300px;overflow:hidden;text-overflow:ellipsis;"';
@@ -182,3 +187,88 @@ test('should preserve table styling after sanitization (fixes ECharts tooltip fo
   expect(html).toContain('padding-left:16px');
   expect(html).toContain('max-width:300px');
 });
+
+describe('truncateLabel', () => {
+  const long = 'prod-us-east-1-service-checkout-latency-p99'; // 43 chars
+
+  test('returns text unchanged for off and end', () => {
+    expect(truncateLabel(long, 'off')).toBe(long);
+    expect(truncateLabel(long, 'end')).toBe(long);
+  });
+
+  test('defaults to end, which does not slice', () => {
+    expect(truncateLabel(long)).toBe(long);
+  });
+
+  test('truncates the start, keeping the distinguishing suffix', () => {
+    expect(truncateLabel(long, 'start')).toBe(
+      '…-us-east-1-service-checkout-latency-p99',
+    );
+    expect(truncateLabel(long, 'start')).toHaveLength(TRUNCATION_MAX_CHARS);
+  });
+
+  test('truncates the middle, keeping both ends', () => {
+    expect(truncateLabel(long, 'middle')).toBe(
+      'prod-us-east-1-servi…heckout-latency-p99',
+    );
+    expect(truncateLabel(long, 'middle')).toHaveLength(TRUNCATION_MAX_CHARS);
+  });
+
+  test('leaves text at or under the limit untouched', () => {
+    const atLimit = 'x'.repeat(TRUNCATION_MAX_CHARS);
+    expect(truncateLabel(atLimit, 'start')).toBe(atLimit);
+    expect(truncateLabel(atLimit, 'middle')).toBe(atLimit);
+    expect(truncateLabel('short', 'start')).toBe('short');
+    expect(truncateLabel('', 'middle')).toBe('');
+  });
+
+  test('truncates text one character over the limit', () => {
+    const overLimit = 'x'.repeat(TRUNCATION_MAX_CHARS + 1);
+    expect(truncateLabel(overLimit, 'start')).toBe(
+      `…${'x'.repeat(TRUNCATION_MAX_CHARS - 1)}`,
+    );
+  });
+});
+
+describe('tooltipHtml truncation modes', () => {
+  const rows = [['label', 'value']];
+
+  // sanitizeHtml normalizes spacing inside style attributes, and it does so
+  // differently across versions, so compare with whitespace stripped.
+  const styles = (
+    title: string | undefined,
+    truncation?: 'off' | 'end' | 'start' | 'middle',
+  ) => removeWhitespaces(tooltipHtml(rows, title, undefined, truncation));
+
+  test('emits the 300px cap for end and for the default', () => {
+    expect(styles('Title', 'end')).toContain('max-width:300px');
+    expect(tooltipHtml(rows, 'Title')).toBe(
+      tooltipHtml(rows, 'Title', undefined, 'end'),
+    );
+  });
+
+  test('emits no truncation style for off', () => {
+    const html = styles('Title', 'off');
+    expect(html).not.toContain('max-width');
+    expect(html).not.toContain('text-overflow');
+    expect(html).not.toContain('white-space');
+  });
+
+  test.each(['start', 'middle'] as const)(
+    'emits nowrap instead of a cap for %s',
+    mode => {
+      const html = styles('Title', mode);
+      expect(html).toContain('white-space:nowrap');
+      expect(html).not.toContain('max-width');
+    },
+  );
+
+  test('never slices cell text itself, whatever the mode', () => {
+    const longCell = 'y'.repeat(TRUNCATION_MAX_CHARS + 20);
+    (['off', 'end', 'start', 'middle'] as const).forEach(mode => {
+      expect(tooltipHtml([[longCell]], undefined, undefined, mode)).toContain(
+        longCell,
+      );
+    });
+  });
+});

superset-frontend/plugins/plugin-chart-calendar/src/Calendar.ts

@@ -22,7 +22,7 @@ import { getSequentialSchemeRegistry } from '@superset-ui/core';
 import { SupersetTheme } from '@apache-superset/core/theme';
 import { t } from '@apache-superset/core/translation';
 import CalHeatMapImport from './vendor/cal-heatmap';
-import { convertUTCTimestampToLocal } from './utils';
+import { convertUTCTimestampToLocal, getFormattedUTCTime } from './utils';
 
 // The vendor file is @ts-nocheck, so its export lacks type info.
 // Define a minimal constructor interface for use in this file.
@@ -103,6 +103,8 @@ function Calendar(element: HTMLElement, props: CalendarProps) {
   const subDomainTextFormat = showValues
     ? (_date: Date, value: number) => valueFormatter(value)
     : null;
+  const dateFormatter = (date: Date, format: string) =>
+    getFormattedUTCTime(date.getTime(), format);
 
   const metricsData = data.data;
 
@@ -166,6 +168,7 @@ function Calendar(element: HTMLElement, props: CalendarProps) {
       itemName: '',
       valueFormatter,
       timeFormatter,
+      dateFormatter,
       subDomainTextFormat,
     });
   });

superset-frontend/plugins/plugin-chart-calendar/src/vendor/cal-heatmap.ts

@@ -76,6 +76,8 @@ var CalHeatMap = function () {
 
     timeFormatter: d => d,
 
+    dateFormatter: null,
+
     domain: 'hour',
 
     subDomain: 'min',
@@ -1990,10 +1992,14 @@ CalHeatMap.prototype = {
 
     if (typeof format === 'function') {
       return format(d);
-    } else {
-      var f = d3.time.format(format);
-      return f(d);
     }
+
+    if (typeof this.options.dateFormatter === 'function') {
+      return this.options.dateFormatter(d, format);
+    }
+
+    var f = d3.time.format(format);
+    return f(d);
   },
 
   getSubDomainTitle: function (d) {

superset-frontend/plugins/plugin-chart-calendar/test/ReactCalendar.test.tsx

@@ -25,9 +25,11 @@ import {
   waitFor,
 } from 'spec/helpers/testing-library';
 import { CALENDAR_TOOLTIP_CLASS } from '../src/tooltip';
+import { convertUTCTimestampToLocal } from '../src/utils';
 
 interface MockCalHeatMapConfig {
   itemSelector: Element;
+  dateFormatter?: (date: Date, format: string) => string;
 }
 
 type MetricNameInput = string | string[];
@@ -38,6 +40,7 @@ let mockInitCallCount = 0;
 let mockThrowOnInitCall: number | null = null;
 let mockDestroyCallCount = 0;
 let mockDestroyedInstanceIds: string[] = [];
+let mockDateFormatter: MockCalHeatMapConfig['dateFormatter'];
 
 const mockTheme = {
   colorBgElevated: '#ffffff',
@@ -56,6 +59,7 @@ jest.mock('../src/vendor/cal-heatmap', () => ({
       } = require('../src/tooltip');
 
       mockInitCallCount += 1;
+      mockDateFormatter = config.dateFormatter;
       if (mockThrowOnInitCall === mockInitCallCount) {
         throw new Error('Mock CalHeatMap init failure');
       }
@@ -284,9 +288,28 @@ afterEach(() => {
   mockThrowOnInitCall = null;
   mockDestroyCallCount = 0;
   mockDestroyedInstanceIds = [];
+  mockDateFormatter = undefined;
   document.body.innerHTML = '';
 });
 
+test('Calendar provides a timezone-safe date formatter to CalHeatMap', () => {
+  const calendarOwner = document.createElement('div');
+  document.body.appendChild(calendarOwner);
+
+  Calendar(calendarOwner, {
+    ...createCalendarProps('localized-metric'),
+    theme: mockTheme,
+  });
+
+  if (!mockDateFormatter) {
+    throw new Error('Expected Calendar to configure a date formatter');
+  }
+
+  const localDate = new Date(convertUTCTimestampToLocal(Date.UTC(2024, 0, 1)));
+
+  expect(mockDateFormatter(localDate, '%Y-%m-%d')).toBe('2024-01-01');
+});
+
 test('rerender and unmount clean up only the affected calendar tooltips', () => {
   jest.useFakeTimers();
 

superset-frontend/plugins/plugin-chart-calendar/test/cal-heatmap.test.ts

@@ -0,0 +1,61 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import CalHeatMapImport from '../src/vendor/cal-heatmap';
+
+type DateFormatter = (date: Date, format: string) => string;
+type FunctionalDateFormat = (date: Date) => string;
+
+interface CalHeatMapInstance {
+  options: {
+    dateFormatter: DateFormatter | null;
+  };
+  formatDate(date: Date, format: string | FunctionalDateFormat): string;
+}
+
+const CalHeatMap = CalHeatMapImport as unknown as new () => CalHeatMapInstance;
+
+test('CalHeatMap delegates string date formats to the configured formatter', () => {
+  const calendar = new CalHeatMap();
+  const date = new Date(2024, 0, 1);
+  const dateFormatter = jest.fn<string, [Date, string]>(() => 'Январь');
+  calendar.options.dateFormatter = dateFormatter;
+
+  expect(calendar.formatDate(date, '%B')).toBe('Январь');
+  expect(dateFormatter).toHaveBeenCalledWith(date, '%B');
+});
+
+test('CalHeatMap preserves functional formatters over the configured formatter', () => {
+  const calendar = new CalHeatMap();
+  const date = new Date(2024, 0, 1);
+  const dateFormatter = jest.fn<string, [Date, string]>(() => 'localized');
+  const functionalFormat = jest.fn<string, [Date]>(() => 'custom');
+  calendar.options.dateFormatter = dateFormatter;
+
+  expect(calendar.formatDate(date, functionalFormat)).toBe('custom');
+  expect(functionalFormat).toHaveBeenCalledWith(date);
+  expect(dateFormatter).not.toHaveBeenCalled();
+});
+
+test('CalHeatMap keeps the D3 formatter fallback', () => {
+  const calendar = new CalHeatMap();
+  const date = new Date(2024, 0, 1);
+
+  expect(calendar.formatDate(date, '%B')).toBe('January');
+});

superset-frontend/plugins/plugin-chart-echarts/src/Bubble/transformProps.test.ts

@@ -0,0 +1,70 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { SqlaFormData } from '@superset-ui/core';
+import transformProps from './transformProps';
+import { EchartsBubbleChartProps } from './types';
+
+const baseFormData: SqlaFormData = {
+  datasource: '1__table',
+  viz_type: 'bubble_v2',
+  entity: 'customer_name',
+  x: 'price',
+  y: 'sales',
+  size: 'count',
+};
+
+const baseChartProps = {
+  width: 400,
+  height: 400,
+  hooks: {},
+  queriesData: [
+    {
+      data: [
+        { customer_name: 'A', price: 10, sales: 100, count: 5 },
+        { customer_name: 'B', price: 20, sales: 200, count: 8 },
+      ],
+    },
+  ],
+  theme: { colorText: '#000' },
+};
+
+test('nests xAxisLabelInterval under axisLabel rather than the axis itself', () => {
+  // Regression test: xAxis.interval forces echarts' IntervalScale into a
+  // fixed-tick-spacing mode that expects a number and crashes on the
+  // 'auto'/'0' strings this control actually produces (observed as an
+  // uncaught assertion deep in echarts' axis "nice" tick calculation,
+  // reproducing on every dashboard bubble chart). The interval belongs on
+  // axisLabel, where it only controls how many labels are skipped.
+  const { echartOptions } = transformProps({
+    ...baseChartProps,
+    formData: baseFormData,
+  } as unknown as EchartsBubbleChartProps);
+
+  expect((echartOptions.xAxis as any).interval).toBeUndefined();
+  expect((echartOptions.xAxis as any).axisLabel.interval).toBe('auto');
+});
+
+test('honors an explicit xAxisLabelInterval override', () => {
+  const { echartOptions } = transformProps({
+    ...baseChartProps,
+    formData: { ...baseFormData, xAxisLabelInterval: '0' },
+  } as unknown as EchartsBubbleChartProps);
+
+  expect((echartOptions.xAxis as any).axisLabel.interval).toBe('0');
+});

superset-frontend/plugins/plugin-chart-echarts/src/Bubble/transformProps.ts

@@ -212,13 +212,16 @@ export default function transformProps(chartProps: EchartsBubbleChartProps) {
   const echartOptions: EChartsCoreOption = {
     series,
     xAxis: {
-      axisLabel: { formatter: xAxisFormatter, rotate: xAxisLabelRotation },
+      axisLabel: {
+        formatter: xAxisFormatter,
+        rotate: xAxisLabelRotation,
+        interval: xAxisLabelInterval,
+      },
       splitLine: {
         lineStyle: {
           type: 'dashed',
         },
       },
-      interval: xAxisLabelInterval,
       scale: true,
       name: bubbleXAxisTitle,
       nameLocation: 'middle',

superset-frontend/plugins/plugin-chart-echarts/src/MixedTimeseries/transformProps.ts

@@ -40,6 +40,7 @@ import {
   TimeseriesChartDataResponseResult,
   TimeseriesDataRecord,
   tooltipHtml,
+  truncateLabel,
   ValueFormatter,
 } from '@superset-ui/core';
 import { GenericDataType } from '@apache-superset/core/common';
@@ -207,6 +208,7 @@ export default function transformProps(
     zoomable,
     richTooltip,
     tooltipSortByMetric,
+    tooltipTruncation,
     xAxisBounds,
     xAxisLabelRotation,
     xAxisLabelInterval,
@@ -907,13 +909,19 @@ export default function transformProps(
               formatter: primarySeries.has(key)
                 ? tooltipFormatter
                 : tooltipFormatterSecondary,
+              truncation: tooltipTruncation,
             });
             rows.push(row);
             if (key === focusedSeries) {
               focusedRow = rows.length - 1;
             }
           });
-        return tooltipHtml(rows, tooltipFormatter(xValue), focusedRow);
+        return tooltipHtml(
+          rows,
+          truncateLabel(tooltipFormatter(xValue), tooltipTruncation),
+          focusedRow,
+          tooltipTruncation,
+        );
       },
     },
     legend: {

superset-frontend/plugins/plugin-chart-echarts/src/MixedTimeseries/types.ts

@@ -24,6 +24,7 @@ import {
   ContributionType,
   TimeFormatter,
   AxisType,
+  TooltipTruncationMode,
 } from '@superset-ui/core';
 import {
   BaseChartProps,
@@ -59,6 +60,7 @@ export type EchartsMixedTimeseriesFormData = QueryFormData & {
   timeGrainSqla?: TimeGranularity;
   forceMaxInterval?: boolean;
   tooltipTimeFormat?: string;
+  tooltipTruncation?: TooltipTruncationMode;
   zoomable: boolean;
   richTooltip: boolean;
   showQueryIdentifiers?: boolean;
@@ -108,6 +110,7 @@ export const DEFAULT_FORM_DATA: EchartsMixedTimeseriesFormData = {
   yAxisFormatSecondary: TIMESERIES_DEFAULTS.yAxisFormat,
   yAxisTitleSecondary: DEFAULT_TITLE_FORM_DATA.yAxisTitle,
   tooltipTimeFormat: TIMESERIES_DEFAULTS.tooltipTimeFormat,
+  tooltipTruncation: TIMESERIES_DEFAULTS.tooltipTruncation,
   xAxisBounds: TIMESERIES_DEFAULTS.xAxisBounds,
   xAxisForceCategorical: TIMESERIES_DEFAULTS.xAxisForceCategorical,
   xAxisTimeFormat: TIMESERIES_DEFAULTS.xAxisTimeFormat,

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/EchartsTimeseries.test.tsx

@@ -21,7 +21,8 @@ import {
   waitFor,
   cleanup,
 } from '../../../../spec/helpers/testing-library';
-import { AxisType } from '@superset-ui/core';
+import { AxisType, TimeGranularity } from '@superset-ui/core';
+import { GenericDataType } from '@apache-superset/core/common';
 import type { EChartsCoreOption } from 'echarts/core';
 import type { ECElementEvent } from 'echarts/types/src/util/types';
 import type { ReactNode } from 'react';
@@ -655,3 +656,99 @@ test('context menu cross-filter uses the category value for a horizontal categor
     ]);
   }
 });
+
+// A category axis can still sit on a temporal column when the axis is
+// forced categorical (xAxisForceCategorical); the drillBy x-axis filter must
+// then bucket by the configured time grain rather than doing an exact match.
+test('drillBy filters by time bucket when a categorical axis is forced onto a temporal column', async () => {
+  const onContextMenuMock = jest.fn();
+
+  const propsWithForcedCategoricalTemporalAxis: TimeseriesChartTransformedProps =
+    {
+      ...defaultProps,
+      onContextMenu: onContextMenuMock,
+      formData: {
+        ...defaultFormData,
+        xAxisForceCategorical: true,
+        timeGrainSqla: TimeGranularity.MONTH,
+      },
+      coltypeMapping: { order_date: GenericDataType.Temporal },
+      xAxis: {
+        label: 'order_date',
+        type: AxisType.Category,
+      },
+    };
+
+  render(<EchartsTimeseries {...propsWithForcedCategoricalTemporalAxis} />);
+
+  const contextMenuHandler = getLatestEchartProps().eventHandlers?.contextmenu;
+  expect(contextMenuHandler).toBeDefined();
+  await contextMenuHandler?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    data: ['2021-02-01T00:00:00', 100],
+    name: '2021-02-01T00:00:00',
+    event: { stop: jest.fn(), event: { clientX: 10, clientY: 20 } },
+  });
+
+  await waitFor(() => {
+    expect(onContextMenuMock).toHaveBeenCalled();
+  });
+
+  const { drillBy } = onContextMenuMock.mock.calls[0][2];
+  expect(drillBy.xAxisFilters).toEqual([
+    {
+      col: 'order_date',
+      op: 'TEMPORAL_RANGE',
+      val: '2021-02-01T00:00:00 : 2021-03-01T00:00:00',
+      formattedVal: '2021-02-01T00:00:00',
+    },
+  ]);
+});
+
+// For horizontal orientation the [x, value] pair reported by ECharts is
+// swapped, so the drillBy x-axis filter must read the clicked time value
+// from the second element of the data tuple rather than the first.
+test('drillBy uses the swapped data index for a horizontal time-based axis', async () => {
+  const onContextMenuMock = jest.fn();
+
+  const propsWithHorizontalTimeAxis: TimeseriesChartTransformedProps = {
+    ...defaultProps,
+    onContextMenu: onContextMenuMock,
+    formData: {
+      ...defaultFormData,
+      orientation: OrientationType.Horizontal,
+    },
+    xAxis: {
+      label: 'order_date',
+      type: AxisType.Time,
+    },
+  };
+
+  render(<EchartsTimeseries {...propsWithHorizontalTimeAxis} />);
+
+  const contextMenuHandler = getLatestEchartProps().eventHandlers?.contextmenu;
+  expect(contextMenuHandler).toBeDefined();
+  await contextMenuHandler?.({
+    componentType: 'series',
+    seriesName: 'Sales',
+    // Horizontal: value first, x (time) value second
+    data: [100, '2021-02-01T00:00:00'],
+    name: '2021-02-01T00:00:00',
+    event: { stop: jest.fn(), event: { clientX: 10, clientY: 20 } },
+  });
+
+  await waitFor(() => {
+    expect(onContextMenuMock).toHaveBeenCalled();
+  });
+
+  const { drillBy } = onContextMenuMock.mock.calls[0][2];
+  expect(drillBy.xAxisFilters).toEqual([
+    {
+      col: 'order_date',
+      op: '==',
+      val: '2021-02-01T00:00:00',
+      formattedVal: '2021-02-01T00:00:00',
+    },
+  ]);
+});

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/EchartsTimeseries.tsx

@@ -28,6 +28,7 @@ import {
   ensureIsArray,
 } from '@superset-ui/core';
 import { useTheme } from '@apache-superset/core/theme';
+import { GenericDataType } from '@apache-superset/core/common';
 import type {
   ECElementEvent,
   ViewRootGroup,
@@ -43,6 +44,7 @@ import {
 } from './percentChange';
 import { OrientationType, TimeseriesChartTransformedProps } from './types';
 import { formatSeriesName } from '../utils/series';
+import { getTemporalXAxisDrillByFilter } from '../utils/xAxisDrillByFilter';
 import { ExtraControls } from '../components/ExtraControls';
 
 const TIMER_DURATION = 300;
@@ -507,6 +509,55 @@ export default function EchartsTimeseries({
           });
         });
 
+        // Filters for the clicked x-axis value, so Drill By can subset the
+        // drilled data to the clicked bar/point rather than only the series
+        const xAxisFilters: BinaryQueryObjectFilterClause[] = [];
+        const xAxisCol =
+          // if the xAxis is '__timestamp', granularity_sqla will be the column of filter
+          xAxis.label === DTTM_ALIAS ? formData.granularitySqla : xAxis.label;
+        if (data && xAxis.type === AxisType.Time && xAxisCol) {
+          // For horizontal orientation the [x, value] pair is swapped
+          const xValue = Array.isArray(data)
+            ? data[categoryAxisValueIndex]
+            : data;
+          const xAxisFilter = getTemporalXAxisDrillByFilter(
+            xAxisCol,
+            xValue,
+            formData.timeGrainSqla,
+            String(xValueFormatter(xValue as number)),
+          );
+          if (xAxisFilter) {
+            xAxisFilters.push(xAxisFilter);
+          }
+        } else if (xAxis.type === AxisType.Category && xAxisCol) {
+          const categoryAxisValue = getCategoryAxisValue(
+            data,
+            eventParams.name,
+          );
+          if (categoryAxisValue !== undefined) {
+            // A category axis can still sit on a temporal column when the
+            // axis is forced categorical; filter by time bucket in that case
+            const xAxisFilter =
+              coltypeMapping?.[getColumnLabel(xAxis.label)] ===
+              GenericDataType.Temporal
+                ? getTemporalXAxisDrillByFilter(
+                    xAxisCol,
+                    categoryAxisValue,
+                    formData.timeGrainSqla,
+                    String(eventParams.name ?? categoryAxisValue),
+                  )
+                : {
+                    col: xAxisCol,
+                    op: '==' as const,
+                    val: categoryAxisValue,
+                    formattedVal: String(categoryAxisValue),
+                  };
+            if (xAxisFilter) {
+              xAxisFilters.push(xAxisFilter);
+            }
+          }
+        }
+
         // Provide cross-filter for dimensions OR categorical X-axis (issue #25334)
         let crossFilter;
         if (hasDimensions) {
@@ -526,7 +577,11 @@ export default function EchartsTimeseries({
 
         onContextMenu(pointerEvent.clientX, pointerEvent.clientY, {
           drillToDetail: drillToDetailFilters,
-          drillBy: { filters: drillByFilters, groupbyFieldName: 'groupby' },
+          drillBy: {
+            filters: drillByFilters,
+            groupbyFieldName: 'groupby',
+            ...(xAxisFilters.length > 0 && { xAxisFilters }),
+          },
           crossFilter,
         });
       }

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/constants.ts

@@ -73,6 +73,7 @@ export const DEFAULT_FORM_DATA: EchartsTimeseriesFormData = {
   seriesType: EchartsTimeseriesSeriesType.Line,
   stack: false,
   tooltipTimeFormat: 'smart_date',
+  tooltipTruncation: 'end',
   xAxisTimeFormat: 'smart_date',
   xAxisNumberFormat: 'SMART_NUMBER',
   truncateXAxis: true,

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/transformProps.ts

@@ -30,6 +30,7 @@ import {
   DTTM_ALIAS,
   ensureIsArray,
   tooltipHtml,
+  truncateLabel,
   getCustomFormatter,
   getMetricLabel,
   getNumberFormatter,
@@ -303,6 +304,7 @@ export default function transformProps(
     tooltipSortByMetric,
     showTooltipTotal,
     showTooltipPercentage,
+    tooltipTruncation,
     truncateXAxis,
     truncateYAxis,
     xAxis: xAxisOrig,
@@ -1449,6 +1451,7 @@ export default function transformProps(
               seriesName: key,
               formatter,
               marker,
+              truncation: tooltipTruncation,
             });
 
             const annotationRow = annotationLayers.some(
@@ -1482,7 +1485,12 @@ export default function transformProps(
           }
           rows.push(totalRow);
         }
-        return tooltipHtml(rows, tooltipFormatter(xValue), focusedRow);
+        return tooltipHtml(
+          rows,
+          truncateLabel(tooltipFormatter(xValue), tooltipTruncation),
+          focusedRow,
+          tooltipTruncation,
+        );
       },
     },
     legend: {

superset-frontend/plugins/plugin-chart-echarts/src/Timeseries/types.ts

@@ -25,6 +25,7 @@ import {
   QueryFormMetric,
   TimeFormatter,
   TimeGranularity,
+  TooltipTruncationMode,
 } from '@superset-ui/core';
 import {
   BaseChartProps,
@@ -82,6 +83,7 @@ export type EchartsTimeseriesFormData = QueryFormData & {
   tooltipTimeFormat?: string;
   showTooltipTotal?: boolean;
   showTooltipPercentage?: boolean;
+  tooltipTruncation?: TooltipTruncationMode;
   truncateXAxis: boolean;
   truncateYAxis: boolean;
   yAxisFormat?: string;

superset-frontend/plugins/plugin-chart-echarts/src/components/Echart.test.tsx

@@ -16,9 +16,13 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { render, waitFor } from '../../../../spec/helpers/testing-library';
 import type { EChartsCoreOption } from 'echarts/core';
-import Echart, { isReportScreenshotMode } from './Echart';
+import { render, waitFor } from '../../../../spec/helpers/testing-library';
+import Echart, {
+  ECHARTS_HOST_CLASS,
+  ECHARTS_RENDER_FINISHED_CLASS,
+  isReportScreenshotMode,
+} from './Echart';
 import type { EchartsProps } from '../types';
 
 type Handler = (params: unknown) => void;
@@ -272,3 +276,31 @@ test('keeps animation enabled when not in report screenshot mode', async () => {
   const lastOptions = mockChart.setOption.mock.calls.at(-1)?.[0];
   expect(lastOptions.animation).not.toBe(false);
 });
+
+test('tags the ECharts canvas host with the readiness-gate class', async () => {
+  const { container } = render(renderEchart(), {
+    initialState,
+    useRedux: true,
+  });
+  await waitFor(() => expect(mockChart.setOption).toHaveBeenCalled());
+  expect(container.querySelector(`.${ECHARTS_HOST_CLASS}`)).not.toBeNull();
+});
+
+test('marks the host painted only on the ECharts `finished` event', async () => {
+  const { container } = render(renderEchart(), {
+    initialState,
+    useRedux: true,
+  });
+  await waitFor(() => expect(mockChart.setOption).toHaveBeenCalled());
+
+  const host = container.querySelector(`.${ECHARTS_HOST_CLASS}`) as HTMLElement;
+  expect(host).not.toBeNull();
+
+  // `setOption` ran during mount, which clears the marker; `finished` has not
+  // fired yet, so the host must NOT be flagged as painted.
+  expect(host).not.toHaveClass(ECHARTS_RENDER_FINISHED_CLASS);
+
+  // Simulate ECharts completing its draw -> the host is flagged painted.
+  trigger('finished');
+  expect(host).toHaveClass(ECHARTS_RENDER_FINISHED_CLASS);
+});

superset-frontend/plugins/plugin-chart-echarts/src/components/Echart.tsx

@@ -138,6 +138,15 @@ export function isReportScreenshotMode(): boolean {
   }
 }
 
+// Report-screenshot readiness contract (see superset/utils/screenshot_utils.py).
+// `echarts-host` marks the canvas host element; `echarts-render-finished` is
+// toggled OFF before each setOption and ON in the ECharts `finished` event --
+// the only signal that the canvas is fully painted (chartStatus/onRenderSuccess
+// both fire pre-paint). The readiness gate treats a host that lacks
+// `echarts-render-finished` as not-yet-painted so it never captures a blank chart.
+export const ECHARTS_HOST_CLASS = 'echarts-host';
+export const ECHARTS_RENDER_FINISHED_CLASS = 'echarts-render-finished';
+
 function Echart(
   {
     width,
@@ -201,6 +210,11 @@ function Echart(
           width,
           height,
         });
+        // Paint marker for the report-screenshot readiness gate. `finished`
+        // is the only event that guarantees the canvas is fully drawn.
+        chartRef.current.on('finished', () => {
+          divRef.current?.classList.add(ECHARTS_RENDER_FINISHED_CLASS);
+        });
       }
       // did mount
       handleSizeChange({ width, height });
@@ -321,6 +335,9 @@ function Echart(
             }
           )?.dataZoom
         : undefined;
+      // Clear the paint marker before (re)drawing; the `finished` handler
+      // re-adds it once the new frame is fully rendered.
+      divRef.current?.classList.remove(ECHARTS_RENDER_FINISHED_CLASS);
       chartRef.current?.setOption(themedEchartOptions, {
         notMerge,
         replaceMerge: notMerge ? undefined : ['series'],
@@ -412,7 +429,14 @@ function Echart(
     handleSizeChange({ width, height });
   }, [width, height, handleSizeChange]);
 
-  return <Styles ref={divRef} height={height} width={width} />;
+  return (
+    <Styles
+      ref={divRef}
+      className={ECHARTS_HOST_CLASS}
+      height={height}
+      width={width}
+    />
+  );
 }
 
 export default forwardRef(Echart);

superset-frontend/plugins/plugin-chart-echarts/src/controls.tsx

@@ -315,6 +315,27 @@ const tooltipPercentageControl: ControlSetItem = {
   },
 };
 
+const tooltipTruncationControl: ControlSetItem = {
+  name: 'tooltipTruncation',
+  config: {
+    type: 'SelectControl',
+    freeForm: false,
+    label: t('Truncate labels'),
+    renderTrigger: true,
+    default: 'end',
+    clearable: false,
+    choices: [
+      ['off', t('Off')],
+      ['end', t('End')],
+      ['start', t('Start')],
+      ['middle', t('Middle')],
+    ],
+    description: t(
+      'Where to place the ellipsis when a tooltip label is too long. Choose Off to always show the full label, or Start when labels share a common prefix.',
+    ),
+  },
+};
+
 export const richTooltipSection: ControlSetRow[] = [
   [<ControlSubSectionHeader>{t('Tooltip')}</ControlSubSectionHeader>],
   [richTooltipControl],
@@ -322,6 +343,7 @@ export const richTooltipSection: ControlSetRow[] = [
   [tooltipPercentageControl],
   [tooltipSortByMetricControl],
   [tooltipTimeFormatControl],
+  [tooltipTruncationControl],
 ];
 
 const sortSeriesType: ControlSetItem = {

superset-frontend/plugins/plugin-chart-echarts/src/utils/forecast.ts

@@ -16,7 +16,13 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { DataRecord, DTTM_ALIAS, ValueFormatter } from '@superset-ui/core';
+import {
+  DataRecord,
+  DTTM_ALIAS,
+  truncateLabel,
+  TooltipTruncationMode,
+  ValueFormatter,
+} from '@superset-ui/core';
 import type { OptionName, SeriesOption } from 'echarts/types/src/util/types';
 import type { TooltipMarker } from 'echarts/types/src/util/format';
 import {
@@ -91,12 +97,16 @@ export const formatForecastTooltipSeries = ({
   forecastUpper,
   marker,
   formatter,
+  truncation = 'end',
 }: ForecastValue & {
   seriesName: string;
   marker: TooltipMarker;
   formatter: ValueFormatter;
+  truncation?: TooltipTruncationMode;
 }): string[] => {
-  const name = `${marker}${sanitizeHtml(seriesName)}`;
+  // Truncate before sanitizing and before the marker is prepended: slicing a
+  // string that already contains markup would cut into the marker's tag.
+  const name = `${marker}${sanitizeHtml(truncateLabel(seriesName, truncation))}`;
   let value = typeof observation === 'number' ? formatter(observation) : '';
   // Use finite-number checks rather than truthiness so that legitimate
   // zero values (e.g. a forecast that crosses zero, or a confidence bound of

superset-frontend/plugins/plugin-chart-echarts/src/utils/xAxisDrillByFilter.ts

@@ -0,0 +1,164 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import {
+  BinaryQueryObjectFilterClause,
+  QueryFormColumn,
+  TimeGranularity,
+} from '@superset-ui/core';
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+
+/**
+ * Format a Date as a naive ISO datetime string (UTC, no timezone suffix),
+ * the format Superset's time range parser expects, e.g. "2021-01-01T00:00:00".
+ * Sub-second precision is preserved when present (e.g.
+ * "2021-01-01T00:00:00.123") so exact-match filters on high-frequency
+ * timestamps don't get truncated to the containing second.
+ */
+export const formatNaiveDateTime = (date: Date): string => {
+  const iso = date.toISOString();
+  return date.getUTCMilliseconds() === 0 ? iso.slice(0, 19) : iso.slice(0, 23);
+};
+
+/**
+ * Given the start (label) of a time bucket and its time grain, return the
+ * [since, until) range covering the bucket, using calendar-aware UTC
+ * arithmetic. Week-ending grains are labeled by the last day of the bucket,
+ * so their range extends backwards from the label. Returns undefined for
+ * unknown grains.
+ */
+export const getTimeBucketRange = (
+  bucketLabel: Date,
+  grain: TimeGranularity,
+): { since: Date; until: Date } | undefined => {
+  const until = new Date(bucketLabel.getTime());
+  switch (grain) {
+    case TimeGranularity.SECOND:
+      until.setUTCSeconds(until.getUTCSeconds() + 1);
+      break;
+    case TimeGranularity.MINUTE:
+      until.setUTCMinutes(until.getUTCMinutes() + 1);
+      break;
+    case TimeGranularity.FIVE_MINUTES:
+      until.setUTCMinutes(until.getUTCMinutes() + 5);
+      break;
+    case TimeGranularity.TEN_MINUTES:
+      until.setUTCMinutes(until.getUTCMinutes() + 10);
+      break;
+    case TimeGranularity.FIFTEEN_MINUTES:
+      until.setUTCMinutes(until.getUTCMinutes() + 15);
+      break;
+    case TimeGranularity.THIRTY_MINUTES:
+      until.setUTCMinutes(until.getUTCMinutes() + 30);
+      break;
+    case TimeGranularity.HOUR:
+      until.setUTCHours(until.getUTCHours() + 1);
+      break;
+    case TimeGranularity.DATE:
+    case TimeGranularity.DAY:
+      until.setUTCDate(until.getUTCDate() + 1);
+      break;
+    case TimeGranularity.WEEK:
+    case TimeGranularity.WEEK_STARTING_SUNDAY:
+    case TimeGranularity.WEEK_STARTING_MONDAY:
+      until.setUTCDate(until.getUTCDate() + 7);
+      break;
+    case TimeGranularity.WEEK_ENDING_SATURDAY:
+    case TimeGranularity.WEEK_ENDING_SUNDAY:
+      // These buckets are labeled with their last day: the bucket spans
+      // the 6 days before the label plus the label day itself.
+      until.setUTCDate(until.getUTCDate() + 1);
+      return { since: new Date(bucketLabel.getTime() - 6 * DAY_MS), until };
+    case TimeGranularity.MONTH:
+      until.setUTCMonth(until.getUTCMonth() + 1);
+      break;
+    case TimeGranularity.QUARTER:
+      until.setUTCMonth(until.getUTCMonth() + 3);
+      break;
+    case TimeGranularity.YEAR:
+      until.setUTCFullYear(until.getUTCFullYear() + 1);
+      break;
+    default:
+      return undefined;
+  }
+  return { since: new Date(bucketLabel.getTime()), until };
+};
+
+// Matches an explicit timezone designator (Z or ±HH:MM/±HHMM) at the end of
+// a datetime string.
+const TIMEZONE_SUFFIX_RE = /(Z|[+-]\d{2}:?\d{2})$/;
+
+/**
+ * Parse a datetime string the same way regardless of the host's local
+ * timezone. Superset's backend returns naive datetime strings (no timezone
+ * designator) that represent UTC instants; passing those directly to `new
+ * Date()` would interpret them as local wall-clock time and shift the
+ * result by the browser's UTC offset. Strings that already carry an
+ * explicit timezone designator are parsed as-is.
+ */
+const parseAsUtc = (value: string): Date =>
+  new Date(TIMEZONE_SUFFIX_RE.test(value) ? value : `${value}Z`);
+
+/**
+ * Build a drill-by filter clause matching the clicked value on a temporal
+ * x-axis. When a known time grain is active, the clause is a TEMPORAL_RANGE
+ * covering the clicked bucket; otherwise it falls back to an exact match on
+ * the timestamp.
+ */
+export const getTemporalXAxisDrillByFilter = (
+  col: QueryFormColumn,
+  value: unknown,
+  grain?: TimeGranularity,
+  formattedVal?: string,
+): BinaryQueryObjectFilterClause | undefined => {
+  if (
+    !col ||
+    (typeof value !== 'number' &&
+      typeof value !== 'string' &&
+      !(value instanceof Date))
+  ) {
+    return undefined;
+  }
+  let bucketLabel: Date;
+  if (value instanceof Date) {
+    bucketLabel = value;
+  } else if (typeof value === 'string') {
+    bucketLabel = parseAsUtc(value);
+  } else {
+    bucketLabel = new Date(value);
+  }
+  if (Number.isNaN(bucketLabel.getTime())) {
+    return undefined;
+  }
+  const range = grain ? getTimeBucketRange(bucketLabel, grain) : undefined;
+  if (!range) {
+    return {
+      col,
+      op: '==',
+      val: formatNaiveDateTime(bucketLabel),
+      formattedVal,
+    };
+  }
+  return {
+    col,
+    op: 'TEMPORAL_RANGE',
+    val: `${formatNaiveDateTime(range.since)} : ${formatNaiveDateTime(range.until)}`,
+    formattedVal,
+  };
+};

superset-frontend/plugins/plugin-chart-echarts/test/MixedTimeseries/transformProps.test.ts

@@ -27,6 +27,7 @@ import {
   VizType,
   ChartDataResponseResult,
   TimeGranularity,
+  TooltipTruncationMode,
 } from '@superset-ui/core';
 import { GenericDataType } from '@apache-superset/core/common';
 import {
@@ -1295,3 +1296,59 @@ test('y-axis title position: non-Left sets nameLocation to end', () => {
   expect(yAxis[1].nameGap).toEqual(30);
   expect(yAxis[1].nameLocation).toEqual('end');
 });
+describe('EchartsMixedTimeseries tooltip truncation', () => {
+  const longSeriesName = 'prod-us-east-1-service-checkout-latency-p99';
+  const marker = '<span style="background-color:#1f77b4;"></span>';
+
+  const buildTooltip = (tooltipTruncation?: TooltipTruncationMode) => {
+    const chartProps = createEchartsTimeseriesTestChartProps<
+      EchartsMixedTimeseriesFormData,
+      EchartsMixedTimeseriesProps
+    >({
+      ...MIXED_TIMESERIES_CHART_PROPS_DEFAULTS,
+      defaultQueriesData: queriesData,
+      formData: {
+        ...formData,
+        ...(tooltipTruncation ? { tooltipTruncation } : {}),
+      },
+      queriesData,
+    });
+    const { echartOptions } = transformProps(chartProps);
+    const { formatter } = echartOptions.tooltip as {
+      formatter: (params: unknown) => string;
+    };
+    // richTooltip is false in this fixture, so the trigger is 'item' and the
+    // formatter receives a single param object rather than an array.
+    return formatter({
+      seriesId: longSeriesName,
+      seriesName: longSeriesName,
+      value: [599616000000, 1],
+      marker,
+    });
+  };
+
+  test('keeps full text with the CSS cap by default', () => {
+    const html = buildTooltip();
+    expect(html.replace(/\s/g, '')).toContain('max-width:300px');
+    expect(html).toContain(longSeriesName);
+  });
+
+  test('removes the cap and keeps full text when off', () => {
+    const html = buildTooltip('off');
+    expect(html).not.toContain('max-width');
+    expect(html).toContain(longSeriesName);
+  });
+
+  test('drops the shared prefix when truncating from the start', () => {
+    const html = buildTooltip('start');
+    expect(html).not.toContain('prod-us-east');
+    expect(html).toContain('latency-p99');
+    expect(html).toContain('background-color:#1f77b4');
+  });
+
+  test('keeps both ends when truncating the middle', () => {
+    const html = buildTooltip('middle');
+    expect(html).toContain('prod-us-east-1-servi…heckout-latency-p99');
+    expect(html).not.toContain(longSeriesName);
+  });
+});

superset-frontend/plugins/plugin-chart-echarts/test/Timeseries/transformProps.test.ts

@@ -32,6 +32,7 @@ import {
   TimeseriesAnnotationLayer,
   ChartDataResponseResult,
   TimeGranularity,
+  TooltipTruncationMode,
 } from '@superset-ui/core';
 import { GenericDataType } from '@apache-superset/core/common';
 import { supersetTheme } from '@apache-superset/core/theme';
@@ -2437,3 +2438,94 @@ test('honors the snake_case flag the compare-chart migration stores in params',
     [BASE_TIMESTAMP + 300000000, 2],
   ]);
 });
+describe('EchartsTimeseries tooltip truncation', () => {
+  const longSeriesName = 'prod-us-east-1-service-checkout-latency-p99';
+  const marker = '<span style="background-color:#1f77b4;"></span>';
+
+  const buildTooltip = (
+    tooltipTruncation?: TooltipTruncationMode,
+    xValue: string | number = 599616000000,
+  ) => {
+    const chartProps = new ChartProps({
+      formData: {
+        colorScheme: 'bnbColors',
+        datasource: '3__table',
+        granularity_sqla: 'ds',
+        metric: 'sum__num',
+        groupby: ['foo'],
+        viz_type: 'my_viz',
+        ...(tooltipTruncation ? { tooltipTruncation } : {}),
+      } as SqlaFormData,
+      width: 800,
+      height: 600,
+      queriesData: [
+        {
+          data: [
+            { [longSeriesName]: 1, __timestamp: 599616000000 },
+            { [longSeriesName]: 3, __timestamp: 599916000000 },
+          ],
+        },
+      ],
+      theme: supersetTheme,
+    });
+    const { echartOptions } = transformProps(
+      chartProps as EchartsTimeseriesChartProps,
+    );
+    const { formatter } = echartOptions.tooltip as {
+      formatter: (params: unknown) => string;
+    };
+    return formatter([
+      {
+        seriesId: longSeriesName,
+        seriesName: longSeriesName,
+        value: [xValue, 1],
+        marker,
+      },
+    ]);
+  };
+
+  test('applies the CSS cap and keeps full text by default', () => {
+    const html = buildTooltip();
+    expect(html).toContain(longSeriesName);
+    // sanitizeHtml normalizes spacing inside style attributes, so compare with
+    // whitespace stripped rather than hard-coding one version's formatting.
+    expect(html.replace(/\s/g, '')).toContain('max-width:300px');
+  });
+
+  test('removes the cap and keeps full text when off', () => {
+    const html = buildTooltip('off');
+    expect(html).not.toContain('max-width');
+    expect(html).toContain(longSeriesName);
+  });
+
+  test('drops the shared prefix when truncating from the start', () => {
+    const html = buildTooltip('start');
+    expect(html).not.toContain('prod-us-east');
+    expect(html).toContain('latency-p99');
+    expect(html.replace(/\s/g, '')).toContain('white-space:nowrap');
+  });
+
+  test('keeps both ends when truncating the middle', () => {
+    const html = buildTooltip('middle');
+    expect(html).toContain('prod-us-east-1-servi…heckout-latency-p99');
+    expect(html).not.toContain(longSeriesName);
+  });
+
+  test('preserves the echarts marker in every mode', () => {
+    (['off', 'end', 'start', 'middle'] as const).forEach(mode => {
+      expect(buildTooltip(mode)).toContain('background-color:#1f77b4');
+    });
+  });
+
+  test('truncates a long non-temporal x-axis title', () => {
+    const longCategory = 'prod-us-east-1-service-checkout-cohort-2026';
+    const html = buildTooltip('start', longCategory);
+    expect(html).not.toContain(longCategory);
+    expect(html).toContain('cohort-2026');
+  });
+
+  test('leaves a long title alone in the default mode', () => {
+    const longCategory = 'prod-us-east-1-service-checkout-cohort-2026';
+    expect(buildTooltip(undefined, longCategory)).toContain(longCategory);
+  });
+});

superset-frontend/plugins/plugin-chart-echarts/test/utils/forecast.test.ts

@@ -16,7 +16,11 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { getNumberFormatter, NumberFormats } from '@superset-ui/core';
+import {
+  getNumberFormatter,
+  NumberFormats,
+  TRUNCATION_MAX_CHARS,
+} from '@superset-ui/core';
 import { SeriesOption } from 'echarts';
 import {
   extractForecastSeriesContext,
@@ -411,3 +415,52 @@ test('formatForecastTooltipSeries should skip non-finite forecast values', () =>
     }),
   ).toEqual(['<img>qwerty', '10']);
 });
+
+describe('formatForecastTooltipSeries truncation', () => {
+  const marker =
+    '<span style="display:inline-block;width:10px;height:10px;background-color:#1f77b4;"></span>';
+  const longName = 'prod-us-east-1-service-checkout-latency-p99'; // 43 chars
+  const intFormatter = getNumberFormatter(NumberFormats.INTEGER);
+
+  const format = (truncation?: 'off' | 'end' | 'start' | 'middle') =>
+    formatForecastTooltipSeries({
+      seriesName: longName,
+      observation: 1,
+      marker,
+      formatter: intFormatter,
+      ...(truncation ? { truncation } : {}),
+    })[0];
+
+  test('leaves the name intact by default and for off/end', () => {
+    expect(format()).toContain(longName);
+    expect(format('off')).toContain(longName);
+    expect(format('end')).toContain(longName);
+  });
+
+  test('slices the start of the name without harming the marker', () => {
+    const cell = format('start');
+    expect(cell).toContain(marker);
+    expect(cell).toContain('…-us-east-1-service-checkout-latency-p99');
+    expect(cell).not.toContain('prod-us-east');
+  });
+
+  test('slices the middle of the name without harming the marker', () => {
+    const cell = format('middle');
+    expect(cell).toContain(marker);
+    expect(cell).toContain('prod-us-east-1-servi…heckout-latency-p99');
+  });
+
+  test('measures the budget against the name, not the marker markup', () => {
+    // The marker alone is far longer than the budget. If truncation were
+    // applied to the concatenated cell, a short name would be mangled.
+    expect(marker.length).toBeGreaterThan(TRUNCATION_MAX_CHARS);
+    const [cell] = formatForecastTooltipSeries({
+      seriesName: 'cpu',
+      observation: 1,
+      marker,
+      formatter: intFormatter,
+      truncation: 'start',
+    });
+    expect(cell).toBe(`${marker}cpu`);
+  });
+});

superset-frontend/plugins/plugin-chart-echarts/test/utils/xAxisDrillByFilter.test.ts

@@ -0,0 +1,238 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { TimeGranularity } from '@superset-ui/core';
+import {
+  formatNaiveDateTime,
+  getTemporalXAxisDrillByFilter,
+  getTimeBucketRange,
+} from '../../src/utils/xAxisDrillByFilter';
+
+const utc = (dateString: string) => new Date(`${dateString}Z`);
+
+const expectRange = (
+  bucketLabel: string,
+  grain: TimeGranularity,
+  since: string,
+  until: string,
+) => {
+  const range = getTimeBucketRange(utc(bucketLabel), grain);
+  expect(range).toBeDefined();
+  expect(formatNaiveDateTime(range!.since)).toEqual(since);
+  expect(formatNaiveDateTime(range!.until)).toEqual(until);
+};
+
+/* eslint jest/expect-expect: ["warn", { "assertFunctionNames": ["expect*"] }] */
+
+test('getTimeBucketRange computes sub-daily buckets', () => {
+  expectRange(
+    '2021-03-14T01:59:00',
+    TimeGranularity.MINUTE,
+    '2021-03-14T01:59:00',
+    '2021-03-14T02:00:00',
+  );
+  expectRange(
+    '2021-03-14T01:30:00',
+    TimeGranularity.THIRTY_MINUTES,
+    '2021-03-14T01:30:00',
+    '2021-03-14T02:00:00',
+  );
+  expectRange(
+    '2021-03-14T23:00:00',
+    TimeGranularity.HOUR,
+    '2021-03-14T23:00:00',
+    '2021-03-15T00:00:00',
+  );
+});
+
+test('getTimeBucketRange computes daily and weekly buckets', () => {
+  expectRange(
+    '2021-12-31T00:00:00',
+    TimeGranularity.DAY,
+    '2021-12-31T00:00:00',
+    '2022-01-01T00:00:00',
+  );
+  expectRange(
+    '2021-04-26T00:00:00',
+    TimeGranularity.WEEK,
+    '2021-04-26T00:00:00',
+    '2021-05-03T00:00:00',
+  );
+  expectRange(
+    '2021-04-25T00:00:00',
+    TimeGranularity.WEEK_STARTING_SUNDAY,
+    '2021-04-25T00:00:00',
+    '2021-05-02T00:00:00',
+  );
+});
+
+test('getTimeBucketRange extends week-ending buckets backwards from their label', () => {
+  expectRange(
+    '2021-05-01T00:00:00',
+    TimeGranularity.WEEK_ENDING_SATURDAY,
+    '2021-04-25T00:00:00',
+    '2021-05-02T00:00:00',
+  );
+  expectRange(
+    '2021-05-02T00:00:00',
+    TimeGranularity.WEEK_ENDING_SUNDAY,
+    '2021-04-26T00:00:00',
+    '2021-05-03T00:00:00',
+  );
+});
+
+test('getTimeBucketRange respects calendar month lengths', () => {
+  expectRange(
+    '2021-01-01T00:00:00',
+    TimeGranularity.MONTH,
+    '2021-01-01T00:00:00',
+    '2021-02-01T00:00:00',
+  );
+  expectRange(
+    '2021-02-01T00:00:00',
+    TimeGranularity.MONTH,
+    '2021-02-01T00:00:00',
+    '2021-03-01T00:00:00',
+  );
+  expectRange(
+    '2024-02-01T00:00:00',
+    TimeGranularity.MONTH,
+    '2024-02-01T00:00:00',
+    '2024-03-01T00:00:00',
+  );
+  expectRange(
+    '2021-12-01T00:00:00',
+    TimeGranularity.MONTH,
+    '2021-12-01T00:00:00',
+    '2022-01-01T00:00:00',
+  );
+});
+
+test('getTimeBucketRange computes quarter and year buckets', () => {
+  expectRange(
+    '2021-10-01T00:00:00',
+    TimeGranularity.QUARTER,
+    '2021-10-01T00:00:00',
+    '2022-01-01T00:00:00',
+  );
+  expectRange(
+    '2024-01-01T00:00:00',
+    TimeGranularity.YEAR,
+    '2024-01-01T00:00:00',
+    '2025-01-01T00:00:00',
+  );
+});
+
+test('getTimeBucketRange returns undefined for unknown grains', () => {
+  expect(
+    getTimeBucketRange(utc('2021-01-01T00:00:00'), 'P1D2H' as TimeGranularity),
+  ).toBeUndefined();
+});
+
+test('getTemporalXAxisDrillByFilter builds a temporal range for known grains', () => {
+  expect(
+    getTemporalXAxisDrillByFilter(
+      'ds',
+      utc('2021-01-01T00:00:00').getTime(),
+      TimeGranularity.MONTH,
+      'Jan 2021',
+    ),
+  ).toEqual({
+    col: 'ds',
+    op: 'TEMPORAL_RANGE',
+    val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
+    formattedVal: 'Jan 2021',
+  });
+});
+
+test('getTemporalXAxisDrillByFilter falls back to exact match without a grain', () => {
+  expect(
+    getTemporalXAxisDrillByFilter(
+      'ds',
+      utc('2021-01-01T12:34:56').getTime(),
+      undefined,
+      '2021-01-01 12:34:56',
+    ),
+  ).toEqual({
+    col: 'ds',
+    op: '==',
+    val: '2021-01-01T12:34:56',
+    formattedVal: '2021-01-01 12:34:56',
+  });
+});
+
+test('getTemporalXAxisDrillByFilter preserves sub-second precision in the exact-match fallback', () => {
+  expect(
+    getTemporalXAxisDrillByFilter(
+      'ds',
+      new Date('2021-01-01T12:34:56.123Z').getTime(),
+      undefined,
+      '2021-01-01 12:34:56.123',
+    ),
+  ).toEqual({
+    col: 'ds',
+    op: '==',
+    val: '2021-01-01T12:34:56.123',
+    formattedVal: '2021-01-01 12:34:56.123',
+  });
+});
+
+test('getTemporalXAxisDrillByFilter falls back to exact match for unknown grains', () => {
+  expect(
+    getTemporalXAxisDrillByFilter(
+      'ds',
+      utc('2021-01-01T00:00:00').getTime(),
+      'P1D2H' as TimeGranularity,
+    ),
+  ).toMatchObject({ op: '==', val: '2021-01-01T00:00:00' });
+});
+
+test('getTemporalXAxisDrillByFilter accepts parseable date strings and Dates', () => {
+  expect(
+    getTemporalXAxisDrillByFilter(
+      'ds',
+      '2021-01-01T00:00:00Z',
+      TimeGranularity.DAY,
+    ),
+  ).toMatchObject({
+    op: 'TEMPORAL_RANGE',
+    val: '2021-01-01T00:00:00 : 2021-01-02T00:00:00',
+  });
+  expect(
+    getTemporalXAxisDrillByFilter(
+      'ds',
+      utc('2021-01-01T00:00:00'),
+      TimeGranularity.DAY,
+    ),
+  ).toMatchObject({
+    op: 'TEMPORAL_RANGE',
+    val: '2021-01-01T00:00:00 : 2021-01-02T00:00:00',
+  });
+});
+
+test('getTemporalXAxisDrillByFilter returns undefined for unusable input', () => {
+  expect(
+    getTemporalXAxisDrillByFilter('ds', 'not a date', TimeGranularity.DAY),
+  ).toBeUndefined();
+  expect(
+    getTemporalXAxisDrillByFilter('ds', null, TimeGranularity.DAY),
+  ).toBeUndefined();
+  expect(
+    getTemporalXAxisDrillByFilter('', 1609459200000, TimeGranularity.DAY),
+  ).toBeUndefined();
+});

superset-frontend/plugins/plugin-chart-point-cluster-map/package.json

@@ -30,10 +30,10 @@
   },
   "dependencies": {
     "@math.gl/web-mercator": "^4.1.0",
-    "mapbox-gl": "^3.28.0",
+    "mapbox-gl": "^3.28.1",
     "maplibre-gl": "^5.24.0",
     "react-map-gl": "^8.1.2",
-    "supercluster": "^8.0.1"
+    "supercluster": "^9.0.0"
   },
   "peerDependencies": {
     "@apache-superset/core": "*",

superset-frontend/scripts/bundle-size-summary.js

@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied.  See the License for the specific language governing
+ * permissions and limitations under the License.
+ */
+
+// Reduces a webpack `--json` stats file down to the handful of headline
+// numbers worth tracking over time, in the flat array format
+// benchmark-action/github-action-benchmark expects for its
+// "customSmallerIsBetter" tool. The full stats file also includes a
+// `modules`/`chunks` graph across ~15k modules, which is enormous and not
+// useful for this purpose, so we only ever read `entrypoints`.
+//
+// Usage: node scripts/bundle-size-summary.js <path-to-stats.json>
+
+const fs = require('fs');
+
+// Entrypoints worth tracking: the two user-facing app shells. `menu`,
+// `preamble`, `theme`, and `service-worker` are small, low-variance
+// infrastructure chunks, not where bundle bloat actually shows up.
+const TRACKED_ENTRYPOINTS = ['spa', 'embedded'];
+
+function entrypointSizeByExt(entrypoint, ext) {
+  return (entrypoint.assets || [])
+    .filter(asset => asset.name.endsWith(ext))
+    .reduce((total, asset) => total + asset.size, 0);
+}
+
+function main() {
+  const statsPath = process.argv[2];
+  if (!statsPath) {
+    console.error('Usage: bundle-size-summary.js <path-to-stats.json>');
+    process.exit(1);
+  }
+
+  const stats = JSON.parse(fs.readFileSync(statsPath, 'utf8'));
+  const { entrypoints } = stats;
+  if (!entrypoints) {
+    console.error(
+      'stats.json has no `entrypoints` key -- was it built with ' +
+        '`BUNDLE_SIZE_STATS=true` set? Without it, webpack.config.js uses ' +
+        '`stats: "minimal"`, which omits `entrypoints`.',
+    );
+    process.exit(1);
+  }
+
+  const results = [];
+  TRACKED_ENTRYPOINTS.forEach(name => {
+    const entrypoint = entrypoints[name];
+    if (!entrypoint) {
+      console.error(`stats.json is missing the "${name}" entrypoint`);
+      process.exit(1);
+    }
+    results.push({
+      name: `${name} entrypoint (JS)`,
+      unit: 'bytes',
+      value: entrypointSizeByExt(entrypoint, '.js'),
+    });
+    results.push({
+      name: `${name} entrypoint (CSS)`,
+      unit: 'bytes',
+      value: entrypointSizeByExt(entrypoint, '.css'),
+    });
+  });
+
+  console.log(JSON.stringify(results, null, 2));
+}
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = { entrypointSizeByExt, main, TRACKED_ENTRYPOINTS };

superset-frontend/scripts/oxlint-metrics-uploader.js

@@ -35,6 +35,43 @@ if (SERVICE_ACCOUNT_KEY.client_email) {
 
 const DATETIME = new Date().toISOString().replace(/T/, ' ').replace(/\..+/, '');
 
+/**
+ * Turn an oxlint diagnostic code into the canonical rule id used by the metrics
+ * series.
+ *
+ * oxlint reports `<plugin>(<rule>)`, where the plugin is the linter the rule came
+ * from: `eslint(no-console)`, `react-hooks(exhaustive-deps)`, `react(jsx-key)`,
+ * `jest(no-conditional-expect)`, `oxc(erasing-op)`, and the legacy
+ * `eslint-plugin-unicorn(no-new-array)` spelling.
+ *
+ * `eslint` is the implicit namespace, so its rules keep their bare name and stay
+ * comparable with the rows recorded before the oxlint migration. Every other
+ * plugin becomes `<plugin>/<rule>`, which is the id those rules are known by in
+ * config and in the pre-migration history.
+ *
+ * @param {string | undefined} code the diagnostic's `code` field
+ * @returns {string} the rule id to record
+ */
+function parseRuleId(code) {
+  if (!code) {
+    return 'unknown';
+  }
+
+  const match = code.match(/^([\w-]+)\(([^)]+)\)$/);
+  if (!match) {
+    return code;
+  }
+
+  const [, namespace, rule] = match;
+  if (namespace === 'eslint') {
+    return rule;
+  }
+
+  // `eslint-plugin-unicorn(...)` is the same rule as `unicorn/...`
+  const plugin = namespace.replace(/^eslint-plugin-/, '');
+  return `${plugin}/${rule}`;
+}
+
 async function writeToGoogleSheet(data, range, headers, append = false) {
   if (!sheets) {
     console.log('No Google Sheets credentials, skipping upload');
@@ -101,17 +138,7 @@ async function runOxlintAndProcess() {
     // OXC JSON format has diagnostics array
     if (results.diagnostics && Array.isArray(results.diagnostics)) {
       results.diagnostics.forEach(diagnostic => {
-        // Extract rule ID from code like "eslint(no-unused-vars)" or "eslint-plugin-unicorn(no-new-array)"
-        const codeMatch = diagnostic.code?.match(
-          /^(?:eslint(?:-plugin-(\w+))?\()([^)]+)\)$/,
-        );
-        let ruleId = diagnostic.code || 'unknown';
-
-        if (codeMatch) {
-          const plugin = codeMatch[1];
-          const rule = codeMatch[2];
-          ruleId = plugin ? `${plugin}/${rule}` : rule;
-        }
+        const ruleId = parseRuleId(diagnostic.code);
 
         const file = diagnostic.filename || 'unknown';
         const line = diagnostic.labels?.[0]?.span?.line || 0;
@@ -251,5 +278,10 @@ async function runOxlintAndProcess() {
   }
 }
 
-// Run the process
-runOxlintAndProcess().catch(console.error);
+// Run the process, unless this file was imported (e.g. by a test) rather than
+// executed, in which case nothing should be linted or uploaded on import.
+if (require.main === module) {
+  runOxlintAndProcess().catch(console.error);
+}
+
+module.exports = { parseRuleId };

superset-frontend/spec/helpers/testing-library.tsx

@@ -164,7 +164,7 @@ export async function selectOption(option: string, selectName?: string) {
   const item = await waitFor(() =>
     within(
       // eslint-disable-next-line testing-library/no-node-access
-      document.querySelector('.rc-virtual-list')!,
+      document.querySelector('.ant-select-dropdown-list')!,
     ).getByText(option),
   );
   await userEvent.click(item);

superset-frontend/spec/scripts/bundle-size-summary.test.js

@@ -0,0 +1,110 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+const fs = require('fs');
+const {
+  entrypointSizeByExt,
+  main,
+} = require('../../scripts/bundle-size-summary');
+
+function mockStats(entrypoints) {
+  jest
+    .spyOn(fs, 'readFileSync')
+    .mockReturnValue(JSON.stringify({ entrypoints }));
+}
+
+function mockExit() {
+  return jest.spyOn(process, 'exit').mockImplementation(() => {
+    throw new Error('process.exit called');
+  });
+}
+
+const originalArgv = process.argv;
+
+afterEach(() => {
+  jest.restoreAllMocks();
+  process.argv = originalArgv;
+});
+
+test('entrypointSizeByExt sums only assets matching the given extension', () => {
+  const entrypoint = {
+    assets: [
+      { name: 'spa.entry.js', size: 100 },
+      { name: 'spa.entry.js.map', size: 500 },
+      { name: 'spa.entry.css', size: 20 },
+    ],
+  };
+  expect(entrypointSizeByExt(entrypoint, '.js')).toBe(100);
+  expect(entrypointSizeByExt(entrypoint, '.css')).toBe(20);
+});
+
+test('entrypointSizeByExt returns 0 when the entrypoint has no assets', () => {
+  expect(entrypointSizeByExt({}, '.js')).toBe(0);
+});
+
+test('main prints byte totals for every tracked entrypoint', () => {
+  mockStats({
+    spa: { assets: [{ name: 'spa.js', size: 100 }] },
+    embedded: { assets: [{ name: 'embedded.js', size: 50 }] },
+  });
+  const logSpy = jest.spyOn(console, 'log').mockImplementation(() => {});
+  process.argv = ['node', 'bundle-size-summary.js', 'stats.json'];
+
+  main();
+
+  const printed = JSON.parse(logSpy.mock.calls[0][0]);
+  expect(printed).toEqual([
+    { name: 'spa entrypoint (JS)', unit: 'bytes', value: 100 },
+    { name: 'spa entrypoint (CSS)', unit: 'bytes', value: 0 },
+    { name: 'embedded entrypoint (JS)', unit: 'bytes', value: 50 },
+    { name: 'embedded entrypoint (CSS)', unit: 'bytes', value: 0 },
+  ]);
+});
+
+test('main exits with an error when a tracked entrypoint is missing from stats.json', () => {
+  mockStats({ spa: { assets: [] } });
+  const errorSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+  mockExit();
+  process.argv = ['node', 'bundle-size-summary.js', 'stats.json'];
+
+  expect(main).toThrow('process.exit called');
+  expect(errorSpy).toHaveBeenCalledWith(
+    expect.stringContaining('missing the "embedded" entrypoint'),
+  );
+});
+
+test('main exits with an error when stats.json has no `entrypoints` key', () => {
+  jest.spyOn(fs, 'readFileSync').mockReturnValue(JSON.stringify({}));
+  const errorSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+  mockExit();
+  process.argv = ['node', 'bundle-size-summary.js', 'stats.json'];
+
+  expect(main).toThrow('process.exit called');
+  expect(errorSpy).toHaveBeenCalledWith(
+    expect.stringContaining('no `entrypoints` key'),
+  );
+});
+
+test('main prints a usage message and exits when no stats path is given', () => {
+  const errorSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+  mockExit();
+  process.argv = ['node', 'bundle-size-summary.js'];
+
+  expect(main).toThrow('process.exit called');
+  expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('Usage:'));
+});

superset-frontend/spec/scripts/oxlint-metrics-uploader.test.js

@@ -0,0 +1,58 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+const { parseRuleId } = require('../../scripts/oxlint-metrics-uploader');
+
+test('eslint rules keep their bare name', () => {
+  expect(parseRuleId('eslint(no-console)')).toBe('no-console');
+  expect(parseRuleId('eslint(prefer-destructuring)')).toBe(
+    'prefer-destructuring',
+  );
+});
+
+test('plugin rules are recorded under plugin/rule (#42981)', () => {
+  // These are the codes oxlint actually emits. They previously fell through to
+  // the raw `react-hooks(exhaustive-deps)` string, so the rows no longer lined
+  // up with the ids the same rules were recorded under before the migration.
+  expect(parseRuleId('react-hooks(exhaustive-deps)')).toBe(
+    'react-hooks/exhaustive-deps',
+  );
+  expect(parseRuleId('react-hooks(rules-of-hooks)')).toBe(
+    'react-hooks/rules-of-hooks',
+  );
+  expect(parseRuleId('react(jsx-key)')).toBe('react/jsx-key');
+  expect(parseRuleId('jest(no-conditional-expect)')).toBe(
+    'jest/no-conditional-expect',
+  );
+  expect(parseRuleId('oxc(erasing-op)')).toBe('oxc/erasing-op');
+  expect(parseRuleId('typescript(no-explicit-any)')).toBe(
+    'typescript/no-explicit-any',
+  );
+});
+
+test('the legacy eslint-plugin- prefix still collapses to the plugin name', () => {
+  expect(parseRuleId('eslint-plugin-unicorn(no-new-array)')).toBe(
+    'unicorn/no-new-array',
+  );
+});
+
+test('an unrecognized or missing code is passed through rather than dropped', () => {
+  expect(parseRuleId('something-unparseable')).toBe('something-unparseable');
+  expect(parseRuleId(undefined)).toBe('unknown');
+  expect(parseRuleId('')).toBe('unknown');
+});

superset-frontend/src/SqlLab/reducers/sqlLab.test.ts

@@ -695,6 +695,49 @@ describe('sqlLabReducer', () => {
       );
       expect(newState.queries['sync-query'].state).toBe(QueryState.Fetching);
     });
+    test('should move an async query from running to success when polling reports it finished', () => {
+      const asyncQuery = {
+        ...query,
+        id: 'async-query',
+        state: QueryState.Running,
+        runAsync: true,
+      };
+      newState = sqlLabReducer(
+        {
+          ...newState,
+          queries: { 'async-query': asyncQuery },
+        },
+        actions.refreshQueries({
+          'async-query': {
+            ...asyncQuery,
+            state: QueryState.Success,
+          },
+        }),
+      );
+      expect(newState.queries['async-query'].state).toBe(QueryState.Success);
+    });
+    test('should downgrade a premature poller success to fetching for a running sync query', () => {
+      const syncQuery = {
+        ...query,
+        id: 'sync-running',
+        state: QueryState.Running,
+        runAsync: false,
+        results: null,
+      };
+      newState = sqlLabReducer(
+        {
+          ...newState,
+          queries: { 'sync-running': syncQuery },
+        },
+        actions.refreshQueries({
+          'sync-running': {
+            ...syncQuery,
+            state: QueryState.Success,
+          },
+        }),
+      );
+      expect(newState.queries['sync-running'].state).toBe(QueryState.Fetching);
+    });
   });
   // eslint-disable-next-line no-restricted-globals -- TODO: Migrate from describe blocks
   describe('CLEAR_INACTIVE_QUERIES', () => {

superset-frontend/src/SqlLab/reducers/sqlLab.ts

@@ -769,14 +769,15 @@ export default function sqlLabReducer(
               }),
               // race condition:
               // because of async behavior, sql lab may still poll a couple of seconds
-              // when it started fetching or finished rendering results
+              // after it started fetching or finished rendering results. Guard only
+              // against re-applying a redundant Success onto a state that's already at
+              // or past Success (Fetching/Success) — Running is strictly before
+              // Success, so an incoming Success there is new information, not a stale
+              // poll, and must be allowed through (otherwise an async query can never
+              // leave Running once observed there).
               state:
                 currentState === QueryState.Success &&
-                [
-                  QueryState.Fetching,
-                  QueryState.Success,
-                  QueryState.Running,
-                ].includes(prevState)
+                [QueryState.Fetching, QueryState.Success].includes(prevState)
                   ? prevState
                   : currentState,
             };

superset-frontend/src/components/Chart/ChartContextMenu/ChartContextMenu.test.tsx

@@ -17,7 +17,7 @@
  * under the License.
  */
 import { useRef, useState } from 'react';
-import { FeatureFlag, VizType } from '@superset-ui/core';
+import { ContextMenuFilters, FeatureFlag, VizType } from '@superset-ui/core';
 import { render, screen, waitFor } from 'spec/helpers/testing-library';
 import userEvent from '@testing-library/user-event';
 import mockState from 'spec/fixtures/mockState';
@@ -30,6 +30,35 @@ import ChartContextMenu, {
 
 jest.mock('src/utils/cachedSupersetGet');
 
+// The scope-selector behavior within the submenu (which filters get built
+// for x-axis/series/both) is covered by DrillBySubmenu.test.tsx. Here we
+// only need a stand-in that lets us trigger onDrillBy with a distinguishable
+// config, so we can assert ChartContextMenu wires it into the modal.
+jest.mock('../DrillBy/DrillBySubmenu', () => ({
+  DrillBySubmenu: ({ onDrillBy }: any) => (
+    <button
+      type="button"
+      data-test="fake-drill-by-submenu"
+      onClick={() =>
+        onDrillBy(
+          { column_name: 'city', groupby: true },
+          { id: 1, columns: [], metrics: [] },
+          { filters: [{ col: 'selected_scope' }], groupbyFieldName: 'groupby' },
+        )
+      }
+    >
+      Fake Drill By
+    </button>
+  ),
+}));
+
+jest.mock('src/components/Chart/DrillBy/DrillByModal', () => ({
+  __esModule: true,
+  default: ({ drillByConfig }: any) => (
+    <div data-test="drill-by-modal">{JSON.stringify(drillByConfig)}</div>
+  ),
+}));
+
 const mockCachedSupersetGet = cachedSupersetGet as jest.MockedFunction<
   typeof cachedSupersetGet
 >;
@@ -39,7 +68,11 @@ const defaultFormData = {
   viz_type: VizType.Pie,
 };
 
-const TestWrapper = () => {
+const TestWrapper = ({
+  openFilters = {},
+}: {
+  openFilters?: ContextMenuFilters;
+}) => {
   const contextMenuRef = useRef<ChartContextMenuRef>(null);
   const [isTooltipVisible, setIsTooltipVisible] = useState(true);
 
@@ -51,7 +84,7 @@ const TestWrapper = () => {
     <>
       <button
         type="button"
-        onClick={() => contextMenuRef.current?.open(100, 100, {})}
+        onClick={() => contextMenuRef.current?.open(100, 100, openFilters)}
         data-test="open-context-menu"
       >
         Open Context Menu
@@ -71,8 +104,8 @@ const TestWrapper = () => {
   );
 };
 
-const setup = () =>
-  render(<TestWrapper />, {
+const setup = (openFilters?: ContextMenuFilters) =>
+  render(<TestWrapper openFilters={openFilters} />, {
     useRedux: true,
     initialState: {
       ...mockState,
@@ -150,3 +183,30 @@ test('tooltip is restored when user selects a menu item', async () => {
     expect(screen.getByTestId('tooltip-visible')).toBeInTheDocument();
   });
 });
+
+test('drill by modal uses the scope selected in the submenu over the raw context filters', async () => {
+  setup({
+    drillBy: {
+      filters: [{ col: 'raw_scope', op: '==', val: 'raw' }],
+      groupbyFieldName: 'groupby',
+    },
+  });
+
+  userEvent.click(screen.getByTestId('open-context-menu'));
+
+  await waitFor(() => {
+    expect(screen.getByTestId('chart-context-menu')).toBeInTheDocument();
+  });
+
+  const submenuButton = await screen.findByTestId('fake-drill-by-submenu');
+  userEvent.click(submenuButton);
+
+  await waitFor(() => {
+    expect(screen.getByTestId('drill-by-modal')).toBeInTheDocument();
+  });
+
+  const modalConfig = JSON.parse(
+    screen.getByTestId('drill-by-modal').textContent || '{}',
+  );
+  expect(modalConfig.filters).toEqual([{ col: 'selected_scope' }]);
+});

superset-frontend/src/components/Chart/ChartContextMenu/ChartContextMenu.tsx

@@ -55,6 +55,7 @@ import { getMenuAdjustedY } from '../utils';
 import { DrillBySubmenu } from '../DrillBy/DrillBySubmenu';
 import DrillDetailModal from '../DrillDetail/DrillDetailModal';
 import { MenuItemTooltip } from '../DisabledMenuItemTooltip';
+import { Dataset } from '../types';
 
 export enum ContextMenuItem {
   CrossFilter,
@@ -155,6 +156,10 @@ const ChartContextMenu = (
 
   const [drillModalIsOpen, setDrillModalIsOpen] = useState(false);
   const [drillByColumn, setDrillByColumn] = useState<Column>();
+  // Drill by config as selected in the submenu (e.g. with the chosen
+  // x-axis/series filter scope applied), used over the raw context filters
+  const [selectedDrillByConfig, setSelectedDrillByConfig] =
+    useState<ContextMenuFilters['drillBy']>();
   const [showDrillByModal, setShowDrillByModal] = useState(false);
 
   const closeContextMenu = useCallback(() => {
@@ -162,10 +167,18 @@ const ChartContextMenu = (
     onClose();
   }, [onClose]);
 
-  const handleDrillBy = useCallback((column: Column) => {
-    setDrillByColumn(column);
-    setShowDrillByModal(true);
-  }, []);
+  const handleDrillBy = useCallback(
+    (
+      column: Column,
+      _dataset: Dataset,
+      drillByConfig?: ContextMenuFilters['drillBy'],
+    ) => {
+      setDrillByColumn(column);
+      setSelectedDrillByConfig(drillByConfig);
+      setShowDrillByModal(true);
+    },
+    [],
+  );
 
   const loadDrillByOptionsExtension = getExtensionsRegistry().get(
     'load.drillby.options',
@@ -175,6 +188,8 @@ const ChartContextMenu = (
     setShowDrillByModal(false);
   }, []);
 
+  const drillByModalConfig = selectedDrillByConfig ?? enhancedFilters?.drillBy;
+
   const menuItems: MenuItem[] = [];
 
   const showDrillToDetail =
@@ -459,10 +474,10 @@ const ChartContextMenu = (
       {showDrillByModal &&
         drillByColumn &&
         filteredDataset &&
-        enhancedFilters?.drillBy && (
+        drillByModalConfig && (
           <DrillByModal
             column={drillByColumn}
-            drillByConfig={enhancedFilters?.drillBy}
+            drillByConfig={drillByModalConfig}
             formData={formData}
             onHideModal={handleCloseDrillByModal}
             dataset={filteredDataset}

superset-frontend/src/components/Chart/DrillBy/DrillBySubmenu.test.tsx

@@ -274,6 +274,140 @@ test('When menu item is clicked, call onSelection with clicked column and drill
   );
 });
 
+const xAxisFilters = [
+  {
+    col: 'ds',
+    op: 'TEMPORAL_RANGE' as const,
+    val: '2021-01-01T00:00:00 : 2021-02-01T00:00:00',
+    formattedVal: 'Jan 2021',
+  },
+];
+
+test('do not display scope selector without x-axis filters', async () => {
+  renderSubmenu({});
+  await expectDrillByEnabled();
+  await screen.findByText('col1');
+  expect(
+    screen.queryByTestId('drill-by-scope-selector'),
+  ).not.toBeInTheDocument();
+});
+
+test('do not display scope selector with only x-axis filters', async () => {
+  renderSubmenu({
+    drillByConfig: { filters: [], xAxisFilters, groupbyFieldName: 'groupby' },
+  });
+  await expectDrillByEnabled();
+  await screen.findByText('col1');
+  expect(
+    screen.queryByTestId('drill-by-scope-selector'),
+  ).not.toBeInTheDocument();
+});
+
+test('display scope selector when x-axis and series filters are present', async () => {
+  renderSubmenu({
+    drillByConfig: {
+      filters: defaultFilters,
+      xAxisFilters,
+      groupbyFieldName: 'groupby',
+    },
+  });
+  await expectDrillByEnabled();
+  await screen.findByText('col1');
+
+  const scopeSelector = screen.getByTestId('drill-by-scope-selector');
+  expect(scopeSelector).toBeInTheDocument();
+  expect(within(scopeSelector).getByText('Jan 2021')).toBeInTheDocument();
+  expect(within(scopeSelector).getByText('val')).toBeInTheDocument();
+  expect(within(scopeSelector).getByText('Both')).toBeInTheDocument();
+});
+
+test('apply both x-axis and series filters by default', async () => {
+  const onSelectionMock = jest.fn();
+  renderSubmenu({
+    drillByConfig: {
+      filters: defaultFilters,
+      xAxisFilters,
+      groupbyFieldName: 'groupby',
+    },
+    onSelection: onSelectionMock,
+  });
+  await expectDrillByEnabled();
+
+  const col1Element = await screen.findByText('col1');
+  userEvent.click(col1Element);
+
+  expect(onSelectionMock).toHaveBeenCalledWith(
+    { column_name: 'col1', groupby: true },
+    {
+      filters: [...xAxisFilters, ...defaultFilters],
+      groupbyFieldName: 'groupby',
+    },
+  );
+});
+
+test('apply only x-axis filters when x-axis scope is selected', async () => {
+  const onSelectionMock = jest.fn();
+  renderSubmenu({
+    drillByConfig: {
+      filters: defaultFilters,
+      xAxisFilters,
+      groupbyFieldName: 'groupby',
+    },
+    onSelection: onSelectionMock,
+  });
+  await expectDrillByEnabled();
+  await screen.findByText('col1');
+
+  const scopeSelector = screen.getByTestId('drill-by-scope-selector');
+  userEvent.click(within(scopeSelector).getByText('Jan 2021'));
+  userEvent.click(screen.getByText('col1'));
+
+  expect(onSelectionMock).toHaveBeenCalledWith(
+    { column_name: 'col1', groupby: true },
+    { filters: xAxisFilters, groupbyFieldName: 'groupby' },
+  );
+});
+
+test('apply only series filters when series scope is selected', async () => {
+  const onSelectionMock = jest.fn();
+  renderSubmenu({
+    drillByConfig: {
+      filters: defaultFilters,
+      xAxisFilters,
+      groupbyFieldName: 'groupby',
+    },
+    onSelection: onSelectionMock,
+  });
+  await expectDrillByEnabled();
+  await screen.findByText('col1');
+
+  const scopeSelector = screen.getByTestId('drill-by-scope-selector');
+  userEvent.click(within(scopeSelector).getByText('val'));
+  userEvent.click(screen.getByText('col1'));
+
+  expect(onSelectionMock).toHaveBeenCalledWith(
+    { column_name: 'col1', groupby: true },
+    { filters: defaultFilters, groupbyFieldName: 'groupby' },
+  );
+});
+
+test('apply x-axis filters when only x-axis filters are present', async () => {
+  const onSelectionMock = jest.fn();
+  renderSubmenu({
+    drillByConfig: { filters: [], xAxisFilters, groupbyFieldName: 'groupby' },
+    onSelection: onSelectionMock,
+  });
+  await expectDrillByEnabled();
+
+  const col1Element = await screen.findByText('col1');
+  userEvent.click(col1Element);
+
+  expect(onSelectionMock).toHaveBeenCalledWith(
+    { column_name: 'col1', groupby: true },
+    { filters: xAxisFilters, groupbyFieldName: 'groupby' },
+  );
+});
+
 test('matrixify_mode_rows enabled should not render component', () => {
   const { container } = renderSubmenu({
     formData: {

superset-frontend/src/components/Chart/DrillBy/DrillBySubmenu.tsx

@@ -29,6 +29,7 @@ import { t } from '@apache-superset/core/translation';
 import {
   BaseFormData,
   Behavior,
+  BinaryQueryObjectFilterClause,
   Column,
   ContextMenuFilters,
   ensureIsArray,
@@ -42,6 +43,7 @@ import {
   Popover,
   Icons,
 } from '@superset-ui/core/components';
+import { Radio } from '@superset-ui/core/components/Radio';
 import { debounce } from 'lodash-es';
 import { List, type RowComponentProps } from 'react-window';
 import { InputRef } from 'antd';
@@ -80,6 +82,15 @@ function DrillByColumnRow({
   );
 }
 
+enum DrillByFilterScope {
+  XAxis = 'x-axis',
+  Series = 'series',
+  All = 'all',
+}
+
+const formatFilterValues = (filters: BinaryQueryObjectFilterClause[]) =>
+  filters.map(filter => filter.formattedVal ?? String(filter.val)).join(', ');
+
 export interface DrillBySubmenuProps {
   drillByConfig?: ContextMenuFilters['drillBy'];
   formData: BaseFormData & { [key: string]: any };
@@ -88,7 +99,11 @@ export interface DrillBySubmenuProps {
   onCloseMenu?: () => void;
   openNewModal?: boolean;
   excludedColumns?: Column[];
-  onDrillBy?: (column: Column, dataset: Dataset) => void;
+  onDrillBy?: (
+    column: Column,
+    dataset: Dataset,
+    drillByConfig?: ContextMenuFilters['drillBy'],
+  ) => void;
   dataset?: Dataset;
   isLoadingDataset?: boolean;
 }
@@ -110,6 +125,7 @@ export const DrillBySubmenu = ({
   const [searchInput, setSearchInput] = useState('');
   const [debouncedSearchInput, setDebouncedSearchInput] = useState('');
   const [popoverOpen, setPopoverOpen] = useState(false);
+  const [filterScope, setFilterScope] = useState(DrillByFilterScope.All);
   const ref = useRef<InputRef>(null);
   const menuItemRef = useRef<HTMLButtonElement>(null);
 
@@ -119,18 +135,54 @@ export const DrillBySubmenu = ({
   );
   const showSearch = columns.length > SHOW_COLUMNS_SEARCH_THRESHOLD;
 
+  const seriesFilters = useMemo(
+    () => ensureIsArray(drillByConfig?.filters),
+    [drillByConfig?.filters],
+  );
+  const xAxisFilters = useMemo(
+    () => ensureIsArray(drillByConfig?.xAxisFilters),
+    [drillByConfig?.xAxisFilters],
+  );
+  // Both the clicked x-axis value and the clicked series can scope the
+  // drilled data; when both are available the user picks which to apply
+  const showScopeSelector = seriesFilters.length > 0 && xAxisFilters.length > 0;
+
+  const effectiveDrillByConfig = useMemo(():
+    | ContextMenuFilters['drillBy']
+    | undefined => {
+    if (!drillByConfig) {
+      return undefined;
+    }
+    let filters = [...xAxisFilters, ...seriesFilters];
+    if (showScopeSelector && filterScope === DrillByFilterScope.XAxis) {
+      filters = xAxisFilters;
+    } else if (showScopeSelector && filterScope === DrillByFilterScope.Series) {
+      filters = seriesFilters;
+    }
+    const config = { ...drillByConfig, filters };
+    // the x-axis filters have been folded into `filters` above
+    delete config.xAxisFilters;
+    return config;
+  }, [
+    drillByConfig,
+    filterScope,
+    seriesFilters,
+    showScopeSelector,
+    xAxisFilters,
+  ]);
+
   const handleSelection = useCallback(
     (event: React.MouseEvent, column: Column) => {
       onClick(event);
-      onSelection(column, drillByConfig);
+      onSelection(column, effectiveDrillByConfig);
       if (openNewModal && onDrillBy && dataset) {
-        onDrillBy(column, dataset);
+        onDrillBy(column, dataset, effectiveDrillByConfig);
       }
       setPopoverOpen(false);
       onCloseMenu();
     },
     [
-      drillByConfig,
+      effectiveDrillByConfig,
       onClick,
       onSelection,
       openNewModal,
@@ -148,9 +200,10 @@ export const DrillBySubmenu = ({
         ref.current?.input?.focus({ preventScroll: true });
       }, 100);
     } else {
-      // Reset search input when menu is closed
+      // Reset search input and filter scope when menu is closed
       setSearchInput('');
       setDebouncedSearchInput('');
+      setFilterScope(DrillByFilterScope.All);
     }
     return () => {
       if (timeoutId) clearTimeout(timeoutId);
@@ -237,6 +290,55 @@ export const DrillBySubmenu = ({
       `}
       onClick={e => e.stopPropagation()}
     >
+      {showScopeSelector && (
+        <div
+          data-test="drill-by-scope-selector"
+          css={css`
+            margin-bottom: ${theme.sizeUnit * 2}px;
+            padding-bottom: ${theme.sizeUnit * 2}px;
+            border-bottom: 1px solid ${theme.colorSplit};
+          `}
+        >
+          <div
+            css={css`
+              color: ${theme.colorTextSecondary};
+              margin-bottom: ${theme.sizeUnit}px;
+            `}
+          >
+            {t('Filter by')}
+          </div>
+          <Radio.Group
+            value={filterScope}
+            onChange={e => setFilterScope(e.target.value)}
+            css={css`
+              display: flex;
+              flex-direction: column;
+              .ant-radio-wrapper {
+                margin-inline-end: 0;
+                span:last-of-type {
+                  overflow: hidden;
+                  text-overflow: ellipsis;
+                  white-space: nowrap;
+                }
+              }
+            `}
+          >
+            <Radio
+              value={DrillByFilterScope.XAxis}
+              title={formatFilterValues(xAxisFilters)}
+            >
+              {formatFilterValues(xAxisFilters)}
+            </Radio>
+            <Radio
+              value={DrillByFilterScope.Series}
+              title={formatFilterValues(seriesFilters)}
+            >
+              {formatFilterValues(seriesFilters)}
+            </Radio>
+            <Radio value={DrillByFilterScope.All}>{t('Both')}</Radio>
+          </Radio.Group>
+        </div>
+      )}
       {showSearch && (
         <Input
           ref={ref}

superset-frontend/src/components/Chart/useDrillDetailMenuItems/useDrillDetailMenuItems.test.tsx

@@ -17,6 +17,7 @@
  * under the License.
  */
 import { useState } from 'react';
+import fetchMock from 'fetch-mock';
 import {
   cleanup,
   render,
@@ -35,6 +36,10 @@ import { useDrillDetailMenuItems, DrillDetailMenuItemsProps } from './index';
 
 /* eslint jest/expect-expect: ["warn", { "assertFunctionNames": ["expect*"] }] */
 
+// Opening the context menu logs an event, and an unmatched request makes
+// fetch-mock throw inside the component.
+fetchMock.post('glob:*/log/?*', {});
+
 jest.mock(
   '../DrillDetail/DrillDetailPane',
   () =>

superset-frontend/src/components/Datasource/components/DatasourceEditor/DatasourceEditor.tsx

@@ -867,7 +867,7 @@ function DatasourceEditor({
       return {
         ...metric,
         certification_details: certificationDetails || details,
-        warning_markdown: warningMarkdown || '',
+        warning_markdown: warningMarkdown || metric.warning_markdown || '',
         certified_by: certifiedBy || certifiedByMetric,
       };
     }),

superset-frontend/src/components/Datasource/components/DatasourceEditor/tests/DatasourceEditorMetricCertification.test.tsx

@@ -0,0 +1,73 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import fetchMock from 'fetch-mock';
+import { screen, userEvent, waitFor } from 'spec/helpers/testing-library';
+import {
+  createProps,
+  DATASOURCE_ENDPOINT,
+  setupDatasourceEditorMocks,
+  cleanupAsyncOperations,
+  fastRender,
+  dismissDatasourceWarning,
+} from './DatasourceEditor.test.utils';
+
+beforeEach(() => {
+  fetchMock.get(DATASOURCE_ENDPOINT, [], { name: DATASOURCE_ENDPOINT });
+  setupDatasourceEditorMocks();
+});
+
+afterEach(async () => {
+  await cleanupAsyncOperations();
+  fetchMock.clearHistory().removeRoutes();
+});
+
+// Certifying a metric fills two adjacent fields in one visit to the expanded
+// row. Both are committed through TextControl's debounce, so the second one
+// used to land on the item as it looked before the first had been applied,
+// leaving the saved metric with details but no certifier.
+test('certifying a metric keeps both certified_by and certification_details', async () => {
+  const testProps = createProps();
+  fastRender(testProps);
+  await dismissDatasourceWarning();
+
+  await userEvent.click(await screen.findByTestId('collection-tab-Metrics'));
+  const expandToggles = await screen.findAllByLabelText(/expand row/i);
+  await userEvent.click(expandToggles[0]);
+
+  await userEvent.type(
+    await screen.findByPlaceholderText('Certified by'),
+    'Metric Certifier',
+  );
+  await userEvent.type(
+    await screen.findByPlaceholderText('Certification details'),
+    'Metric cert details',
+  );
+
+  await waitFor(() => {
+    const { calls } = testProps.onChange.mock;
+    const savedMetrics = calls[calls.length - 1]?.[0]?.metrics ?? [];
+    const saved = savedMetrics.find(metric => metric.metric_name === 'count');
+    expect(saved).toEqual(
+      expect.objectContaining({
+        certified_by: 'Metric Certifier',
+        certification_details: 'Metric cert details',
+      }),
+    );
+  });
+});

superset-frontend/src/components/Datasource/components/DatasourceEditor/tests/DatasourceEditorWarningMarkdown.test.tsx

@@ -0,0 +1,97 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import fetchMock from 'fetch-mock';
+import { screen, userEvent } from 'spec/helpers/testing-library';
+import {
+  createProps,
+  DATASOURCE_ENDPOINT,
+  setupDatasourceEditorMocks,
+  cleanupAsyncOperations,
+  fastRender,
+  dismissDatasourceWarning,
+} from './DatasourceEditor.test.utils';
+
+// Stub the Ace-backed control with a plain textarea. Ace spreads its document
+// across many spans and keeps only the keystroke buffer in its own textarea,
+// so asserting on the value the control receives is less brittle than
+// reaching into Ace's DOM.
+jest.mock('src/explore/components/controls/TextAreaControl', () => ({
+  __esModule: true,
+  default: ({
+    controlId,
+    value,
+    onChange,
+  }: {
+    controlId?: string;
+    value?: string;
+    onChange?: (value: string) => void;
+  }) => (
+    <textarea
+      data-test={`mock-textarea-${controlId}`}
+      value={value ?? ''}
+      onChange={event => onChange?.(event.target.value)}
+    />
+  ),
+}));
+
+beforeEach(() => {
+  fetchMock.get(DATASOURCE_ENDPOINT, [], { name: DATASOURCE_ENDPOINT });
+  setupDatasourceEditorMocks();
+});
+
+afterEach(async () => {
+  await cleanupAsyncOperations();
+  fetchMock.clearHistory().removeRoutes();
+});
+
+// Regression test for #42704. Explore's datasource payload (SqlMetric.data on
+// the backend) exposes warning_markdown as a flattened top-level field and
+// omits the raw `extra` JSON string that the /api/v1/dataset/{id} endpoint
+// backing the Datasets page provides. Deriving warning_markdown purely from
+// `extra` therefore dropped the saved text when the modal was opened from
+// Explore, leaving the Warning field blank on reopen.
+test('keeps a pre-existing top-level warning_markdown when the metric has no extra', async () => {
+  const baseProps = createProps();
+  const testProps = {
+    ...baseProps,
+    datasource: {
+      ...baseProps.datasource,
+      metrics: [
+        {
+          ...baseProps.datasource.metrics[0],
+          warning_markdown: 'existing warning',
+          extra: undefined,
+        },
+      ],
+    },
+  };
+
+  fastRender(testProps);
+  await dismissDatasourceWarning();
+
+  const metricsTab = await screen.findByTestId('collection-tab-Metrics');
+  await userEvent.click(metricsTab);
+
+  const expandToggles = await screen.findAllByLabelText(/expand row/i);
+  await userEvent.click(expandToggles[0]);
+
+  expect(
+    await screen.findByTestId('mock-textarea-warning_markdown'),
+  ).toHaveValue('existing warning');
+});

superset-frontend/src/components/Datasource/components/Fieldset/index.tsx

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { ReactNode, useCallback } from 'react';
+import { ReactNode, useCallback, useEffect, useRef } from 'react';
 import { Divider, Form, Typography } from '@superset-ui/core/components';
 import { css } from '@apache-superset/core/theme';
 import { recurseReactClone } from '../../utils';
@@ -39,14 +39,24 @@ export default function Fieldset({
   title = null,
   compact = false,
 }: FieldsetProps) {
+  // Controls report their edits asynchronously - TextControl debounces by
+  // FAST_DEBOUNCE - so the callback that eventually fires was built during an
+  // earlier render. Spreading that render's `item` rebuilds the whole record
+  // from a snapshot taken before a sibling field committed, dropping the value
+  // the user typed first. Reading off a ref merges into the latest commit.
+  const itemRef = useRef(item);
+  useEffect(() => {
+    itemRef.current = item;
+  }, [item]);
+
   const handleChange = useCallback(
     (fieldKey: fieldKeyType, val: any) => {
       onChange?.({
-        ...item,
+        ...itemRef.current,
         [fieldKey]: val,
       });
     },
-    [onChange, item],
+    [onChange],
   );
 
   const propExtender = (field: { props: { fieldKey: fieldKeyType } }) => ({

superset-frontend/src/dashboard/actions/dashboardState.test.ts

@@ -135,6 +135,15 @@ describe('dashboardState actions', () => {
 
   // eslint-disable-next-line no-restricted-globals -- TODO: Migrate from describe blocks
   describe('saveDashboardRequest', () => {
+    const findDangerToast = (dispatch: jest.Mock) =>
+      dispatch.mock.calls
+        .map(call => call[0])
+        .find(
+          action =>
+            action?.type === ADD_TOAST &&
+            action.payload.toastType === ToastType.Danger,
+        );
+
     test('should dispatch UPDATE_COMPONENTS_PARENTS_LIST action', () => {
       const { getState, dispatch } = setup({
         dashboardState: { hasUnsavedChanges: false },
@@ -227,6 +236,89 @@ describe('dashboardState actions', () => {
         const { body } = putStub.mock.calls[0][0];
         expect(body).toBe(JSON.stringify(confirmedDashboardData));
       });
+
+      test('warns about the overwrite values when a diff is detected', async () => {
+        const { getState, dispatch } = setup();
+        const thunk = saveDashboardRequest(
+          newDashboardData,
+          192,
+          SAVE_TYPE_OVERWRITE,
+        );
+        thunk(dispatch, getState);
+        await waitFor(() =>
+          expect(findDangerToast(dispatch)?.payload.text).toBe(
+            'Please confirm the overwrite values.',
+          ),
+        );
+        expect(putStub.mock.calls.length).toBe(0);
+      });
+
+      test('reports the actual error when the overwrite precheck fails', async () => {
+        getStub.mockRestore();
+        getStub = jest
+          .spyOn(SupersetClient, 'get')
+          .mockRejectedValue(new Error('precheck exploded'));
+        const { getState, dispatch } = setup();
+        const thunk = saveDashboardRequest(
+          newDashboardData,
+          192,
+          SAVE_TYPE_OVERWRITE,
+        );
+        thunk(dispatch, getState);
+        await waitFor(() =>
+          expect(findDangerToast(dispatch)?.payload.text).toContain(
+            'precheck exploded',
+          ),
+        );
+        expect(putStub.mock.calls.length).toBe(0);
+      });
+    });
+
+    // eslint-disable-next-line no-restricted-globals -- TODO: Migrate from describe blocks
+    describe('when FeatureFlag.CONFIRM_DASHBOARD_DIFF is disabled', () => {
+      beforeEach(() => {
+        mockIsFeatureEnabled.mockImplementation(() => false);
+      });
+
+      afterEach(() => {
+        mockIsFeatureEnabled.mockRestore();
+      });
+
+      test('never runs the overwrite precheck', async () => {
+        const { getState, dispatch } = setup();
+        const thunk = saveDashboardRequest(
+          newDashboardData,
+          192,
+          SAVE_TYPE_OVERWRITE,
+        );
+        thunk(dispatch, getState);
+        await waitFor(() => expect(putStub.mock.calls.length).toBe(1));
+        expect(getStub).not.toHaveBeenCalledWith(
+          expect.objectContaining({ endpoint: '/api/v1/dashboard/192' }),
+        );
+      });
+
+      // An unexpected failure used to reach the overwrite-confirm handler,
+      // which reported it as "Please confirm the overwrite values." even with
+      // the feature flag off, hiding the real error.
+      test('reports the actual error when the update throws unexpectedly', async () => {
+        putStub.mockRestore();
+        putStub = jest.spyOn(SupersetClient, 'put').mockImplementation(() => {
+          throw new Error('unexpected boom');
+        });
+        const { getState, dispatch } = setup();
+        const thunk = saveDashboardRequest(
+          newDashboardData,
+          192,
+          SAVE_TYPE_OVERWRITE,
+        );
+        thunk(dispatch, getState);
+        await waitFor(() =>
+          expect(findDangerToast(dispatch)?.payload.text).toContain(
+            'unexpected boom',
+          ),
+        );
+      });
     });
 
     test('should navigate to the new dashboard after Save As', async () => {
@@ -379,15 +471,6 @@ describe('dashboardState actions', () => {
     // permission-denied copy, while a 403 from outside Superset (reverse proxy,
     // WAF, SSO gateway) carries a non-JSON body and must fall back to the
     // generic status-derived toast. See #42239.
-    const findDangerToast = (dispatch: jest.Mock) =>
-      dispatch.mock.calls
-        .map(call => call[0])
-        .find(
-          action =>
-            action?.type === ADD_TOAST &&
-            action.payload.toastType === ToastType.Danger,
-        );
-
     test('maps a non-JSON 403 save failure to the generic error toast', async () => {
       const { getState, dispatch } = setup();
       putStub.mockRestore();

superset-frontend/src/dashboard/actions/dashboardState.ts

@@ -646,6 +646,7 @@ export function saveDashboardRequest(
     };
 
     const onError = async (response: Response): Promise<void> => {
+      logging.error(response);
       const { error, message } = await getClientErrorObject(response);
       let errorText = t('Sorry, an unknown error occurred');
 
@@ -689,64 +690,64 @@ export function saveDashboardRequest(
               }),
             };
 
-      const updateDashboard = (): Promise<JsonObject | void> =>
-        SupersetClient.put({
-          endpoint: `/api/v1/dashboard/${id}`,
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify(updatedDashboard),
-        })
-          .then(response => onUpdateSuccess(response))
-          .catch(response => onError(response));
-      return new Promise<void>((resolve, reject) => {
-        if (
-          !isFeatureEnabled(FeatureFlag.ConfirmDashboardDiff) ||
-          saveType === SAVE_TYPE_OVERWRITE_CONFIRMED
-        ) {
-          // skip overwrite precheck
-          resolve();
-          return;
+      const updateDashboard = async (): Promise<JsonObject | void> => {
+        try {
+          const response = await SupersetClient.put({
+            endpoint: `/api/v1/dashboard/${id}`,
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(updatedDashboard),
+          });
+          return await onUpdateSuccess(response);
+        } catch (error) {
+          return onError(error as Response);
         }
+      };
 
-        // precheck for overwrite items
-        SupersetClient.get({
-          endpoint: `/api/v1/dashboard/${id}`,
-        }).then((response: JsonObject) => {
+      if (
+        !isFeatureEnabled(FeatureFlag.ConfirmDashboardDiff) ||
+        saveType === SAVE_TYPE_OVERWRITE_CONFIRMED
+      ) {
+        // skip overwrite precheck
+        return updateDashboard();
+      }
+
+      // precheck for overwrite items
+      return SupersetClient.get({
+        endpoint: `/api/v1/dashboard/${id}`,
+      })
+        .then((response: JsonObject) => {
           const dashboard = (response.json as JsonObject).result as JsonObject;
           const overwriteConfirmItems = getOverwriteItems(
             dashboard,
             updatedDashboard,
           );
-          if (overwriteConfirmItems.length > 0) {
-            dispatch(
-              setOverrideConfirm({
-                updatedAt: dashboard.changed_on as string,
-                updatedBy: dashboard.changed_by_name as string,
-                overwriteConfirmItems:
-                  overwriteConfirmItems as DashboardState['overwriteConfirmMetadata'] extends
-                    | { overwriteConfirmItems: infer I }
-                    | undefined
-                    ? I
-                    : never,
-                dashboardId: id,
-                data: updatedDashboard,
-              }),
-            );
-            return reject(overwriteConfirmItems);
+          if (overwriteConfirmItems.length === 0) {
+            return updateDashboard();
           }
-          return resolve();
-        });
-      })
-        .then(updateDashboard)
-        .catch((overwriteConfirmItems: JsonObject[]) => {
-          const errorText = t('Please confirm the overwrite values.');
+          dispatch(
+            setOverrideConfirm({
+              updatedAt: dashboard.changed_on as string,
+              updatedBy: dashboard.changed_by_name as string,
+              overwriteConfirmItems:
+                overwriteConfirmItems as DashboardState['overwriteConfirmMetadata'] extends
+                  | { overwriteConfirmItems: infer I }
+                  | undefined
+                  ? I
+                  : never,
+              dashboardId: id,
+              data: updatedDashboard,
+            }),
+          );
           dispatch(
             logEvent(LOG_ACTIONS_CONFIRM_OVERWRITE_DASHBOARD_METADATA, {
               dashboard_id: id,
               items: overwriteConfirmItems,
             }),
           );
-          dispatch(addDangerToast(errorText));
-        });
+          dispatch(addDangerToast(t('Please confirm the overwrite values.')));
+          return undefined;
+        })
+        .catch(onError);
     }
     // changing the data as the endpoint requires
     if (

superset-frontend/src/dashboard/actions/nativeFilters.ts

@@ -27,7 +27,7 @@ import {
 } from '@superset-ui/core';
 import { Dispatch } from 'redux';
 import { RootState } from 'src/dashboard/types';
-import { cloneDeep } from 'lodash-es';
+import { cloneDeep, omit } from 'lodash-es';
 import { setDataMaskForFilterChangesComplete } from 'src/dataMask/actions';
 import { HYDRATE_DASHBOARD } from './hydrate';
 import {
@@ -90,12 +90,20 @@ export const setFilterConfiguration =
     });
     try {
       const response = await updateFilters(filterChanges);
+      // chartsInScope/tabsInScope are derived from the live layout, and the
+      // response carries the persisted copy for every filter - including the
+      // ones this save never touched, whose copy is whatever was stored when
+      // the dashboard was last saved. Dropping them lets the reducers keep the
+      // scopes calculateScopes already computed for this session.
+      const savedFilters = response.result.map(
+        filter => omit(filter, ['chartsInScope', 'tabsInScope']) as Filter,
+      );
       dispatch({
         type: SET_NATIVE_FILTERS_CONFIG_COMPLETE,
-        filterChanges: response.result,
+        filterChanges: savedFilters,
         deletedIds: filterChanges.deleted,
       });
-      dispatch(nativeFiltersConfigChanged(response.result));
+      dispatch(nativeFiltersConfigChanged(savedFilters));
       dispatch(setDataMaskForFilterChangesComplete(filterChanges, oldFilters));
     } catch (err) {
       dispatch({

superset-frontend/src/dashboard/components/PropertiesModal/PropertiesModal.test.tsx

@@ -528,6 +528,57 @@ describe('PropertiesModal', () => {
     });
   });
 
+  test('preserves certification fields on save without opening Certification section', async () => {
+    // Accordion Collapse only mounts the active panel, so certifiedBy /
+    // certificationDetails FormItems are unregistered until Certification is
+    // opened. onFinish must use getFieldsValue(true) to read store values for
+    // unregistered fields; otherwise save clears certified_by to null.
+    const put = jest.spyOn(SupersetCore.SupersetClient, 'put');
+    put.mockResolvedValue({
+      json: {
+        result: {
+          dashboard_title: 'dashboard_title',
+          slug: 'slug',
+          json_metadata: 'json_metadata',
+          editors: 'editors',
+        },
+      },
+    } as any);
+    mockedIsFeatureEnabled.mockReturnValue(false);
+    const props = createProps();
+    const propsWithDashboardInfo = {
+      ...props,
+      dashboardInfo: {
+        ...dashboardInfo,
+        json_metadata: mockedJsonMetadata,
+      },
+    };
+    render(<PropertiesModal {...propsWithDashboardInfo} />, {
+      useRedux: true,
+    });
+    await screen.findByTestId('dashboard-edit-properties-form');
+
+    // Only General information fields are mounted; Certification inputs are not.
+    expect(screen.getAllByRole('textbox')).toHaveLength(3);
+    expect(screen.queryByText('Certified by')).not.toBeInTheDocument();
+
+    await userEvent.click(screen.getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => {
+      expect(props.onSubmit).toHaveBeenCalledTimes(1);
+    });
+    const submitCall = props.onSubmit.mock.calls[0][0];
+    expect(submitCall.certifiedBy).toBe('John Doe');
+    expect(submitCall.certificationDetails).toBe('Sample certification');
+
+    expect(put).toHaveBeenCalled();
+    const putRequest = put.mock.calls[0][0];
+    expect(typeof putRequest.body).toBe('string');
+    const putBody = JSON.parse(putRequest.body as string);
+    expect(putBody.certified_by).toBe('John Doe');
+    expect(putBody.certification_details).toBe('Sample certification');
+  });
+
   test('submitting with onlyApply:true', async () => {
     mockedIsFeatureEnabled.mockReturnValue(false);
     const props = createProps();